Authentication method and device

Abstract

One or more embodiments of the present specification provide an identity authentication method and device, the method comprising: obtaining an encryption instruction issued by a server; encrypting the intermediate data obtained in at least one target processing stage of collecting identity authentication images according to the encryption instruction; and sending the collected encrypted identity authentication images to the server so that the server performs identity authentication based on the identity authentication images. During the process of collecting identity authentication images, the generated intermediate data is encrypted according to the encryption instruction issued by the server, and the identity authentication image embedded with the encryption information is sent to the server so that the server extracts the encryption information from the received identity authentication image and performs identity authentication based on the encryption information, thereby preventing malicious attacks on the identity authentication data by illegal elements, thereby ensuring the real-time, authenticity and effectiveness of identity authentication data collection, and improving the security of user account use.

Description

[0001] This application is a divisional application of the Chinese patent application submitted to the China Patent Office on August 13, 2018, with application number 201810917717.0 and invention name “An Identity Verification Method and Device”. Technical Field

[0002] One or more aspects of this specification relate to the field of information verification, and in particular, to an identity verification method and device. Background Art

[0003] At present, in order to improve the security of the account, a user identity authentication method is added to verify the authenticity and legitimacy of the user during the process of the user requesting account login. For example, the facial image data of the current user is collected through the user terminal, and the facial image data is uploaded to the identity authentication server, so that the identity authentication server completes the user identity authentication based on the facial image data. Only after the identity authentication is passed, the user is allowed to enter the operation interface.

[0004] However, in the process of face image identity authentication, some criminals use video frame injection attacks to complete identity authentication. Specifically, the criminals obtain the target user's identity authentication video data in advance, and then upload the target user's identity authentication video data to the identity authentication server through video frame replacement when the face image is collected. At this time, the identity authentication server will authenticate the logged-in user based on the identity authentication video data, and then determine that the user identity authentication is successful, so that the criminals can complete the identity authentication and enter the user operation interface. This will provide an entry for criminals to perform illegal activities, and the purpose of ensuring account security through identity authentication cannot be achieved.

[0005] It can be seen from this that the existing method of identity authentication based on facial images has problems such as account vulnerability, ineffective facial identity authentication, and low account security. Summary of the invention

[0006] The purpose of one or more embodiments of the present specification is to provide an identity authentication method and device. During the process of collecting identity authentication images, the intermediate data generated is encrypted according to the encryption instructions issued by the server, and the identity authentication image embedded with encrypted information is sent to the server, so that the server can extract the encrypted information from the received identity authentication image and perform identity authentication based on the encrypted information, thereby preventing malicious attacks on the identity authentication data by illegal elements, thereby ensuring the real-time, authenticity and effectiveness of the identity authentication data collection, and improving the security of user account use.

[0007] To solve the above technical problems, one or more embodiments of this specification are implemented as follows:

[0008] One or more embodiments of this specification provide an identity authentication method, including:

[0009] Obtain the encrypted instructions sent by the verification server;

[0010] According to the encryption instruction, encrypting the intermediate data obtained in at least one target processing stage of collecting the identity verification image;

[0011] The collected identity verification image is sent to the verification server, so that the verification server performs identity verification based on the identity verification image.

[0012] One or more embodiments of this specification provide an identity authentication method, including:

[0013] After sending an encryption instruction to the client, obtaining the identity verification image collected based on the encryption instruction and reported by the client;

[0014] Decrypting the identity verification image to obtain target encryption information corresponding to at least one target processing stage;

[0015] According to the encryption instruction and the target encryption information, it is determined whether the identity authentication of the client is passed.

[0016] One or more embodiments of this specification provide an identity authentication device, including:

[0017] An encryption instruction acquisition module is used to acquire the encryption instruction sent by the verification server;

[0018] A data encryption module, used to encrypt the intermediate data obtained in at least one target processing stage of collecting identity verification images according to the encryption instruction;

[0019] The verification image sending module is used to send the collected identity verification image to the verification server, so that the verification server performs identity verification based on the identity verification image.

[0020] One or more embodiments of this specification provide an identity authentication device, including:

[0021] A verification image receiving module, used for obtaining the identity verification image collected based on the encrypted instruction and reported by the client after sending the encrypted instruction to the client;

[0022] A data decryption module, used to decrypt the identity verification image to obtain target encryption information corresponding to at least one target processing stage;

[0023] The identity authentication module is used to determine whether the identity authentication of the client is passed according to the encryption instruction and the target encryption information.

[0024] One or more embodiments of this specification provide an identity authentication device, including: a processor; and

[0025] a memory arranged to store computer executable instructions which, when executed, cause the processor to:

[0026] Obtain the encrypted instructions sent by the verification server;

[0027] According to the encryption instruction, encrypting the intermediate data obtained in at least one target processing stage of collecting the identity verification image;

[0028] The collected identity verification image is sent to the verification server, so that the verification server performs identity verification based on the identity verification image.

[0029] One or more embodiments of this specification provide an identity authentication device, including: a processor; and

[0030] a memory arranged to store computer executable instructions which, when executed, cause the processor to:

[0031] After sending an encryption instruction to the client, obtaining the identity verification image collected based on the encryption instruction and reported by the client;

[0032] Decrypting the identity verification image to obtain target encryption information corresponding to at least one target processing stage;

[0033] According to the encryption instruction and the target encryption information, it is determined whether the identity authentication of the client is passed.

[0034] One or more embodiments of this specification provide a storage medium for storing computer-executable instructions, wherein the executable instructions implement the following process when executed:

[0035] Obtain the encrypted instructions sent by the verification server;

[0036] According to the encryption instruction, encrypting the intermediate data obtained in at least one target processing stage of collecting the identity verification image;

[0037] The collected identity verification image is sent to the verification server, so that the verification server performs identity verification based on the identity verification image.

[0038] One or more embodiments of this specification provide a storage medium for storing computer-executable instructions, wherein the executable instructions implement the following process when executed:

[0039] After sending an encryption instruction to the client, obtaining the identity verification image collected based on the encryption instruction and reported by the client;

[0040] Decrypting the identity verification image to obtain target encryption information corresponding to at least one target processing stage;

[0041] According to the encryption instruction and the target encryption information, it is determined whether the identity authentication of the client is passed.

[0042] The identity authentication method and device in one or more embodiments of the present specification obtains an encryption instruction issued by a server; according to the encryption instruction, encrypts the intermediate data obtained in at least one target processing stage of collecting identity authentication images; and sends the collected encrypted identity authentication images to the server so that the server performs identity authentication based on the identity authentication images. During the process of collecting identity authentication images, the generated intermediate data is encrypted according to the encryption instruction issued by the server, and the identity authentication image embedded with the encryption information is sent to the server so that the server extracts the encryption information from the received identity authentication image and performs identity authentication based on the encryption information, thereby preventing malicious attacks on the identity authentication data by illegal elements, thereby ensuring the real-time, authenticity and effectiveness of identity authentication data collection, and improving the security of user account use. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate one or more embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in one or more of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0044] Figure 1 A schematic diagram of an application scenario of an identity verification system provided in one or more embodiments of this specification;

[0045] Figure 2 A first flow chart of an identity authentication method applied to a client provided in one or more embodiments of this specification;

[0046] Figure 3 A second flow chart of an identity authentication method applied to a client provided in one or more embodiments of this specification;

[0047] Figure 4 A third flow chart of an identity authentication method applied to a client provided in one or more embodiments of this specification;

[0048] Figure 5 A fourth flow chart of an identity authentication method applied to a client provided in one or more embodiments of this specification;

[0049] Figure 6 A fifth flow chart of an identity authentication method applied to a client provided in one or more embodiments of this specification;

[0050] Figure 7 A schematic diagram of the implementation principle of the user face image acquisition process of the identity authentication method applied to the client provided in one or more embodiments of this specification;

[0051] Figure 8 A flowchart of an identity verification method applied to a verification server provided in one or more embodiments of this specification

[0052] Fig. 9 A schematic diagram of the module composition of an identity verification device provided on a client side in one or more embodiments of this specification;

[0053] Fig.10 A schematic diagram of the module composition of an identity verification device provided in a verification server according to one or more embodiments of this specification;

[0054] Fig.11 A schematic diagram of the structure of an identity verification system provided for one or more embodiments of this specification;

[0055] Fig.12 A schematic diagram of the structure of an identity verification device provided for one or more embodiments of this specification. DETAILED DESCRIPTION

[0056] In order to enable persons skilled in the art to better understand the technical solutions in one or more embodiments of this specification, the technical solutions in one or more embodiments of this specification will be clearly and completely described below in conjunction with the drawings in one or more embodiments of this specification. Obviously, the described embodiments are only one or more partial embodiments of this specification, rather than all embodiments. Based on one or more embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of one or more embodiments of this specification.

[0057] One or more embodiments of the present specification provide an identity authentication method and device. During the process of collecting identity authentication images, the generated intermediate data is encrypted according to the encryption instructions issued by the server, and the identity authentication image embedded with the encrypted information is sent to the server, so that the server can extract the encrypted information from the received identity authentication image and perform identity authentication based on the encrypted information, thereby preventing malicious attacks on the identity authentication data by illegal elements, thereby ensuring the real-time, authenticity and effectiveness of the identity authentication data collection, and improving the security of user account use.

[0058] Figure 1 A schematic diagram of an application scenario of an identity verification system provided in one or more embodiments of this specification, such as Figure 1 As shown, the system includes: multiple clients and verification servers, wherein the client can be a mobile terminal such as a smart phone, a tablet computer, or a fixed terminal such as a desktop computer, wherein the specific process of user identity verification is:

[0059] First, the verification server sends an encryption instruction to the client, wherein the encryption instruction includes: the target processing stage to be encrypted and the encryption parameters corresponding to each target processing stage;

[0060] Then, after receiving the encryption instruction sent by the verification server, the client encrypts the intermediate data obtained in at least one target processing stage according to the encryption instruction during the process of collecting the identity verification image, and obtains the encrypted identity verification image;

[0061] Again, the client sends the encrypted authentication image to the verification server;

[0062] Finally, after receiving the encrypted identity authentication image, the verification server authenticates the user using the client based on the identity authentication image. If the identity authentication is successful, a prompt message indicating that the authentication is successful is sent to the client. If the identity authentication fails, a prompt message indicating that the authentication has failed is sent to the client.

[0063] Figure 2 A first flow chart of an identity authentication method provided in one or more embodiments of this specification, Figure 2 The method in can be Figure 1 The client executes in Figure 2 As shown, the method comprises at least the following steps:

[0064] S201, obtaining an encryption instruction issued by a verification server, wherein the encryption instruction includes: a target processing stage to be encrypted, and encryption parameters corresponding to each target processing stage;

[0065] Specifically, the verification server selects at least one target processing stage from multiple data processing stages involved in the identity verification image acquisition process in advance, and sets encryption parameters corresponding to each target processing stage, and generates an encryption instruction for instructing the client to perform encryption operations based on the selected target processing stage and the encryption parameters corresponding to each target processing stage; the verification server sends the encryption instruction to the client, and after receiving the encryption instruction, the client parses the encryption instruction to determine at least one target processing stage that needs to be encrypted and the encryption parameters corresponding to the target processing stage.

[0066] S202, encrypting intermediate data obtained in at least one target processing stage of collecting identity verification images according to the obtained encryption instruction;

[0067] Specifically, when the identity verification image is collected, according to the execution order of the data processing stages, among the multiple data processing stages involved in the identity verification image collection process, the data processing stage that needs to be currently executed is determined;

[0068] Based on the at least one target processing stage analyzed, determining whether the data processing stage currently to be executed is the target processing stage;

[0069] If so, the intermediate data obtained when executing the data processing stage is encrypted according to the encryption parameters corresponding to the target processing stage, and the encrypted data is used as the input data of the next data processing stage to determine the next data processing stage that needs to be executed until the identity authentication image is collected.

[0070] S203: Send the collected encrypted identity verification image to the verification server, so that the verification server performs identity verification based on the encrypted identity verification image.

[0071] The identity verification image is obtained by encrypting the intermediate data obtained in at least one target processing stage of collecting the identity verification image according to the encryption instruction issued by the verification server. Since the client encrypts the intermediate data according to the encryption requirements of the verification server during the process of collecting the identity verification image, the verification server parses the identity verification image after receiving the identity verification image sent by the client, obtains the target encryption information embedded at the client, and then matches the target encryption information with the encryption instruction issued to the client in advance. If the match is successful, it is determined that the user identity verification is passed, and if the match is unsuccessful, it is determined that the user identity verification fails.

[0072] In the specific implementation, during the identity authentication image acquisition process, the client needs to execute multiple data processing stages and finally output the identity authentication image, where the identity authentication image can be a frame of verification image or a verification video stream composed of multiple frames of verification images. Specifically, in order to prevent the identity authentication image from being attacked and tampered with by illegal elements, during the process of generating the identity authentication image on the client, the data generated by at least one data processing stage is encrypted, so that inherent encryption information is embedded in the final identity authentication image. At the same time, which data processing stage is encrypted and how to encrypt in the data processing stage is determined according to the encryption instructions issued by the server. In this way, the server can accurately identify whether the identity authentication image has been tampered with after receiving the identity authentication image encrypted by the client.

[0073] In one or more embodiments of the present specification, during the process of collecting the identity authentication image, the client encrypts the generated intermediate data according to the encryption instructions issued by the server, and sends the identity authentication image embedded with the encrypted information to the server, so that the server extracts the encrypted information from the received identity authentication image and performs identity authentication based on the encrypted information. That is to say, during the process of generating the identity authentication image, corresponding encryption processing is performed at different data processing stages. On the one hand, the client encrypts according to the encryption requirements of the server to achieve interactive encryption between the client and the server. On the other hand, the intermediate data is encrypted during the generation of the identity authentication image to avoid the risk of data replacement, thereby preventing malicious attacks on the identity authentication data by illegal elements, ensuring the real-time, authenticity and effectiveness of the identity authentication data collection, and improving the security of user account use.

[0074] Taking identity authentication by collecting face images as an example, specifically, the above-mentioned identity authentication images include: user face images, and the main data processing stages involved in the user face image collection process may include: optical imaging stage, image sensor collection stage, video stream generation stage and video encoding stage;

[0075] Correspondingly, the at least one target processing stage mentioned above may include: at least one of an optical imaging stage, an image sensor acquisition stage, a video stream generation stage, and a video encoding stage.

[0076] Specifically, the number of target processing stages that need to be encrypted indicated by the encryption instruction sent by the server may be one or more. For example, at least one target processing stage includes: an optical imaging stage. Then, when the client collects the identity authentication image, it only encrypts the intermediate data obtained in the optical imaging stage. Therefore, the generated identity authentication image is embedded with encryption information corresponding to the encryption parameters of the optical imaging stage indicated in the encryption instruction. For another example, at least one target processing stage includes: an image sensor acquisition stage and a video stream generation stage. Then, when the client collects the identity authentication image, it successively encrypts the intermediate data obtained in the image sensor acquisition stage and the video stream generation stage. Therefore, the generated identity authentication image is embedded with first encryption information corresponding to the encryption parameters of the image sensor acquisition stage indicated in the encryption instruction, and second encryption information corresponding to the encryption parameters of the video stream generation stage indicated in the encryption instruction.

[0077] Specifically, in the case where multiple data processing stages in the identity authentication image acquisition process are all target processing stages, it is necessary to encrypt the intermediate data generated by each target processing stage one by one, and transmit the encrypted data of the previous target processing stage to the next data processing stage. The next data processing stage uses the encrypted data as input data to continue corresponding data processing until the last data processing stage is executed to generate the final required identity authentication image.

[0078] Among them, for the case where the target processing stage is the optical imaging stage, at this time, it is necessary to encrypt the intermediate data generated in the optical imaging stage of the identity authentication image acquisition process, and then enter the image sensor acquisition stage of the identity authentication image acquisition process. Based on this, Figure 3 As shown, the above S202 encrypts the intermediate data obtained in at least one target processing stage of collecting the identity verification image according to the obtained encryption instruction, specifically including:

[0079] S2021, determining the optical coding information used for data encryption in the optical imaging stage according to the obtained encryption instruction. Specifically, the encryption instruction sent by the server is used not only to indicate the target processing stage that needs to be encrypted, but also to indicate the encryption parameters corresponding to each target processing stage. In the optical imaging stage, the intermediate data is encrypted by optical coding. Therefore, the encryption parameters corresponding to the optical imaging stage are the optical coding information.

[0080] S2022, encrypting the optical image in the optical imaging stage of capturing the identity verification image according to the determined optical coding information.

[0081] Specifically, the above S2022 encrypts the optical image in the optical imaging stage of collecting the identity verification image according to the determined optical coding information, specifically including:

[0082] Step 1, obtaining a speckle pattern obtained by irradiating a laser light source on a diffractive optical element corresponding to the determined light coding information. Specifically, the laser light source is irradiated on a diffractive optical element (DOE) with a diffraction grating to form diffraction spots (i.e., speckle pattern). Different diffraction gratings will result in different diffraction spots. In a specific implementation, if a plurality of diffractive optical elements are arranged in an imaging optical path, a correspondence between the light coding information and the diffractive optical elements can be preset, and the laser light source is irradiated on the diffractive optical element corresponding to the determined light coding information to obtain corresponding diffraction spots.

[0083] Step 2: superimposing the above-mentioned speckle pattern on the optical image obtained in the optical imaging stage of collecting the identity verification image.

[0084] Among them, for the optical imaging stage, light coding technology is used to encrypt the intermediate data generated by the optical imaging stage. The light coding technology is a kind of structured light technology. The structured light technology mainly uses light source to encode the measured space, and projects a one-dimensional or two-dimensional specific image onto the object to be measured. It can also judge the surface shape and depth information of the object to be measured based on the deformation of the sample image irradiated to the object to be measured.

[0085] Correspondingly, in the case where the target processing stage includes an optical imaging stage, after receiving the identity authentication image sent by the client, the verification server parses the identity authentication image to determine whether there is an embedded speckle pattern in the optical image. If so, it is determined that the intermediate data obtained in the target processing stage meets the preset encryption requirement; or, it is determined whether there is an embedded speckle pattern in the optical image, and whether the speckle pattern is consistent with a preset speckle pattern. If so, it is determined that the intermediate data obtained in the target processing stage meets the preset encryption requirement.

[0086] Among them, for the case where the target processing stage is the image sensor acquisition stage, at this time, it is necessary to encrypt the intermediate data generated by the image sensor acquisition stage in the identity authentication image acquisition process, and then enter the video stream generation stage in the identity authentication image acquisition process. Based on this, Figure 4 As shown, the above S202 encrypts the intermediate data obtained in at least one target processing stage of collecting the identity verification image according to the obtained encryption instruction, specifically including:

[0087] S2023, determining the hidden position of the digital watermark used for data encryption in the image sensor acquisition stage according to the obtained encryption instruction. Specifically, the encryption instruction sent by the server is used not only to indicate the target processing stage that needs to be encrypted, but also to indicate the encryption parameters corresponding to each target processing stage. In the image sensor acquisition stage, the intermediate data is encrypted by means of a digital watermark. Therefore, the encryption parameters corresponding to the image sensor acquisition stage are the hidden positions of the digital watermark.

[0088] S2024, embedding a digital watermark into the image signal in the image sensor acquisition phase of acquiring the identity authentication image according to the determined hidden position. Specifically, embedding the digital watermark into the position indicated by the hidden position in the image signal.

[0089] Specifically, the hidden position of the digital watermark corresponds to the encryption method one by one. The above S2023 determines the hidden position of the digital watermark used for data encryption in the image sensor acquisition phase according to the obtained encryption instruction, which specifically includes:

[0090] If the encryption instruction indicates time domain encryption, the spatial domain is used as the hidden location of the digital watermark used for data encryption during the image sensor acquisition phase;

[0091] If the encryption instruction indicates frequency domain encryption, the DCT transform domain is used as the hidden location of the digital watermark used for data encryption during the image sensor acquisition phase;

[0092] If the encryption instruction indicates time-frequency domain encryption, the time-frequency transform domain is used as the hidden location of the digital watermark used for data encryption during the image sensor acquisition phase;

[0093] If the encryption instruction indicates time-scale domain encryption, the wavelet transform domain is used as the hiding position of the digital watermark used for data encryption in the image sensor acquisition stage.

[0094] Correspondingly, for the case where the target processing stage includes the image sensor acquisition stage, after receiving the identity authentication image sent by the client, the verification server parses the identity authentication image to determine whether there is an embedded digital watermark in the target domain of the image signal. If so, it is determined that the intermediate data obtained in the target processing stage meets the preset encryption requirements; or, it is determined whether there is an embedded digital watermark in the target transformation domain of the image signal, and whether the digital watermark is consistent with the preset digital watermark. If so, it is determined that the intermediate data obtained in the target processing stage meets the preset encryption requirements;

[0095] Specifically, if the encryption instruction indicates time domain encryption, the target domain is the spatial domain; if the encryption instruction indicates frequency domain encryption, the target domain is the DCT transform domain; if the encryption instruction indicates time-frequency domain encryption, the target domain is the time-frequency transform domain; if the encryption instruction indicates time-scale domain encryption, the target domain is the wavelet transform domain.

[0096] Among them, for the case where the target processing stage is the video stream generation stage, at this time, it is necessary to encrypt the intermediate data generated in the video stream generation stage of the identity authentication image acquisition process, and then enter the video encoding stage of the identity authentication image acquisition process. Based on this, Figure 5 As shown, the above S202 encrypts the intermediate data obtained in at least one target processing stage of collecting the identity verification image according to the obtained encryption instruction, specifically including:

[0097] S2025, determining the target video frame for data encryption and the insertion position of the target video frame in the video stream generation stage according to the obtained encryption instruction. Specifically, the encryption instruction sent by the server is used not only to indicate the target processing stage that needs to be encrypted, but also to indicate the encryption parameters corresponding to each target processing stage. In the video stream generation stage, the intermediate data is encrypted by a special frame embedding method. Therefore, the encryption parameters corresponding to the video stream generation stage are the target video frame and the insertion position;

[0098] S2026, inserting the target video frame into the video stream generated in the video stream generation stage of capturing the identity authentication image according to the determined insertion position. Specifically, inserting a specified number of target video frames into the specified position in the video stream, for example, inserting one target video frame every 10 frames in the video stream.

[0099] The target video frame includes at least one of a blank frame, a video frame embedded with a digital watermark, and a video frame superimposed with a preset encryption pattern.

[0100] Correspondingly, for the case where the target processing stage includes a video stream generation stage, after the verification server receives the identity authentication image sent by the client, it parses the identity authentication image to determine whether there is a target video frame at the target insertion position. If so, it is determined that the intermediate data obtained in the target processing stage meets the preset encryption requirements.

[0101] Among them, for the case where the target processing stage is the video encoding stage, at this time, it is necessary to encrypt the intermediate data generated in the video encoding stage of the identity authentication image acquisition process, and then enter the verification data sending stage of the identity authentication image acquisition process. Based on this, Figure 6As shown, the above S202 encrypts the intermediate data obtained in at least one target processing stage of collecting the identity verification image according to the obtained encryption instruction, specifically including:

[0102] S2027, determining the adding position of the target information for data encryption in the video encoding stage according to the obtained encryption instruction. Specifically, the encryption instruction sent by the server is used not only to indicate the target processing stage that needs to be encrypted, but also to indicate the encryption parameters corresponding to each target processing stage. In the video encoding stage, the intermediate data is encrypted by adding special information. Therefore, the encryption parameter corresponding to the video encoding stage is the adding position of the target information.

[0103] S2028, according to the determined adding position, embed the target information in the file header information or picture structure diagram of the face image in the video encoding stage of collecting the identity authentication image. Specifically, the video encoding stage is to use video compression technology to compress the video stream and encode the face image in the video stream. Among them, the image encoding has file header information or picture structure diagram. For example, a jpeg file generally has an attached exif information. The exif information contains information such as image size, shooting time, photo orientation, image thumbnail, etc. Therefore, the file header information or picture structure diagram of the face image can be modified and a special image pattern can be added thereto to achieve the purpose of data encryption.

[0104] Correspondingly, for the case where the target processing stage includes a video encoding stage, after the verification server receives the identity verification image sent by the client, it parses the identity verification image to determine whether the target information exists in the file header information or the picture structure diagram of the face image. If so, it is determined that the intermediate data obtained in the target processing stage meets the preset encryption requirements.

[0105] In the specific implementation, the client collects the identity authentication image in combination with Figures 3 to 6 The specific implementation method of encrypting the intermediate data obtained in the target data processing stage is to encrypt the intermediate data obtained in at least one target processing stage of collecting identity authentication images according to the obtained encryption instructions to generate the final identity authentication image required.

[0106] Furthermore, with respect to the server, after receiving the identity authentication image sent by the client, in the process of verifying the user identity based on the identity authentication image, the identity authentication image is parsed, and according to the parsing result and the encryption instructions pre-issued to the client, it is determined one by one whether the intermediate data obtained in each target processing stage meets the preset encryption requirements. If the intermediate data obtained in each target processing stage meets the preset encryption requirements, it is determined that the user identity authentication is passed; if the intermediate data obtained in any target processing stage does not meet the preset encryption requirements, it is determined that the user identity authentication has failed.

[0107] In order to take into account both the security of the client user account and the efficiency of the authentication server in performing identity authentication, the client is controlled to encrypt the identity authentication image in a targeted manner. Based on this, in the process of the authentication server generating encryption instructions, the security level of the client is considered. Not all clients are issued the same encryption instructions. For clients with higher security levels, the number of target processing stages indicated by the encryption instructions issued to them is greater. Specifically, the above encryption instructions are determined by the authentication server in the following manner:

[0108] Determine the target security level of the client to be authenticated;

[0109] In the multiple data processing stages of collecting identity authentication images, at least one target processing stage is determined according to the determined target security level, and encryption parameters corresponding to each target processing stage are determined. Specifically, a corresponding relationship between the security level and at least one target processing stage that needs to be encrypted can be preset;

[0110] An encryption instruction to be sent to the client is generated according to at least one target processing stage and encryption parameters corresponding to each target processing stage.

[0111] Specifically, the higher the security level of the client, the greater the number of target processing stages indicated by the corresponding encryption instruction. Further, considering that the user's identity authentication can be strengthened for a certain special situation, for example, for a client that is initially determined to have a suspected illegal attack risk, the identity authentication of the user corresponding to the client is strengthened by raising the security level of the client. Based on this, the above target security level can be obtained by dynamically adjusting the original security level pre-set for the client. In a specific embodiment, the process of determining the target security level is specifically as follows:

[0112] Determine whether the login environment of the client has changed. If so, increase the security level of the client according to a preset adjustment rule, and determine the increased security level as the target security level of the client;

[0113] For example, when it is detected that the client's login geographic location information is not the commonly used geographic location information, that is, if it is detected that the client is logging in from a different location, it is determined that the client's login environment has changed. At this time, it is necessary to strengthen user identity authentication and further improve the security of user account use.

[0114] Further, taking the user face image acquisition process as an example, if at least one target processing stage includes: an optical imaging stage, an image sensor acquisition stage, a video stream generation stage, and a video encoding stage, where Figure 7 As shown in the figure, the process of collecting user face images is as follows:

[0115] (1) First, enter the optical imaging stage, encrypt the optical image in the optical imaging stage according to the light coding information corresponding to the optical imaging stage, obtain the optical image embedded with the speckle pattern, and use the optical image embedded with the speckle pattern as the input data of the image sensor acquisition stage;

[0116] (2) After the imaging optical path outputs the optical image embedded with the speckle pattern, the image sensor acquisition stage is entered. According to the hidden position of the digital watermark corresponding to the image sensor acquisition stage, the digital watermark is embedded in the image signal obtained in the image sensor acquisition stage to obtain an image signal embedded with the speckle pattern and the digital watermark, and the image signal embedded with the speckle pattern and the digital watermark is used as input data for the video stream generation stage;

[0117] (3) After the image sensor outputs the image signal embedded with the speckle pattern and the digital watermark, the video stream generation stage is entered, and the image signal processor (ISP) performs signal processing on the image signal output by the image sensor to obtain multiple face images in sequence, generate a face image video stream, and insert the target video frame into the face image video stream according to the insertion position of the target video frame corresponding to the video stream generation stage to obtain a face image video stream embedded with the speckle pattern, the digital watermark and the encrypted video frame (i.e., the encrypted first face image video stream), and the encrypted first face image video stream is used as the input data of the video encoding stage;

[0118] (4) After the image signal processor outputs the encrypted first face image video stream, it enters the video encoding stage. According to the adding position of the target information corresponding to the video encoding stage, the target information is added to the file header information or the picture structure diagram of the face image in the encrypted first face image video stream, so as to obtain a face image video stream (i.e., the encrypted second face image video stream) embedded with a speckle pattern, embedded with a digital watermark, inserted with an encrypted video frame, and added with the target information. The encrypted second face image video stream is used as the user face image to be verified.

[0119] The identity authentication method in one or more embodiments of the present specification obtains an encryption instruction issued by a server; according to the encryption instruction, encrypts the intermediate data obtained in at least one target processing stage of collecting identity authentication images; and sends the collected encrypted identity authentication images to the server so that the server performs identity authentication based on the identity authentication images. During the process of collecting identity authentication images, the generated intermediate data is encrypted according to the encryption instruction issued by the server, and the identity authentication image embedded with the encryption information is sent to the server so that the server extracts the encryption information from the received identity authentication image and performs identity authentication based on the encryption information, thereby preventing malicious attacks on the identity authentication data by illegal elements, thereby ensuring the real-time, authenticity and effectiveness of identity authentication data collection, and improving the security of user account use.

[0120] Corresponding to the above Figures 2 to 7 The identity authentication method described in the present invention is based on the same technical concept, and one or more embodiments of the present invention further provide an identity authentication method. Figure 8 A flowchart of an identity authentication method provided in one or more embodiments of this specification, Figure 8 The method in can be executed by the authentication server, such as Figure 8 As shown, the method comprises at least the following steps:

[0121] S801, after sending an encryption instruction to the client, obtain the identity authentication image collected based on the encryption instruction reported by the client, wherein the encryption instruction includes: the target processing stage to be encrypted, and the encryption parameters corresponding to each target processing stage. For details, the specific implementation process of the client collecting the identity authentication image is shown in the above Figures 3 to 6 The process shown will not be repeated here;

[0122] Specifically, the verification server selects at least one target processing stage from multiple data processing stages involved in the identity verification image acquisition process in advance, and sets encryption parameters corresponding to each target processing stage, and generates an encryption instruction for instructing the client to perform encryption operations based on the selected target processing stage and the encryption parameters corresponding to each target processing stage; the verification server sends the encryption instruction to the client.

[0123] S802, decrypting the acquired identity authentication image to obtain target encryption information corresponding to at least one target processing stage, specifically, extracting the target encryption information embedded in the identity authentication image by the client by reverse parsing the identity authentication image;

[0124] S803, determining whether the identity authentication of the client is passed according to the encryption instruction sent to the client in advance and the target encrypted information obtained by decryption.

[0125] Among them, since the client encrypts the intermediate data according to the encryption requirements of the verification server during the process of collecting the identity verification image, the verification server parses the identity verification image after receiving the identity verification image sent by the client, and obtains the target encryption information embedded in the client, and then matches the target encryption information with the encryption instruction pre-sent to the client. If the match is successful, it is determined that the user identity verification is passed. If the match is unsuccessful, it is determined that the user identity verification has failed.

[0126] In one or more embodiments of the present specification, the verification server sends an encryption instruction to the client, so that the client encrypts the intermediate data generated according to the encryption instruction during the collection of the identity verification image, and then receives the identity verification image embedded with encryption information reported by the client, extracts the encryption information from the received identity verification image and performs identity authentication based on the encryption information. That is to say, in the process of the client generating the identity verification image, corresponding encryption processing is performed at different data processing stages. On the one hand, the client encrypts according to the server encryption requirements and realizes interactive encryption between the client and the server. On the other hand, the intermediate data is encrypted during the generation of the identity verification image to avoid the risk of data replacement, thereby preventing malicious attacks on the identity verification data by illegal elements, ensuring the real-time, authenticity and effectiveness of the identity verification data collection, and improving the security of user account use.

[0127] The above S803 determines whether the identity authentication of the client is passed according to the encryption instruction sent to the client in advance and the target encrypted information obtained by decryption, which specifically includes:

[0128] Determining whether the target encryption information corresponding to each target processing stage matches the encryption parameter corresponding to the target processing stage indicated by the encryption instruction;

[0129] If so, it is determined that the client's identity authentication has passed; if not, it is determined that the client's identity authentication has failed.

[0130] Specifically, taking identity authentication by collecting face images as an example, the above-mentioned identity authentication images include: user face images, and the main data processing stages involved in the user face image collection process may include: optical imaging stage, image sensor collection stage, video stream generation stage and video encoding stage;

[0131] Correspondingly, the at least one target processing stage mentioned above may include: at least one of an optical imaging stage, an image sensor acquisition stage, a video stream generation stage, and a video encoding stage.

[0132] In the case where the target processing stage includes an optical imaging stage, after receiving the identity authentication image sent by the client, the verification server parses the identity authentication image to determine whether there is an embedded speckle pattern on the optical image. If so, it is determined that the intermediate data obtained in the target processing stage meets the preset encryption requirement; or, it is determined whether there is an embedded speckle pattern on the optical image, and whether the speckle pattern is consistent with a preset speckle pattern. If so, it is determined that the intermediate data obtained in the target processing stage meets the preset encryption requirement.

[0133] In the case where the target processing stage includes the image sensor acquisition stage, after receiving the identity authentication image sent by the client, the verification server parses the identity authentication image to determine whether there is an embedded digital watermark in the target domain of the image signal. If so, it is determined that the intermediate data obtained in the target processing stage meets the preset encryption requirements; or, it is determined whether there is an embedded digital watermark in the target transformation domain of the image signal, and whether the digital watermark is consistent with the preset digital watermark. If so, it is determined that the intermediate data obtained in the target processing stage meets the preset encryption requirements;

[0134] Specifically, if the encryption instruction indicates time domain encryption, the target domain is the spatial domain; if the encryption instruction indicates frequency domain encryption, the target domain is the DCT transform domain; if the encryption instruction indicates time-frequency domain encryption, the target domain is the time-frequency transform domain; if the encryption instruction indicates time-scale domain encryption, the target domain is the wavelet transform domain.

[0135] In the case where the target processing stage includes a video stream generation stage, after the verification server receives the identity authentication image sent by the client, it parses the identity authentication image to determine whether there is a target video frame at the target insertion position. If so, it determines that the intermediate data obtained in the target processing stage meets the preset encryption requirements.

[0136] In the case where the target processing stage includes a video encoding stage, after the verification server receives the identity authentication image sent by the client, it parses the identity authentication image to determine whether the target information exists in the file header information or the picture structure diagram of the face image. If so, it is determined that the intermediate data obtained in the target processing stage meets the preset encryption requirements.

[0137] That is to say, after receiving the identity authentication image sent by the client, the verification server parses the identity authentication image during the process of verifying the user's identity based on the identity authentication image, and determines one by one whether the intermediate data obtained in each target processing stage meets the preset encryption requirements according to the analysis result and the encryption instructions issued to the client in advance. If the intermediate data obtained in each target processing stage meets the preset encryption requirements, it is determined that the user identity authentication is passed. If the intermediate data obtained in any target processing stage does not meet the preset encryption requirements, it is determined that the user identity authentication has failed.

[0138] Furthermore, in order to take into account both the security of the client user account and the efficiency of the authentication server in performing identity authentication, the client is controlled to encrypt the identity authentication image in a targeted manner. Based on this, in the process of the authentication server generating the encryption instruction, the security level of the client is considered. Not all clients are issued the same encryption instruction. For clients with higher security levels, the more target processing stages are indicated by the encryption instruction issued to them. Specifically, before sending the encryption instruction to the client, it also includes:

[0139] Determine the target security level of the client to be authenticated;

[0140] In the multiple data processing stages of collecting identity authentication images, at least one target processing stage is determined according to the determined target security level, and encryption parameters corresponding to each of the target processing stages are determined. Specifically, a corresponding relationship between the security level and at least one target processing stage that needs to be encrypted can be pre-set;

[0141] An encryption instruction to be sent to the client is generated according to at least one target processing stage and encryption parameters corresponding to each target processing stage.

[0142] Specifically, the higher the security level of the client, the greater the number of target processing stages indicated by the corresponding encryption instruction. Further, considering that the user's identity authentication can be strengthened for a certain special situation, for example, for a client that is initially determined to have a suspected illegal attack risk, the identity authentication of the user corresponding to the client is strengthened by raising the security level of the client. Based on this, the above target security level can be obtained by dynamically adjusting the original security level pre-set for the client. In a specific embodiment, the process of determining the target security level is specifically as follows:

[0143] Determine whether the login environment of the client has changed. If so, increase the security level of the client according to a preset adjustment rule, and determine the increased security level as the target security level of the client;

[0144] For example, when it is detected that the client's login geographic location information is not the commonly used geographic location information, that is, if it is detected that the client is logging in from a different location, it is determined that the client's login environment has changed. At this time, it is necessary to strengthen user identity authentication and further improve the security of user account use.

[0145] In the identity authentication method in one or more embodiments of the present specification, the verification server sends an encryption instruction to the client, so that the client encrypts the intermediate data generated according to the encryption instruction during the collection of the identity authentication image, and then receives the identity authentication image embedded with encryption information reported by the client, extracts the encryption information from the received identity authentication image and performs identity authentication based on the encryption information. That is to say, in the process of the client generating the identity authentication image, corresponding encryption processing is performed at different data processing stages. On the one hand, the client encrypts according to the server encryption requirements and realizes interactive encryption between the client and the server. On the other hand, the intermediate data is encrypted during the generation of the identity authentication image to avoid the risk of data replacement, thereby preventing malicious attacks on the identity authentication data by illegal elements, ensuring the real-time, authenticity and effectiveness of the identity authentication data collection, and improving the security of user account use.

[0146] It should be noted that this embodiment in this specification is based on the same inventive concept as the previous embodiment in this specification, so the specific implementation of this embodiment can refer to the implementation of the aforementioned identity authentication method, and the repeated parts will not be repeated.

[0147] Corresponding to the above Figures 2 to 7 The identity authentication method described above is based on the same technical concept, and one or more embodiments of this specification also provide an identity authentication device. Fig. 9 A schematic diagram of the module composition of an identity verification device provided on a client side in one or more embodiments of the present specification, the device is used to execute Figures 2 to 7 Describes the authentication method, such as Fig. 9 As shown, the device comprises:

[0148] The encryption instruction acquisition module 901 is used to acquire the encryption instruction sent by the verification server;

[0149] The data encryption module 902 is used to encrypt the intermediate data obtained in at least one target processing stage of collecting the identity verification image according to the encryption instruction;

[0150] The verification image sending module 903 is used to send the collected identity verification image to the verification server, so that the verification server performs identity verification based on the identity verification image.

[0151] Optionally, the identity verification image includes: a user's face image;

[0152] The at least one target processing stage comprises at least one of an optical imaging stage, an image sensor acquisition stage, a video stream generation stage, and a video encoding stage.

[0153] Optionally, the data encryption module 902 is specifically used for:

[0154] Determining, according to the encryption instruction, optical coding information used for data encryption in the optical imaging stage;

[0155] The optical image in the optical imaging stage of capturing the identity verification image is encrypted according to the optical coding information.

[0156] Optionally, the data encryption module 902 is further specifically configured to:

[0157] Acquiring a speckle pattern obtained by irradiating a laser light source onto a diffractive optical element corresponding to the light encoding information;

[0158] The speckle pattern is superimposed on the optical image in the optical imaging stage of acquiring the identity verification image.

[0159] Optionally, the data encryption module 902 is specifically used for:

[0160] Determining, according to the encryption instruction, a hidden position of a digital watermark used for data encryption during the image sensor acquisition phase;

[0161] According to the hidden position, the digital watermark is embedded into the image signal in the image sensor acquisition phase of acquiring the identity verification image.

[0162] Optionally, the data encryption module 902 is further specifically configured to:

[0163] If the encryption instruction indicates time domain encryption, the spatial domain is used as the hidden position of the digital watermark used for data encryption in the image sensor acquisition phase;

[0164] If the encryption instruction indicates frequency domain encryption, the DCT transform domain is used as the hidden position of the digital watermark used for data encryption in the image sensor acquisition stage;

[0165] If the encryption instruction indicates time-frequency domain encryption, the time-frequency transform domain is used as the hidden position of the digital watermark used for data encryption in the image sensor acquisition phase;

[0166] If the encryption instruction indicates time-scale domain encryption, the wavelet transform domain is used as the hiding position of the digital watermark used for data encryption in the image sensor acquisition stage.

[0167] Optionally, the data encryption module 902 is specifically used for:

[0168] According to the encryption instruction, determining a target video frame for data encryption in the video stream generation stage and an insertion position of the target video frame;

[0169] According to the insertion position, the target video frame is inserted into the video stream generated in the video stream generation stage of capturing the identity verification image.

[0170] Optionally, the target video frame includes at least one of: a blank frame, a video frame embedded with a digital watermark, and a video frame superimposed with a preset encryption pattern.

[0171] Optionally, the data encryption module 902 is specifically used for:

[0172] According to the encryption instruction, determining the adding position of the target information for data encryption in the video encoding stage;

[0173] According to the adding position, the target information is embedded in the file header information or the picture structure diagram of the face image in the video encoding stage of collecting the identity verification image.

[0174] Optionally, the encryption instruction is determined by the verification server in the following manner:

[0175] Determine the target security level of the client to be authenticated;

[0176] In a plurality of data processing stages of collecting the identity verification image, determining at least one target processing stage according to the target security level, and determining encryption parameters corresponding to each target processing stage;

[0177] An encryption instruction to be sent to the client is generated according to the at least one target processing stage and the encryption parameter.

[0178] The identity authentication device in one or more embodiments of the present specification obtains an encryption instruction issued by a server; according to the encryption instruction, encrypts the intermediate data obtained in at least one target processing stage of collecting identity authentication images; and sends the collected encrypted identity authentication images to the server so that the server performs identity authentication based on the identity authentication images. During the process of collecting identity authentication images, the generated intermediate data is encrypted according to the encryption instruction issued by the server, and the identity authentication image embedded with the encryption information is sent to the server so that the server extracts the encryption information from the received identity authentication image and performs identity authentication based on the encryption information, thereby preventing malicious attacks on the identity authentication data by illegal elements, thereby ensuring the real-time, authenticity and effectiveness of identity authentication data collection, and improving the security of user account use.

[0179] It should be noted that this embodiment in the present specification is based on the same inventive concept as the first embodiment in the present specification, so the specific implementation of this embodiment can refer to the implementation of the aforementioned identity authentication method, and the repeated parts will not be repeated.

[0180] Corresponding to the above Figure 8 The identity authentication method described above is based on the same technical concept, and one or more embodiments of this specification also provide an identity authentication device. Fig.10 A schematic diagram of the module composition of an identity verification device provided in a service server according to one or more embodiments of the present specification, wherein the device is used to execute Figure 8 Describes the authentication method, such as Fig.10 As shown, the device comprises:

[0181] The verification image receiving module 1001 is used to obtain the identity verification image collected based on the encrypted instruction and reported by the client after sending the encrypted instruction to the client;

[0182] A data decryption module 1002 is used to decrypt the identity verification image to obtain target encryption information corresponding to at least one target processing stage;

[0183] The identity authentication module 1003 is used to determine whether the identity authentication of the client is passed according to the encryption instruction and the target encryption information.

[0184] Optionally, the identity authentication module 1003 is specifically used to:

[0185] Determining whether the target encryption information corresponding to each target processing stage matches the encryption parameter corresponding to the target processing stage indicated by the encryption instruction;

[0186] If yes, it is determined that the identity authentication of the client is passed;

[0187] If not, it is determined that the identity authentication of the client fails.

[0188] Optionally, the identity verification image is obtained by the client encrypting intermediate data obtained in at least one target processing stage of collecting the identity verification image according to the encryption instruction.

[0189] Optionally, the above device further includes an encryption instruction generation module, wherein the encryption instruction generation module is used to:

[0190] Determine the target security level of the client to be authenticated;

[0191] In a plurality of data processing stages of collecting the identity verification image, determining at least one target processing stage according to the target security level, and determining encryption parameters corresponding to each target processing stage;

[0192] An encryption instruction to be sent to the client is generated according to the at least one target processing stage and the encryption parameter.

[0193] In the identity authentication device in one or more embodiments of the present specification, the verification server sends an encryption instruction to the client, so that the client encrypts the intermediate data generated according to the encryption instruction during the collection of the identity authentication image, and then receives the identity authentication image embedded with encryption information reported by the client, extracts the encryption information from the received identity authentication image and performs identity authentication based on the encryption information. That is to say, in the process of the client generating the identity authentication image, corresponding encryption processing is performed at different data processing stages. On the one hand, the client encrypts according to the server encryption requirements and realizes interactive encryption between the client and the server. On the other hand, the intermediate data is encrypted during the generation of the identity authentication image to avoid the risk of data replacement, thereby preventing malicious attacks on the identity authentication data by illegal elements, ensuring the real-time, authenticity and effectiveness of the identity authentication data collection, and improving the security of user account use.

[0194] It should be noted that this embodiment in the present specification is based on the same inventive concept as the first embodiment in the present specification, so the specific implementation of this embodiment can refer to the implementation of the aforementioned identity authentication method, and the repeated parts will not be repeated.

[0195] Corresponding to the above Figures 2 to 8 The identity authentication method described in the present invention is based on the same technical concept, and one or more embodiments of the present invention also provide an identity authentication system. Fig.11 This is a schematic diagram of the structure of the identity verification system provided in one or more embodiments of this specification, and the device is used to execute Figures 2 to 8 Describes the authentication method, such as Fig.11 As shown, the system includes:

[0196] A verification server 10 and multiple clients 20, wherein the verification server 10 is in communication connection with each client 20;

[0197] Specifically, the verification server sends an encryption instruction to the client, wherein the encryption instruction includes: a target processing stage to be encrypted, and encryption parameters corresponding to each target processing stage;

[0198] After receiving the encryption instruction sent by the verification server, the client encrypts the intermediate data obtained in at least one target processing stage according to the encryption instruction during the process of collecting the identity verification image, and obtains the encrypted identity verification image;

[0199] The client sends the encrypted identity verification image to the verification server;

[0200] After receiving the encrypted identity authentication image, the verification server authenticates the user using the client based on the identity authentication image. If the identity authentication is successful, a prompt message indicating that the authentication is successful is sent to the client. If the identity authentication fails, a prompt message indicating that the authentication fails is sent to the client.

[0201] In the identity authentication system in one or more embodiments of the present specification, the verification server sends an encryption instruction to the client. During the process of collecting the identity authentication image, the client encrypts the generated intermediate data according to the encryption instruction to obtain the identity authentication image embedded with the encrypted information. Then, the verification server receives the identity authentication image embedded with the encrypted information reported by the client, extracts the encrypted information from the received identity authentication image and performs identity authentication based on the encrypted information. That is to say, during the process of the client generating the identity authentication image, corresponding encryption processing is performed at different data processing stages. On the one hand, the client encrypts according to the server encryption requirements to realize interactive encryption between the client and the server. On the other hand, the intermediate data is encrypted during the process of generating the identity authentication image to avoid the risk of data replacement, thereby preventing malicious attacks on the identity authentication data by illegal elements, ensuring the real-time, authenticity and effectiveness of the identity authentication data collection, and improving the security of user account use.

[0202] It should be noted that this embodiment in the present specification is based on the same inventive concept as the first embodiment in the present specification, so the specific implementation of this embodiment can refer to the implementation of the aforementioned identity authentication method, and the repeated parts will not be repeated.

[0203] Furthermore, corresponding to the above Figures 2 to 8 Based on the same technical concept, one or more embodiments of this specification also provide an identity authentication device, which is used to perform the above identity authentication method, such as Fig.12 shown.

[0204] The identity authentication device may have relatively large differences due to different configurations or performances, and may include one or more processors 1201 and memory 1202, and the memory 1202 may store one or more storage applications or data. Among them, the memory 1202 may be a short-term storage or a persistent storage. The application stored in the memory 1202 may include one or more modules (not shown in the figure), and each module may include a series of computer executable instructions in the identity authentication device. Furthermore, the processor 1201 may be configured to communicate with the memory 1202 to execute a series of computer executable instructions in the memory 1202 on the identity authentication device. The identity authentication device may also include one or more power supplies 1203, one or more wired or wireless network interfaces 1204, one or more input and output interfaces 1205, one or more keyboards 1206, etc.

[0205] In a specific embodiment, the identity verification device includes a memory and one or more programs, wherein the one or more programs are stored in the memory, and the one or more programs may include one or more modules, and each module may include a series of computer executable instructions in the identity verification device, and the one or more programs are configured to be executed by one or more processors, including computer executable instructions for performing the following:

[0206] Obtain the encrypted instructions sent by the verification server;

[0207] According to the encryption instruction, encrypting the intermediate data obtained in at least one target processing stage of collecting the identity verification image;

[0208] The collected identity verification image is sent to the verification server, so that the verification server performs identity verification based on the identity verification image.

[0209] Optionally, when the computer executable instructions are executed, the identity verification image includes: a user's face image;

[0210] The at least one target processing stage comprises at least one of an optical imaging stage, an image sensor acquisition stage, a video stream generation stage, and a video encoding stage.

[0211] Optionally, when the computer executable instructions are executed, encrypting the intermediate data obtained in at least one target processing stage of collecting the identity verification image according to the encryption instructions includes:

[0212] Determining, according to the encryption instruction, optical coding information used for data encryption in the optical imaging stage;

[0213] The optical image in the optical imaging stage of capturing the identity verification image is encrypted according to the optical coding information.

[0214] Optionally, when the computer executable instructions are executed, encrypting the optical image in the optical imaging stage of acquiring the identity verification image according to the optical coding information includes:

[0215] Acquiring a speckle pattern obtained by irradiating a laser light source onto a diffractive optical element corresponding to the light encoding information;

[0216] The speckle pattern is superimposed on the optical image in the optical imaging stage of acquiring the identity verification image.

[0217] Optionally, when the computer executable instructions are executed, encrypting the intermediate data obtained in at least one target processing stage of collecting the identity verification image according to the encryption instructions includes:

[0218] Determining, according to the encryption instruction, a hidden position of a digital watermark used for data encryption during the image sensor acquisition phase;

[0219] According to the hidden position, the digital watermark is embedded into the image signal in the image sensor acquisition phase of acquiring the identity verification image.

[0220] Optionally, when the computer executable instructions are executed, determining the hidden position of the digital watermark used for data encryption in the image sensor acquisition phase according to the encryption instructions includes:

[0221] If the encryption instruction indicates time domain encryption, the spatial domain is used as the hidden position of the digital watermark used for data encryption in the image sensor acquisition phase;

[0222] If the encryption instruction indicates frequency domain encryption, the DCT transform domain is used as the hidden position of the digital watermark used for data encryption in the image sensor acquisition stage;

[0223] If the encryption instruction indicates time-frequency domain encryption, the time-frequency transform domain is used as the hidden position of the digital watermark used for data encryption in the image sensor acquisition phase;

[0224] If the encryption instruction indicates time-scale domain encryption, the wavelet transform domain is used as the hiding position of the digital watermark used for data encryption in the image sensor acquisition stage.

[0225] Optionally, when the computer executable instructions are executed, encrypting the intermediate data obtained in at least one target processing stage of collecting the identity verification image according to the encryption instructions includes:

[0226] According to the encryption instruction, determining a target video frame for data encryption in the video stream generation stage and an insertion position of the target video frame;

[0227] According to the insertion position, the target video frame is inserted into the video stream generated in the video stream generation stage of capturing the identity verification image.

[0228] Optionally, when the computer executable instructions are executed, the target video frame includes at least one of: a blank frame, a video frame embedded with a digital watermark, and a video frame superimposed with a preset encryption pattern.

[0229] Optionally, when the computer executable instructions are executed, encrypting the intermediate data obtained in at least one target processing stage of collecting the identity verification image according to the encryption instructions includes:

[0230] According to the encryption instruction, determining the adding position of the target information for data encryption in the video encoding stage;

[0231] According to the adding position, the target information is embedded in the file header information or the picture structure diagram of the face image in the video encoding stage of collecting the identity verification image.

[0232] Optionally, when the computer executable instruction is executed, the encrypted instruction is determined by the verification server in the following manner:

[0233] Determine the target security level of the client to be authenticated;

[0234] In a plurality of data processing stages of collecting the identity verification image, determining at least one target processing stage according to the target security level, and determining encryption parameters corresponding to each target processing stage;

[0235] An encryption instruction to be sent to the client is generated according to the at least one target processing stage and the encryption parameter.

[0236] The identity verification device in one or more embodiments of the present specification obtains an encryption instruction issued by a server; according to the encryption instruction, encrypts the intermediate data obtained in at least one target processing stage of collecting identity verification images; and sends the collected encrypted identity verification images to the server so that the server performs identity verification based on the identity verification images. During the process of collecting identity verification images, the generated intermediate data is encrypted according to the encryption instruction issued by the server, and the identity verification image embedded with the encryption information is sent to the server so that the server extracts the encryption information from the received identity verification image and performs identity verification based on the encryption information, thereby preventing malicious attacks on the identity verification data by illegal elements, thereby ensuring the real-time, authenticity and effectiveness of identity verification data collection, and improving the security of user account use.

[0237] In another specific embodiment, the identity verification device includes a memory and one or more programs, wherein the one or more programs are stored in the memory, and the one or more programs may include one or more modules, and each module may include a series of computer executable instructions in the identity verification device, and the one or more programs are configured to be executed by one or more processors, including computer executable instructions for performing the following:

[0238] After sending an encryption instruction to the client, obtaining the identity verification image collected based on the encryption instruction and reported by the client;

[0239] Decrypting the identity verification image to obtain target encryption information corresponding to at least one target processing stage;

[0240] According to the encryption instruction and the target encryption information, it is determined whether the identity authentication of the client is passed.

[0241] Optionally, when the computer executable instruction is executed, determining whether the identity authentication of the client is passed according to the encryption instruction and the target encryption information includes:

[0242] Determining whether the target encryption information corresponding to each target processing stage matches the encryption parameter corresponding to the target processing stage indicated by the encryption instruction;

[0243] If yes, it is determined that the identity authentication of the client is passed;

[0244] If not, it is determined that the identity authentication of the client fails.

[0245] Optionally, when the computer executable instructions are executed, the identity verification image is obtained by the client encrypting intermediate data obtained in at least one target processing stage of collecting the identity verification image according to the encryption instructions.

[0246] Optionally, when the computer executable instructions are executed, they further include computer executable instructions for performing the following:

[0247] Determine the target security level of the client to be authenticated;

[0248] In a plurality of data processing stages of collecting the identity verification image, determining at least one target processing stage according to the target security level, and determining encryption parameters corresponding to each target processing stage;

[0249] An encryption instruction to be sent to the client is generated according to the at least one target processing stage and the encryption parameter.

[0250] In the identity authentication device in one or more embodiments of the present specification, the verification server sends an encryption instruction to the client, so that the client encrypts the intermediate data generated according to the encryption instruction during the collection of the identity authentication image, and then receives the identity authentication image embedded with encryption information reported by the client, extracts the encryption information from the received identity authentication image and performs identity authentication based on the encryption information. That is to say, in the process of the client generating the identity authentication image, corresponding encryption processing is performed at different data processing stages. On the one hand, the client encrypts according to the server encryption requirements and realizes interactive encryption between the client and the server. On the other hand, the intermediate data is encrypted during the generation of the identity authentication image to avoid the risk of data replacement, thereby preventing malicious attacks on the identity authentication data by illegal elements, ensuring the real-time, authenticity and effectiveness of the identity authentication data collection, and improving the security of user account use.

[0251] Furthermore, corresponding to the above Figures 2 to 8 The method shown is based on the same technical concept. One or more embodiments of this specification also provide a storage medium for storing computer executable instructions. In a specific embodiment, the storage medium can be a USB flash drive, an optical disk, a hard disk, etc. When the computer executable instructions stored in the storage medium are executed by the processor, the following process can be implemented:

[0252] Obtain the encrypted instructions sent by the verification server;

[0253] According to the encryption instruction, encrypting the intermediate data obtained in at least one target processing stage of collecting the identity verification image;

[0254] The collected identity verification image is sent to the verification server, so that the verification server performs identity verification based on the identity verification image.

[0255] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, the identity verification image includes: a user face image;

[0256] The at least one target processing stage comprises at least one of an optical imaging stage, an image sensor acquisition stage, a video stream generation stage, and a video encoding stage.

[0257] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, the encryption processing of the intermediate data obtained in at least one target processing stage of collecting the identity verification image according to the encryption instruction includes:

[0258] Determining, according to the encryption instruction, optical coding information used for data encryption in the optical imaging stage;

[0259] The optical image in the optical imaging stage of capturing the identity verification image is encrypted according to the optical coding information.

[0260] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, encrypting the optical image in the optical imaging stage of acquiring the identity verification image according to the optical coding information includes:

[0261] Acquiring a speckle pattern obtained by irradiating a laser light source onto a diffractive optical element corresponding to the light encoding information;

[0262] The speckle pattern is superimposed on the optical image in the optical imaging stage of acquiring the identity verification image.

[0263] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, the encryption processing of the intermediate data obtained in at least one target processing stage of collecting the identity verification image according to the encryption instruction includes:

[0264] Determining, according to the encryption instruction, a hidden position of a digital watermark used for data encryption during the image sensor acquisition phase;

[0265] According to the hidden position, the digital watermark is embedded into the image signal in the image sensor acquisition phase of acquiring the identity verification image.

[0266] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, determining the hidden position of the digital watermark used for data encryption in the image sensor acquisition phase according to the encryption instruction includes:

[0267] If the encryption instruction indicates time domain encryption, the spatial domain is used as the hidden position of the digital watermark used for data encryption in the image sensor acquisition phase;

[0268] If the encryption instruction indicates frequency domain encryption, the DCT transform domain is used as the hidden position of the digital watermark used for data encryption in the image sensor acquisition stage;

[0269] If the encryption instruction indicates time-frequency domain encryption, the time-frequency transform domain is used as the hidden position of the digital watermark used for data encryption in the image sensor acquisition phase;

[0270] If the encryption instruction indicates time-scale domain encryption, the wavelet transform domain is used as the hiding position of the digital watermark used for data encryption in the image sensor acquisition stage.

[0271] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, the encryption processing of the intermediate data obtained in at least one target processing stage of collecting the identity verification image according to the encryption instruction includes:

[0272] According to the encryption instruction, determining a target video frame for data encryption in the video stream generation stage and an insertion position of the target video frame;

[0273] According to the insertion position, the target video frame is inserted into the video stream generated in the video stream generation stage of capturing the identity verification image.

[0274] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, the target video frame includes at least one of: a blank frame, a video frame embedded with a digital watermark, and a video frame superimposed with a preset encryption pattern.

[0275] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, the encryption processing of the intermediate data obtained in at least one target processing stage of collecting the identity verification image according to the encryption instruction includes:

[0276] According to the encryption instruction, determining the adding position of the target information for data encryption in the video encoding stage;

[0277] According to the adding position, the target information is embedded in the file header information or the picture structure diagram of the face image in the video encoding stage of collecting the identity verification image.

[0278] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, the encryption instructions are determined by the verification server in the following manner:

[0279] Determine the target security level of the client to be authenticated;

[0280] In a plurality of data processing stages of collecting the identity verification image, determining at least one target processing stage according to the target security level, and determining encryption parameters corresponding to each target processing stage;

[0281] An encryption instruction to be sent to the client is generated according to the at least one target processing stage and the encryption parameter.

[0282] When the computer executable instructions stored in the storage medium in one or more embodiments of this specification are executed by the processor, the encryption instructions issued by the server are obtained; according to the encryption instructions, the intermediate data obtained in at least one target processing stage of collecting identity authentication images is encrypted; and the collected encrypted identity authentication images are sent to the server so that the server performs identity authentication based on the identity authentication images. During the process of collecting identity authentication images, the generated intermediate data is encrypted according to the encryption instructions issued by the server, and the identity authentication images embedded with the encryption information are sent to the server so that the server extracts the encryption information from the received identity authentication images and performs identity authentication based on the encryption information, thereby preventing malicious attacks on the identity authentication data by illegal elements, thereby ensuring the real-time, authenticity and effectiveness of identity authentication data collection, and improving the security of user account use.

[0283] In another specific embodiment, the storage medium may be a USB flash drive, an optical disk, a hard disk, etc. When the computer executable instructions stored in the storage medium are executed by the processor, the following process can be implemented:

[0284] After sending an encryption instruction to the client, obtaining the identity verification image collected based on the encryption instruction and reported by the client;

[0285] Decrypting the identity verification image to obtain target encryption information corresponding to at least one target processing stage;

[0286] According to the encryption instruction and the target encryption information, it is determined whether the identity authentication of the client is passed.

[0287] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, determining whether the identity authentication of the client is passed according to the encryption instruction and the target encryption information includes:

[0288] Determining whether the target encryption information corresponding to each target processing stage matches the encryption parameter corresponding to the target processing stage indicated by the encryption instruction;

[0289] If yes, it is determined that the identity authentication of the client is passed;

[0290] If not, it is determined that the identity authentication of the client fails.

[0291] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, the identity verification image is obtained by the client encrypting the intermediate data obtained in at least one target processing stage of collecting the identity verification image according to the encryption instructions.

[0292] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, the following process is also implemented:

[0293] Determine the target security level of the client to be authenticated;

[0294] In a plurality of data processing stages of collecting the identity verification image, determining at least one target processing stage according to the target security level, and determining encryption parameters corresponding to each target processing stage;

[0295] An encryption instruction to be sent to the client is generated according to the at least one target processing stage and the encryption parameter.

[0296] When the computer executable instructions stored in the storage medium in one or more embodiments of the present specification are executed by the processor, the verification server sends an encryption instruction to the client, so that the client encrypts the intermediate data generated according to the encryption instruction during the collection of the identity authentication image, and then receives the identity authentication image embedded with encryption information reported by the client, extracts the encryption information from the received identity authentication image and performs identity authentication based on the encryption information. That is to say, in the process of the client generating the identity authentication image, corresponding encryption processing is performed at different data processing stages. On the one hand, the client encrypts according to the server encryption requirements and realizes interactive encryption between the client and the server. On the other hand, the intermediate data is encrypted during the generation of the identity authentication image to avoid the risk of data replacement, thereby preventing malicious attacks on the identity authentication data by illegal elements, ensuring the real-time, authenticity and effectiveness of the identity authentication data collection, and improving the security of user account use.

[0297] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0298] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0299] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0300] For the convenience of description, the above devices are described in various units according to their functions. Of course, when implementing one or more of the present specification, the functions of each unit can be implemented in the same or more software and / or hardware.

[0301] It will be appreciated by those skilled in the art that one or more embodiments of this specification may be provided as methods, systems, or computer program products. Therefore, one or more of this specification may be in the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, one or more of this specification may be in the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0302] One or more of the present specification is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to one or more embodiments of the present specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0303] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0304] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0305] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0306] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0307] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0308] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0309] It should be understood by those skilled in the art that one or more embodiments of this specification may be provided as methods, systems or computer program products. Therefore, one or more of this specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, one or more of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0310] One or more of the present descriptions may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more of the present descriptions may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are connected through a communications network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0311] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0312] The above description is only one or more embodiments of this specification and is not intended to limit this specification. For those skilled in the art, this specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this specification should be included in the scope of one or more claims of this specification.

Claims

1. An identity authentication method, characterized in that: include: Obtaining an encryption instruction issued by a verification server, wherein the encryption instruction includes: a target processing stage that needs to be encrypted; According to the encryption instruction, encrypting the data obtained in at least one of the target processing stages of collecting the identity verification image; The collected identity verification image is sent to the verification server so that the verification server performs identity verification based on the identity verification image. The collected identity verification image is obtained by encrypting data obtained in at least one target processing stage of collecting the identity verification image according to the encryption instruction.

2. The method according to claim 1, characterized in that The identity verification image includes: a user's face image; At least one of the target processing stages includes: at least one of an optical imaging stage, an image sensor acquisition stage, a video stream generation stage, and a video encoding stage.

3. The method according to claim 2, characterized in that The step of encrypting data obtained in at least one target processing stage of collecting identity verification images according to the encryption instruction comprises: Determining, according to the encryption instruction, optical coding information used for data encryption in the optical imaging stage; The optical image in the optical imaging stage of capturing the identity verification image is encrypted according to the optical coding information.

4. The method according to claim 3, characterized in that The step of encrypting the optical image in the optical imaging stage of acquiring the identity verification image according to the optical coding information comprises: Acquiring a speckle pattern obtained by irradiating a laser light source onto a diffractive optical element corresponding to the light encoding information; The speckle pattern is superimposed on the optical image in the optical imaging stage of acquiring the identity verification image.

5. The method according to claim 2, characterized in that: The step of encrypting data obtained in at least one target processing stage of collecting identity verification images according to the encryption instruction comprises: Determining, according to the encryption instruction, a hidden position of a digital watermark used for data encryption during the image sensor acquisition phase; According to the hidden position, the digital watermark is embedded into the image signal in the image sensor acquisition phase of acquiring the identity verification image.

6. The method according to claim 5, characterized in that Determining the hidden position of the digital watermark used for data encryption in the image sensor acquisition phase according to the encryption instruction includes: If the encryption instruction indicates time domain encryption, the spatial domain is used as the hidden position of the digital watermark used for data encryption in the image sensor acquisition phase; If the encryption instruction indicates frequency domain encryption, the DCT transform domain is used as the hidden position of the digital watermark used for data encryption in the image sensor acquisition stage; If the encryption instruction indicates time-frequency domain encryption, the time-frequency transform domain is used as the hidden position of the digital watermark used for data encryption in the image sensor acquisition phase; If the encryption instruction indicates time-scale domain encryption, the wavelet transform domain is used as the hiding position of the digital watermark used for data encryption in the image sensor acquisition stage.

7. The method according to claim 2, characterized in that The step of encrypting data obtained in at least one target processing stage of collecting identity verification images according to the encryption instruction comprises: According to the encryption instruction, determining a target video frame for data encryption in the video stream generation stage and an insertion position of the target video frame; According to the insertion position, the target video frame is inserted into the video stream generated in the video stream generation stage of capturing the identity verification image.

8. The method according to claim 7, characterized in that The target video frame includes at least one of a blank frame, a video frame embedded with a digital watermark, and a video frame superimposed with a preset encryption pattern.

9. The method according to claim 2, characterized in that: The step of encrypting data obtained in at least one target processing stage of collecting identity verification images according to the encryption instruction comprises: According to the encryption instruction, determining the adding position of the target information for data encryption in the video encoding stage; According to the adding position, the target information is embedded in the file header information or the picture structure diagram of the face image in the video encoding stage of collecting the identity verification image.

10. The method according to any one of claims 1 to 9, characterized in that: The encryption instruction is determined by the verification server in the following manner: Determine the target security level of the client to be authenticated; In a plurality of data processing stages of collecting the identity verification image, determining at least one of the target processing stages according to the target security level, and determining encryption parameters corresponding to each of the target processing stages; An encryption instruction to be sent to the client is generated according to the at least one target processing stage and the encryption parameter.

11. An identity authentication method, characterized in that: include: After sending an encryption instruction to the client, obtaining an identity verification image collected based on the encryption instruction and reported by the client, wherein the encryption instruction includes: a target processing stage to be encrypted, and the identity verification image is obtained by the client encrypting data obtained by at least one of the target processing stages of collecting the identity verification image according to the encryption instruction; Decrypting the identity verification image to obtain target encryption information corresponding to at least one target processing stage; According to the encryption instruction and the target encryption information, it is determined whether the identity authentication of the client is passed.

12. The method according to claim 11, characterized in that The step of determining whether the identity authentication of the client is passed according to the encryption instruction and the target encryption information includes: Determining whether the target encryption information corresponding to each target processing stage matches the encryption parameter corresponding to the target processing stage indicated by the encryption instruction; If yes, it is determined that the identity authentication of the client is passed; If not, it is determined that the identity authentication of the client fails.

13. The method according to claim 11, characterized in that Also includes: Determine the target security level of the client to be authenticated; In a plurality of data processing stages of collecting the identity verification image, determining at least one of the target processing stages according to the target security level, and determining encryption parameters corresponding to each of the target processing stages; An encryption instruction to be sent to the client is generated according to the at least one target processing stage and the encryption parameter.

14. An identity verification device, characterized in that: include: The encryption instruction acquisition module is used to acquire the encryption instruction issued by the verification server, wherein the encryption instruction includes: a target processing stage that needs to be encrypted; A data encryption module, used for encrypting data obtained in at least one of the target processing stages of collecting identity verification images according to the encryption instruction; The verification image sending module is used to send the collected identity verification image to the verification server so that the verification server performs identity verification based on the identity verification image. The collected identity verification image is obtained by encrypting the data obtained in at least one target processing stage of collecting the identity verification image according to the encryption instruction.

15. An identity verification device, characterized in that: include: A verification image receiving module is used to obtain, after sending an encryption instruction to a client, an identity verification image collected based on the encryption instruction and reported by the client, wherein the encryption instruction includes: a target processing stage to be encrypted, and the identity verification image is obtained by the client encrypting data obtained in at least one of the target processing stages of collecting the identity verification image according to the encryption instruction; A data decryption module, used to decrypt the identity verification image to obtain target encryption information corresponding to at least one target processing stage; The identity authentication module is used to determine whether the identity authentication of the client is passed according to the encryption instruction and the target encryption information.

16. An identity verification device, characterized in that: include: processor; as well as a memory arranged to store computer executable instructions which, when executed, cause the processor to: Obtaining an encryption instruction issued by a verification server, wherein the encryption instruction includes: a target processing stage that needs to be encrypted; According to the encryption instruction, encrypting the data obtained in at least one target processing stage of collecting the identity verification image; The collected identity verification image is sent to the verification server so that the verification server performs identity verification based on the identity verification image. The collected identity verification image is obtained by encrypting data obtained in at least one target processing stage of collecting the identity verification image according to the encryption instruction.

17. An identity verification device, characterized in that: include: processor; as well as a memory arranged to store computer executable instructions which, when executed, cause the processor to: After sending an encryption instruction to the client, obtaining an identity verification image collected based on the encryption instruction and reported by the client, wherein the encryption instruction includes: a target processing stage to be encrypted, and the identity verification image is obtained by the client encrypting data obtained by at least one of the target processing stages of collecting the identity verification image according to the encryption instruction; Decrypting the identity verification image to obtain target encryption information corresponding to at least one target processing stage; According to the encryption instruction and the target encryption information, it is determined whether the identity authentication of the client is passed.

18. A storage medium for storing computer executable instructions, characterized in that: The executable instructions implement the following process when executed: Obtaining an encryption instruction issued by a verification server, wherein the encryption instruction includes: a target processing stage that needs to be encrypted; According to the encryption instruction, encrypting the data obtained in at least one target processing stage of collecting the identity verification image; The collected identity verification image is sent to the verification server so that the verification server performs identity verification based on the identity verification image. The collected identity verification image is obtained by encrypting data obtained in at least one target processing stage of collecting the identity verification image according to the encryption instruction.

19. A storage medium for storing computer executable instructions, characterized in that: The executable instructions implement the following process when executed: After sending an encryption instruction to the client, obtaining an identity verification image collected based on the encryption instruction and reported by the client, wherein the encryption instruction includes: a target processing stage to be encrypted, and the identity verification image is obtained by the client encrypting data obtained by at least one of the target processing stages of collecting the identity verification image according to the encryption instruction; Decrypting the identity verification image to obtain target encryption information corresponding to at least one target processing stage; According to the encryption instruction and the target encryption information, it is determined whether the identity authentication of the client is passed.

Images