Identity authentication method and device, storage medium and electronic equipment

Abstract

Embodiments of the present application disclose an identity authentication method and device, a storage medium and an electronic device. The method comprises obtaining an authentication request of an application program, the authentication request comprising an application program identifier; displaying an authentication information acquisition control, and in response to a triggering instruction of the authentication information acquisition control, obtaining user information; sending the user information and the application program identifier to an authentication server to trigger the authentication server to determine a target account level required according to the application program identifier; determining a current account corresponding to the user information according to an authentication result obtained by authenticating the user information; obtaining a target account according to the current account determination result and the target account level, and feeding back a target account obtaining result to the authentication applet; and displaying an authentication result according to the target account obtaining result. The embodiments of the present application realize decoupling of identity authentication and business, and reduce the maintenance difficulty of a business system and an identity authentication service.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to identity authentication methods, devices, storage media, and electronic devices. Background Technology

[0002] With the widespread adoption of mobile internet, an increasing number of businesses rely on unified identity authentication services. Sectors such as finance, credit reporting, banking, and government services all depend on unified identity authentication services to provide corresponding services to users. To adapt to the needs of different businesses, unified identity authentication services can adopt a front-end / back-end separation architecture, providing front-end pages for the specific needs of different business systems and back-end authentication services for these front-end pages. This architecture has a high degree of coupling with business systems; the front-end pages need to rely on components integrated and adapted by the business systems, and the increase in the types of front-end pages also leads to an increase in the types of components. When the authentication service is updated, these related components also need to be updated accordingly, which obviously increases the maintenance cost of business systems. This drawback becomes increasingly serious as the number of business systems relying on unified identity authentication services increases. Furthermore, the operation of the front-end pages depends on specific hardware devices, and compatibility issues between hardware devices and the authentication service may lead to authentication service failures, affecting the robustness of the unified identity authentication service and the stability of business systems. Summary of the Invention

[0003] To address at least one of the aforementioned technical problems, embodiments of this application provide an identity authentication method, apparatus, storage medium, and electronic device.

[0004] On one hand, embodiments of this application provide an identity authentication method applied to an authentication mini-program, the method comprising:

[0005] Obtain the application's authentication request, which includes the application identifier;

[0006] The system displays an authentication information retrieval control and retrieves user information in response to a trigger command on the authentication information retrieval control.

[0007] The user information and the application identifier are sent to the authentication server to trigger the authentication server to determine the required target account level based on the application identifier; the current account corresponding to the user information is determined based on the authentication result obtained by authenticating the user information; the target account is obtained based on the current account determination result and the target account level, and the target account retrieval result is fed back to the authentication applet.

[0008] Based on the results obtained from the target account, the authentication results are displayed.

[0009] On the other hand, embodiments of this application provide an identity authentication method, the method comprising:

[0010] The application generates an authentication request based on the application identifier and sends the authentication request to the authentication applet;

[0011] The authentication mini-program displays an authentication information retrieval control. In response to a trigger command on the authentication information retrieval control, it retrieves user information and sends the user information and the application identifier to the authentication server.

[0012] The authentication server performs authentication processing to obtain the target account; the authentication processing includes determining the required target account level based on the application identifier; determining the current account corresponding to the user information based on the authentication result obtained from authenticating the user information; and obtaining the target account based on the current account determination result and the target account level.

[0013] The authentication server sends the target account acquisition result back to the authentication mini-program;

[0014] The authentication mini-program retrieves the results based on the target account and displays the authentication results.

[0015] In one embodiment, the authentication server feeds back the target account acquisition result to the business server to trigger the business server to provide business services based on the target account acquisition result.

[0016] On the other hand, embodiments of this application provide an identity authentication device, the device comprising:

[0017] An authentication request acquisition module is used to acquire the authentication request of an application, wherein the authentication request includes an application identifier;

[0018] The control display module is used to display the authentication information acquisition control and, in response to the trigger command of the authentication information acquisition control, acquire user information;

[0019] The authentication server interaction module is used to send the user information and the application identifier to the authentication server to trigger the authentication server to determine the required target account level based on the application identifier; determine the current account corresponding to the user information based on the authentication result obtained by authenticating the user information; obtain the target account based on the current account determination result and the target account level; and send the target account acquisition result back to the authentication applet.

[0020] The authentication result display module is used to obtain the result based on the target account and display the authentication result.

[0021] On the other hand, embodiments of this application provide a computer-readable storage medium, characterized in that the computer-readable storage medium stores at least one instruction or at least one program, wherein the at least one instruction or at least one program is loaded and executed by a processor to implement the above-described authentication method.

[0022] On the other hand, embodiments of this application provide an electronic device, characterized in that it includes at least one processor and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the at least one processor implements the above-mentioned authentication method by executing the instructions stored in the memory.

[0023] This application provides an identity authentication method, apparatus, storage medium, and device. This application provides a unified identity authentication service to various business systems via an authentication mini-program as an interface, decoupling identity authentication from business operations, reducing the maintenance difficulty of both business systems and the identity authentication service. Furthermore, since the authentication mini-program runs on a mobile terminal, it reduces the impact of hardware differences in business systems on the identity authentication service, fully leveraging the high standardization, high integration, and low error rate of mobile terminal hardware modules to reduce the anomaly rate of the identity authentication service and improve its stability. Attached Figure Description

[0024] To more clearly illustrate the technical solutions and advantages in the embodiments of this application or related technologies, the drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 This is a schematic diagram of the interaction framework between the unified identity authentication platform and the business system in the related technologies provided in the embodiments of this application;

[0026] Figure 2 This is a schematic diagram of a feasible implementation framework for the identity authentication method provided in the embodiments of this application;

[0027] Figure 3 This is a schematic diagram of an optional structure of a distributed system applied to a blockchain system, as provided in an embodiment of this application.

[0028] Figure 4 This is a flowchart illustrating the identity authentication method provided in an embodiment of this application;

[0029] Figure 5This is a schematic diagram illustrating the startup of an authentication applet in a non-mobile terminal scenario, as provided in this application embodiment.

[0030] Figure 6 This is a schematic diagram illustrating the startup of an authentication mini-program running in a mobile terminal scenario, as provided in this application embodiment.

[0031] Figure 7 This is a schematic diagram of the display interface of the bio-information sensing control provided in the embodiments of this application;

[0032] Figure 8 This is a schematic diagram of an application login interface provided in an embodiment of this application;

[0033] Figure 9 This is a schematic diagram of the interaction flow of an identity authentication method provided in an embodiment of this application;

[0034] Figure 10 This is a schematic diagram of the identity authentication scheme architecture provided in the embodiments of this application;

[0035] Figure 11 This is a schematic diagram of the architecture of the unified identity authentication platform provided in the embodiments of this application;

[0036] Figure 12 This is a flowchart of a method for authentication processing based on a unified identity authentication platform provided in an embodiment of this application;

[0037] Figure 13 This is a schematic diagram of identity authentication interaction under certain circumstances in the login scenario provided in this application embodiment;

[0038] Figure 14 This is a block diagram of an identity authentication device provided in an embodiment of this application;

[0039] Figure 15 This is a block diagram of an identity authentication system provided in an embodiment of this application;

[0040] Figure 16 This is a schematic diagram of the hardware structure of a device for implementing the method provided in the embodiments of this application. Detailed Implementation

[0041] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of the embodiments of this application.

[0042] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of the embodiments of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the present application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes, methods, products, or devices.

[0043] To make the objectives, technical solutions, and advantages disclosed in the embodiments of this application clearer, the embodiments of this application will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are merely illustrative of the embodiments of this application and are not intended to limit the embodiments of this application.

[0044] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this embodiment, unless otherwise stated, "multiple" means two or more. To facilitate understanding of the above-described technical solutions and their resulting technical effects in the embodiments of this application, the embodiments of this application first explain the relevant technical terms:

[0045] Personal Computer (PC): A computer that can operate independently and perform specific functions without sharing the processing, disk, and printer resources of other computers.

[0046] APP: Application.

[0047] SDK: Software Development Kit.

[0048] Registration: After obtaining user information, the unified identity authentication service can register an account for the corresponding user.

[0049] Real-name registration: Users complete user registration by completing real-name authentication.

[0050] Real-person registration: Users complete user registration by completing real-person authentication.

[0051] Real-name login: Verify user identity information through real-name authentication to complete user login.

[0052] Real-person login: Verify user identity information through real-name authentication and real-person authentication to complete user login.

[0053] Real-person authentication: This involves performing liveness detection on the user, including but not limited to facial recognition, fingerprint scanning, and iris scanning. For example, the user's face can be compared with faces in a public account database, and real-person authentication can be completed based on the comparison result.

[0054] Real-name authentication: Verify the identity document information submitted by the user.

[0055] Real-name authentication combined with real-person authentication: Based on the user's liveness detection, verify whether the document information submitted by the user is the same person as the user.

[0056] In related technologies, each business unit can independently configure its corresponding authentication service. However, the authentication information obtained by this service is scattered across information silos within each business unit, resulting in problems such as redundant authentication information, low authentication convenience, and a low proportion of highly trusted real-name accounts. By building a unified identity authentication platform, combined with an authoritative database, a unified identity authentication service can be provided for all businesses.

[0057] In order to better reach users, business systems take on multiple forms to adapt to different hardware devices and front-end components. For example, users can log in to the business system via personal computers, mobile terminals, or all-in-one machines. Alternatively, users can log in via application software, authentication mini-programs, or web pages. This requires a unified identity authentication platform to support access to business systems across multiple carriers.

[0058] To support access from various business systems, the unified identity authentication platform can provide services to these systems through front-end and back-end frameworks. Please refer to [reference needed]. Figure 1 The diagram illustrates the interaction framework between a unified identity authentication platform and a business system in related technologies. The unified identity authentication platform can interface with business systems running on various hardware environments, requiring each business system to integrate corresponding components. For example, if business system A provides services to users via personal computers, it needs to integrate PC-side components; if business system N provides services to users via all-in-one machines, it needs to integrate all-in-one machine components. This integration of components by business systems results in a high degree of coupling between the business systems and the unified identity authentication platform. Updates to the unified identity authentication platform may require corresponding updates to the compatible components of each business system, leading to maintenance difficulties.

[0059] Furthermore, with the development of technology, identity authentication services increasingly rely on the collection of biometric information. The biometric information collection modules vary significantly across different hardware environments. For example, the logic related to face collection in all-in-one machines and that in mobile terminals may not be compatible. For instance, taking face information collection on a PC as an example, the brands, models, and technical standards of PC cameras differ greatly, leading to a higher probability of collection failure compared to mobile terminals. All-in-one machines also exhibit this issue, resulting in a higher failure rate for authentication services in some hardware devices.

[0060] To reduce the coupling between the unified identity authentication platform and business systems, and to improve the success rate of authentication in various hardware environments, this application provides an identity authentication method. This method can provide unified identity authentication services for various business systems in various hardware environments based on an authentication mini-program, thus decoupling the business systems and the identity authentication service. Furthermore, since the authentication mini-program runs on a mobile terminal, it can leverage the high success rate of biometric information collected by the mobile terminal to improve the authentication success rate and avoid authentication failures caused by changes in the hardware environment.

[0061] Please see Figure 2 , Figure 2 This is a schematic diagram illustrating a feasible implementation framework for the identity authentication method provided in the embodiments of this specification, such as... Figure 2 As shown, the implementation framework may include at least an application client 01, an authentication server 02, and at least one business server 03.

[0062] In one scenario, the application client 01 can be a mobile terminal that runs an application and launches an authentication mini-program through the application. This mini-program then communicates with the authentication server 02 to provide authentication services to the application and displays the authentication result. After successful authentication, the application can display a service interface to the user to provide subsequent services.

[0063] In another scenario, the application client 01 can also be any physical device with communication and display capabilities, such as a desktop computer, tablet, laptop, digital assistant, or smart wearable device, and may also include software running on the physical device. In this scenario, the implementation framework also includes an authentication client 04, which is a mobile terminal. The application client 01 can run an application program, which displays an authentication mini-program code. The authentication client 04 scans the authentication mini-program code to launch the authentication mini-program, which then provides authentication services to the application program through communication with the authentication server 02 and displays the authentication result. After successful authentication, the application program in the application client 01 can display a service interface to the user to provide subsequent services.

[0064] Specifically, the authentication mini-program can obtain the authentication request of the application, which includes the application identifier; display an authentication information retrieval control, and in response to a trigger instruction on the authentication information retrieval control, obtain user information; send the user information and the application identifier to the authentication server to trigger the authentication server to determine the required target account level based on the application identifier; determine the current account corresponding to the user information based on the authentication result obtained from authenticating the user information; obtain the target account based on the current account determination result and the target account level, and provide feedback on the target account retrieval result to the authentication mini-program; and display the authentication result based on the target account retrieval result.

[0065] Both authentication server 02 and business server 03 can be a standalone server, a distributed server, or a server cluster consisting of multiple servers. Authentication server 02 and at least one business server 03 can include network communication units, processors, and memory, etc. Authentication server 02 can also transmit the target account acquisition result to business server 03 to trigger business server 03 to provide subsequent services based on the target account acquisition result.

[0066] In one embodiment, the authentication server 02 described above can support various scalable business systems in the form of a cloud and provide them with identity authentication services. This specification does not limit the specific form of the cloud, which can be a private cloud, a public cloud, or a hybrid cloud.

[0067] Private cloud refers to cloud infrastructure and hardware / software resources created within a firewall, allowing various departments within an organization or enterprise to share resources within a data center. Besides hardware resources, creating a private cloud typically involves cloud equipment (IaaS, Infrastructure as a Service) software. Public cloud, on the other hand, usually refers to a cloud provided by a third-party provider to users. Public clouds are generally accessible via the Internet and may be free or inexpensive. The core attribute of a public cloud is shared resource services. Many instances of this type of cloud exist, providing services across today's open public networks. Hybrid cloud combines public and private clouds and has become a major model and development direction of cloud computing in recent years. Private clouds primarily cater to enterprise users. For security reasons, enterprises prefer to store data in private clouds but simultaneously desire access to public cloud computing resources. Hybrid clouds are increasingly adopted in this context, combining and matching public and private clouds to achieve optimal results. This personalized solution achieves both cost-effectiveness and security.

[0068] In this embodiment of the application, the authentication server 02 can also provide identity authentication services to the business server 03 by communicating with a relevant database. The relevant database can be stored in a blockchain, and the data in the authentication server 02 can also be stored in a blockchain.

[0069] Blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. Essentially, a blockchain is a decentralized database, a chain of data blocks linked together using cryptographic methods. Each data block contains information about a batch of network transactions, used to verify the validity of the information (anti-counterfeiting) and to generate the next block.

[0070] Taking a distributed system as an example, see blockchain system. Figure 3 , Figure 3This is an optional structural diagram of a distributed system applied to a blockchain system, provided by an embodiment of the present invention. It consists of multiple nodes (any form of computing device connected to the network, such as servers or user terminals) and clients. These nodes form a peer-to-peer (P2P) network. The P2P protocol is an application layer protocol running on top of the Transmission Control Protocol (TCP). In the distributed system, any machine, such as a server or terminal, can join and become a node. A node includes a hardware layer, a middleware layer, an operating system layer, and an application layer.

[0071] See Figure 3 The functions of each node in the blockchain system shown include:

[0072] 1) Routing: A basic function of nodes used to support communication between nodes.

[0073] In addition to routing capabilities, nodes can also have the following functions:

[0074] 2) Applications are deployed in the blockchain to implement specific business needs. They record data related to the implementation of functions to form record data, carry digital signatures in the record data to indicate the source of the task data, and send the record data to other nodes in the blockchain system. When other nodes successfully verify the source and integrity of the record data, they add the record data to a temporary block.

[0075] 3) A blockchain consists of a series of blocks that are sequentially generated. Once a new block is added to the blockchain, it will not be removed. The blocks contain the data submitted by the nodes in the blockchain system.

[0076] For ease of description, the following describes an identity authentication method provided in this application embodiment, using the client running the authentication applet as the execution subject. This specification provides the method operation steps as described in the embodiments or flowcharts, but based on conventional or non-inventive labor, more or fewer operation steps may be included. The order of steps listed in the embodiments is merely one possible execution order among many steps and does not represent the only execution order. In actual system or server product execution, the method can be executed sequentially according to the embodiments or accompanying drawings, or in parallel (e.g., in a parallel processor or multi-threaded processing environment).

[0077] Please see Figure 4 This illustrates a flowchart of an identity authentication method provided in an embodiment of this application. Figure 4 As shown, this method, applied to the authentication of a mini-program, can include:

[0078] S101. Obtain the application's authentication request, which includes the application identifier.

[0079] This application does not specifically limit the application. It can be a client program of an organization's (government / enterprise) business system. These client programs can be public welfare applications such as "housing provident fund service", "health code service" and "transportation card service", or highly sensitive applications such as "salary inquiry" and "bank transfer", or ordinary applications.

[0080] In this embodiment, the mini-program can run dependent on a host program. Users only need to install the host program to add and use various mini-programs at any time. The aforementioned authentication mini-program is such a mini-program; for example, it can be an enterprise WeChat authentication mini-program, a WeChat authentication mini-program, or a QQ authentication mini-program. In this application, the authentication mini-program can run on a mobile terminal. By running the authentication mini-program on the aforementioned mobile terminal, a unified identity authentication service can be provided for various business systems. These business systems can include applications for interacting with users and business servers for interacting with those applications. The authentication logic of different business systems may differ; corresponding authentication services can be provided by obtaining the application identifier in the authentication request.

[0081] In one embodiment, the application runs on a non-mobile terminal, such as a desktop computer, tablet, laptop, digital assistant, smart wearable device, or other physical device with communication and display capabilities. The application generates an authentication mini-program code based on user actions triggering relevant controls on its interface and displays this code on the application's screen. The user scans the authentication mini-program code using a host application on a mobile terminal capable of running the authentication mini-program. Based on the host application's parsing of the code, the user launches the authentication mini-program within the host application. Please refer to [reference needed]. Figure 5 This illustrates the startup diagram of the authentication mini-program running in a non-mobile terminal scenario. It can be displayed on non-mobile terminals (such as PCs). Figure 5 The authentication mini-program code shown can be scanned by the user's mobile device within the host application to launch the corresponding authentication mini-program.

[0082] In another embodiment, the application runs on a mobile terminal, allowing the authentication applet to be launched directly from the application. Please refer to [link / reference]. Figure 6 This diagram illustrates the startup of the authentication mini-program when the application runs on a mobile terminal. The authentication mini-program can be directly launched from the application on the mobile terminal to enter the authentication mini-program's display interface.

[0083] In this embodiment, under different operating environments, the authentication mini-program can be launched to enter the identity authentication interface and complete the subsequent authentication process. The authentication mini-program uniformly provides authentication services for various applications in various operating environments, decoupling the application from the authentication service, shielding the differences in front-end diversity, and reducing the maintenance difficulty of the application.

[0084] S102. Display the authentication information acquisition control, and in response to the trigger command of the above authentication information acquisition control, acquire user information.

[0085] If the authentication mini-program has a camera or photo-taking function, it can be used to collect the user's facial image information. It can also collect iris information, fingerprint information, retinal information, or palm print information to characterize specific user attributes. If the authentication mini-program has a voice recognition function, it can also be used to collect the user's voiceprint information, voice information, etc. It should be understood that in practical applications, user information, in addition to the facial image information, iris information, fingerprint information, retinal information, palm print information, voiceprint information, or voice information described above, may also include information such as body shape. Specific details are not limited in this embodiment.

[0086] In this embodiment, the display interface of the authentication mini-program may include an authentication information retrieval control. The specific form of this control is not limited; it can be a unified authentication information retrieval control adapted to various applications, or it can be an authentication information retrieval control obtained according to the application identifier. The authentication information retrieval control in the display interface of the authentication mini-program may include a user information control. The display interface may display a single user information retrieval control or a combination of multiple user information retrieval controls.

[0087] In one embodiment, the above-mentioned response to the trigger instruction of the above-mentioned authentication information acquisition control to acquire user information includes:

[0088] S1021. If the above-mentioned user information acquisition control is a biological information shooting control, then in response to the trigger command of the above-mentioned biological information shooting control, the camera module is invoked, and the above-mentioned user information is determined based on the shooting result of the above-mentioned camera module.

[0089] If the user information acquisition control is a biometrics capture control, clicking the biometrics capture control can trigger the camera module, which can then capture user information. In this embodiment, applications running on various hardware devices can perform identity authentication through an authentication mini-program running on the mobile terminal. Therefore, the authentication mini-program only needs to be compatible with the camera module in the mobile terminal environment to ensure its successful startup, thereby reducing the probability of camera module startup failure due to the diversification of hardware devices and improving the authentication success rate.

[0090] S1022. If the above-mentioned user information retrieval control is a text box control, then the information entered in the above-mentioned text box is determined as the above-mentioned user information.

[0091] S1023. If the above-mentioned user information acquisition control is a bio-information sensing control, then the bio-information sensing module is activated in response to the trigger command of the above-mentioned bio-information sensing control, and the above-mentioned user information is determined based on the output result of the above-mentioned bio-information sensing module.

[0092] Please refer to Figure 7 It shows a schematic diagram of the display interface of the bio-information sensing control. Figure 7 The user information acquisition control is a biometric sensing control. Clicking this control triggers a biometric sensing module, such as a fingerprint module, to obtain fingerprint information. Many hardware devices in related technologies have not yet integrated biometric sensing controls, thus limiting the implementation of identity recognition schemes based on biometric sensing controls. In this embodiment, applications running on various hardware devices can perform identity authentication through an authentication applet running on a mobile terminal. Therefore, an identity authentication scheme relying on biometric sensing controls can be implemented, improving authentication security.

[0093] In one embodiment, this specification embodiment may also display a corresponding authentication method acquisition control based on the specific authentication method. "Personal Login" is one such authentication method acquisition control. If a user clicks "Personal Login" and personal login requires facial recognition, a facial recognition control can be displayed accordingly. By displaying the corresponding user information acquisition control based on the user's choice of authentication method, the adaptability of the identity authentication service to different user needs can be improved. In one embodiment, this specification embodiment may also display a corresponding authentication method acquisition control and authentication information acquisition control based on the application identifier. For example, if the application identifier is 01, then "Personal Login" and "Legal Person Login" will be displayed. After the user selects a login method, the corresponding authentication information acquisition control will be displayed.

[0094] S103. Send the above user information and the above application identifier to the authentication server to trigger the authentication server to determine the required target account level based on the above application identifier; determine the current account corresponding to the above user information based on the authentication result obtained by authenticating the above user information; obtain the target account based on the current account determination result and the above target account level, and send the target account acquisition result back to the above authentication applet.

[0095] In this embodiment, the authentication applet sends the obtained user information and application identifier to the authentication server to obtain the target account acquisition result. In this embodiment, each application can provide services to the user based on the account provided by the unified identity authentication platform. The target account acquisition result can be considered the authentication result output by the unified identity authentication platform. If authentication fails, the target account cannot be output, and the application cannot provide the corresponding service to the user. Conversely, the application can provide the corresponding service to the user based on the target account. The specific authentication process will be detailed below on the authentication server side and will not be repeated here.

[0096] In one embodiment, the authentication mini-program can not only obtain user information, but also transmit relevant information transmitted by the application to the authentication mini-program as part of the user information to the authentication server. Please refer to [link / reference]. Figure 8 The diagram illustrates an application login interface. Users can enter relevant information (phone number, verification code) on the login interface to trigger a facial recognition login button, launching an authentication mini-program. The application can then input this information into the authentication mini-program, which in turn can transmit this information as user information to the authentication server.

[0097] In one embodiment, the authentication server can feed back the target account retrieval result to the corresponding business server of the application based on the obtained application identifier. The business server can then provide a service interface to the application based on the target account retrieval result. For example, if the target account retrieval result indicates authentication failure, the service interface can display "authentication failed," or it can also display the reason for the authentication failure. Conversely, the service interface can display a welcome message for the user and specific service content.

[0098] S104. Based on the results obtained from the target account mentioned above, display the authentication results.

[0099] In this embodiment, if the result of obtaining the target account indicates that authentication has failed, an authentication failure interface is displayed; otherwise, an authentication success interface is displayed. In one embodiment, after successful authentication, if the application is also running on a mobile terminal, the authentication applet can automatically redirect back to the application, which will then display the corresponding service interface.

[0100] Please see Figure 9 This illustrates a schematic diagram of the interaction flow of an identity authentication method provided in an embodiment of this application. For example... Figure 9 As shown, this method is applied to a system consisting of an authentication server, an application, and an authentication applet, and the method may include:

[0101] S201. The application generates an authentication request based on the application identifier and sends the authentication request to the authentication applet.

[0102] In one embodiment, if the application runs on a mobile terminal, the application triggers the launch of the authentication mini-program on the mobile terminal; wherein, the application is the main program or a mini-program running on the main program. For example, the main program could be WeChat, and the application could be a mini-program running on WeChat.

[0103] If the above application is running on a fixed terminal, an authentication mini-program code is displayed on the interface of the application, and the authentication mini-program is launched based on the authentication mini-program code; wherein the fixed terminal is a personal computer or an all-in-one machine.

[0104] In this embodiment of the application, the authentication request can be issued directly in response to the user's trigger command on a certain control, or it can be issued based on a related request. For example, if the user issues a login request or a request to modify information, it may be necessary to authenticate the user's identity. The application issues the authentication request in response to the login request or the request to modify information.

[0105] S202. The aforementioned authentication applet displays an authentication information retrieval control, and in response to a trigger command on the aforementioned authentication information retrieval control, retrieves user information; and sends the aforementioned user information and the aforementioned application identifier to the authentication server.

[0106] In one embodiment, the authentication mini-program can send user information, application identifier, and authentication request type to the aforementioned authentication server.

[0107] S203. The authentication server performs authentication processing to obtain the target account; the authentication processing includes determining the required target account level based on the application identifier; determining the current account corresponding to the user information based on the authentication result obtained from authenticating the user information; and obtaining the target account based on the current account determination result and the target account level.

[0108] Business systems are complex, and the corresponding target account levels can vary. Some services can provide services to lower-level target accounts, while others can only provide services to higher-level target accounts. For example, higher security requirements correspond to higher target account levels. Financial services can have a target account level of three, parking services can have a target account level of one, payment services can have a target account level of four, and city service services can have a target account level of two. The required target account level for a given service can be determined based on the application identifier.

[0109] This application does not elaborate on the meaning of authentication in its embodiments. The above-mentioned authentication of user information includes: verifying whether the user information matches and verifying whether the user information is authentic. In one embodiment, if the user information includes an ID card number and a facial image, it is verified whether the facial image has a corresponding target face in the facial information database. If it does not exist, the user information is determined to be authentic, and authentication fails. If it exists, it is determined whether the target ID card number corresponding to the target face matches the aforementioned ID card number. If they do not match, authentication fails; if they match, authentication succeeds. In another embodiment, if the user information includes a username, password, and facial image, it is verified whether the facial image has a corresponding target face in the facial information database. If it does not exist, the user information is determined to be authentic, and authentication fails. If it exists, it is determined whether the username, password, and target face match. If they do not match, authentication fails; if they match, authentication succeeds.

[0110] Once authentication is successful, the current account corresponding to the user information can be determined based on the authentication result. If the user has never authenticated, the current account can be empty. Otherwise, the user's current account can be obtained, which can be considered a unique identifier for the user. The account level can be determined based on the authentication results. If authentication fails, a message will be sent indicating that a valid current account cannot be obtained.

[0111] In one feasible embodiment, if the current account has been authorized by a trusted third-party application, its corresponding account level is level two. The current account reaches level three after passing real-name verification, and level four after passing both real-name verification and real-person verification. The trusted third-party application can be WeChat or WeChat Work; this embodiment does not limit its application.

[0112] If authentication fails, the above current account determination result indicates that a legitimate current account cannot be obtained, and correspondingly, the target account acquisition result indicates that the target account cannot be obtained.

[0113] If authentication is successful, and the current account determination result indicates that no current account exists, a target account adapted to the target account level is generated based on the interaction with the authentication mini-program. In one embodiment, if the target account level is level two, the authentication mini-program can display an authorization control for a trusted third-party application. The user obtains the target account by triggering this control. This target account is authorized by the trusted third-party application and its account level is level two.

[0114] If the current account determination result indicates that the current account's level is lower than the target account's level, then the current account is verified based on the interaction with the authentication mini-program, and a target account adapted to the target account's level is obtained based on the verification result. In one embodiment, if the target account's level is level two and the target account's level is level three, the user can be verified using the authentication mini-program. After the verification is successful, the current account's level is upgraded to level three, and the current account is identified as the target account.

[0115] If the current account determination result indicates that the level of the current account is greater than or equal to the level of the target account, then the current account will be determined as the target account.

[0116] S204. The aforementioned authentication server sends the target account retrieval result back to the aforementioned authentication mini-program.

[0117] S205. The aforementioned authentication mini-program obtains the results based on the target account and displays the authentication results.

[0118] In this embodiment of the application, if the target account acquisition result indicates that the target account does not exist, it indicates that the authentication failed and an authentication failure interface is displayed; otherwise, an authentication success interface is displayed.

[0119] In one embodiment, the above authentication method may further include:

[0120] S206. The authentication server sends the results obtained from the target account to the business server.

[0121] S207. The aforementioned business server determines the corresponding business service based on the result obtained from the aforementioned target account, and sends the business service determination result back to the aforementioned application.

[0122] S208. The above application determines the result based on the above business service and displays the corresponding interface.

[0123] Please refer to Figure 10This document illustrates a schematic diagram of the identity authentication scheme architecture in an embodiment of this application. Supported by a backend authentication server, the authentication mini-program can provide a unified interface to the front-end applications of various business systems, shielding them from differences. When the unified identity authentication platform updates its functionality, the authentication mini-program in this embodiment updates accordingly, while the business systems do not require corresponding updates, thus decoupling the business systems from the unified identity authentication platform. The authentication mini-program is lightweight, virtually imperceptible to users, and does not degrade the user experience. Running on mobile terminals with minimal hardware differences, the authentication mini-program also exhibits a low failure rate.

[0124] In one embodiment, the authentication mini-program and its backend authentication server can form a unified identity authentication platform, thereby providing various authentication services for different business systems. These systems can build polymorphic applications on their front-ends according to their own needs and access the unified identity authentication platform to enjoy the unified identity authentication services. The unified identity authentication platform provides unified account management and convenient real-name verification services for natural persons and legal entities using government / enterprise services. It records the basic and extended information of real-name accounts of natural persons or legal entities, enabling any user to log in to various business systems using only one account on any terminal.

[0125] Please refer to Figure 11 The diagram illustrates the architecture of the unified identity authentication platform. This platform comprises five logical layers, with the authentication mini-program residing in its presentation layer.

[0126] The unified identity authentication platform described above rests on an infrastructure layer, which includes computing resource pools, storage resource pools, and network resource pools. Directly above the infrastructure layer is the data layer, which is categorized into natural person account databases, legal person account databases, and other account databases based on business needs. The data layer can access relevant authoritative population and legal person data as sources for account real-name verification, forming a high-quality, high-standard account database.

[0127] The functional layer directly above the data layer includes a natural person authentication platform, a legal person authentication platform, and authentication interface sub-platforms, providing various services to natural persons and legal persons. The service layer, with identity authentication at its core, integrates various services such as natural person and legal person registration, user login, and real-name verification through an API (Application Programming Interface) gateway, forming a unified authentication platform standard service. Individual business systems do not need to concern themselves with the internal logic of the unified authentication platform; they only need to apply for and use the corresponding services according to their business needs. For natural persons, the unified authentication platform standard service can include functions such as registration, login, verification, password retrieval, and personal information maintenance; for legal persons, the unified authentication platform standard service can include functions such as registration, login, verification, password retrieval, maintenance of legal person information, and management of authorized persons; depending on the needs of each business system, services such as registration, login, and verification can include multiple methods. For example, login can include account password, third-party application authorization login, application QR code login, etc. Verification can be carried out through the internal of the organization (government / enterprise) or through external authoritative (public security, industry and commerce, etc.) authentication sources for real-name authentication.

[0128] Please refer to Figure 12 It illustrates a flowchart of a method for authentication processing based on a unified identity authentication platform, including:

[0129] S2031. Obtain the above-mentioned request type sent by the above-mentioned authentication applet.

[0130] This application does not limit the specific content of the request type. It can be the request type corresponding to various services supported by the unified identity authentication platform mentioned above. For example, it can be registration, login, verification, etc.

[0131] S2032. Based on the above request type, determine the target service in the above service layer, wherein the target service is a service that is compatible with the above request type.

[0132] The target service is compatible with the above request types. For example, if the request type is registration, then the registration service is the target service. If the request type is verification, then the verification service is the target service.

[0133] S2033. Based on the above user information, determine the target platform in the above functional layer, and the target platform is used to provide the above target service adapted to the above user information.

[0134] The target platform can be determined based on user information. For example, if the user information is personal information, then the target platform can be a natural person authentication platform. If the user information is legal person information, then the target platform can be a legal person authentication platform.

[0135] S2034. Based on the above user information, a target account database is determined in the above data layer. The target account database is used to provide account data adapted to the above user information.

[0136] The target account database can be determined based on user information. For example, if the user information is personal information, then the target account database can be a database of natural person accounts. If the user information is legal person information, then the target account database can be a database of legal person accounts.

[0137] S2035. Relying on the aforementioned infrastructure layer, the aforementioned target platform runs the aforementioned target service based on the aforementioned user information and the aforementioned target account database, performs the aforementioned authentication process in the aforementioned target service, and obtains the aforementioned target account.

[0138] The process of obtaining the target account in this embodiment can be found above and will not be repeated here.

[0139] The identity authentication method provided in this application embodiment can uniformly provide identity authentication services to various business systems through an authentication mini-program as the interface, thereby decoupling identity authentication from business operations, reducing the maintenance difficulty of both business systems and the identity authentication service. Furthermore, since the authentication mini-program runs on a mobile terminal, it can reduce the impact of differences in the hardware running on business systems on the identity authentication service. It fully leverages the high standardization, high integration, and low error rate of mobile terminal hardware modules to reduce the anomaly rate of the identity authentication service and improve its stability.

[0140] Based on steps S201-S205, this application embodiment provides a specific interaction example. Please refer to... Figure 13 It illustrates a schematic diagram of identity authentication interaction in a certain scenario during login.

[0141] First, the user initiates a login request through the application interface. The application then launches an authentication mini-program in response. On the authentication mini-program's interface, the user can select a login method. For example, if the user chooses personal login, facial recognition can be performed based on the authentication mini-program, which then obtains the user's facial information.

[0142] Second, the authentication mini-program transmits the obtained user information (including facial information) to the unified identity authentication platform backend (authentication server) for authentication. If the authentication is successful, it checks whether a current account that meets the application's requirements exists. For example, if the application requires a level four account, it checks whether a current account at level four or above exists.

[0143] Third, if no target account exists, the authentication mini-program interacts with the user to obtain a qualified target account. For example, the authentication mini-program can prompt the user to enter their mobile phone number and verify its validity. Once the user enters their mobile phone number and verification code and passes the verification, a target account can be generated for the user. If a target account already exists, that current account will be used as the target account.

[0144] Fourth, the authentication result for the target account is reported back to the authentication mini-program and the business server. The authentication mini-program can display the corresponding authentication result interface, and can also redirect back to the application, which will provide follow-up services.

[0145] The identity authentication method provided in this application embodiment allows the authentication server to encapsulate authentication logic under various circumstances, enabling unified management of corresponding accounts for users. Each business system can then provide corresponding services to users based on these accounts. This eliminates the need for each business system to manage user accounts, completely decoupling identity authentication from the specific business operations of the business system. This facilitates the provision of highly secure and diversified identity authentication services to the business system and reduces the management burden on the business system.

[0146] This application also discloses an identity authentication device, such as... Figure 14 As shown, the above-mentioned device includes:

[0147] The authentication request acquisition module 10 is used to acquire the authentication request of the application, wherein the authentication request includes the application identifier;

[0148] The control display module 20 is used to display the authentication information acquisition control and to acquire user information in response to the trigger command of the authentication information acquisition control.

[0149] The authentication server interaction module 30 is used to send the aforementioned user information and application identifier to the authentication server to trigger the authentication server to determine the required target account level based on the application identifier; determine the current account corresponding to the aforementioned user information based on the authentication result obtained from authenticating the aforementioned user information; obtain the target account based on the current account determination result and the aforementioned target account level; and provide feedback on the target account acquisition result to the authentication applet.

[0150] The authentication result display module 40 is used to obtain the result based on the target account mentioned above and display the authentication result.

[0151] Specifically, the identity authentication device and the corresponding method embodiment of the aforementioned authentication applet disclosed in this application are both based on the same inventive concept. For details, please refer to the method embodiment; further elaboration will not be repeated here.

[0152] This application also discloses an identity authentication system, such as... Figure 15As shown, the above system includes an application client 100, an authentication mini-program client 200, and an authentication server 300;

[0153] The aforementioned application terminal 100 is used to generate an authentication request based on the application identifier and send the authentication request to the aforementioned authentication applet terminal 200;

[0154] The aforementioned authentication applet 200 is used to display an authentication information acquisition control, and in response to a trigger command on the aforementioned authentication information acquisition control, acquires user information; and sends the aforementioned user information and the aforementioned application identifier to the aforementioned authentication server 300;

[0155] The authentication server 300 is used to perform authentication processing to obtain a target account; the authentication processing includes determining the required target account level based on the application identifier; determining the current account corresponding to the user information based on the authentication result obtained from authenticating the user information; and obtaining the target account based on the current account determination result and the target account level.

[0156] The aforementioned authentication server 300 is also used to send the target account acquisition result back to the aforementioned authentication applet 200;

[0157] The aforementioned authentication mini-program 200 is also used to obtain results based on the target account and display the authentication results.

[0158] Specifically, the identity authentication system disclosed in this application and the corresponding method embodiments are both based on the same inventive concept. For details, please refer to the method embodiments, which will not be repeated here.

[0159] This application also provides a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the aforementioned authentication method.

[0160] This application also provides a computer-readable storage medium that can store multiple instructions. These instructions are adaptable for a processor to load and execute the authentication method described in this application.

[0161] Furthermore, Figure 16 A schematic diagram of a hardware structure for implementing the method provided in the embodiments of this application is shown. This device can participate in or include the apparatus or system provided in the embodiments of this application. Figure 16As shown, device 10 may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 16 The structure shown is for illustrative purposes only and does not limit the structure of the electronic device described above. For example, device 10 may also include a... Figure 16 The more or fewer components shown, or having the same Figure 16 The different configurations shown.

[0162] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the device 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0163] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the method described in the embodiments of this application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the aforementioned identity authentication method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the device 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0164] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of device 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a radio frequency (RF) module used for wireless communication with the Internet.

[0165] The display may be, for example, a touchscreen liquid crystal display (LCD) that allows a user to interact with the user interface of device 10 (or a mobile device).

[0166] It should be noted that the order of the embodiments described above is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. Furthermore, the above description focuses on specific embodiments of this application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims can be performed in a different order than that shown in the embodiments and still achieve the desired result. Additionally, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some implementations, multitasking and parallel processing are also possible or may be advantageous.

[0167] The embodiments in this application are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the device and server embodiments are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0168] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0169] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present application should be included within the protection scope of the present application.

Claims

1. An identity authentication method, characterized in that, Applied to authentication mini-programs, the method includes: Obtain the application's authentication request, which includes the application identifier; The system displays an authentication information retrieval control and retrieves user information in response to a trigger command on the authentication information retrieval control. The user information and the application identifier are sent to the authentication server to trigger authentication. The authentication process verifies whether the user information matches and whether it is authentic. If authentication is successful, the user's current account is obtained. If the current account has been authorized by a trusted third-party application, its account level is level two. If the current account has passed real-name verification, its account level is level three. If the current account has passed real-name verification and joint real-person verification, its account level reaches level four. If the current account's account level is greater than or equal to the target account level, the current account is identified as the target account, and the target account retrieval result is obtained. The target account level is determined based on the application identifier, which indicates the security requirements of the business corresponding to the application. Different security requirements correspond to different target account levels, and different account levels require different authorization or verification methods. The target account retrieval result is also fed back to the authentication mini-program. The authentication server provides multiple authentication services for various business systems, allowing one account to log in to various business systems. Based on the target account, the authentication result is displayed.

2. The method according to claim 1, characterized in that, The method further includes: Based on the host application's parsing of the authentication mini-program code, the authentication mini-program is launched in the host application; wherein, the authentication mini-program code is displayed on the interface of the application, and the host application provides the runtime environment for the authentication mini-program; or, The authentication applet is launched by the application.

3. The method according to claim 1 or 2, characterized in that, The authentication information acquisition control includes a user information acquisition control. The step of acquiring user information in response to a trigger command on the authentication information acquisition control includes: If the user information acquisition control is a bio-information shooting control, then in response to the trigger command of the bio-information shooting control, the camera module is invoked, and the user information is determined based on the shooting result of the camera module; If the user information retrieval control is a text box control, then the information entered in the text box is determined as the user information; If the user information acquisition control is a bio-information sensing control, then the bio-information sensing module is activated in response to the trigger command of the bio-information sensing control, and the user information is determined based on the output result of the bio-information sensing module.

4. The method according to claim 3, characterized in that, The authentication information acquisition control also includes an authentication method acquisition control. Before acquiring user information in response to a trigger instruction on the authentication information acquisition control, the method further includes: displaying the corresponding user information acquisition control in response to a trigger instruction on the authentication method acquisition control.

5. The method according to claim 1, characterized in that, The method further includes: If the current account does not exist, a target account adapted to the target account level will be generated based on the interaction with the authentication mini-program; If the account level corresponding to the current account is lower than the target account level, the current account is verified based on the interaction with the authentication mini-program, and the target account that is adapted to the target account level is obtained according to the verification result.

6. An identity authentication method, characterized in that, The method includes: The application generates an authentication request based on the application identifier and sends the authentication request to the authentication applet; The authentication mini-program displays an authentication information retrieval control. In response to a trigger command on the authentication information retrieval control, it retrieves user information and sends the user information and the application identifier to the authentication server. The authentication server performs authentication, and the authentication instruction verifies whether the user information matches and whether the user information is authentic. If the authentication is successful, the current account corresponding to the user is obtained. If the current account has been authorized by a trusted third-party application, its corresponding account level is level two. If the current account has passed real-name verification, its corresponding account level is level three. If the current account has passed real-name verification and joint real-person verification, its corresponding account level reaches level four. If the account level corresponding to the current account is greater than or equal to the target account level, the current account is identified as the target account, and the target account acquisition result is obtained; wherein, the target account level is determined based on the application identifier, which is used to indicate the security requirements of the business corresponding to the application; different security requirements of the business correspond to different target account levels, and different account levels require different authorization or verification methods to achieve; the authentication server is used to provide multiple authentication services for various business systems, and one account can be used to log in to various business systems; The authentication server sends the target account acquisition result back to the authentication mini-program; The authentication mini-program retrieves the results based on the target account and displays the authentication results.

7. The method according to claim 6, characterized in that: Before the application generates an authentication request based on the application identifier and sends the authentication request to the authentication mini-program, the method further includes: If the application is running on a mobile terminal, the application triggers the launch of the authentication mini-program on the mobile terminal; wherein, the application is the main program or a mini-program running on the main program; If the application is running on a fixed terminal, an authentication mini-program code is displayed on the application's interface, and the authentication mini-program is launched based on the authentication mini-program code; wherein, the fixed terminal is a personal computer or an all-in-one machine; The authentication server comprises a service layer, a functional layer, a data layer, and an infrastructure layer; wherein, the service layer includes registration service, login service, and verification service; the functional layer includes a natural person authentication platform, a legal person authentication platform, and an authentication docking sub-platform; the data layer includes a natural person account database, a legal person account database, and other account databases; and the infrastructure layer includes a computing resource pool, a storage resource pool, and a network resource pool. The authentication request includes a request type, and the authentication server performs the following operations: Obtain the request type sent by the authentication mini-program; Based on the request type, a target service is determined in the service layer, wherein the target service is a service that is compatible with the request type. Based on the user information, a target platform is determined in the functional layer, and the target platform is used to provide the target service adapted to the user information; Based on the user information, a target account database is determined in the data layer, and the target account database is used to provide account data adapted to the user information; Based on the infrastructure layer, the target platform runs the target service based on the user information and the target account database, and performs the authentication process in the target service to obtain the target account.

8. An identity authentication device, characterized in that, The device, used in authentication mini-programs, includes: An authentication request acquisition module is used to acquire the authentication request of an application, wherein the authentication request includes an application identifier; The control display module is used to display the authentication information acquisition control and, in response to the trigger command of the authentication information acquisition control, acquire user information; The authentication server interaction module is used to send the user information and the application identifier to the authentication server to trigger authentication. The authentication indicates whether the user information matches and whether the user information is authentic. If the authentication is successful, the current account corresponding to the user is obtained. If the current account has been authorized by a trusted third-party application, its corresponding account level is level two. If the current account has passed real-name verification, its corresponding account level is level three. If the current account has passed real-name verification and joint real-person verification, its corresponding account level reaches level four. If the account level corresponding to the current account is greater than or equal to the target account level, the current account is determined as the target account, and the target account acquisition result is obtained. The target account level is determined based on the application identifier, which is used to indicate the security requirements of the business corresponding to the application. Different security requirements correspond to different target account levels, and different account levels require different authorization or verification methods. The target account acquisition result is also fed back to the authentication applet. The authentication server is used to provide multiple authentication services for various business systems, and one account can log in to various business systems. The authentication result display module is used to obtain the result based on the target account and display the authentication result.

9. An identity authentication system, characterized in that, The system includes: an application client, an authentication mini-program client, and an authentication server; The application client is used to generate an authentication request based on the application identifier and send the authentication request to the authentication mini-program client; The authentication mini-program is used to display an authentication information retrieval control, and in response to a trigger command on the authentication information retrieval control, retrieves user information; and sends the user information and the application identifier to the authentication server. The authentication server is used for authentication. The authentication instruction verifies whether the user information matches and whether the user information is authentic. If the authentication is successful, the current account corresponding to the user is obtained. If the current account has been authorized by a trusted third-party application, its corresponding account level is level two. If the current account has passed real-name verification, its corresponding account level is level three. If the current account has passed real-name verification and joint real-person verification, its corresponding account level reaches level four. If the account level corresponding to the current account is greater than or equal to the target account level, the current account is identified as the target account, and the target account acquisition result is obtained; wherein, the target account level is determined based on the application identifier, which is used to indicate the security requirements of the business corresponding to the application; different security requirements of the business correspond to different target account levels, and different account levels require different authorization or verification methods to achieve; the authentication server is used to provide multiple authentication services for various business systems, and one account can be used to log in to various business systems; The authentication service is also used to provide feedback on the target account acquisition result to the authentication mini-program. The authentication mini-program is also used to obtain and display the authentication results based on the target account.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one instruction, which is loaded and executed by a processor to implement an authentication method as described in any one of claims 1 to 5, or an authentication method as described in claim 6 or 7.

11. An electronic device, characterized in that, The device includes at least one processor and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that are executed by the at least one processor, and the at least one processor implements an authentication method as described in any one of claims 1 to 5, or an authentication method as described in claim 6 or 7, by executing the instructions stored in the memory.

12. A computer program product, characterized in that, The computer program product includes computer instructions stored in a computer-readable storage medium; the processor of the computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform an authentication method according to any one of claims 1 to 5, or an authentication method according to claim 6 or 7.

Images