Remote identity authentication method, device, equipment and storage medium

Abstract

The present application provides a remote identity authentication method, apparatus, device and storage medium, the method comprising: after the terminal device obtains an obfuscation sequence from a server, the facial data of the user to be authenticated is filled according to the obfuscation sequence to generate the filled facial data. Then, the facial data of the user to be authenticated is filled according to the obfuscation sequence to generate the filled facial data. After that, the facial data is processed to obtain a verification value. Finally, the verification value is filled into a preset position of the filled facial data to generate target facial data, and the target facial data is sent to the server. In this solution, since the data transmitted by the terminal device to the server is filled, it is prevented from the attacker being able to directly obtain the original data when the data is leaked, and the server can verify whether the target facial data has been tampered with according to the verification value carried in the target facial data, thereby further ensuring data security.

Description

Technical Field

[0001] The present application relates to the field of financial technology, and in particular to a remote identity authentication method, apparatus, device and storage medium. Background Art

[0002] In recent years, with the promotion and vigorous development of financial technology, various applications based on financial technology have emerged. In order to ensure financial security, users need to fully understand their customers (KYC) in the process of conducting financial business. KYC certification effectively protects the property safety of customers and the business security of institutions by identifying the identity of customers in real time and taking corresponding measures based on the identification results.

[0003] At present, KYC authentication mainly involves users sending facial authentication requests to the server through a terminal device pre-installed with a software development kit (SDK) when conducting financial business. After receiving the facial authentication request sent by the terminal device, the server extracts the facial features of the user image or user video carried in the facial authentication request, and compares the facial features with the pre-stored facial features to obtain the identity authentication result.

[0004] However, due to the current technology, terminal devices interact with servers through Hyper Text Transfer Protocol over Secure Socket Layer (HTTPS), and the encryption range of HTTPS is relatively limited. It has almost no effect on hacker attacks, denial of service attacks, server hijacking, etc., and cannot guarantee the security of the data transmission process. Summary of the invention

[0005] The present application provides a remote identity authentication method, apparatus, device and storage medium to improve the security of data transmission during the KYC authentication process.

[0006] In a first aspect, an embodiment of the present application provides a remote identity authentication method, which is applied to a terminal device, and the method includes:

[0007] Obtain an obfuscated sequence from a server, wherein the obfuscated sequence includes a plurality of padding positions and corresponding numbers of padding characters;

[0008] Filling the facial data of the user to be authenticated according to the obfuscation sequence to generate filled facial data;

[0009] Processing the facial data to obtain a verification value, where the verification value is used to verify whether the facial data has been tampered with;

[0010] Filling the verification value into a preset position of the filled face data to generate target face data;

[0011] The target face data is sent to the server.

[0012] In a possible design of the first aspect, before obtaining the obfuscated sequence from the server, the method further includes:

[0013] When running a preset application, obtaining a public key from the server;

[0014] In response to the operation of the preset application by the user to be authenticated, sending a remote identity authentication request to the server;

[0015] receiving first message information returned by the server, the first message information including an encrypted first random factor and an encrypted information acquisition request, the first random factor being used to decrypt the encrypted information acquisition request, the information acquisition request being used to acquire the to-be-authenticated user information;

[0016] The first message information is decrypted according to the public key, and the processed second message information is sent to the server, the second message information includes an encrypted second random factor and encrypted user information to be authenticated, and the second random factor is used to decrypt the encrypted user information to be authenticated, so that the server can authenticate the user to be authenticated according to the user information to be authenticated.

[0017] Optionally, obtaining the obfuscated sequence from the server includes:

[0018] receiving the encrypted obfuscated sequence returned by the server;

[0019] The encrypted obfuscation sequence is decrypted according to the public key to obtain the obfuscation sequence.

[0020] Optionally, after decrypting the first message information according to the public key and sending the processed second message information to the server, the method further includes:

[0021] Receive the authentication result returned by the server, where the authentication result is used to indicate whether the user to be authenticated has passed the authentication.

[0022] In a second aspect, an embodiment of the present application provides a remote identity authentication method, which is applied to a server, and the method includes:

[0023] Sending an obfuscated sequence to a terminal device, the obfuscated sequence including a plurality of padding positions and a corresponding number of padding characters;

[0024] Receiving target face data of a user to be authenticated sent by the terminal device;

[0025] According to the obfuscation sequence and the preset position, the padding characters in the target face data and the verification value corresponding to the preset position are deleted to obtain the face data;

[0026] Verifying, according to the verification value, whether the facial data has been tampered with;

[0027] If the facial data has not been tampered with, identity authentication is performed based on the facial data and the standard facial data corresponding to the user to be authenticated, and an authentication result is generated.

[0028] In a possible design of the second aspect, after generating the authentication result, the method further includes:

[0029] Obtain the master key from the unified configuration center system;

[0030] Generate multiple working keys based on the master key;

[0031] Encrypt the facial data using any working key to generate encrypted facial data;

[0032] Encrypting any one of the working keys to obtain an encryption key;

[0033] A target file is generated and stored based on any one of the working keys, the encrypted facial data and the encryption key, wherein the target file includes the length of the encryption key, the encryption key, the length of the encrypted facial data, the encrypted facial data, and a check digit.

[0034] In another possible design of the second aspect, before sending the obfuscated sequence to the terminal device, the method further includes:

[0035] When the terminal device runs a preset application, creating a public-private key pair, and sending the public key in the public-private key pair to the terminal device;

[0036] receiving a remote identity authentication request sent by the terminal device, and sending first message information to the terminal device according to the remote identity authentication request, wherein the first message information includes an encrypted first random factor and an encrypted information acquisition request, wherein the first random factor is used to decrypt the encrypted information acquisition request, and the information acquisition request is used to obtain the user information to be authenticated;

[0037] receiving second message information returned by the terminal device, where the second message information includes an encrypted second random factor and encrypted user information to be authenticated, where the second random factor is used to decrypt the encrypted user information to be authenticated;

[0038] Decrypting the second message information by using the private key in the public-private key pair, and if the decryption is successful, authenticating the user information to be authenticated obtained by decryption;

[0039] The authentication result obtained by the authentication process is sent to the terminal device, and the authentication result is used to indicate whether the user to be authenticated has passed the authentication.

[0040] Optionally, before sending the obfuscated sequence to the terminal device, the method further includes:

[0041] randomly generating the obfuscated sequence according to the remote identity authentication request, and encrypting the obfuscated sequence;

[0042] Accordingly, sending the obfuscated sequence to the terminal device includes:

[0043] The encrypted obfuscated sequence is sent to the terminal device.

[0044] Optionally, after decrypting the second message information by using the private key in the public-private key pair, the method further includes:

[0045] If the decryption fails, an authentication failure message is sent to the terminal device.

[0046] Optionally, the storage target file includes:

[0047] The target file is stored in a distributed file system, and file storage index information is generated, wherein the file storage index information includes an identifier of the target file, an identifier of a user, a storage path of the target file, a length of the target file, and a starting position and an ending position of the target file in the storage path.

[0048] Optionally, the method further includes:

[0049] Decrypting the encryption key by using the master key to obtain any one of the working keys;

[0050] The encrypted facial data is decrypted according to any one of the working keys to obtain the facial data.

[0051] In yet another possible design of the second aspect, after verifying whether the facial data has been tampered with according to the verification value, the method further includes:

[0052] If the facial data is tampered with, a reminder message is returned to the terminal device, where the reminder message is used to remind the user that the facial data of the user to be authenticated is tampered with.

[0053] In a third aspect, an embodiment of the present application provides a remote identity authentication device, which is applied to a terminal device, and the device includes:

[0054] An acquisition module, configured to acquire an obfuscated sequence from a server, wherein the obfuscated sequence includes a plurality of filling positions and corresponding numbers of filling characters;

[0055] A processing module, used for filling the facial data of the user to be authenticated according to the obfuscation sequence to generate filled facial data;

[0056] The processing module is further used to process the facial data to obtain a verification value, where the verification value is used to verify whether the facial data has been tampered with;

[0057] The processing module is further used to fill the verification value into a preset position of the filled face data to generate target face data;

[0058] A sending module is used to send the target face data to the server.

[0059] In a possible design of the third aspect, before obtaining the obfuscated sequence from the server, the apparatus further includes:

[0060] The acquisition module is further used to obtain the public key from the server when running the preset application;

[0061] A receiving module, configured to send a remote identity authentication request to the server in response to the operation of the preset application by the user to be authenticated;

[0062] The receiving module is further used to receive first message information returned by the server, the first message information includes an encrypted first random factor and an encrypted information acquisition request, the first random factor is used to decrypt the encrypted information acquisition request, and the information acquisition request is used to obtain the user information to be authenticated;

[0063] The sending module is used to decrypt the first message information according to the public key, and send the processed second message information to the server, the second message information includes an encrypted second random factor and encrypted user information to be authenticated, and the second random factor is used to decrypt the encrypted user information to be authenticated, so that the server can authenticate the user to be authenticated according to the user information to be authenticated.

[0064] Optionally, the acquisition module is specifically used to:

[0065] receiving the encrypted obfuscated sequence returned by the server;

[0066] The encrypted obfuscation sequence is decrypted according to the public key to obtain the obfuscation sequence.

[0067] Optionally, after decrypting the first message information according to the public key and sending the processed second message information to the server, the receiving module is also used to receive an authentication result returned by the server, and the authentication result is used to indicate whether the user to be authenticated has passed the authentication.

[0068] In a fourth aspect, an embodiment of the present application provides a remote identity authentication device, which is applied to a server, and the device includes:

[0069] A sending module, used to send an obfuscated sequence to a terminal device, wherein the obfuscated sequence includes a plurality of filling positions and a corresponding number of filling characters;

[0070] A receiving module, used for receiving target face data of a user to be authenticated sent by the terminal device;

[0071] A processing module, configured to delete the padding characters in the target face data and the verification value corresponding to the preset position according to the obfuscation sequence and the preset position, so as to obtain the face data;

[0072] The processing module is further used to verify whether the facial data has been tampered with according to the verification value;

[0073] The processing module is further used to perform identity authentication based on the facial data and standard facial data corresponding to the user to be authenticated, and generate an authentication result if the facial data has not been tampered with.

[0074] In a possible design of the fourth aspect, after generating the authentication result, the apparatus further includes:

[0075] The acquisition module is used to obtain the master key from the unified configuration center system;

[0076] The processing module is further used to generate multiple working keys according to the master key;

[0077] The processing module is further used to encrypt the facial data using any working key to generate encrypted facial data;

[0078] The processing module is further used to encrypt any one of the working keys to obtain an encryption key;

[0079] The processing module is also used to generate and store a target file based on any one of the working keys, the encrypted facial data and the encryption key, wherein the target file includes the length of the encryption key, the encryption key, the length of the encrypted facial data, the encrypted facial data, and a check digit.

[0080] In another possible design of the fourth aspect, before sending the obfuscated sequence to the terminal device, the processing module is further configured to create a public-private key pair when the terminal device runs a preset application, and send the public key in the public-private key pair to the terminal device;

[0081] The receiving module is further used to receive a remote identity authentication request sent by the terminal device, and send a first message information to the terminal device according to the remote identity authentication request, wherein the first message information includes an encrypted first random factor and an encrypted information acquisition request, wherein the first random factor is used to decrypt the encrypted information acquisition request, and the information acquisition request is used to obtain the user information to be authenticated;

[0082] The receiving module is further used to receive second message information returned by the terminal device, the second message information includes an encrypted second random factor and encrypted user information to be authenticated, and the second random factor is used to decrypt the encrypted user information to be authenticated;

[0083] The processing module is further used to decrypt the second message information by using the private key in the public-private key pair, and if the decryption is successful, authenticate the user information to be authenticated obtained by decryption;

[0084] The sending module is further used to send the authentication result obtained by the authentication process to the terminal device, and the authentication result is used to indicate whether the user to be authenticated has passed the authentication.

[0085] Optionally, before sending the obfuscated sequence to the terminal device, the processing module is further used to randomly generate the obfuscated sequence according to the remote identity authentication request, and encrypt the obfuscated sequence;

[0086] Accordingly, the sending module is specifically used for:

[0087] The encrypted obfuscated sequence is sent to the terminal device.

[0088] Optionally, after the second message information is decrypted by using the private key in the public-private key pair, the sending module is further used to send authentication failure information to the terminal device if the decryption fails.

[0089] Optionally, the processing module is specifically used to store the target file in a distributed file system and generate file storage index information, wherein the file storage index information includes the identifier of the target file, the identifier of the user, the storage path of the target file, the length of the target file, and the starting position and ending position of the target file in the storage path.

[0090] Optionally, the acquisition module is further used to decrypt the encryption key by using the master key to obtain any one of the working keys;

[0091] The acquisition module is also used to decrypt the encrypted face data according to any one of the working keys to obtain the face data.

[0092] In another possible design of the fourth aspect, after verifying whether the facial data has been tampered with based on the verification value, the sending module is also used to return a reminder message to the terminal device if the facial data has been tampered with, and the reminder message is used to remind the user that the facial data of the user to be authenticated has been tampered with.

[0093] In the fifth aspect, an embodiment of the present application provides a terminal device, comprising: a processor, a transceiver, a memory, and computer program instructions stored in the memory and executable on the processor, wherein the processor is used to implement the first aspect and the methods provided by various possible designs when executing the computer program instructions.

[0094] In the sixth aspect, an embodiment of the present application provides a server, comprising: a processor, a transceiver, a memory, and computer program instructions stored in the memory and executable on the processor, wherein the processor is used to implement the second aspect and the methods provided by various possible designs when executing the computer program instructions.

[0095] In the seventh aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer execution instructions are stored. When the computer execution instructions are executed by a processor, they are used to implement the methods provided by the first aspect, the second aspect, and various possible designs.

[0096] The remote identity authentication method, apparatus, device and storage medium provided in the embodiments of the present application are as follows: after the terminal device obtains the obfuscation sequence from the server, the facial data of the user to be authenticated is filled according to the obfuscation sequence to generate the filled facial data. Then, the facial data of the user to be authenticated is filled according to the obfuscation sequence to generate the filled facial data. After that, the facial data is processed to obtain a verification value. Finally, the verification value is filled into the preset position of the filled facial data to generate the target facial data, and the target facial data is sent to the server. In this solution, since the data transmitted by the terminal device to the server is filled, it is prevented from the attacker being able to directly obtain the original data when the data is leaked, and the server can verify whether the target facial data has been tampered with according to the verification value carried in the target facial data, thereby further ensuring data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0097] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0098] Figure 1 A flowchart of a first embodiment of remote identity authentication provided by the prior art;

[0099] Figure 2 A schematic diagram of the user login process provided by the prior art;

[0100] Figure 3 A flowchart of a second embodiment of remote identity authentication provided by the prior art;

[0101] Figure 4 A flowchart of a first embodiment of a remote identity authentication method provided in an embodiment of the present application;

[0102] Figure 5 A flowchart of a second embodiment of a remote identity authentication method provided in an embodiment of the present application;

[0103] Figure 6 A flowchart of a third embodiment of a remote identity authentication method provided in an embodiment of the present application;

[0104] Figure 7 Schematic diagram of the process of obtaining target face data provided in the embodiment of the present application

[0105] Figure 8 A flowchart of a fourth embodiment of a remote identity authentication method provided in an embodiment of the present application;

[0106] Fig. 9 A flowchart of a fifth embodiment of a remote identity authentication method provided in an embodiment of the present application;

[0107] Fig.10 A flowchart of a sixth embodiment of a remote identity authentication method provided in an embodiment of the present application;

[0108] Fig.11 A schematic diagram of the structure of a first embodiment of a remote identity authentication device provided in an embodiment of the present application;

[0109] Fig.12 A schematic diagram of the structure of a second embodiment of a remote identity authentication device provided in an embodiment of the present application;

[0110] Fig.13 A schematic diagram of the structure of a terminal device provided in an embodiment of the present application;

[0111] Fig.14 A schematic diagram of the structure of a server provided in an embodiment of the present application.

[0112] The above drawings show clear embodiments of the present disclosure, which will be described in more detail below. These drawings and text descriptions are not intended to limit the scope of the present disclosure in any way, but to illustrate the concepts of the present disclosure to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0113] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0114] Before introducing the embodiments of the present application, the application background of the embodiments of the present application is first explained:

[0115] In the field of remote identity verification, the security of user data is the first issue to be considered. User data is not allowed to be leaked or tampered with by attackers during the identification process. Some large domestic Internet companies provide cloud remote identity authentication service SDKs for developers. While providing a complete access system, the SDK also provides developers with computing and storage services on their cloud platforms, which greatly facilitates developers' access, protects the property security of financial users, Internet users and enterprises, and avoids property losses of enterprises and users.

[0116] At present, in order to ensure the security of user data, the protocol used when a terminal device interacts with a server is usually replaced by the HTTPS protocol from the Hyper Text Transfer Protocol (HTTP). Figure 1 The flowchart of the first embodiment of remote identity authentication provided by the prior art is as follows. Figure 1 As shown, the terminal device interacts with the server via the HTTPS protocol, and a remote authentication SDK is installed in the terminal device. In response to the user's operation on the remote authentication SDK, the terminal device sends a remote authentication request to the server via the HTTPS protocol, so that the server processes the remote authentication request and provides remote authentication services for the user.

[0117] In the prior art, when a user performs remote identity authentication, a user login authorization is first performed, so that the server can perform remote identity authentication on the face recognition video or face recognition image submitted by the user after the user login authorization is successful. Exemplarily, the user login process and remote identity authentication process in the prior art are explained through two specific embodiments.

[0118] Figure 2 A flowchart of user login provided by the prior art. During the user login process, the Open Application Programming Interface (OpenAPI) based on the open authorization (OAUTH 2.0) open platform will be used for authentication, and all access processes will be subject to token authentication, whitelist, and current limiting mechanisms to effectively protect user data at the user access layer.

[0119] like Figure 2 As shown, the terminal device responds to the user's operation on the SDK and submits a user login request to the server. The server receives the user login request sent by the terminal device, and performs risk control on the user login device and user information according to the user login request. After the verification is passed, the risk is re-judged by the device fingerprint risk decision rule engine, and the risk information of the terminal device obtained by the judgment is persistently stored to facilitate the subsequent judgment and use of the face scanning request submitted by the user. Among them, the risk information is obtained by analyzing massive risk data through big data, and business personnel and operation and maintenance personnel can log in to the management console to view the risk information.

[0120] Among them, the device fingerprint risk decision rule engine includes self-built risk database and third-party services.

[0121] Among them, the mode of the remote identity authentication SDK can be any one of the mobile operating system (IOS) developed by Apple, Android, personal computer (Personal Computer, PC), and hypertext 5.0 (HTML5, H5). The remote identity authentication SDK communicates with the server based on HTTPS.

[0122] For example, risk control can be to limit the number of face scans, set or prohibit login by identifying a device abnormality through big data training results.

[0123] Figure 3 The flowchart of the second embodiment of remote identity authentication provided by the prior art is as follows. Figure 3As shown, the terminal device responds to the user's operation on the SDK, securely encrypts the face-scanning video or face-scanning image, and after passing the open platform OpenAPI authentication, submits a face-scanning request carrying the encrypted face-scanning video or encrypted face-scanning image to the server. After receiving the face-scanning request, the server performs risk control on the encrypted face-scanning video or encrypted face-scanning image (checks whether the request message, the encrypted face-scanning video or the encrypted face-scanning image has been tampered with). After the verification is passed, the risk is re-judged by the device fingerprint risk decision rule engine, and the user is recognized for face recognition after the judgment is passed. After the face recognition is completed, the user's identification feature results, that is, the persistent face-scanning results, will also be temporarily stored.

[0124] However, due to the limited encryption scope of HTTPS, it has almost no effect on hacker attacks, denial of service attacks, server hijacking, etc., and cannot guarantee the security of the data transmission process.

[0125] In view of the above problems, the invention of the present application is as follows: the security of user data can be guaranteed from the process of facial data generation to transmission. After the terminal device collects the facial data, it can fill the facial data according to the multiple filling positions of the obfuscated sequence obtained in advance from the server and the corresponding number of filling characters. Further, a verification value for verifying whether the facial data has been tampered with is obtained according to the facial data, and the verification value is filled into the preset position of the filled facial data, and the generated target facial data is sent to the server. The server restores the target facial data to facial data according to the obfuscated sequence and the preset position, and verifies whether the facial data has been tampered with according to the verification value, so that the user is authenticated when the facial data has not been tampered with. In this way, after the target facial data is leaked, the attacker cannot obtain the obfuscated sequence, so the original facial data cannot be extracted from the target facial data; when the attacker tampers with the target data, the server can detect it in time through the verification value, so that the target facial data can be intercepted to prevent the tampered data from causing losses to the user's property, thereby ensuring the security of the user data.

[0126] The technical solution of the present application is described in detail below through specific embodiments.

[0127] It should be noted that the following specific embodiments may be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0128] Figure 4 The flowchart of the remote identity authentication method embodiment 1 provided in the present application embodiment is as follows. Figure 4 As shown, the remote identity authentication method is applied to a terminal device, and the method may include the following steps:

[0129] S401. Obtain the obfuscation sequence from the server.

[0130] Among them, the obfuscation sequence includes multiple padding positions and the corresponding number of padding characters.

[0131] Exemplarily, multiple padding positions can be represented by random bits of S bits. For example, if S = 6 (0, 3, 20, 31, 47, 50), it means that the padding positions are the 0th, 3rd, 20th, 31st, 47th, and 50th bits of the face data of the user to be authenticated respectively. The number of padding characters can be represented by M. For example, if M = 1, then 1 padding character is filled at each padding position.

[0132] In practical applications, through testing and verification, it is found that when the number of padding positions is not less than 5 and not more than 15, a good obfuscation effect can be achieved. Therefore, as a preferred implementation scheme, in order to ensure the obfuscation effect and obfuscation efficiency, the number of padding positions can be not less than 5 and not more than 10, and the corresponding number of padding characters can be not less than 1 and not more than 3.

[0133] S402. Fill the face data of the user to be authenticated according to the obfuscation sequence to generate the filled face data.

[0134] In one implementable manner, according to the number of padding characters in the obfuscation sequence, randomly select the padding characters corresponding to the number of padding characters from the padding character set stored locally, and fill the selected padding characters into each padding position respectively.

[0135] Among them, the padding characters in the padding character set can be rare Chinese characters (uncommon Chinese characters), such as: 孠, 壱, 姘, 嬉, 宻, 巂, 庱, 嵸, 嵹, 嵺, 嵻, 嵼, 嵽, 嵾, 嵿, 嶀, 嵝, 嶂, 嶃, 崭, 嶅, 嶆, 岖, etc. In practical applications, when opening a video file or an image file with a text editor, due to character encoding reasons, some rare Chinese characters similar to Chinese will appear in the file. Therefore, compared with simple English characters, the file after obfuscation processing with rare Chinese characters as padding characters will be more real, and it is not easy for attackers to detect that the file has undergone padding processing after stealing it.

[0136] Optionally, the filled face data is encoded in 8-bit (Universal Character Set / Unicode Transformation Format, UTF8), and one Chinese character occupies 3 bytes.

[0137] For example, assume that the byte stream of face data is: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 ... 48, 49 ... 57, 58, 59; the filling positions are: 0, 3, 20, 31, 47, 50; the corresponding characters are S1, S2, S3, S4, S5, S6. Then, the byte stream of face data after filling is: S1, 0, 1, S2, 2, 3, 4, 5, 6, 7, 8, 9, 10 ... 18, S3, 19, 20 ... 29, S4, 30, 31 ... 45, S5, 46, 47 ... 48, S6, 49 ... 59.

[0138] In this example, further, assuming that M=1, 6 Chinese characters are randomly selected from the filling character set and filled into the above filling positions (i.e., the positions corresponding to S1, S2, S3, S4, S5, and S6). Since one Chinese character occupies 3 bytes, 18 bytes of data need to be filled into the face data of the user to be authenticated. Similarly, assuming that M=2, 12 Chinese characters are randomly selected from the filling character set, and 2 Chinese characters are written into each filling position, and a total of 36 bytes of data need to be filled into the face data of the user to be authenticated.

[0139] Optionally, the facial data may be facial image data, facial video data, or other data containing the face of the user to be authenticated, and the embodiments of the present application do not impose any specific restrictions on this.

[0140] S403: Process the facial data to obtain a verification value.

[0141] Among them, the verification value is used to verify whether the face data has been tampered with.

[0142] In a possible implementation, a hash function (Hash) calculation can be performed on the face data to obtain a message digest algorithm (Message Digest Algorithm MD5, MD5) value, and the MD5 value is the above-mentioned verification value.

[0143] S404: Fill the verification value into the preset position of the filled face data to generate target face data.

[0144] Optionally, the preset position may be the end of the filled facial data, the head, or other preset positions in the filled facial data, and the embodiments of the present application do not impose any specific restrictions on this.

[0145] Exemplarily, the preset position is taken as the end of the filled face data as an example for specific description. Based on the example of S402, the byte stream of the target face data is: S1, 0, 1, S2, 2, 3, 4, 5, 6, 7, 8, 9, 10...18, S3, 19, 20...29, S4, 30, 31...45, S5, 46, 47...48, S6, 49...59, (32-bit MD5 value).

[0146] S405: Send the target face data to the server.

[0147] The terminal device is connected to the server wirelessly.

[0148] It should be understood that the embodiments of the present application do not limit the protocol used between the terminal device and the server. Exemplarily, the protocol may be the HTTPS protocol.

[0149] Optionally, the terminal device may further process the target face data before sending the target face data, and this application does not limit the processing.

[0150] In the remote identity authentication method provided by the embodiment of the present application, after the terminal device obtains the obfuscation sequence from the server, the facial data of the user to be authenticated is filled according to the obfuscation sequence to generate the filled facial data. Then, the facial data of the user to be authenticated is filled according to the obfuscation sequence to generate the filled facial data. After that, the facial data is processed to obtain a verification value. Finally, the verification value is filled into the preset position of the filled facial data to generate the target facial data, and the target facial data is sent to the server. In this solution, since the data transmitted by the terminal device to the server is filled, it is prevented from the attacker being able to directly obtain the original data when the data is leaked, and the server can verify whether the target facial data has been tampered with according to the verification value carried in the target facial data, thereby further ensuring data security.

[0151] Figure 5 The flowchart of the remote identity authentication method embodiment 2 provided in the present application embodiment is as follows. Figure 5 As shown, the remote identity authentication method is applied to the server, and the method may also include the following steps:

[0152] S501: Send an obfuscated sequence to a terminal device.

[0153] The obfuscated sequence includes multiple filling positions and corresponding numbers of filling characters.

[0154] It should be understood that the principle of confusing serial correlation can be referred to Figure 3 The description of the illustrated embodiments will not be repeated here.

[0155] S502: Receive target face data of the user to be authenticated sent by the terminal device.

[0156] It should be understood that the principles related to the target face data can refer to Figure 3 The description of the illustrated embodiments will not be repeated here.

[0157] S503. According to the obfuscation sequence and the preset position, the padding characters in the target face data and the verification value corresponding to the preset position are deleted to obtain the face data.

[0158] In one achievable manner, after receiving the target face data, the server can delete the padding characters in the target face data according to the multiple padding positions and the corresponding number of padding characters. After that, the verification value at the preset position in the deleted target face data is deleted, thereby obtaining the face data (that is, the original data).

[0159] Exemplarily, based on the example of S404, the padding characters are determined and deleted from the target face data according to S and M in the obfuscation sequence, and the byte stream of the deleted target face data (the deleted target face data obtained after the reverse deobfuscation operation, that is, the padded face data in the above embodiment) is obtained as follows: S1, 0, 1, S2, 2, 3, 4, 5, 6, 7, 8, 9, 10 ... 18, S3, 19, 20 ... 29, S4, 30, 31 ... 45, S5, 46, 47 ... 48, S6, 49 ... 59, (32-bit MD5 value). Further, the verification value at the end of the deleted target face data is deleted, and the byte stream of the obtained face data is as follows: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 ... 48, 49 ... 57, 58, 59.

[0160] Since the obfuscated sequence S and M are not public, the attacker cannot crack the original data (face data) in the target face data after obtaining it, which further ensures the security of user data.

[0161] In this embodiment, the server only needs to know the S and M of the obfuscated sequence and does not need to know the specific content of the filling character, thereby improving the efficiency of the deletion process.

[0162] S504: Verify whether the facial data has been tampered with based on the verification value.

[0163] In a possible implementation, assuming that the verification value is the MD5 value of the face data, the server can use the same hash algorithm as the terminal device to calculate the face data to obtain the target MD5 value of the face data. After that, the target MD5 value is compared with the MD5 value. If the comparison is consistent, it means that the face data has not been tampered with. If the comparison is inconsistent, it means that the face data has been tampered with.

[0164] S505: If the facial data has not been tampered with, identity authentication is performed based on the facial data and the standard facial data corresponding to the user to be authenticated, and an authentication result is generated.

[0165] In a possible implementation, the server may store the standard face data of each user, and the standard face data may be obtained in advance through big data. When the face data of the user to be authenticated is consistent with the standard face data corresponding to the user to be authenticated, it means that the user has passed the identity authentication, and the authentication result generated at this time is used to indicate that the authentication is successful; when the face data of the user to be authenticated is inconsistent with the standard face data corresponding to the user to be authenticated, it means that the user has not passed the identity authentication, and the authentication result generated at this time is used to indicate that the authentication has failed.

[0166] In the remote identity authentication method provided by the embodiment of the present application, after the server sends an obfuscation sequence to the terminal device, it receives the target face data of the user to be authenticated sent by the terminal device, deletes the padding characters in the target face data and the verification value corresponding to the preset position according to the obfuscation sequence and the preset position, and obtains the face data. Afterwards, it verifies whether the face data has been tampered with according to the verification value. If the face data has not been tampered with, the identity authentication is performed according to the face data and the standard face data corresponding to the user to be authenticated, and an authentication result is generated. In this scheme, by sending an obfuscation sequence to the terminal device so that the terminal device fills the transmitted data according to the obfuscation sequence, the filled data obtained by the attacker cannot be directly displayed (if the data is a video, it cannot be played, and if the data is an image, it cannot be viewed using image editing software), thereby ensuring the data security of the data transmission process.

[0167] At the same time, it also verifies whether the target facial data has been tampered with based on the verification value carried in the target facial data, preventing attackers from using tampered data to threaten the user's property safety and data security.

[0168] Figure 6 A flowchart of the third embodiment of the remote identity authentication method provided in the embodiment of the present application.

[0169] like Figure 6 As shown, the remote identity authentication method may include the following steps:

[0170] S601. The server sends an obfuscated sequence to a terminal device.

[0171] Correspondingly, for the terminal device, the obfuscated sequence is obtained from the server.

[0172] S602: The terminal device fills the facial data of the user to be authenticated according to the obfuscation sequence to generate filled facial data.

[0173] S603: The terminal device processes the facial data and obtains a verification value.

[0174] S604: The terminal device fills the verification value into the preset position of the filled facial data to generate target facial data.

[0175] S605: The terminal device sends the target face data to the server.

[0176] Correspondingly, the server receives the target face data of the user to be authenticated sent by the terminal device.

[0177] S606. The server deletes the padding characters in the target facial data and the verification value corresponding to the preset position according to the obfuscation sequence and the preset position to obtain the facial data.

[0178] S607: The server verifies whether the facial data has been tampered with based on the verification value.

[0179] S608. If the facial data has not been tampered with, the server performs identity authentication based on the facial data and the standard facial data corresponding to the user to be authenticated, and generates an authentication result.

[0180] In combination with the remote identity authentication scheme in the above embodiments, the scheme is illustrated below by using a specific example.

[0181] Figure 7 The following is a flow chart of a method for acquiring target face data provided in an embodiment of the present application. Figure 7 As shown, the face data is an N-bit string, and the terminal device fills the face data according to the pre-acquired obfuscation sequence, and the generated filled face data is an N+S-bit string. Further, the face data can be processed to obtain a D-bit verification value, and the verification value is attached to the end of the filled face data to generate the target face data, which is an N+S+D-bit string.

[0182] In actual application, the facial data uploaded by users is usually large, and the current KYC face scanning process needs to be completed within 3s to 5s. If symmetric encryption or asymmetric encryption is used, the encryption process will take a lot of time.

[0183] Exemplarily, AES is taken as an example for comparison with the present application. Table 1 shows the encryption parameters of AES and the encryption parameters of the present application under a test environment.

[0184] Table 1

[0185]

[0186] In Table 1, the encryption parameters include the size of the face data after encryption, the encryption time, and the decryption time. As can be seen from Table 1, the present application encrypts the face data through the obfuscation sequence, and the size of the encrypted face data is much smaller than the size of the face data encrypted by AES, and the encryption and decryption time is much smaller than the encryption and decryption time of AES. In other words, the present application encrypts the face data through the obfuscation sequence, and the size of the encrypted face data will not increase significantly, which can not only save more network bandwidth, but also save the time spent on encryption and decryption.

[0187] Figure 8 This is a flow chart of the fourth embodiment of the remote identity authentication method provided in the present application. Figure 8 As shown, based on any of the above embodiments, before sending the obfuscated sequence to the terminal device, the remote identity authentication method may further include the following steps:

[0188] S801. When a terminal device runs a preset application, the server creates a public-private key pair and sends the public key in the public-private key pair to the terminal device.

[0189] Optionally, when the terminal device runs the preset application, the server starts the service corresponding to the preset application and dynamically creates an initialized public-private key pair. Optionally, the public-private key pair can be a public-private key pair based on the RSA algorithm. The RSA algorithm was proposed by Ronald Rivest, Adi Shamir and Leonard Adleman. RSA is composed of the first letters of their surnames.

[0190] The public key is used by the terminal device to decrypt the data sent by the server.

[0191] The preset application is used to provide the services provided by the server to the user on the terminal device.

[0192] Optionally, the public-private key pair may be updated periodically, such as once every 2 hours, once every 12 hours, or once every day, etc., and the present application embodiment does not impose any specific restrictions on this. By regularly updating the public-private key pair, it can be updated in a timely manner in the event of a public-private key pair being leaked, thereby ensuring data security during data transmission.

[0193] Correspondingly, for the terminal device, when running the preset application, the public key is obtained from the server.

[0194] S802: In response to the operation of the preset application by the user to be authenticated, the terminal device sends a remote identity authentication request to the server.

[0195] The remote identity authentication request is used to request the server to perform remote identity authentication on the user to be authenticated.

[0196] S803: The server receives a remote identity authentication request sent by the terminal device, and sends first message information to the terminal device according to the remote identity authentication request.

[0197] The first message information includes an encrypted first random factor and an encrypted information acquisition request, the first random factor is used to decrypt the encrypted information acquisition request, and the information acquisition request is used to obtain the user information to be authenticated.

[0198] The first random factor is asynchronously created by the server, changes dynamically, and is set with a validity period.

[0199] Exemplarily, the first random factor can be a 32-bit random string with a validity period of 10 minutes. After the first random factor is used, the first random factor is immediately set to invalid, thereby effectively preventing data replay attacks and reducing the risk of the public and private keys being stolen when they are built into the code.

[0200] Optionally, the user information to be authenticated may be user name, user phone number, user ID number, user bank card number, etc. This application does not specifically limit the user information to be authenticated.

[0201] Correspondingly, for the terminal device, the first message information returned by the server is received.

[0202] S804: The terminal device decrypts the first message information according to the public key, and sends the processed second message information to the server.

[0203] The second message information includes an encrypted second random factor and encrypted user information to be authenticated. The second random factor is used to decrypt the encrypted user information to be authenticated, so that the server can authenticate the user to be authenticated according to the user information to be authenticated.

[0204] In a possible implementation, the terminal device decrypts the first message information according to the public key, thereby obtaining the first random factor and the encrypted information acquisition request, and then decrypts the encrypted information acquisition request according to the first random factor, thereby obtaining the information acquisition request. Further, the terminal device generates the user information to be authenticated according to the information acquisition request, and asynchronously creates the second random factor, encrypts the user information to be authenticated using the second random factor, and encrypts the second random factor using the public key, thereby generating the second message information.

[0205] Correspondingly, for the server, the second message information returned by the terminal device is received.

[0206] S805. The server decrypts the second message information using the private key in the public-private key pair. If the decryption is successful, the server authenticates the user information to be authenticated obtained by decryption.

[0207] In a possible implementation, the server can decrypt the second message information by using the private key, and after the decryption is successful, obtain the second random factor and the encrypted user to be authenticated. Afterwards, the encrypted user information to be authenticated is decrypted by using the second random factor to obtain the user information to be authenticated.

[0208] S806: The server sends the authentication result obtained through the authentication process to the terminal device.

[0209] The authentication result is used to indicate whether the user to be authenticated has passed the authentication.

[0210] If the user to be authenticated fails to pass the authentication, the user to be authenticated cannot perform the subsequent remote identity authentication steps.

[0211] In the above embodiment, the message information sent by the terminal device and the server is encrypted by regularly updated public-private keys and random factors, which can effectively prevent the risk of digital attacks. When the public key and / or private key is leaked, the problem can be solved by updating the public key and / or private key, effectively preventing the serious impact caused by the leakage of the public-private key pair.

[0212] Optional, Fig. 9 The flowchart of the fifth embodiment of the remote identity authentication method provided in the present application embodiment is as follows. Fig. 9 As shown, based on any of the above embodiments, obtaining the obfuscated sequence from the server can be achieved by the following steps:

[0213] S901. The server randomly generates an obfuscation sequence according to a remote identity authentication request and encrypts the obfuscation sequence.

[0214] In one feasible manner, after receiving the remote identity authentication request, the server can obtain the number of bits of the facial data carried in the remote identity authentication request and dynamically generate an obfuscation sequence to increase the complexity of the obfuscation sequence and prevent it from being deciphered by an attacker.

[0215] Exemplarily, the filling position can be generated by the following algorithm:

[0216]

[0217] Optional, b1, b2....b s-1 The generation process can be achieved through the following steps:

[0218] Step 1: Construct and generate L[min, max] vector, L[index] = index.

[0219] The range of the number of bits of facial data carried in the remote identity authentication request is [min, max].

[0220] Step 2: Randomly generate index, where index satisfies 0≤index <L.length()-1。

[0221] Step 3: Take a number L[index] from L[min,max] according to index. This L[index] is b. i .

[0222] Step 4. Delete L[index] from L[min,max].

[0223] Step 5. Repeat steps 2-4 until s-1 random numbers are selected.

[0224] The above method can generate non-repetitive filling positions, and the process is simple, efficient and has good robustness.

[0225] In actual applications, the header of the image file and / or video file will store the file format code. After the file is filled in the filling position determined by the above method, the header format description of the filled file will be destroyed, and the general player and picture reader will not be able to play the filled file, which has a better protection effect and further ensures the security of data transmission.

[0226] Exemplarily, the process of generating the obfuscated sequence can be implemented by the following steps:

[0227] Step 1: Generate S0 and fix S0=0.

[0228] Step 2: Set min=0, max=59 (the facial data of the user to be authenticated has a total of 59 bits), initialize the L vector: L[min, max]=L[0, 59], and the value of the L vector is L[i]=i (where 1≤i≤59).

[0229] Step 3: Generate a random number between 0 and 59, random=3. At this time, L[3]=3, S1=3, L[0, 59], and S1=3 is eliminated.

[0230] Step 4: Generate a random number between 0 and 58, random=19, then L

[19] =20, S2=20, L[0, 58], remove S2=20.

[0231] Step 5: Generate a random number between 0 and 57, random=29. At this time, L

[29] =31, S3=31, L[0, 57], and eliminate S3=31.

[0232] Step 6: Generate a random number between 0 and 56, random=43, then L

[43] =47, S4=47, L[0, 56], remove S4=47.

[0233] Step 7: Generate a random number between 0 and 55, random=46, then L

[46] =50, S5=50, L[0,55], remove S5=50.

[0234] In summary, the padding positions S of the obfuscated sequence generated by the above process are 6 (0, 3, 20, 31, 47, 50), and the corresponding number of padding characters is M=1.

[0235] The obfuscated sequence may be encrypted by a private key in a public-private key pair.

[0236] S902: The server sends the encrypted obfuscated sequence to the terminal device.

[0237] S903: The terminal device receives the encrypted obfuscation sequence returned by the server, decrypts the encrypted obfuscation sequence according to the public key, and obtains the obfuscation sequence.

[0238] In the above embodiment, when the server sends the obfuscated sequence to the terminal device, the server may also encrypt the obfuscated sequence, thereby preventing an attacker from using the obfuscated sequence to attack the server after the obfuscated sequence is leaked.

[0239] Optionally, in some embodiments, after the first message information is decrypted according to the public key and the processed second message information is sent to the server, the remote identity authentication method may further include the following steps: receiving the authentication result returned by the server, the authentication result is used to indicate whether the user to be authenticated has passed the authentication, so that the user can view the reason for failure when the authentication result indicates that the user has not passed the authentication, and process and adjust the corresponding problem according to the reason for failure, thereby ensuring that the remote identity authentication process can be carried out normally afterwards.

[0240] Fig.10 This is a flow chart of the sixth embodiment of the remote identity authentication method provided in the present application. Fig.10 As shown, the execution subject of this embodiment is a server. Based on any of the above embodiments, after generating the authentication result, the remote identity authentication method may further include the following steps:

[0241] S1001. Obtain a master key from a unified configuration center system.

[0242] The master key is used to encrypt the working key, and the working key is used to encrypt files (such as facial data).

[0243] Optionally, the master key may be a master key of an ASE algorithm.

[0244] S1002. Generate multiple working keys based on the master key.

[0245] Optionally, multiple working keys can be randomly generated based on the master key.

[0246] Optionally, the working key may be a working key of an ASE algorithm.

[0247] S1003. Use any working key to encrypt the facial data to generate encrypted facial data.

[0248] S1004. Encrypt any working key to obtain an encryption key.

[0249] Any working key used to encrypt the facial data in S1003 is encrypted to obtain an encryption key.

[0250] S1005. Generate and store a target file based on any working key, encrypted face data and encryption key.

[0251] Exemplarily, the format of the target file may be as shown in Table 2.

[0252] Table 2

[0253]

[0254] As shown in Table 2, the target file includes the length of the encryption key, the encryption key, the length of the encrypted face data, the encrypted face data, and the check digit. Among them, the number of bits occupied by each part in different target files is certain. For example, the length of the encryption key is fixed to 5 bits, and the length is filled with 0; the length of the encrypted face data is fixed to 10 bits, and the length is filled with 0.

[0255] In the embodiment of the present application, the face data is double-encrypted by the master key and the working key, wherein the working key can support dynamic changes. When the working key is leaked, it can be replaced immediately to avoid the subsequent leakage of new target files. Among them, there is no upper limit to the number of working keys in theory. The more working keys there are, the more difficult it will be to decrypt and leak.

[0256] Optionally, in some embodiments, after the second message information is decrypted by the private key in the public-private key pair, the remote identity authentication method may further include the following steps: if the decryption fails, sending authentication failure information to the terminal device, and at the same time, the server may also update the public-private key pair based on the authentication failure information, and send the updated public key to the terminal device, so that normal communication with the terminal device can be carried out subsequently based on the updated public key.

[0257] Optionally, in some embodiments, storing the target file may be achieved through the following steps: storing the target file in a distributed file system, and generating file storage index information.

[0258] The file storage index information includes the identifier of the target file, the identifier of the user, the storage path of the target file, the length of the target file, and the starting position and the ending position of the target file in the storage path.

[0259] Optionally, a hash algorithm required to generate the verification value may also be included.

[0260] In the embodiment of the present application, the target file can be stored in blocks. After the target file is stored in the distributed file system, it can be obtained only through the identification of the target file. This ensures that there is no risk of directly accessing the storage path to obtain the file after the file storage system is compromised. The attacker gets a hard disk, which is also a "byte stream" hard disk. If he does not know the file storage index information and the starting and ending positions of the target file in the storage path, he will not be able to obtain the target file.

[0261] When storing target files, they are divided into paths according to the user's ID. Target files with different user IDs are stored in different paths. Small files are merged into large files. The merged files need to know the starting position of the file to access them. File access is performed through the ID of the target file, which is completely randomly generated and not traversable. Attackers cannot obtain the required information by traversing the file ID.

[0262] Optionally, in some embodiments, the remote identity authentication method may further include the following steps: decrypting the encryption key using the master key to obtain any working key; decrypting the encrypted facial data according to any working key to obtain the facial data.

[0263] Optionally, the facial data may also be checked based on the check digit.

[0264] In an embodiment of the present application, the original facial data can be obtained based on the master key, ensuring the security of the data during the data extraction stage.

[0265] Optionally, in some embodiments, after verifying whether the facial data has been tampered with based on the verification value, the remote identity authentication method may further include the following steps: if the facial data has been tampered with, a reminder message is returned to the terminal device, and the reminder message is used to remind the user that the facial data of the user to be authenticated has been tampered with, so as to prevent the user from continuing to send the target facial data to the server through the terminal device when the problem that caused the facial data to be tampered with has not been fixed, thereby ensuring the user's data security and property security.

[0266] Optionally, in some embodiments, before encrypting the facial data with the master key and the working key, the Fawkes anti-leakage recognition algorithm can be used to pre-process and disguise the facial data to ensure that even if the pre-processed facial data is leaked, it cannot be maliciously used for other facial model recognition detection algorithms, thereby ensuring the security of user data.

[0267] Based on the remote identity authentication scheme provided in the above embodiment, a specific embodiment will be provided below to illustrate the scheme.

[0268] First, in accordance with the requirements of the secure transmission protocol specifications, the service details of this interface are described. The services provided by the backend of the hierarchical separate liveness interface need to be authenticated based on OAUTH signatures. The facial data sent by the terminal device to the server for remote identity authentication needs to be obfuscated. After the server performs remote identity authentication, it can temporarily encrypt and store the facial data so that subsequent customers (such as bank staff who handle business for users) can query the facial data. When developing, the backend provides a unified service interface API to the SDK of the terminal device.

[0269] Users can access the KYC service of the server in different ways, and can easily transfer and save files securely by calling the existing interfaces of the server. The KYC secure transmission SDK mainly provides secure online interface transmission and secure file transmission. The entire link from interface to data storage ensures data security. Once users have accessed one SDK, it is easy to access SDKs of other modes. The KYC secure transmission SDK is mainly implemented based on the OAUTH 2.0 protocol and has the following related functions:

[0270] (1) Interface authentication: All interfaces are authenticated for access and signature verification is performed based on dynamic tickets. The verification includes request message and return result message verification;

[0271] (2) Access control: All interfaces are authorized for access. Users cannot access resources without authorized interfaces.

[0272] (3) Traffic control: All interfaces support personalized configuration for traffic control and monitoring. The SDK can limit the flow of malicious traffic, so that attacks can be carried out promptly and effectively at the access end.

[0273] (4) Parameter specification: The interface effectively verifies the parameters to ensure data quality and legitimacy from the source and prevent dirty data from entering the backend service;

[0274] (5) Result return: Supports interface callback and multiple ways of synchronous result return. At the same time, users can selectively select whether to adopt encrypted transmission for all interface request messages.

[0275] Secondly, the terminal device calls the relevant SDK to combine the relevant security authentication and processing requirements. During the data interaction process, the message needs to be fully encrypted based on the RSA+AES algorithm, where the AES algorithm is used to implement the random factor mentioned above. At the same time, before sending the face data, the face data is obfuscated and encrypted through the obfuscation sequence.

[0276] Thirdly, after receiving the message sent by the terminal device, the server first uses the OAUT-based authentication mechanism to perform a signature verification to verify whether the message is legal (that is, the authentication process in the above embodiment). If it is an illegal request, or the request is legal but the decryption message fails, the terminal device is refused to provide services. Further, after the request is legal and the decryption is successful, the target face data sent by the terminal device is deobfuscated. If the deobfuscation cannot be performed, an error is directly reported, indicating that it is an illegal request.

[0277] Fourthly, in order to facilitate customers to pull facial data, facial data can also be temporarily stored and encrypted using corresponding encryption methods during the storage process.

[0278] Fifthly, when a customer queries an order record, the corresponding file storage index information is obtained based on the transaction file in the order record, and the corresponding facial data is extracted and returned to the customer based on the file storage index information.

[0279] The following is an embodiment of the device of the present application, which can be used to execute the embodiment of the method of the present application. For details not disclosed in the embodiment of the device of the present application, please refer to the embodiment of the method of the present application.

[0280] Fig.11 This is a schematic diagram of the structure of the first embodiment of the remote identity authentication device provided in the present application. Fig.11 As shown, the remote identity authentication device is applied to a terminal device, and the device includes:

[0281] An acquisition module 1101 is used to acquire an obfuscated sequence from a server, where the obfuscated sequence includes a plurality of padding positions and corresponding numbers of padding characters;

[0282] A processing module 1102 is used to fill the facial data of the user to be authenticated according to the obfuscation sequence to generate filled facial data;

[0283] The processing module 1102 is further used to process the face data and obtain a verification value, where the verification value is used to verify whether the face data has been tampered with;

[0284] The processing module 1102 is further used to fill the verification value into the preset position of the filled face data to generate the target face data;

[0285] The sending module 1103 is used to send the target face data to the server.

[0286] In a possible design of an embodiment of the present application, before obtaining the obfuscated sequence from the server, the device further includes:

[0287] The acquisition module 1101 is further used to obtain the public key from the server when running the preset application;

[0288] A receiving module, configured to send a remote identity authentication request to a server in response to an operation of a preset application by a user to be authenticated;

[0289] The receiving module is further used to receive the first message information returned by the server, the first message information includes an encrypted first random factor and an encrypted information acquisition request, the first random factor is used to decrypt the encrypted information acquisition request, and the information acquisition request is used to obtain the user information to be authenticated;

[0290] The sending module 1103 is used to decrypt the first message information according to the public key and send the processed second message information to the server, the second message information includes an encrypted second random factor and encrypted user information to be authenticated, and the second random factor is used to decrypt the encrypted user information to be authenticated so that the server can authenticate the user to be authenticated based on the user information to be authenticated.

[0291] Optionally, the acquisition module 1101 is specifically used for:

[0292] Receive the encrypted obfuscated sequence returned by the server;

[0293] The encrypted obfuscation sequence is decrypted according to the public key to obtain the obfuscation sequence.

[0294] Optionally, after decrypting the first message information according to the public key and sending the processed second message information to the server, the receiving module is also used to receive an authentication result returned by the server, and the authentication result is used to indicate whether the user to be authenticated has passed the authentication.

[0295] The remote identity authentication device provided in the embodiment of the present application can be used to execute the remote identity authentication method on the terminal device side in any of the above embodiments. Its implementation principle and technical effects are similar and will not be repeated here.

[0296] Fig.12 This is a schematic diagram of the structure of the second embodiment of the remote identity authentication device provided in the present application. Fig.12 As shown, the remote identity authentication device is applied to a server, and the device includes:

[0297] A sending module 1201 is used to send an obfuscated sequence to a terminal device, where the obfuscated sequence includes a plurality of padding positions and corresponding numbers of padding characters;

[0298] The receiving module 1202 is used to receive the target face data of the user to be authenticated sent by the terminal device;

[0299] The processing module 1203 is used to delete the padding characters in the target face data and the verification value corresponding to the preset position according to the obfuscation sequence and the preset position to obtain the face data;

[0300] The processing module 1203 is further used to verify whether the face data has been tampered with according to the verification value;

[0301] The processing module 1203 is also used to perform identity authentication based on the facial data and standard facial data corresponding to the user to be authenticated, and generate an authentication result if the facial data has not been tampered with.

[0302] In a possible design of an embodiment of the present application, after generating the authentication result, the apparatus further includes:

[0303] The acquisition module is used to obtain the master key from the unified configuration center system;

[0304] The processing module 1203 is further used to generate multiple working keys according to the master key;

[0305] The processing module 1203 is further used to encrypt the face data using any working key to generate encrypted face data;

[0306] The processing module 1203 is further used to encrypt any working key to obtain an encryption key;

[0307] The processing module 1203 is also used to generate and store a target file based on any working key, encrypted facial data and encryption key. The target file includes the length of the encryption key, the encryption key, the length of the encrypted facial data, the encrypted facial data, and a check digit.

[0308] In another possible design of the embodiment of the present application, before sending the obfuscated sequence to the terminal device, the processing module 1203 is further used to create a public-private key pair when the terminal device runs a preset application, and send the public key in the public-private key pair to the terminal device;

[0309] The receiving module 1202 is further configured to receive a remote identity authentication request sent by a terminal device, and to send a first message information to the terminal device according to the remote identity authentication request, wherein the first message information includes an encrypted first random factor and an encrypted information acquisition request, wherein the first random factor is used to decrypt the encrypted information acquisition request, and the information acquisition request is used to obtain user information to be authenticated;

[0310] The receiving module 1202 is further configured to receive second message information returned by the terminal device, where the second message information includes an encrypted second random factor and encrypted user information to be authenticated, where the second random factor is used to decrypt the encrypted user information to be authenticated;

[0311] The processing module 1203 is further used to decrypt the second message information by using the private key in the public-private key pair, and if the decryption is successful, authenticate the user information to be authenticated obtained by decryption;

[0312] The sending module 1201 is further used to send the authentication result obtained by the authentication process to the terminal device, and the authentication result is used to indicate whether the user to be authenticated has passed the authentication.

[0313] Optionally, before sending the obfuscated sequence to the terminal device, the processing module 1203 is further configured to randomly generate an obfuscated sequence according to the remote identity authentication request, and encrypt the obfuscated sequence;

[0314] Accordingly, the sending module 1201 is specifically used for:

[0315] Send the encrypted obfuscated sequence to the terminal device.

[0316] Optionally, after the second message information is decrypted by using the private key in the public-private key pair, the sending module 1201 is further configured to send authentication failure information to the terminal device if the decryption fails.

[0317] Optionally, processing module 1203 is specifically used to store the target file in a distributed file system and generate file storage index information, which includes the target file identifier, hash function, user identifier, storage path of the target file, length of the target file, and the starting position and ending position of the target file in the storage path.

[0318] Optionally, the acquisition module is further used to decrypt the encryption key using the master key to obtain any working key;

[0319] The acquisition module is also used to decrypt the encrypted face data according to any working key to obtain the face data.

[0320] In another possible design of an embodiment of the present application, after verifying whether the facial data has been tampered with based on the verification value, the sending module 1201 is also used to return a reminder message to the terminal device if the facial data has been tampered with. The reminder message is used to remind the user that the facial data of the user to be authenticated has been tampered with.

[0321] The remote identity authentication device provided in the embodiment of the present application can be used to execute the remote identity authentication method on the server side in any of the above embodiments. Its implementation principle and technical effects are similar and will not be repeated here.

[0322] It should be noted that it should be understood that the division of the various modules of the above device is only a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. And these modules can all be implemented in the form of software calling through processing elements; they can also be all implemented in the form of hardware; some modules can also be implemented in the form of software calling through processing elements, and some modules can be implemented in the form of hardware. In addition, all or part of these modules can be integrated together, or they can be implemented independently. The processing element here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each module above can be completed by an integrated logic circuit of hardware in the processor element or instructions in the form of software.

[0323] Fig.13 This is a schematic diagram of the structure of the terminal device provided in the embodiment of the present application. Fig.13 As shown, the terminal device may include: a processor 1301, a transceiver 1302, a memory 1303, and computer program instructions stored in the memory 1303 and executable on the processor 1301. When the processor 1301 executes the computer program instructions, the remote identity authentication method on the terminal device side provided in any of the aforementioned embodiments is implemented.

[0324] Optionally, the above-mentioned components of the terminal device may be connected via a system bus.

[0325] The memory 1303 may be a separate storage unit or a storage unit integrated in the processor. The number of processors is one or more.

[0326] Optionally, the terminal device may also include an interface for interacting with other devices.

[0327] The transceiver 1302 is used to communicate with the server, and the transceiver 1302 constitutes a communication interface.

[0328] Optionally, in hardware implementation, the above Fig.11 In the embodiment shown: the receiving module and the sending module 1103 correspond to the transceiver 1302 in this embodiment. Fig.11 The processing module 1102 in the illustrated embodiment corresponds to the processor 1301 in this embodiment.

[0329] The terminal device provided in the embodiment of the present application can be used to execute the remote identity authentication method on the terminal device side provided in any of the above-mentioned method embodiments. Its implementation principle and technical effects are similar and will not be repeated here.

[0330] Fig.14 This is a schematic diagram of the structure of the server provided in the embodiment of the present application. Fig.14 As shown, the server may include: a processor 1401, a transceiver 1402, a memory 1403, and computer program instructions stored in the memory 1403 and executable on the processor 1401. When the processor 1401 executes the computer program instructions, the remote identity authentication method on the terminal device side provided in any of the aforementioned embodiments is implemented.

[0331] Optionally, the above-mentioned components of the server may be connected via a system bus.

[0332] The memory 1403 may be a separate storage unit or a storage unit integrated in the processor. The number of processors may be one or more.

[0333] Optionally, the server may also include an interface for interacting with the terminal device.

[0334] The transceiver 1402 is used to communicate with other computers, and the transceiver 1402 constitutes a communication interface.

[0335] Optionally, in hardware implementation, the above Fig.12 In the embodiment shown in the figure: the sending module 1201 and the receiving module 1202 correspond to the transceiver 1402 in this embodiment. Fig.12 The processing module 1203 in the illustrated embodiment corresponds to the processor 1401 in this embodiment.

[0336] The server provided in the embodiment of the present application can be used to execute the remote identity authentication method on the terminal device side provided in any of the above method embodiments. Its implementation principle and technical effects are similar and will not be repeated here.

[0337] It should be understood that the processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the present application can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor.

[0338] The system bus may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The system bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage.

[0339] All or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a readable memory. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned memory (storage medium) includes: read-only memory (ROM), RAM, flash memory, hard disk, solid state drive, magnetic tape, floppy disk, optical disc and any combination thereof.

[0340] An embodiment of the present application provides a computer-readable storage medium, in which computer instructions are stored. When the computer instructions are executed on a computer, the computer executes the above-mentioned remote identity authentication method.

[0341] The computer-readable storage medium mentioned above can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory, electrically erasable programmable read-only memory, erasable programmable read-only memory, programmable read-only memory, read-only memory, magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0342] Optionally, a readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0343] An embodiment of the present application also provides a computer program product, which includes a computer program. The computer program is stored in a computer-readable storage medium. At least one processor can read the computer program from the computer-readable storage medium. When at least one processor executes the computer program, the above-mentioned remote identity authentication method can be implemented.

[0344] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A remote identity authentication method, characterized in that: Applied to a terminal device, the method comprises: When running the preset application, obtain the public key from the server; In response to the operation of the preset application by the user to be authenticated, sending a remote identity authentication request to the server; receiving first message information returned by the server, the first message information including an encrypted first random factor and an encrypted information acquisition request, the first random factor being used to decrypt the encrypted information acquisition request, the information acquisition request being used to obtain information of the user to be authenticated; decrypting the first message information according to the public key, and sending the processed second message information to the server, wherein the second message information includes an encrypted second random factor and encrypted user information to be authenticated, and the second random factor is used to decrypt the encrypted user information to be authenticated, so that the server can authenticate the user to be authenticated according to the user information to be authenticated; Obtaining an obfuscation sequence from a server, the obfuscation sequence including a plurality of padding positions and corresponding numbers of padding characters; the obfuscation sequence is sent by the server when authentication is passed; Filling the facial data of the user to be authenticated according to the obfuscation sequence to generate filled facial data; Processing the facial data of the user to be authenticated to obtain a verification value, where the verification value is used to verify whether the facial data of the user to be authenticated has been tampered with; Filling the verification value into a preset position of the filled face data to generate target face data; The target face data is sent to the server.

2. The method according to claim 1, characterized in that The obtaining of the obfuscated sequence from the server includes: receiving the encrypted obfuscated sequence returned by the server; The encrypted obfuscation sequence is decrypted according to the public key to obtain the obfuscation sequence.

3. The method according to claim 2, characterized in that After decrypting the first message information according to the public key and sending the processed second message information to the server, the method further includes: Receive the authentication result returned by the server, where the authentication result is used to indicate whether the user to be authenticated has passed the authentication.

4. A remote identity authentication method, characterized in that: Applied to a server, the method comprises: When the terminal device runs a preset application, creating a public-private key pair, and sending the public key in the public-private key pair to the terminal device; receiving a remote identity authentication request sent by the terminal device, and sending first message information to the terminal device according to the remote identity authentication request, wherein the first message information includes an encrypted first random factor and an encrypted information acquisition request, wherein the first random factor is used to decrypt the encrypted information acquisition request, and the information acquisition request is used to obtain user information to be authenticated; receiving second message information returned by the terminal device, where the second message information includes an encrypted second random factor and encrypted user information to be authenticated, where the second random factor is used to decrypt the encrypted user information to be authenticated; Decrypting the second message information by using the private key in the public-private key pair, and if the decryption is successful, authenticating the user information to be authenticated obtained by decryption; When the authentication is passed, a confusion sequence is sent to the terminal device, wherein the confusion sequence includes a plurality of padding positions and a corresponding number of padding characters; Receiving target face data of a user to be authenticated sent by the terminal device; According to the obfuscation sequence and the preset position, the padding characters in the target face data and the verification value corresponding to the preset position are deleted to obtain the face data; Verifying, according to the verification value, whether the facial data has been tampered with; If the facial data has not been tampered with, identity authentication is performed based on the facial data and the standard facial data corresponding to the user to be authenticated, and an authentication result is generated.

5. The method according to claim 4, characterized in that After generating the authentication result, the method further includes: Obtain the master key from the unified configuration center system; Generate multiple working keys based on the master key; Encrypt the facial data using any working key to generate encrypted facial data; Encrypting any one of the working keys to obtain an encryption key; A target file is generated and stored based on any one of the working keys, the encrypted facial data and the encryption key, wherein the target file includes the length of the encryption key, the encryption key, the length of the encrypted facial data, the encrypted facial data, and a check digit.

6. The method according to claim 4 or 5, characterized in that: After authenticating the decrypted user information to be authenticated, the method further includes: The authentication result obtained by the authentication process is sent to the terminal device, and the authentication result is used to indicate whether the user to be authenticated has passed the authentication.

7. The method according to claim 6, characterized in that Before sending the obfuscated sequence to the terminal device, the method further includes: randomly generating the obfuscated sequence according to the remote identity authentication request, and encrypting the obfuscated sequence; Accordingly, sending the obfuscated sequence to the terminal device includes: The encrypted obfuscated sequence is sent to the terminal device.

8. The method according to claim 6, characterized in that After decrypting the second message information by using the private key in the public-private key pair, the method further includes: If the decryption fails, an authentication failure message is sent to the terminal device.

9. The method according to claim 5, characterized in that The storage target file includes: The target file is stored in a distributed file system, and file storage index information is generated, wherein the file storage index information includes an identifier of the target file, an identifier of a user, a storage path of the target file, a length of the target file, and a starting position and an ending position of the target file in the storage path.

10. The method according to claim 5, characterized in that The method further comprises: Decrypting the encryption key by using the master key to obtain any one of the working keys; The encrypted facial data is decrypted according to any one of the working keys to obtain the facial data.

11. The method according to claim 4, characterized in that After verifying whether the face data has been tampered with according to the verification value, the method further includes: If the facial data is tampered with, a reminder message is returned to the terminal device, where the reminder message is used to remind the user that the facial data of the user to be authenticated is tampered with.

12. A remote identity authentication device, characterized in that: Applied to a terminal device, the device comprises: An acquisition module, used to obtain a public key from a server when running a preset application; A receiving module, configured to send a remote identity authentication request to the server in response to an operation of the preset application by the user to be authenticated; The receiving module is further used to receive first message information returned by the server, the first message information includes an encrypted first random factor and an encrypted information acquisition request, the first random factor is used to decrypt the encrypted information acquisition request, and the information acquisition request is used to obtain the user information to be authenticated; a sending module, configured to decrypt the first message information according to the public key, and send the processed second message information to the server, wherein the second message information includes an encrypted second random factor and encrypted user information to be authenticated, and the second random factor is used to decrypt the encrypted user information to be authenticated, so that the server can authenticate the user to be authenticated according to the user information to be authenticated; The acquisition module is further used to acquire an obfuscation sequence from a server, wherein the obfuscation sequence includes a plurality of padding positions and a corresponding number of padding characters; the obfuscation sequence is sent by the server when authentication is passed; A processing module, used for filling the facial data of the user to be authenticated according to the obfuscation sequence to generate filled facial data; The processing module is further used to process the facial data of the user to be authenticated to obtain a verification value, where the verification value is used to verify whether the facial data of the user to be authenticated has been tampered with; The processing module is further used to fill the verification value into a preset position of the filled face data to generate target face data; The sending module is also used to send the target face data to the server.

13. A remote identity authentication device, characterized in that: Applied to a server, the device comprises: A processing module, used for creating a public-private key pair when a terminal device runs a preset application, and sending a public key in the public-private key pair to the terminal device; a receiving module, configured to receive a remote identity authentication request sent by the terminal device, and to send a first message information to the terminal device according to the remote identity authentication request, wherein the first message information includes an encrypted first random factor and an encrypted information acquisition request, wherein the first random factor is used to decrypt the encrypted information acquisition request, and the information acquisition request is used to obtain user information to be authenticated; The receiving module is further used to receive second message information returned by the terminal device, the second message information includes an encrypted second random factor and encrypted user information to be authenticated, and the second random factor is used to decrypt the encrypted user information to be authenticated; The processing module is further used to decrypt the second message information by using the private key in the public-private key pair, and if the decryption is successful, authenticate the user information to be authenticated obtained by decryption; A sending module, used to send an obfuscation sequence to a terminal device when the authentication is passed, wherein the obfuscation sequence includes a plurality of filling positions and a corresponding number of filling characters; The receiving module is further used to receive the target face data of the user to be authenticated sent by the terminal device; The processing module is further used to delete the padding characters in the target face data and the verification value corresponding to the preset position according to the obfuscation sequence and the preset position, so as to obtain the face data; The processing module is further used to verify whether the facial data has been tampered with according to the verification value; The processing module is further used to perform identity authentication based on the facial data and standard facial data corresponding to the user to be authenticated, and generate an authentication result if the facial data has not been tampered with.

14. A terminal device, comprising: A processor, a transceiver, a memory, and computer program instructions stored in the memory and executable on the processor, wherein the processor is used to implement the remote identity authentication method as described in any one of claims 1 to 3 when executing the computer program instructions.

15. A server, comprising: A processor, a transceiver, a memory, and computer program instructions stored in the memory and executable on the processor, wherein the processor is used to implement the remote identity authentication method as described in any one of claims 4 to 11 when executing the computer program instructions.

16. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the remote identity authentication method according to any one of claims 1 to 3 or claims 4 to 11.

Images