Identity security authentication method based on personal information protection

Abstract

An identity security authentication method based on personal information protection comprises the following steps: a verification party calls a program calling interface, establishes communication for a built-in security chip of a key generator, initiates an identity authentication request for personal information of a verified party, and transmits a data public key of the verification party; the key generator receives and verifies the request, generates a one-time private key signature in real time by using an input data public key and current time information, and sends the one-time private key signature to a verification party; the verification party submits the private key signature to the personal information storage cloud service; verifying the private key signature, encrypting pre-stored personal information by using a data public key in the private key signature, and then returning the encrypted personal information to the verification party; and the verification party carries out decryption by using the own data private key to obtain the personal information. The authenticity of personal identity is ensured, and personal information is protected.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to an identity security authentication method based on personal information protection. Background Art

[0002] Identity security authentication is an important means to protect information systems and data security. By confirming and verifying user identities, security issues such as unauthorized access and data leakage can be effectively prevented. However, with the rapid development and popularization of network technology, personal information protection has become the focus of social attention. Figure 1 As shown in the figure, the traditional identity authentication method is that the party being authenticated submits personal information, and the authenticator then submits it to the data source service provider for information comparison, such as checking whether the name, ID number, bank card number, mobile phone number and other elements are correct and whether they match each other. The problem with this method is that personal information is exposed while authenticating the identity, so that the third-party intermediary providing the authentication service indirectly obtains this information, which on the one hand causes the leakage of personal information, and on the other hand makes the next identity authentication no longer safe and reliable, because other parties who obtain the leaked information can also complete the identity authentication in the same way, achieving the fraud effect of impersonating the person who provided the information. Summary of the invention

[0003] In order to solve the problems existing in the prior art, the present invention provides an identity security authentication method based on personal information protection, which can ensure the authenticity of personal identity while protecting personal information and avoiding leakage during the verification process.

[0004] The identity security authentication method based on personal information protection includes:

[0005] The verifier calls the standard program call interface, establishes communication with the built-in security chip of the key generator, initiates an identity authentication request for the personal information of the verified party, and passes in the verifier's own data public key as a parameter;

[0006] When the key generator receives and verifies the legitimacy of the request, it uses the incoming data public key and current time information to generate a one-time private key signature in real time and sends it to the verification party. The private key signature has a validity period of a preset length.

[0007] When the verification party obtains the private key signature, it submits the private key signature to the personal information storage cloud service;

[0008] Verify the private key signature through the personal information storage cloud service. If it is legitimate, encrypt the corresponding pre-stored personal information using the data public key in the private key signature and then return it to the verification party;

[0009] When the authenticator obtains the encrypted personal information, it uses its own data private key to decrypt it, obtains the personal information, and completes identity verification.

[0010] Preferably, the security chip includes an encryption and decryption coprocessor for data encryption and decryption operations of the key generator, and a hardware protection module for hardware protection of various modules inside the key generator.

[0011] Preferably, the step of using the incoming data public key and current time information to generate a one-time private key signature in real time further comprises:

[0012] Randomly generate a private key set {s0, s1, ..., sN} according to the current time information, and then generate a corresponding public key set {p0, p1, ..., pN} based on the data public key;

[0013] Generate summary information of the verification request using a hash function, then split the summary information into t sub-summaries {b1, b2, ..., bt}, calculate the octal values ​​corresponding to the sub-summaries {b1, b2, ..., bt}, store them in an array {i1, i2, ..., it}, and obtain a private key signature sig=si1‖si2‖...‖sit based on a private key set {s0, s1, ..., sN}, where ‖ is a character concatenation operation;

[0014] According to the received verification request and the signature sig to be verified, verify the data source and the integrity of the data, including using the above-mentioned signature generation process to generate a verification summary and a verification array {i'1, i'2, ..., i't}, and then calculate the verification public key: pub = pi'1‖pi'2‖..., pi't, verify the signature, that is, verify whether pi'u = f(siu), where 1≤u≤t; if so, assign a validity period dt to the private key signature sig, and send the private key signature sig to the verifier.

[0015] After submitting the private key signature to the personal information storage cloud service, the method further includes:

[0016] The personal information storage cloud service performs behavioral detection on the verifiers accessing the cloud service, monitors and analyzes the access behavior of the verifiers in real time, intercepts the verifiers below the preset security threshold, and only establishes connections with the verifiers that pass the detection.

[0017] The key generator consists of a cloud service and a standardized SDK program.

[0018] The personal information is the user's facial image information. Before encrypting the corresponding pre-stored personal information using the data public key in the private key signature, the personal information storage cloud service also includes adaptive image encoding for the foreground area and background area of ​​the user's facial image information.

[0019] Before encrypting the pre-stored corresponding personal information using the data public key in the private key signature, the method further includes:

[0020] The personal information storage cloud service generates a token based on the face image, verifies the legitimacy of the token, and generates a user private key upon success;

[0021] The personal information storage cloud service performs normalization preprocessing on the facial image, determines a watermark region of the normalized facial image, scrambles the watermark region, and saves an index of the scrambled sequence as an image key;

[0022] Embed the user private key into the watermark area to obtain a face image embedded with the user private key;

[0023] When restoring the watermark area, the face image embedded with the user's private key is decrypted using the image key to obtain the original face image of the user.

[0024] Based on the same inventive concept, the present invention also provides an identity security authentication system based on personal information protection, comprising:

[0025] A request unit, used for the verifier to call a standard program call interface, establish communication with the built-in security chip of the key generator, initiate an identity authentication request for the personal information of the verified party, and pass in the data public key of the verifier itself as a parameter;

[0026] A signature unit, which is used to generate a one-time private key signature in real time using the input data public key and current time information after the key generator receives and verifies the legitimacy of the request, and send it to the verification party, wherein the private key signature has a validity period of a preset length;

[0027] A submitting unit, configured to submit the private key signature to the personal information storage cloud service when the verification party obtains the private key signature;

[0028] An encryption unit, used to verify the private key signature through the personal information storage cloud service, and if it is legitimate, encrypt the corresponding pre-stored personal information using the data public key in the private key signature, and then return it to the verification party;

[0029] The decryption unit is used to decrypt the encrypted personal information using its own data private key after the authenticator obtains the encrypted personal information, thereby obtaining the personal information and completing identity authentication.

[0030] Based on the same inventive concept, the present invention also provides a mobile terminal, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the computer program.

[0031] The present invention also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps of the method described above are implemented.

[0032] Compared with the prior art, the present invention has the following beneficial effects:

[0033] The present invention provides an identity security authentication method based on personal information protection. The party being verified does not need to provide any personal information, and the identity signature collected and transmitted during the verification process can only be used once in a short period of time. The intermediary service provider cannot obtain personal information or cause the leakage of personal information, thereby improving privacy security. The identity private key signature based on the verification cannot be forged or reused, and has high credibility, so that identity fraudsters cannot impersonate themselves to complete the verification. There is no need for the verified party user or the verification party organization to make any changes. It only needs to add a new personal information storage party to the service network in this way. No adjustments need to be made to the existing service network, thereby expanding the service capacity of the entire network. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 A schematic diagram of the overall architecture of the identity security authentication method based on personal information protection according to the present invention is shown.

[0035] Figure 2 It is a flow chart of the identity security authentication method based on personal information protection according to the present invention.

[0036] Figure 3 It is a flowchart of another embodiment of the identity security authentication method based on personal information protection according to the present invention. DETAILED DESCRIPTION

[0037] The scheme of the present invention will be described in detail below by means of exemplary implementations in conjunction with the accompanying drawings. The described embodiment is only one application scenario of the present invention, not all. Based on the embodiments of the present invention, all embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0038] In view of the above problems existing in the prior art, the present invention provides an identity security authentication method based on personal information protection, which realizes a more secure, reliable and privacy-protected identity authentication by allocating a key generator based on a security chip to the user, and replaces the original way of personal information circulation in the verification process by using an encrypted identifier based on cryptography to verify the identity and as an encrypted credential for extracting identity data. It can better ensure the authenticity of personal identity and protect personal information from being leaked during the verification process.

[0039] The present invention constructs a key generator A with a built-in intelligent security chip, pre-sets a globally unique private key and a national secret algorithm in its unreadable ROM area, and the key generator is used for NFC or Bluetooth secure communication, and provides a standardized program call interface API. User personal information is stored in a group of cloud services B, which can be provided in an integrated form or in the form of a sub-service Bi that only stores some specific personal information. The cloud service performs public key verification, internal calculation and extraction of personal information on the private key signature generated by the key generator A, and encrypts data based on the national secret algorithm.

[0040] like Figure 2 As shown, the present invention provides an identity security authentication method based on personal information protection, comprising:

[0041] Step 1: The verifier calls the standard program call interface to establish communication with the built-in security chip of key generator A, initiates an identity authentication request for the personal information of the verified party, and passes in the verifier's own data public key as a parameter.

[0042] The communication with the built-in security chip of the key generator A includes NFC or Bluetooth secure communication.

[0043] The security chip includes a chip processor, a first non-volatile storage, a second non-volatile storage, a third non-volatile storage, an encryption and decryption coprocessor, a hardware protection module and an on-chip interface.

[0044] The chip processor is used for data processing and memory management of the key generator, and for the central computing, processing and management functions of the system. The first non-volatile storage is used to store the key generation application. The second non-volatile storage stores other applications on the key generator except the key generation application. The third non-volatile storage is used to store personal information instance data of the key generation application. The on-chip interface is used for the input and output of the key generator data, and provides Bluetooth or NFC secure communication transmission functions. The encryption and decryption coprocessor is used for data encryption and decryption operations of the key generator. The hardware protection module is used to perform hardware protection on each module inside the key generator.

[0045] Step 2: After receiving and verifying the legitimacy of the request, key generator A uses the incoming data public key and current time information to generate a one-time private key signature in real time and sends it to the verifier. The private key signature has a validity period of a preset length.

[0046] The step 2 further comprises:

[0047] Step 2.1: Key generator A randomly generates a private key set {s0, s1, …, s N}, and then generate the corresponding public key set {p0, p1, ..., p N};

[0048] Step 2.2: Generate the summary information of the verification request using a hash function, and then split the summary information into t sub-summaries {b1, b2, ..., b t}, compute the subsummary {b1, b2, …, b t}, and store the corresponding octal value in the array {i1, i2, ..., i t}, based on the private key set {s0, s1, …, s N}Get private key signature sig=s i1 ‖s i2 ‖…‖s it , where ‖ is the character concatenation operation.

[0049] Step 2.3: Based on the received verification request and the signature sig to be verified, verify the data source and the integrity of the data, including using the above signature generation process to generate a verification summary and a verification array {i'1, i'2, ..., i' t}, then calculate the verification public key: pub = p i’1 ‖p i’2 ‖…, p i’t , verify the signature, that is, verify p i ' u =f(s iu ) is established, where 1≤u≤t; if established, a validity period dt is assigned to the private key signature sig, and the private key signature sig is sent to the verifier.

[0050] Step 3: After obtaining the private key signature, the verifier submits the private key signature to the personal information storage cloud service B;

[0051] According to a preferred embodiment, after initiating an identity authentication request for the personal information of the party being verified, the personal information storage cloud service needs to perform behavioral detection on the verifier accessing the cloud service, monitor and analyze the access behavior of the verifier in real time, intercept the verifier below the preset security threshold, and only establish a connection with the verifier that passes the detection.

[0052] The behavior detection process includes the following steps:

[0053] Step 3.1: Obtain the verification behavior test set λ = {x1, x2, ..., x n} contains n behavior samples, each of which belongs to a d-dimensional feature vector; calculate the mean μ and standard deviation matrix Sm of each feature to obtain the Gaussian distribution of the test set λ;

[0054] Sm=[[sm11,sm12,...,sm1d],

[0055] [sm21, sm22, ..., sm2d],

[0056] ...,

[0057] [smd1,smd2,...,smdd]];

[0058] Among them, the mean μ=(μ1,μ2,...,μ d ), μ i represents the mean of the i-th feature.

[0059] Step 3.2: For new behavior samples calculate Probability density under Gaussian distribution

[0060]

[0061] Among them, sqrt is the square root operation.

[0062] Step 3.3: Set the safety threshold e, if The behavior sample Marked as abnormal behavior, that is, the personal information storage cloud service fails the detection of the verification party, otherwise the detection passes.

[0063] Step 4: The personal information storage cloud service B verifies the private key signature. If it is legitimate, the corresponding pre-stored personal information is encrypted using the data public key in the private key signature and then returned to the verifier.

[0064] Specifically, the personal information storage cloud service first generates a pair of keys SK1 and SK2, and uses the key pair SK1, SK2 and the configuration function f as input items to generate a watermark certificate for authentication. The personal information storage cloud service generates an authentication message with the cloud service public key Sp and sends it to the verifier.

[0065] After receiving the authentication message, the verifier determines whether the personal information storage cloud service is the real provider requested by the verifier. If the judgment result is true, the verifier records the cloud service ID, finds the corresponding authentication message in the directory according to the cloud service ID, and then signs and generates data Wp.

[0066] A watermark certificate is generated based on the data Wp and sent to the personal information storage cloud service to authenticate the identity of the verifier. The personal information storage cloud service verifies whether the result value is its own identity. If the values ​​are equal, it means that the verifier is legitimate.

[0067] Optionally, when the two-way authentication gateway receives the attribute verification request information, it generates an authentication response message and sends it to the personal information storage cloud service. After receiving the authentication response message, the personal information storage cloud service first decrypts it with its own private key. After successful decryption, the personal information storage cloud service will obtain the Wp of the verifier and the encrypted public key from the key generator to verify the attribute information.

[0068] When the personal information storage cloud service successfully verifies the attribute information, it returns the received information to the two-way authentication gateway. Finally, the two-way authentication gateway transmits the received encrypted personal information to the verifier.

[0069] In an optional embodiment of the present invention, the personal information is the user's facial image information. The personal information storage cloud service performs adaptive encoding on the foreground area and background area of ​​the user's facial image information. For the KL transformation, a correlation coefficient matrix is ​​defined:

[0070]

[0071] w i Takes 0 or 1. In the specific encoding, w is determined according to whether the block belongs to the foreground area or the background area. i Set i and j as the horizontal and vertical coordinates of the block respectively, and calculate according to the following formula:

[0072]

[0073] Where W(k) ij is the correlation coefficient encoding matrix; N is the block size, and k is the rank of different candidate matrices. The encoding weight W of the background area BG is BG Normalized to M levels L BG :

[0074] L BG =W BG / (S BG / M)

[0075] S BG Corresponding to the four block sizes, the correlation coefficient encoding matrix of BG is determined as follows:

[0076] W BG =W{min[max(L BG +W stt ,0),4]},

[0077] W stt is the initial vector used to select the correlation coefficient matrix.

[0078] Furthermore, the personal information storage cloud service generates a token based on the facial image, verifies the legitimacy of the token, and generates a user private key upon success.

[0079] The personal information storage cloud service performs normalization preprocessing on the facial image, determines a watermark area of ​​the normalized facial image, scrambles the watermark area, and saves an index of the scrambled sequence as an image key.

[0080] The user private key is embedded into the watermark area to obtain a face image embedded with the user private key. When the watermark area is restored, the face image embedded with the user private key is decrypted using the image key to obtain the original face image of the user.

[0081] Step 5: After the verifier obtains the encrypted personal information, it uses its own data private key to decrypt it and obtain the personal information. The identity verification process is completed.

[0082] It can be seen that the identity security authentication method based on personal information protection of the present invention does not require the verified party to provide any personal information, and the identity signature collected and transmitted during the verification process can only be used once in a short period of time. The intermediary service provider cannot obtain personal information or cause the leakage of personal information, thereby improving privacy security. The identity private key signature based on the verification cannot be forged or reused, and has high credibility, so that identity fraudsters cannot impersonate themselves to complete the verification. There is no need for the verified party user or the verification party organization to make any changes. It only needs the new personal information storage party to join the service network in this way. No adjustments need to be made to the existing service network, thereby expanding the service capacity of the entire network.

[0083] The disadvantage of hardware key generators is that they are not convenient to issue and carry, and the software cannot guarantee the storage security and multiple uses of the generated keys because it does not have a security chip as a hardware basis, and cannot meet the long-term and continuous requirements of identity authentication. Therefore, in a further embodiment of the present invention, another implementation method of the key generator is proposed, which is a new key generator composed of cloud services and standardized SDK programs. It can not only ensure security, but also greatly reduce the requirements for hardware.

[0084] The security capability of the national secret chip of the ID card ensures that the user's identity cannot be forged, but it does not have the ability to independently generate private keys and encrypt data; the encryption capability of the smart phone security chip can generate a public-private key pair that meets the specifications according to the program requirements and perform data encryption, but it cannot verify the user's identity by itself, and the private key in the key pair not only exists only on the local machine, but also disappears when the caller APP is uninstalled. Therefore, neither can independently become a key generator that meets the requirements. The present invention utilizes the second-generation resident ID card with the security capability of the built-in national secret chip, and an ordinary smart phone with the encryption capability of the built-in security chip, combines the characteristics of the two hardware, and realizes a trusted key generator through cloud services and standardized SDK programs.

[0085] The complete process of the exemplary embodiment of the present invention is as follows:

[0086] Step A1: The authentication party initiates an authentication call request through a standardized SDK program and provides the authentication party's own data public key;

[0087] Step A2: The standardized SDK program first checks whether there is a generated identity private key locally. If so, it checks whether it is the latest version through the identity registration publishing server. If it is the latest version, it jumps to step A5; if it is not the latest version, or there is no identity private key locally, it continues to execute A3;

[0088] Step A3: Confirm whether the user's identity is credible by reading the built-in chip of the ID card. If not, the process ends and returns to the data verification party that the user's identity is not credible. If it is credible, continue to step A4;

[0089] Step A4: Call the encryption component of the built-in security chip of the smartphone to generate a random public-private key pair, synchronize the public key to the identity registration and publishing server, and notify it that the registration is the latest. If successful, continue to step A5; if unsuccessful, end the process and return to the data verification party that the identity authentication failed;

[0090] Step A5: Use the private key to sign the public key and current time of the data passed in by the verifier.

[0091] Step A6: After the identity authentication party obtains the identity private key signature, it submits it to the external personal information storage service to request identity authentication and obtain personal information.

[0092] Step A7: The personal information storage service first obtains the latest identity public key from the identity registration and publishing server to verify the private key signature. If the verification is successful, the internally stored personal information is extracted and encrypted according to the data public key before being returned to the identity verification party;

[0093] Step A8: The identity verification party encrypts the personal information based on its own data private key to complete the identity verification process.

[0094] The present invention further provides an identity security authentication system based on personal information protection, comprising:

[0095] A request unit, used for the verifier to call a standard program call interface, establish communication with the built-in security chip of the key generator, initiate an identity authentication request for the personal information of the verified party, and pass in the data public key of the verifier itself as a parameter;

[0096] A signature unit, which is used to generate a one-time private key signature in real time using the input data public key and current time information after the key generator receives and verifies the legitimacy of the request, and send it to the verification party, wherein the private key signature has a validity period of a preset length;

[0097] A submitting unit, configured to submit the private key signature to the personal information storage cloud service when the verification party obtains the private key signature;

[0098] An encryption unit, used to verify the private key signature through the personal information storage cloud service, and if it is legitimate, encrypt the corresponding pre-stored personal information using the data public key in the private key signature, and then return it to the verification party;

[0099] The decryption unit is used to decrypt the encrypted personal information using its own data private key after the authenticator obtains the encrypted personal information, thereby obtaining the personal information and completing identity authentication.

[0100] The present invention also provides a mobile terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the computer program.

[0101] The present invention also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps of the method described above are implemented.

[0102] Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0103] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the present application can adopt the form of computer program products implemented on multiple computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that comprise computer-usable program codes.

[0104] The present application is described using flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0105] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0106] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0107] The above are merely embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention are included in the scope of the claims of the present invention to be approved.

Claims

1. An identity security authentication method based on personal information protection, It is characterized in that The method includes: The verifier calls the standard program call interface, establishes communication with the built-in security chip of the key generator, initiates an identity authentication request for the personal information of the verified party, and passes in the verifier's own data public key as a parameter; When the key generator receives and verifies the legitimacy of the request, it uses the incoming data public key and current time information to generate a one-time private key signature in real time and sends it to the verification party. The private key signature has a validity period of a preset length; When the verification party obtains the private key signature, it submits the private key signature to the personal information storage cloud service; Verify the private key signature through the personal information storage cloud service. If it is legitimate, encrypt the corresponding pre-stored personal information using the data public key in the private key signature and then return it to the verification party; When the authenticator obtains the encrypted personal information, it uses its own data private key to decrypt it, obtains the personal information, and completes identity verification.

2. The identity security authentication method based on personal information protection according to claim 1, It is characterized in that The security chip includes an encryption and decryption coprocessor for data encryption and decryption operations of the key generator, and a hardware protection module for hardware protection of various modules inside the key generator.

3. The identity security authentication method based on personal information protection according to claim 1, It is characterized in that The method of using the incoming data public key and current time information to generate a one-time private key signature in real time further includes: Randomly generate a private key set based on the current time information {s 0 ,s 1 ,…,s N }, then generate the corresponding public key set {p 0 , p 1 ,…,p N }; Generate the summary information of the verification request using a hash function, and then split the summary information into t sub-summaries {b 1 , b 2 , …, b t }, calculate the subsummary {b 1 , b 2 , …, b t } corresponding to the octal value, stored in the array {i 1 ,i 2 ,…,i t }, based on the private key set {s 0 ,s 1 ,…,s N }Get private key signature sig=s i1 ‖s i2 ‖…‖s it , where ‖ is the character concatenation operation; According to the received verification request and the signature sig to be verified, verify the data source and data integrity, including using the above signature generation process to generate a verification summary and a verification array {i' 1 ,i' 2 ,…,i' t }, then calculate the verification public key: pub = p i’1 ‖p i’2 ‖…, p i’t , verify the signature, that is, verify p i ' u =f(s iu ) is established, where 1≤u≤t; if established, a validity period dt is assigned to the private key signature sig, and the private key signature sig is sent to the verification party.

4. The identity security authentication method based on personal information protection according to claim 1, It is characterized in that After submitting the private key signature to the personal information storage cloud service, the method further includes: The personal information storage cloud service performs behavioral detection on the verifiers accessing the cloud service, monitors and analyzes the access behavior of the verifiers in real time, intercepts the verifiers below the preset security threshold, and only establishes connections with the verifiers that pass the detection.

5. The identity security authentication method based on personal information protection according to claim 1, It is characterized in that The personal information is the user's facial image information. Before encrypting the corresponding pre-stored personal information using the data public key in the private key signature, the personal information storage cloud service also includes adaptive image encoding for the foreground area and background area of ​​the user's facial image information.

6. The identity security authentication method based on personal information protection according to claim 1, It is characterized in that Before encrypting the pre-stored corresponding personal information using the data public key in the private key signature, the method further includes: The personal information storage cloud service generates a token based on the face image, verifies the legitimacy of the token, and generates a user private key upon success; The personal information storage cloud service performs normalization preprocessing on the face image, determines a watermark region of the normalized face image, scrambles the watermark region, and saves an index of the scrambled sequence as an image key; Embed the user private key into the watermark area to obtain a face image embedded with the user private key; When restoring the watermark area, the face image embedded with the user's private key is decrypted using the image key to obtain the original face image of the user.

7. The identity security authentication method based on personal information protection according to claim 1, It is characterized in that The key generator consists of a cloud service and a standardized SDK program.

8. An identity security authentication system based on personal information protection, It is characterized in that The system includes: A request unit, used for the verifier to call a standard program call interface, establish communication with the built-in security chip of the key generator, initiate an identity authentication request for the personal information of the verified party, and pass in the data public key of the verifier itself as a parameter; A signature unit, which is used to generate a one-time private key signature in real time using the input data public key and current time information after the key generator receives and verifies the legitimacy of the request, and send it to the verification party, wherein the private key signature has a validity period of a preset length; A submitting unit, configured to submit the private key signature to the personal information storage cloud service when the verification party obtains the private key signature; An encryption unit, used to verify the private key signature through the personal information storage cloud service, and if it is legitimate, encrypt the corresponding pre-stored personal information using the data public key in the private key signature, and then return it to the verification party; The decryption unit is used to decrypt the encrypted personal information using its own data private key after the authenticator obtains the encrypted personal information, thereby obtaining the personal information and completing identity authentication.

9. A mobile terminal, It is characterized in that The method comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, It is characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images