Face authentication method and apparatus

Abstract

This specification provides a face authentication method and apparatus. The face authentication method, executed in a verification server, includes: receiving a face authentication request from a face verification app in a terminal device, the request carrying facial information; authenticating the facial information to obtain a face authentication result; generating an authorization code; saving a first correspondence between the authorization code and the face authentication result; sending the generated authorization code to the face verification app, which then sends the authorization code to a third-party app; receiving an authentication result query request from a third-party server; determining whether the authentication result query request carries an authorization code; if so, sending the face authentication result corresponding to the authorization code carried in the authentication result query request to the third-party server, which then sends the face authentication result to the third-party app. This specification embodiment can improve the security of face authentication services.

Description

Technical Field

[0001] This specification relates to network information technology, and more particularly to face authentication methods and apparatus, through one or more embodiments. Background Technology

[0002] With the development of network technology, the application scenarios of facial recognition technology are becoming increasingly widespread. For example, facial recognition is used for payment when shopping, and for access control when logging into a system or passing through a gate. Furthermore, in addition to mini-programs and third-party apps, some H5 pages are also beginning to integrate facial recognition. Therefore, the security of facial recognition technology is crucial; however, the current security of facial recognition systems needs improvement.

[0003] Therefore, a more secure facial recognition method is urgently needed. Summary of the Invention

[0004] This specification describes one or more embodiments of a face authentication method and apparatus that can improve the security of face authentication services.

[0005] According to the first aspect, a face authentication method is provided, wherein the method includes:

[0006] Receive a face authentication request sent by the face verification APP in the terminal device. The face authentication request carries face information.

[0007] The facial information is then authenticated to obtain the facial authentication result.

[0008] Generate authorization code;

[0009] Save the initial correspondence between the authorization code and the facial recognition result;

[0010] The generated authorization code is sent to the face verification app, which then sends the authorization code to a third-party app.

[0011] Receive authentication result query requests from third-party servers;

[0012] Determine whether the authentication result query request carries an authorization code. If so, send the face authentication result corresponding to the authorization code carried in the authentication result query request to the third-party server, so that the third-party server can send the face authentication result to the third-party APP.

[0013] In the first aspect, before receiving the facial information from the facial verification APP in the receiving terminal device, the method further includes: receiving an authentication authorization request from a third-party server; obtaining an authentication identifier CertifyID based on the user identity information carried in the authentication authorization request; and sending the CertifyID to the third-party server.

[0014] After generating the authorization code, the method further includes: saving a second correspondence between the generated authorization code and the obtained CertifyID;

[0015] The authentication result query request further includes the CertifyID;

[0016] After determining that the authentication result query request carries an authorization code, and before sending the face authentication result corresponding to the authorization code to the third-party server, the process further includes: determining whether there is a second correspondence between the CertifyID carried in the authentication result query request and the authorization code carried in the authentication result query request; if so, then continue to send the face authentication result corresponding to the authorization code carried in the authentication result query request to the third-party server; otherwise, refuse to return the face authentication result.

[0017] In the first aspect, before receiving the facial information from the facial verification APP in the receiving terminal device, the method further includes: receiving an authentication authorization request from a third-party server, the authentication authorization request carrying user identity information and a session identifier (SessionID) for the current session, obtaining an authentication identifier (CertifyID) corresponding to the user identity information; and saving a third correspondence between the CertifyID and the SessionID; and sending the CertifyID to the third-party server so that the third-party server can send the CertifyID to the third-party APP.

[0018] The face authentication request sent by the face verification APP further includes: the CertifyID and SessionID reported by the third-party APP to the face verification APP;

[0019] After receiving the face authentication request from the face verification APP in the receiving terminal device, and before obtaining the face authentication result, the process further includes: determining whether there is a third correspondence between the CertifyID carried in the face authentication request and the SessionID carried in the face authentication request; if so, the process of obtaining the face authentication result continues; otherwise, the face authentication fails.

[0020] In the first aspect, after generating the authorization code, the method further includes: storing a fourth correspondence between the generated authorization code and the SessionID obtained from the authentication authorization request;

[0021] After determining that the authentication result query request carries an authorization code, and before sending the face authentication result corresponding to the authorization code to the third-party server, the process further includes: determining whether the authentication result query request sent by the third-party server carries a SessionID; if so, determining whether there is the fourth correspondence between the SessionID carried in the authentication result query request and the authorization code carried in the authentication result query request; if so, continuing to send the face authentication result corresponding to the authorization code carried in the authentication result query request to the third-party server; otherwise, refusing to return the face authentication result.

[0022] According to the second aspect, a face authentication method is provided, wherein the method includes:

[0023] Receive authentication trigger requests from third-party apps on the terminal device;

[0024] Obtain the user's facial information;

[0025] The facial information is included in the facial authentication request and sent to the verification server.

[0026] If an authorization code is received from the verification server, the authorization code will be sent to the third-party app.

[0027] In the second aspect, the authentication trigger request sent by the third-party APP carries the authentication identifier CertifyID and the session identifier SessionID for this session;

[0028] Sending the facial information, along with the CertifyID and SessionID obtained from the authentication trigger request, to the verification server in the facial authentication request includes: sending the facial information, the CertifyID obtained from the authentication trigger request, and the SessionID to the verification server in the facial authentication request.

[0029] According to the third aspect, a face authentication method is provided, which includes:

[0030] Receive authentication result query requests from third-party apps; the authentication result query request carries an authorization code;

[0031] Send the authentication result query request carrying the authorization code to the verification server;

[0032] Receive the face authentication result sent by the verification server;

[0033] Send the facial recognition results to a third-party app.

[0034] In the third aspect, before receiving the authentication result query request sent by the third-party APP, it further includes: receiving the authentication authorization request sent by the third-party APP, the authentication authorization request carrying user identity information and the session identifier (SessionID) of the current session; and sending the authentication authorization request carrying user identity information and the SessionID to the verification server.

[0035] Sending the authentication result query request carrying the authorization code to the verification server includes: sending the authentication result query request carrying the authorization code and the SessionID to the verification server.

[0036] According to the fourth aspect, a face authentication method is provided, wherein the method includes:

[0037] Send an authentication trigger request to the face verification APP in the terminal device to trigger the face verification APP to obtain the user's face information;

[0038] Receive the authorization code sent by the face verification app;

[0039] Send the authentication result query request carrying the authorization code to the third-party server to trigger the third-party server to query the face authentication result;

[0040] Receive the face authentication result sent by the third-party server.

[0041] In the fourth aspect, before sending the authentication trigger request to the face verification APP in the terminal device, it further includes: sending an authentication authorization request to a third-party server, wherein the authentication authorization request carries user identity information and the session identifier (SessionID) of the current session;

[0042] Sending an authentication trigger request to the face verification APP in the terminal device includes: sending the SessionID and the authentication identifier CertifyID sent by the third-party server in the authentication trigger request to the face verification APP in the terminal device;

[0043] The authentication result query request further carries the CertifyID and / or the SessionID.

[0044] According to the fifth aspect, a face authentication device is provided, wherein the device is installed in a verification server, and the device includes:

[0045] The face authentication request receiving module is configured to receive a face authentication request sent by the face verification APP in the terminal device, which carries face information.

[0046] The face authentication execution module is configured to authenticate the face information and obtain the face authentication result;

[0047] The authentication result processing module is configured to generate an authorization code and save the first correspondence between the authorization code and the face authentication result.

[0048] The authorization code distribution module is configured to distribute the generated authorization code to the face verification APP, which then sends the authorization code to a third-party APP.

[0049] The result query processing module is configured to receive authentication result query requests from third-party servers; determine whether the authentication result query request carries an authorization code; if so, send the face authentication result corresponding to the authorization code carried in the authentication result query request to the third-party server, so that the third-party server can send the face authentication result to the third-party APP.

[0050] According to the sixth aspect, a face authentication device is provided, wherein the device is installed in a terminal device for performing the processing of a face authentication APP, and the device includes:

[0051] The trigger request receiving module is configured to receive authentication trigger requests sent by third-party apps in the terminal device.

[0052] The face information processing module is configured to acquire the user's face information and send this face information to the verification server in a face authentication request.

[0053] The authorization code forwarding module is configured to send the authorization code to a third-party app if it receives an authorization code from the verification server.

[0054] According to the seventh aspect, a facial recognition device is provided, which is set up in a third-party server, and the device includes:

[0055] The query request receiving module is configured to receive authentication result query requests sent by third-party apps; the authentication result query request carries an authorization code.

[0056] The query request forwarding module is configured to send the authentication result query request carrying the authorization code to the verification server;

[0057] The authentication result acquisition module is configured to receive the face authentication result sent by the verification server and send the face authentication result to a third-party APP.

[0058] According to the eighth aspect, a face authentication device is provided, which is installed in a terminal device for enabling processing by a third-party APP. The device includes:

[0059] The trigger request sending module is configured to send an authentication trigger request to the face verification APP in the terminal device to trigger the face verification APP to obtain the user's face information;

[0060] The authorization code receiving module is configured to receive authorization codes sent by the face verification app.

[0061] The query request sending module is configured to send an authentication result query request carrying the authorization code to a third-party server to trigger the third-party server to query the face authentication result;

[0062] The authentication result determination module is configured to receive the face authentication result sent by a third-party server.

[0063] According to a ninth aspect, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method described in any embodiment of this specification.

[0064] The face authentication methods and devices provided in the various embodiments of this specification have at least the following beneficial effects:

[0065] 1. After authenticating facial information, the verification server does not directly send the facial authentication result, such as a status value indicating successful or failed verification, to the facial verification app. Instead, it sends an authorization code to the facial verification app. Consequently, the facial verification app cannot send the facial authentication result to third-party apps. In this way, even if an attack occurs and an attacker steals the authorization code, the attacker cannot obtain the facial authentication result based on the authorization code, and therefore cannot modify the facial authentication result. This greatly improves the security of the facial authentication service.

[0066] 2. Provide face authentication results using the first correspondence. Specifically, considering that CertifyID corresponds to the user's identity information, rather than the face information during authentication, this embodiment does not use CertifyID as the credential for querying face authentication results. Instead, it uses an authorization code that can represent the face information in an authentication process as the credential for querying face authentication results. That is, if the third-party APP and the third-party server can provide the correct authorization code to the verification server, the verification server will provide the face authentication result based on the first correspondence between the authorization code and the face authentication result that it has saved in advance.

[0067] 3. Because the face verification result is not sent directly to the third-party APP, but an authorization code is sent first, the third-party APP cannot know the face verification result based on the authorization code. Therefore, the third-party APP and the third-party server are forced to actively query the verification server for the face verification result based on the obtained authorization code, thus complying with the requirements of the protocol and further improving the security of the face verification business.

[0068] 4. Utilize a third-party mapping to address potential CertifyID leaks. Specifically, the verification server can use a pre-stored third-party mapping between SessionID and CertifyID to determine the legitimacy of the CertifyID carried in the face authentication request and whether an attack due to CertifyID leakage has occurred. If so, the face authentication result will not be provided. Therefore, the security of the face authentication process can be further improved.

[0069] 5. Utilize the second mapping relationship to verify the legitimacy of the third-party server and third-party app querying the face authentication result. Specifically, the verification server can pre-store the second mapping relationship between the authorization code and the CertifyID. If the third-party server can provide an authorization code and CertifyID with this second mapping relationship, the legitimacy of the third-party app and third-party server can be determined, and only then will the face authentication result be provided.

[0070] 6. Utilize the fourth mapping relationship to verify the legitimacy of the third-party server and third-party app querying the face authentication result. Specifically, the verification server can pre-store the fourth mapping relationship between the authorization code and the SessionID. If the third-party server can provide an authorization code and SessionID with this fourth mapping relationship, the legitimacy of the third-party app and third-party server can be determined, and only then will the face authentication result be provided. Attached Figure Description

[0071] To more clearly illustrate the technical solutions in the embodiments or prior art of this specification, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0072] Figure 1 This is a schematic diagram of the system architecture used in one embodiment of this specification.

[0073] Figure 2 This is a flowchart of a face authentication method executed in a verification server in one embodiment of this specification.

[0074] Figure 3 This is a flowchart of a face authentication method executed in a face verification APP in one embodiment of this specification.

[0075] Figure 4 This is a flowchart of a face authentication method executed on a third-party server in one embodiment of this specification.

[0076] Figure 5 This is a flowchart of a face authentication method executed in a third-party APP in one embodiment of this specification.

[0077] Figure 6 This is a flowchart of a face authentication method completed by the cooperation of all parties in one embodiment of this specification.

[0078] Figure 7 This is a schematic diagram of the structure of a face authentication device installed in a verification server in one embodiment of this specification.

[0079] Figure 8 This is a schematic diagram of the structure of a face authentication device that performs face verification APP processing in a terminal device according to one embodiment of this specification.

[0080] Figure 9 This is a schematic diagram of the structure of a face authentication device installed in a third-party server in one embodiment of this specification.

[0081] Figure 10 This is a schematic diagram of the structure of a face authentication device that executes third-party APP processing in a terminal device, as described in one embodiment of this specification. Detailed Implementation

[0082] The solution provided in this specification will now be described with reference to the accompanying drawings.

[0083] First, it should be noted that the terminology used in the embodiments of this invention is for the purpose of describing specific embodiments only and is not intended to limit the invention. The singular forms “a,” “the,” and “the” used in the embodiments of this invention and the appended claims are also intended to include the plural forms, unless the context clearly indicates otherwise.

[0084] It should be understood that the term "and / or" used in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0085] On the terminal device side, when an application, called a third-party app, needs to use the facial recognition service, it sends the collected facial information to the verification server through the facial verification app on the terminal device. The verification server verifies the face and then sends the facial recognition result to the third-party app through the facial verification app. However, during the process of the verification server sending the facial recognition result to the facial verification app and the facial verification app sending the facial recognition result to the third-party app, there is a possibility of attack, which could alter the facial recognition result. For example, if an attacker initiates facial recognition using a fake face, although the facial recognition result sent by the verification server is "failed," the attacker can modify the sent facial recognition result to "passed," thus greatly reducing the security of the facial recognition service.

[0086] To facilitate understanding of the methods provided in this manual, the system architecture involved and applicable to this manual is first described. For example... Figure 1 As shown, the system architecture mainly includes four types of network nodes: third-party APP, face verification APP, third-party server, and verification server.

[0087] Third-party apps and facial recognition apps are installed and run on terminal devices, which can include, but are not limited to, smart mobile terminals, smart home devices, network devices, wearable devices, smart medical devices, and PCs (personal computers). Smart mobile devices can include mobile phones, tablets, laptops, PDAs (personal digital assistants), and connected cars. Smart home devices can include smart appliances such as smart TVs, smart air conditioners, smart water heaters, smart refrigerators, and smart air purifiers, as well as smart door locks, smart sockets, smart lights, and smart cameras. Network devices can include switches, wireless access points, and servers. Wearable devices can include smartwatches, smart glasses, smart bracelets, virtual reality devices, augmented reality devices, and mixed reality devices (devices that support both virtual and augmented reality). Smart medical devices can include smart thermometers, smart blood pressure monitors, and smart blood glucose meters.

[0088] A third-party server can be a single server or a group of servers, responsible for providing network services to third-party apps, such as security authentication and network service level management.

[0089] The verification server can be a single server or a server cluster consisting of multiple servers, responsible for providing network services to the face verification app, such as face comparison, etc.

[0090] It should be understood that Figure 1 The number of third-party apps, face verification apps, third-party servers, and verification servers shown is merely illustrative. Any number can be selected and deployed as needed.

[0091] As can be seen, the method of this invention involves the processing of third-party apps, the processing of face verification apps, the processing of third-party servers, and the processing of verification servers. The following will illustrate the processing of each party in the face authentication process through different embodiments.

[0092] The following section first explains the processing in the verification server. Figure 2 This is a flowchart illustrating a face authentication method executed in a verification server according to one embodiment of this specification. The execution entity of this method is a face authentication device, which resides within the verification server. It is understood that this method can also be executed by any device, equipment, platform, or cluster of devices with computing and processing capabilities. See also... Figure 2 The method includes:

[0093] Step 201: The verification server receives a face authentication request from the face verification APP in the terminal device. The face authentication request carries face information.

[0094] Step 203: The verification server authenticates the facial information and obtains the facial authentication result;

[0095] Step 205: Verify the server generates the authorization code;

[0096] Step 207: Verify the first correspondence between the authorization code and the face authentication result stored on the server;

[0097] Step 209: The verification server sends the generated authorization code to the face verification APP, which then sends the authorization code to a third-party APP.

[0098] Step 211: The verification server receives the authentication result query request sent by the third-party server;

[0099] Step 213: The verification server determines whether the authentication result query request carries an authorization code. If so, proceed to step 215; otherwise, refuse to provide the face authentication result and end the current process.

[0100] Step 215: The verification server sends the face authentication result corresponding to the authorization code carried in the authentication result query request to the third-party server, so that the third-party server can send the face authentication result to the third-party APP.

[0101] The above Figure 2 The illustrated process describes the handling within the verification server. Corresponding to the above... Figure 2 The verification server shown requires the cooperation of the face verification app, third-party server, and third-party app to complete the corresponding processing.

[0102] The following explanation corresponds to Figure 2 The processing shown in the verification server corresponds to the processing performed in the face verification app. Figure 3 This is a flowchart illustrating a face authentication method executed in a face verification app according to one embodiment of this specification. The execution entity of this method is a face authentication device, which is located in the terminal device. It is understood that this method can also be executed by any device, equipment, platform, or cluster of devices with computing and processing capabilities. See also... Figure 3 The method includes:

[0103] Step 301: The face verification APP receives an authentication trigger request sent by a third-party APP in the terminal device.

[0104] Step 303: The face verification app obtains the user's facial information.

[0105] Step 305: The face verification APP sends the face information to the verification server in the face authentication request.

[0106] Step 307: If the face verification app receives the authorization code issued by the verification server, it sends the authorization code to the third-party app.

[0107] The following explanation corresponds to Figure 2 The verification server's processing is shown, and the corresponding processing is performed in the third-party server. Figure 4 This is a flowchart illustrating a face authentication method executed on a third-party server in one embodiment of this specification. The execution entity of this method is a face authentication device, which resides on the third-party server. It is understood that this method can also be executed by any device, equipment, platform, or cluster of devices with computing and processing capabilities. See also... Figure 4 The method includes:

[0108] Step 401: The third-party server receives the authentication result query request sent by the third-party APP; the authentication result query request carries an authorization code.

[0109] Step 403: The third-party server sends the authentication result query request carrying the authorization code to the verification server.

[0110] Step 405: The third-party server receives the face authentication result sent by the verification server.

[0111] Step 407: The third-party server sends the face authentication result to the third-party APP.

[0112] The following explanation corresponds to Figure 2 The verification server's processing is shown, and the corresponding processing is performed in the third-party app. Figure 5 This is a flowchart illustrating a face authentication method executed in a third-party app according to one embodiment of this specification. The execution entity of this method is a face authentication device, located within the terminal device. It is understood that this method can also be executed by any device, equipment, platform, or cluster of devices with computing and processing capabilities. See also... Figure 5 The method includes:

[0113] Step 501: The third-party APP sends an authentication trigger request to the face verification APP on the terminal device to trigger the face verification APP to obtain the user's face information.

[0114] Step 503: The third-party APP receives the authorization code sent by the face verification APP.

[0115] Step 505: The third-party APP sends an authentication result query request carrying the authorization code to the third-party server to trigger the third-party server to query the face authentication result.

[0116] Step 507: The third-party APP receives the face authentication result sent by the third-party server.

[0117] As mentioned earlier, in existing technologies, the verification server directly sends the face authentication result, such as a status value indicating successful or failed verification, to the face verification app. Correspondingly, the face verification app also directly sends this face authentication result to a third-party app. When an attack occurs targeting this face authentication result, it can alter the face authentication result received by the face verification app or the third-party app. For example, if an attacker initiates face authentication using a fake face, although the face authentication result sent by the verification server is "failed," the attacker can modify the sent face authentication result to "successful," thus significantly reducing the security of the face authentication service. Conversely, see the above... Figures 2 to 5 In the process illustrated in this embodiment, after authenticating the facial information, the verification server does not directly send the facial authentication result, such as a status value indicating successful or failed verification, to the facial verification app. Instead, it sends an authorization code to the facial verification app. Consequently, the facial verification app cannot send the facial authentication result to a third-party app. Therefore, even if an attack occurs and an attacker steals the authorization code, the attacker cannot obtain the facial authentication result based on the authorization code, and thus cannot modify the facial authentication result. This significantly improves the security of the facial authentication service. See also... Figures 2 to 5Subsequently, third-party apps and servers can only obtain facial recognition results if they can provide the correct authorization code to the verification server.

[0118] To enhance security, in facial recognition systems, after a third-party app receives the facial verification result forwarded by the facial verification app, it is required to proactively query the verification server for the result. However, in current technology, because the third-party app already obtains the success or failure result from the forwarded result, many third-party apps and servers fail to proactively query the verification server for the result as required by the protocol, thus violating the protocol and reducing the security of the facial recognition system. Instead, see [link to relevant documentation]. Figures 2 to 5 The process illustrated in this embodiment of the specification involves sending an authorization code first, instead of directly sending the face authentication result to the third-party app. The third-party app cannot determine the face authentication result based on the authorization code. This forces both the third-party app and the third-party server to actively query the verification server for the face verification result based on the obtained authorization code, thus complying with the protocol requirements and further improving the security of the face authentication service. In the above embodiment of the specification, the authorization code prevents attackers from modifying the face authentication result.

[0119] In the embodiments of this specification, the following issues in the face authentication process are further considered:

[0120] 1. When a third-party app or server actively queries the verification server for the face verification result, how can the authorization code be used to verify the legitimacy of the third-party app or server?

[0121] 2. How to avoid security issues related to face authentication caused by the leakage of the authentication identifier (CertifyID).

[0122] Regarding point 1 above, the legitimacy of third-party apps and servers can be verified using the following two methods:

[0123] Method A: Use the correspondence between the authorization code and CertifyID, denoted as the second correspondence, to verify the legitimacy of the third-party APP and the third-party server.

[0124] Method B: Use the correspondence between the authorization code and the session identifier (SessionID), referred to as the fourth correspondence, to verify the legitimacy of the third-party APP and the third-party server.

[0125] The following explanation focuses on method A.

[0126] In facial recognition authentication, each user's identity information, such as their name, uniquely corresponds to a CertifyID; that is, one CertifyID represents one user. During a session, because facial information needs to be authenticated, the CertifyID corresponding to the user's identity information is transmitted between the verification server, the third-party server, the facial recognition app, and the third-party app. Leveraging this characteristic, in one embodiment of this specification, the verification server can store the mapping relationship between authorization codes and CertifyIDs, i.e., a second mapping relationship, thereby using this second mapping relationship to verify the legitimacy of the third-party app and the third-party server.

[0127] In Method A, when a third-party app needs to use the facial recognition function, it sends an authentication authorization request carrying user identity information to a third-party server before sending facial information. The third-party server then sends the authentication authorization request carrying user identity information to the verification server, thereby exchanging the user identity information for a CertifyID. In other words, the verification server receives the authentication authorization request from the third-party server; obtains the authentication identifier CertifyID based on the user identity information carried in the authentication authorization request; sends the CertifyID to the third-party server, which then sends the CertifyID to the third-party app. After that, the verification server generates an authorization code; and the verification server saves a second correspondence between the generated authorization code and the obtained CertifyID. Subsequently, when a face authentication result needs to be queried, the third-party app sends an authentication result query request carrying the CertifyID and authorization code to the third-party server. The third-party server then sends the authentication result query request carrying the CertifyID and authorization code to the verification server. Thus, in step 213 above, after the verification server determines that the authentication result query request carries an authorization code, before sending the face authentication result corresponding to the authorization code to the third-party server, it further includes: the verification server determining whether there is a second correspondence between the CertifyID carried in the authentication result query request and the authorization code carried in the authentication result query request stored in the verification server. That is, whether the correspondence between the CertifyID carried in the authentication result query request and the authorization code carried in the authentication result query request can be found in the second correspondence stored in the verification server. If so, the third-party server and the third-party app are determined to be legitimate, and the process of sending the face authentication result corresponding to the authorization code carried in the authentication result query request to the third-party server continues. Otherwise, the third-party server and the third-party app are determined to be illegitimate, and the face authentication result is refused to be returned.

[0128] The following section will first explain the method for solving the second problem mentioned above. Based on this method, we can further implement method B to solve the first problem mentioned above.

[0129] As mentioned earlier, in facial recognition, a CertifyID represents a user's identity information. Therefore, the same CertifyID is used in different facial recognition attempts for the same user. If an attack occurs during different facial recognition attempts and an attacker steals the user's identity information, they can obtain the corresponding CertifyID. Therefore, a certain risk remains, reducing the security of the facial recognition process. Using a SessionID, which identifies a session, can further mitigate this risk because the SessionID represents not only the user's identity information in a single facial recognition attempt but also the facial information itself, thus resolving the second issue mentioned above.

[0130] At this point, when a third-party app needs to use the face authentication function, it obtains the SessionID of the current session. Before the face verification app sends its facial information, the third-party app sends an authentication and authorization request carrying the user's identity information and the SessionID to the third-party server. The third-party server then sends the authentication and authorization request carrying the user's identity information and the SessionID to the verification server. This process involves exchanging the user's identity information for a CertifyID and simultaneously reporting the SessionID of the current session to the verification server. In other words, the verification server receives the authentication and authorization request from the third-party server, which carries the user's identity information and the SessionID of the current session. It then obtains the CertifyID corresponding to the user's identity information, saves the third-party mapping between the CertifyID and the SessionID, and sends the CertifyID and SessionID to the third-party server, which then forwards them to the third-party app. Subsequently, the third-party app sends the obtained CertifyID and SessionID to the face verification app on the terminal device in the authentication trigger request; the app then sends the acquired face information, the CertifyID and SessionID obtained from the authentication trigger request, to the verification server in the face authentication request. Upon receiving the face authentication request from the face verification app, and before authenticating the face to obtain the face authentication result, the verification server further determines whether there is a third correspondence between the CertifyID and SessionID carried in the face authentication request. That is, the verification server checks whether it can find a correspondence between the CertifyID and SessionID carried in the face authentication request in its stored third correspondence database. If so, it determines that the CertifyID has not been stolen and continues to authenticate the face to obtain the face authentication result; otherwise, the face authentication fails. Therefore, this process solves problem 2 mentioned above. Afterwards, the verification server generates an authorization code; the verification server will save the fourth correspondence between the generated authorization code and the obtained SessionID.Subsequently, when a face authentication result needs to be queried, the third-party app sends an authentication result query request carrying the SessionID and authorization code to the third-party server. The third-party server then sends the same request to the verification server. Thus, in step 213 above, after the verification server determines that the authentication result query request carries an authorization code, before sending the face authentication result corresponding to the authorization code to the third-party server, it further includes: the verification server determining whether there is a fourth correspondence between the SessionID and the authorization code carried in the authentication result query request, stored in the verification server. That is, whether the fourth correspondence stored in the verification server can find a correspondence between the SessionID and the authorization code carried in the authentication result query request. If so, the third-party server and the third-party app are deemed legitimate, and the process of sending the face authentication result corresponding to the authorization code carried in the authentication result query request to the third-party server continues. Otherwise, the third-party server and the third-party app are deemed illegitimate, and the face authentication result is refused. Therefore, method B, addressing the first problem, is implemented.

[0131] Figure 6 This is a flowchart illustrating a face authentication method implemented through cooperation among various parties in one embodiment of this specification. See also... Figure 6 The method includes:

[0132] Step 601: The third-party app obtains the SessionID and sends an authentication and authorization request carrying the SessionID and user identity information to the third-party server.

[0133] Step 603: The third-party server sends an authentication and authorization request carrying the session ID and user identity information to the verification server.

[0134] Step 605: The verification server obtains the CertifyID corresponding to the user identity information carried in the authentication and authorization request, and saves the correspondence between the obtained CertifyID and the sessionID carried in the authentication and authorization request, which is referred to as the third correspondence.

[0135] Step 607: The verification server sends the obtained CertifyID to the third-party server.

[0136] Step 609: The third-party server sends the received CertifyID to the third-party app.

[0137] In step 609, to improve security, the third-party server may send the signed CertifyID to the third-party app.

[0138] Step 611: The third APP sends the SessionID and the received CertifyID in the authentication trigger request to the face verification APP in the terminal device.

[0139] Step 613: The face verification APP obtains the user's face information and sends the face information, along with the CertifyID and SessionID obtained from the authentication trigger request, to the verification server in the face authentication request.

[0140] Step 615: The verification server determines whether there is a third correspondence between the CertifyID carried in the face authentication request and the SessionID carried in the face authentication request. In other words, the verification server checks whether it can find a correspondence between the CertifyID and the SessionID carried in the face authentication request in its own stored third correspondence. If so, it is determined that the CertifyID has not been stolen, and step 617 is executed. Otherwise, the face authentication fails, and the current process ends.

[0141] Step 617: Verify the facial information using the verification server to obtain the facial verification result.

[0142] Step 619: Verify that the server generates an authorization code and saves the correspondence between the authorization code and the face authentication result, which is called the first correspondence; the verification server saves the correspondence between the authorization code and the SessionID, which is called the fourth correspondence.

[0143] In step 619, the verification server may not save the fourth correspondence, but instead save the correspondence between the authorization code and CertifyID as the second correspondence.

[0144] Step 621: The verification server sends the authorization code (Authcode) to the face verification app.

[0145] Step 623: The face verification app sends the authorization code to the third-party app.

[0146] Step 625: The third-party app sends the authorization code and SessionID to the third-party server in the authentication result query request.

[0147] Step 627: The third-party server sends an authentication result query request carrying the authorization code and SessionID to the verification server.

[0148] Step 629: After the verification server determines that the authentication result query request carries an authorization code, it determines whether there is a fourth correspondence between the SessionID carried in the authentication result query request and the authorization code carried in the authentication result query request, as stored in the verification server. If yes, proceed to step 631; otherwise, refuse to return the face authentication result and end the current process.

[0149] It should be noted that in steps 625 to 627 above, the authentication result query request may not carry the SessionID, but instead carry the CertifyID. In this way, in step 629, the verification server determines whether there is a second correspondence between the CertifyID carried in the authentication result query request and the authorization code carried in the authentication result query request, as stored in the verification server. If so, step 631 is executed; otherwise, the face authentication result is refused to be returned, and the current process ends.

[0150] Step 631: The verification server obtains the face authentication result corresponding to the authorization code carried in the authentication result query request based on the first correspondence mentioned above, and sends the face authentication result to the third-party server.

[0151] Step 633: The third-party server sends the received face authentication result to the third-party APP.

[0152] This specification also proposes a face authentication device in its embodiments, which is installed in a verification server. See [link to documentation]. Figure 7 The device includes:

[0153] The face authentication request receiving module 701 is configured to receive a face authentication request sent by the face verification APP in the terminal device, which carries face information.

[0154] The face authentication execution module 702 is configured to authenticate the face information and obtain the face authentication result;

[0155] The authentication result processing module 703 is configured to generate an authorization code and save the first correspondence between the authorization code and the face authentication result.

[0156] The authorization code distribution module 704 is configured to distribute the generated authorization code to the face verification APP, so that the face verification APP can send the authorization code to a third-party APP.

[0157] The result query processing module 705 is configured to receive an authentication result query request sent by a third-party server; determine whether the authentication result query request carries an authorization code; if so, send the face authentication result corresponding to the authorization code carried in the authentication result query request to the third-party server, so that the third-party server can send the face authentication result to the third-party APP.

[0158] In one embodiment of this specification, in Figure 7 The face authentication device shown, configured in the verification server, further includes: a first authorization module ( Figure 7 (Not shown in the image), the first authorization module is configured to receive an authentication and authorization request from a third-party server; obtain the authentication identifier CertifyID based on the user identity information carried in the authentication and authorization request; and send the CertifyID to the third-party server.

[0159] Accordingly, the authentication result processing module 703 is further configured to, after generating the authorization code, save the second correspondence between the generated authorization code and the obtained CertifyID;

[0160] The authentication result query request further includes the CertifyID;

[0161] Accordingly, the result query processing module 705 is configured to perform the following: after determining that the authentication result query request carries an authorization code, and before sending the face authentication result corresponding to the authorization code to the third-party server, determine whether there is a second correspondence between the CertifyID carried in the authentication result query request and the authorization code carried in the authentication result query request. If so, continue to send the face authentication result corresponding to the authorization code carried in the authentication result query request to the third-party server; otherwise, refuse to return the face authentication result.

[0162] In one embodiment of this specification, in Figure 7 The face authentication device shown, configured in the verification server, further includes: a second authorization module ( Figure 7 (Not shown in the image), the second authorization module is configured to perform the following: receive an authentication and authorization request from a third-party server, which carries user identity information and the session identifier (SessionID) of the current session; obtain the authentication identifier (CertifyID) corresponding to the user identity information; save the third correspondence between the CertifyID and the SessionID; and send the CertifyID to the third-party server so that the third-party server can send the CertifyID to the third-party APP.

[0163] Accordingly, the face authentication request received by the face authentication request receiving module 701 further carries the CertifyID and SessionID reported by the third-party APP to the face verification APP.

[0164] Accordingly, the result query processing module 705 is configured to perform the following: after receiving the face authentication request sent by the face verification APP in the terminal device, and before obtaining the face authentication result, determine whether there is the third correspondence between the CertifyID carried in the face authentication request and the SessionID carried in the face authentication request. If so, continue to obtain the face authentication result; otherwise, the face authentication fails.

[0165] In one embodiment of this specification, in Figure 7 When the face authentication device shown in the illustration, configured in the verification server, further includes the aforementioned second authorization module,

[0166] The authentication result processing module 703 is further configured to perform the following: after generating the authorization code, save the fourth correspondence between the generated authorization code and the SessionID obtained from the authentication authorization request;

[0167] Accordingly, the result query processing module 705 is configured to perform the following: after determining that the authentication result query request carries an authorization code, and before sending the face authentication result corresponding to the authorization code to the third-party server, determine whether the authentication result query request sent by the third-party server carries a SessionID. If so, determine whether there is the fourth correspondence between the SessionID carried in the authentication result query request and the authorization code carried in the authentication result query request. If so, continue to send the face authentication result corresponding to the authorization code carried in the authentication result query request to the third-party server; otherwise, refuse to return the face authentication result.

[0168] One embodiment of this specification also proposes a face authentication device, which is installed in a terminal device for performing face verification processing by an app. See also Figure 8 The device includes:

[0169] Trigger request receiving module 801 is configured to receive authentication trigger requests sent by third-party APP in terminal device;

[0170] The face information processing module 802 is configured to acquire the user's face information and send the face information to the verification server in a face authentication request.

[0171] The authorization code forwarding module 803 is configured to send the authorization code to a third-party APP if it receives an authorization code issued by the verification server.

[0172] In one embodiment of this specification, in Figure 8 In the face authentication device shown in the terminal device, the authentication trigger request received by the trigger request receiving module 801 carries the authentication identifier CertifyID and the session identifier SessionID of the current session.

[0173] Accordingly, the face information processing module 802 is configured to send the face information, the CertifyID obtained from the authentication trigger request, and the SessionID to the verification server in the face authentication request.

[0174] This specification also provides an embodiment of a face authentication device, which is set up in a third-party server; see [link to documentation]. Figure 9 The device includes:

[0175] The query request receiving module 901 is configured to receive authentication result query requests sent by third-party apps; the authentication result query request carries an authorization code.

[0176] The query request forwarding module 902 is configured to send an authentication result query request carrying an authorization code to the verification server;

[0177] The authentication result acquisition module 903 is configured to receive the face authentication result sent by the verification server and send the face authentication result to a third-party APP.

[0178] In one embodiment of this specification, in Figure 9 The face authentication device set up in a third-party server, as shown, further includes: an authorization request forwarding module (not shown in the figure), which is configured to receive an authentication authorization request sent by a third-party APP, the authentication authorization request carrying user identity information and the session identifier (SessionID) of the current session; and send the authentication authorization request carrying user identity information and the SessionID to the verification server.

[0179] The query request forwarding module 902 is configured to send an authentication result query request carrying the authorization code and the SessionID to the verification server.

[0180] This specification also provides an embodiment of a face authentication device, which is installed in a terminal device to implement the functionality of a third-party APP. See [link to documentation]. Figure 10 The device includes:

[0181] The trigger request sending module 1001 is configured to send an authentication trigger request to the face verification APP in the terminal device to trigger the face verification APP to obtain the user's face information;

[0182] Authorization code receiving module 1002 is configured to receive authorization codes sent by the face verification APP;

[0183] The query request sending module 1003 is configured to send an authentication result query request carrying the authorization code to a third-party server to trigger the third-party server to query the face authentication result;

[0184] The authentication result determination module 1004 is configured to receive the face authentication result sent by a third-party server. In one embodiment of this specification, in Figure 10 The face authentication device shown in the terminal device further includes: an authorization request sending module (not shown in the figure), configured to send an authentication authorization request to a third-party server, wherein the authentication authorization request carries user identity information and the session identifier SessionID of the current session;

[0185] The trigger request sending module 1001 is configured to execute: send the SessionID and the authentication identifier CertifyID sent by the third-party server in the authentication trigger request to the face verification APP in the terminal device;

[0186] The authentication result query request further carries the CertifyID and / or the SessionID.

[0187] This specification provides, in one embodiment, a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the methods of any embodiment in the specification.

[0188] This specification provides a computing device according to one embodiment, including a memory and a processor, wherein the memory stores executable code, and the processor executes the executable code to perform the method of any embodiment of the specification.

[0189] It is understood that the structures illustrated in the embodiments of this specification do not constitute a specific limitation on the apparatus of the embodiments of this specification. In other embodiments of the specification, the above-described apparatus may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0190] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the apparatus embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0191] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solution of the present invention should be included within the scope of protection of the present invention.

Claims

1. The face authentication method is executed by the verification server, wherein, The method includes: Receive authentication and authorization requests from third-party servers. These requests contain user identity information and the SessionID identifier for this session. Obtain the CertifyID, the authentication identifier corresponding to the user's identity information; Save the third mapping between the CertifyID and the SessionID; Send the CertifyID to a third-party server, which will then send the CertifyID to a third-party app. Receive a face authentication request from the face verification APP in the terminal device. The face authentication request carries face information and the CertifyID and SessionID reported to the face verification APP by the third-party APP. Determine whether there is a third correspondence between the CertifyID carried in the face authentication request and the SessionID carried in the face authentication request. If not, the face authentication fails and the current process ends. If so, the facial information is then authenticated to obtain the facial authentication result; Generate authorization code; Save the initial correspondence between the authorization code and the facial recognition result; The generated authorization code is sent to the face verification app, which then sends the authorization code to a third-party app. Receive authentication result query requests from third-party servers; Determine whether the authentication result query request carries an authorization code. If so, send the face authentication result corresponding to the authorization code carried in the authentication result query request to the third-party server, so that the third-party server can send the face authentication result to the third-party APP.

2. The method according to claim 1, wherein, Before receiving the facial information from the facial verification app in the receiving terminal device, the method further includes: receiving an authentication authorization request from a third-party server; obtaining an authentication identifier CertifyID based on the user identity information carried in the authentication authorization request; and sending the CertifyID to the third-party server. After generating the authorization code, the method further includes: saving a second correspondence between the generated authorization code and the obtained CertifyID; The authentication result query request further includes the CertifyID; After determining that the authentication result query request carries an authorization code, and before sending the face authentication result corresponding to the authorization code to the third-party server, the process further includes: determining whether there is a second correspondence between the CertifyID carried in the authentication result query request and the authorization code carried in the authentication result query request; if so, then continue to send the face authentication result corresponding to the authorization code carried in the authentication result query request to the third-party server; otherwise, refuse to return the face authentication result.

3. The method according to claim 1, further comprising, after generating the authorization code: Save the fourth correspondence between the generated authorization code and the SessionID obtained from the authentication authorization request; After determining that the authentication result query request carries an authorization code, and before sending the face authentication result corresponding to the authorization code to the third-party server, the process further includes: determining whether the authentication result query request sent by the third-party server carries a SessionID; if so, determining whether there is the fourth correspondence between the SessionID carried in the authentication result query request and the authorization code carried in the authentication result query request; if so, continuing to send the face authentication result corresponding to the authorization code carried in the authentication result query request to the third-party server; otherwise, refusing to return the face authentication result.

4. The facial recognition method is executed by the facial recognition app, whereby... The method includes: Receive authentication trigger requests from third-party apps on the terminal device; these authentication trigger requests carry CertifyID and SessionID; Obtain the user's facial information; The facial information, CertifyID and SessionID obtained from the authentication trigger request are sent to the verification server in the facial authentication request; If an authorization code is received from the verification server, the authorization code will be sent to the third-party app. The authentication trigger request sent by the third-party APP carries the authentication identifier CertifyID and the session identifier SessionID for this session; Before the verification server receives the facial information sent by the facial verification APP in the terminal device, the method further includes: the verification server receiving an authentication authorization request sent by a third-party server, the authentication authorization request carrying user identity information and the session identifier SessionID of the current session, the verification server obtaining the authentication identifier CertifyID corresponding to the user identity information, and saving the third correspondence between the CertifyID and the SessionID, and sending the CertifyID to the third-party server so that the third-party server can send the CertifyID to the third-party APP; After the verification server receives the face authentication request sent by the face verification APP in the terminal device, and before the verification server obtains the face authentication result, the verification server further includes: determining whether there is a third correspondence between the CertifyID carried in the face authentication request and the SessionID carried in the face authentication request; if so, the verification server continues to obtain the face authentication result; otherwise, the face authentication fails. The third-party server is the server responsible for providing network services to the third-party APP.

5. The face authentication method is executed by a third-party server, wherein, The third-party server is a server responsible for providing network services to the third-party APP; the method includes: Receive authentication and authorization requests from third-party apps. These requests contain user identity information and the SessionID identifier for the current session. The authentication and authorization request carrying the user's identity information and the SessionID is sent to the verification server, so that the verification server can obtain the authentication identifier CertifyID corresponding to the user's identity information based on the authentication and authorization request sent by the third-party server, and the verification server can save the third correspondence between the CertifyID and the SessionID, and send the CertifyID to the third-party server. Send the CertifyID to the third-party app; Receive authentication result query requests from third-party apps; the authentication result query request carries an authorization code; Send the authentication result query request carrying the authorization code to the verification server; Receive the face authentication result sent by the verification server; Send the facial recognition results to a third-party app; The process further includes, after the verification server receives the face authentication request from the face verification APP in the terminal device, and before the verification server obtains the face authentication result, the following steps: the verification server determines whether there is a third correspondence between the CertifyID carried in the face authentication request and the SessionID carried in the face authentication request. If so, the process continues to obtain the face authentication result; otherwise, the face authentication fails and the current process ends.

6. The facial recognition method is executed by a third-party app, among which, The method includes: An authentication and authorization request is sent to a third-party server. The authentication and authorization request carries the user's identity information and the session identifier (SessionID) of the current session. The third-party server then sends the authentication and authorization request to the verification server. The verification server obtains the authentication identifier (CertifyID) corresponding to the user's identity information based on the authentication and authorization request, and saves the third-party correspondence between the CertifyID and the SessionID. The verification server then sends the CertifyID to the third-party server, which in turn sends the CertifyID to the third-party app. The SessionID and the CertifyID sent by the third-party server are carried in the authentication trigger request and sent to the face verification APP in the terminal device to trigger the face verification APP to obtain the user's face information. Receive the authorization code sent by the face verification app; Send the authentication result query request carrying the authorization code to the third-party server to trigger the third-party server to query the face authentication result from the verification server; Receive the face authentication result sent by the third-party server; After the verification server receives the face authentication request sent by the face verification APP in the terminal device, and before the verification server obtains the face authentication result, the process further includes: the verification server determining whether there is a third correspondence between the CertifyID carried in the face authentication request and the SessionID carried in the face authentication request; if so, the process continues to obtain the face authentication result; otherwise, the face authentication fails and the current process ends. The third-party server is the server responsible for providing network services to the third-party APP.

7. Facial recognition device, among which, The device is located in the verification server and includes: The face authentication request receiving module is configured to receive a face authentication request sent by the face verification APP in the terminal device, which carries face information. The face authentication execution module is configured to authenticate the face information and obtain the face authentication result; The authentication result processing module is configured to generate an authorization code and save the first correspondence between the authorization code and the face authentication result. The authorization code distribution module is configured to distribute the generated authorization code to the face verification APP, which then sends the authorization code to a third-party APP. The result query processing module is configured to receive an authentication result query request sent by a third-party server; determine whether the authentication result query request carries an authorization code; if so, send the face authentication result corresponding to the authorization code carried in the authentication result query request to the third-party server, so that the third-party server can send the face authentication result to the third-party APP. The device further includes: a second authorization module; The second authorization module is configured to perform the following: receive an authentication and authorization request from a third-party server, which carries user identity information and the session identifier (SessionID) of the current session; obtain the authentication identifier (CertifyID) corresponding to the user identity information; save the third correspondence between the CertifyID and the SessionID; and send the CertifyID to the third-party server so that the third-party server can send the CertifyID to the third-party APP. The face authentication request received by the face authentication request receiving module further carries: the CertifyID and SessionID reported by the third-party APP to the face verification APP; The result query processing module is configured to perform the following: after receiving the face authentication request sent by the face verification APP in the terminal device, and before obtaining the face authentication result, determine whether there is a third correspondence between the CertifyID carried in the face authentication request and the SessionID carried in the face authentication request. If so, continue to obtain the face authentication result; otherwise, the face authentication fails. The third-party server is the server responsible for providing network services to the third-party APP.

8. Facial recognition device, among which, This device, installed in a terminal device, is used to perform the processing of a face verification app. The device includes: The trigger request receiving module is configured to receive authentication trigger requests sent by third-party apps in the terminal device. The face information processing module is configured to acquire the user's face information and send this face information to the verification server in a face authentication request. The authorization code forwarding module is configured to send the authorization code to a third-party APP if it receives an authorization code from the verification server. in, The authentication trigger request received by the trigger request receiving module carries the authentication identifier CertifyID and the session identifier SessionID of the current session. The face information processing module is configured to send the face information, the CertifyID and SessionID obtained from the authentication trigger request, in the face authentication request to the verification server; Before the verification server receives the facial information sent by the facial verification APP in the terminal device, the method further includes: the verification server receiving an authentication authorization request sent by a third-party server, which carries user identity information and the session identifier SessionID of the current session; the verification server obtaining the authentication identifier CertifyID corresponding to the user identity information; saving the third correspondence between CertifyID and SessionID; and sending CertifyID to the third-party server so that the third-party server can send CertifyID to the third-party APP. After the verification server receives the face authentication request sent by the face verification APP in the terminal device, and before the verification server obtains the face authentication result, the verification server further includes: determining whether there is a third correspondence between the CertifyID carried in the face authentication request and the SessionID carried in the face authentication request; if so, the verification server continues to obtain the face authentication result; otherwise, the face authentication fails. The third-party server is the server responsible for providing network services to the third-party APP.

9. A facial recognition device, which is located on a third-party server, comprising: The query request receiving module is configured to receive authentication result query requests sent by third-party apps. The authentication result query request includes an authorization code; The query request forwarding module is configured to send the authentication result query request carrying the authorization code to the verification server; The authentication result acquisition module is configured to receive the face authentication result sent by the verification server; Send the facial recognition results to a third-party app; The device further includes: an authorization request forwarding module; The authorization request forwarding module is configured to receive an authentication authorization request from a third-party APP, which carries user identity information and the session identifier (SessionID) for the current session; send the authentication authorization request carrying the user identity information and the SessionID to the verification server, so that the verification server can obtain the authentication identifier (CertifyID) corresponding to the user identity information based on the authentication authorization request sent by the third-party server; the verification server can save the third-party correspondence between the CertifyID and the SessionID; and send the CertifyID to the third-party server, which then sends the CertifyID to the third-party APP. The process further includes, after the verification server receives the face authentication request from the face verification APP in the terminal device, and before the verification server obtains the face authentication result, the following steps: the verification server determines whether there is a third correspondence between the CertifyID carried in the face authentication request and the SessionID carried in the face authentication request. If so, the process continues to obtain the face authentication result; otherwise, the face authentication fails and the current process ends. The third-party server is the server responsible for providing network services to the third-party APP.

10. A facial recognition device, installed in a terminal device for enabling processing by a third-party app, the device comprising: The trigger request sending module is configured to send an authentication trigger request to the face verification APP in the terminal device to trigger the face verification APP to obtain the user's face information; The authorization code receiving module is configured to receive authorization codes sent by the face verification app. The query request sending module is configured to send an authentication result query request carrying the authorization code to a third-party server to trigger the third-party server to query the face authentication result; The authentication result determination module is configured to receive the face authentication result sent from a third-party server; The device further includes: an authorization request sending module; The authorization request sending module is configured to send an authentication and authorization request to a third-party server. The authentication and authorization request carries the user's identity information and the session identifier (SessionID) of the current session. The third-party server then sends the authentication and authorization request to the verification server. The verification server obtains the authentication identifier (CertifyID) corresponding to the user's identity information based on the authentication and authorization request, and saves the third-party correspondence between the CertifyID and the SessionID. The verification server then sends the CertifyID to the third-party server, which in turn sends the CertifyID to the third-party APP. The trigger request sending module is configured to send the SessionID and the authentication identifier CertifyID sent by the third-party server in the authentication trigger request to the face verification APP in the terminal device. The process further includes, after the verification server receives the face authentication request from the face verification APP in the terminal device, and before the verification server obtains the face authentication result, the following steps: the verification server determines whether there is a third correspondence between the CertifyID carried in the face authentication request and the SessionID carried in the face authentication request. If so, the process continues to obtain the face authentication result; otherwise, the face authentication fails and the current process ends. The third-party server is the server responsible for providing network services to the third-party APP.

11. A computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method of any one of claims 1-6.

Images