Evaluation method and device for detecting whether face recognition can be bypassed

Abstract

The invention relates to the technical field of face recognition, and particularly provides an evaluation method and device for detecting whether face recognition can be bypassed, and the method can comprise the steps: obtaining the current flow data of a target object when face recognition is carried out on a to-be-tested face recognition system; replacing a face image in the current traffic data with a test image of the target object to obtain replaced traffic data; and sending the replacement traffic data to a back end, so that the back end verifies the test image and obtains a face recognition result, and the face recognition result is used for determining a test result of the to-be-tested face recognition system. According to some embodiments of the invention, effective testing of the face recognition system can be realized, and the testing method is simple and efficient.

Description

Technical Field

[0001] The present application relates to the field of face recognition technology, and more specifically, to a method and device for detecting whether face recognition can be bypassed. Background Art

[0002] As face recognition technology becomes more and more popular, the challenges it faces are becoming increasingly prominent. With the continuous development of the Internet, face recognition technology has gradually become an indispensable part of daily life. However, attackers can deceive face recognition systems through malicious technical means to obtain unauthorized access rights or conduct illegal activities. Currently, in the method of bypassing the detection of face recognition systems, some simple packet capture tools or more complex training models are usually used, but most of these tools cannot be used in real scenarios, and the training model method is complex and has a large workload and high complexity in data collection.

[0003] Therefore, how to provide a technical solution for efficiently detecting whether a facial recognition evaluation method can be bypassed has become a technical problem that needs to be solved urgently. Summary of the invention

[0004] The purpose of some embodiments of the present application is to provide an evaluation method and device for detecting whether face recognition can be bypassed. The technical solutions of the embodiments of the present application can achieve efficient evaluation of face recognition systems. The evaluation method is easy to implement and simple to operate, and the evaluation accuracy can be guaranteed.

[0005] In a first aspect, some embodiments of the present application provide a method for detecting whether face recognition can be bypassed, comprising: obtaining current traffic data of a target object when face recognition is performed on a face recognition system to be tested; replacing the face image in the current traffic data with a test image of the target object, and obtaining replacement traffic data; sending the replacement traffic data to a back end so that the back end can verify the test image and obtain a face recognition result, which is used to determine the test result of the face recognition system to be tested.

[0006] Some embodiments of the present application replace the face image in the current data flow generated by the face recognition system to be tested with the test image, obtain the replaced flow, and send it to the backend for verification; determine the test result of the face recognition system to be tested by the face recognition result. Some embodiments of the present application can realize efficient evaluation of the face recognition system, and the evaluation method is easy to implement, simple to operate, and can ensure the evaluation accuracy.

[0007] In some embodiments, before replacing the facial image in the current traffic data with the test image of the target object to obtain the replaced traffic data, the method further includes: determining an encoding method for the facial image; and encoding the replacement image using the encoding method to obtain the test image.

[0008] Some embodiments of the present application encode the replacement image in the same manner as the facial image to obtain a test image, thereby achieving effective replacement of traffic data and providing data support for subsequent verification.

[0009] In some embodiments, before replacing the facial image in the current traffic data with the test image of the target object and obtaining the replaced traffic data, the method further includes: obtaining encrypted facial data corresponding to the facial image in the current traffic data; and encrypting the replacement image using the same encryption algorithm as the encrypted facial data to obtain the test image.

[0010] Some embodiments of the present application perform the same processing on the replacement image as the encryption and encoding method of the facial image, thereby achieving effective replacement of traffic data and providing data support for subsequent verification.

[0011] In some embodiments, when the face recognition result is passed, the test result indicates that the face recognition system to be tested is not safe; when the face recognition result is failed, the test result indicates that the face recognition system to be tested is safe.

[0012] Some embodiments of the present application can conveniently determine the test results through face recognition results, which is intuitive and clear, and has high evaluation efficiency.

[0013] On the second aspect, some embodiments of the present application provide an evaluation device for detecting whether face recognition can be bypassed, including: an acquisition module, used to obtain current traffic data of a target object when face recognition is performed on a face recognition system to be tested; a replacement module, used to replace the face image in the current traffic data with a test image of the target object, and obtain replacement traffic data; a test module, used to send the replacement traffic data to a back end, so that the back end can verify the test image and obtain a face recognition result, and the face recognition result is used to determine the test result of the face recognition system to be tested.

[0014] In some embodiments, before the replacement module, the device further includes: a processing module; the processing module is used to: determine the encoding method of the face image; and encode the replacement image using the encoding method to obtain the test image.

[0015] In some embodiments, before the replacement module, the device also includes: an encryption module; the encryption module is used to: obtain the face encryption data corresponding to the face image in the current traffic data; encrypt the replacement image using the same encryption algorithm as the face encryption data to obtain the test image.

[0016] In some embodiments, when the face recognition result is passed, the test result indicates that the face recognition system to be tested is not safe; when the face recognition result is failed, the test result indicates that the face recognition system to be tested is safe.

[0017] In a third aspect, some embodiments of the present application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the method described in any embodiment of the first aspect.

[0018] In a fourth aspect, some embodiments of the present application provide an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor can implement a method as described in any embodiment of the first aspect when executing the program.

[0019] In a fifth aspect, some embodiments of the present application provide a computer program product, wherein the computer program product comprises a computer program, wherein the computer program, when executed by a processor, can implement the method described in any embodiment of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of some embodiments of the present application, the drawings required for use in some embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 A diagram of an evaluation system for detecting whether face recognition can be bypassed provided in some embodiments of the present application;

[0022] Figure 2 One of the flow charts of the evaluation method for detecting whether face recognition can be bypassed provided in some embodiments of the present application;

[0023] Figure 3 A second flow chart of a method for evaluating whether face recognition can be bypassed provided in some embodiments of the present application;

[0024] Figure 4 A block diagram of a device for detecting whether face recognition can be bypassed provided in some embodiments of the present application;

[0025] Figure 5 A schematic diagram of an electronic device is provided for some embodiments of the present application. DETAILED DESCRIPTION

[0026] The technical solutions in some embodiments of the present application will be described below in conjunction with the drawings in some embodiments of the present application.

[0027] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0028] In the digital age, facial recognition technology has gradually become an indispensable part of daily life. From unlocking mobile phones to security access, from identity verification to related investigations, the application areas of facial recognition technology are constantly expanding. However, with the popularization of facial recognition technology, the challenges it faces are becoming increasingly prominent. The principle of facial recognition technology is to analyze and identify geometric features and biometric features in facial images through computer vision and pattern recognition technology. Although this technology brings many advantages in terms of improving security and convenience, it is accompanied by a series of challenges to bypass attacks.

[0029] In actual applications, attackers can use technical means to deceive face recognition systems, thereby obtaining unauthorized access rights or conducting illegal activities. These bypass attacks not only pose a threat to personal privacy, but may also have a serious impact on social security and information security.

[0030] The face recognition process usually includes the following steps: face detection -> liveness detection -> uploading face images / face features -> backend comparison and verification. In the existing face bypass detection methods, some relatively simple packet capture tools are commonly used, for example, the SSL verification removal plug-in using the general Hook framework. However, such tools are mostly unusable in real scenarios and cannot achieve effective testing of face recognition systems.

[0031] In view of this, some embodiments of the present application provide a method for detecting whether face recognition can be bypassed, in which the current data traffic generated by the face recognition system can be intercepted, and then the face image therein is replaced with a test image to obtain the replacement traffic data, which is then sent to the backend for verification, and finally the test result is determined by the face recognition result. The face recognition evaluation method provided by some embodiments of the present application can be applied to different terminal systems to achieve efficient testing of the face recognition system, has wide applicability, and is easy to implement.

[0032] The following is combined with Figure 1 The overall structure of the evaluation system for detecting whether facial recognition can be bypassed is exemplified in some embodiments of the present application.

[0033] like Figure 1 As shown, some embodiments of the present application provide an evaluation system for detecting whether face recognition can be bypassed, and the evaluation system for detecting whether face recognition can be bypassed includes: a terminal 100 and a backend 200. Among them, the backend 200 can be a background server, and the hook framework Xtweak environment and the face recognition system to be tested are deployed in the system environment of the terminal 100. After the face recognition system to be tested is started, the camera of the terminal 100 can take real-time photos of the target object to obtain a face image, and then package it with other data to generate current traffic data, and send it to the backend 200. In the process of sending it to the backend 200, the current traffic data is intercepted, and the face image therein is replaced to obtain the replacement traffic data. The replacement traffic data is sent to the backend 200. The backend 200 verifies and compares the test image contained therein with the local image, and outputs the face recognition result, so as to determine the test result of the face recognition system to be tested.

[0034] In some embodiments of the present application, the evaluation system for detecting whether face recognition can be bypassed uses a customized Hook framework Xtweak, a Hook plug-in, which can easily intercept data traffic to replace face images / features and complete face bypass. In addition, the adopted solution includes a remote function call tool that can call any function of the APP source code. For example, by calling an encryption function, the victim's face image (that is, the replacement image) is encrypted and then replaced and sent with the corresponding replacement traffic data, thereby bypassing the face detection. Among them, the encryption function (or encryption algorithm) call in this application can use frida, xposed or lsposed of the general Hook framework. When intercepting traffic data for packet capture, tools such as reqable, postern, fiddler, BurpSuit, etc. can be used to complete packet capture.

[0035] In some embodiments of the present application, the terminal 100 may be a mobile terminal (for example, a smart phone, a tablet computer, an access control terminal, etc.), or a non-portable computer terminal; the system environment in the mobile terminal may be an Android system, a Hongmeng system, an iOS system, etc. The embodiments of the present application are not specifically limited here.

[0036] The following is combined with Figure 2 The implementation process of evaluating whether the detection performed by the terminal 100 can bypass face recognition is exemplified in some embodiments of the present application.

[0037] Please see attached Figure 2 , Figure 2 A flow chart of a method for detecting whether face recognition can be bypassed is provided for some embodiments of the present application. The method for detecting whether face recognition can be bypassed may include:

[0038] S210, obtaining current traffic data of the target object when performing face recognition on the face recognition system to be tested.

[0039] For example, in some embodiments of the present application, after the attacker (as a specific example of the target object) starts the face recognition system to be tested of a certain APP on the terminal 100, the camera of the terminal 100 performs face recognition on the attacker and collects the face image to generate current traffic data. After the face recognition is completed, the terminal 100 can intercept the communication traffic (that is, the current traffic data) between the APP and the background (that is, the backend 200).

[0040] S220, replacing the face image in the current traffic data with the test image of the target object to obtain replaced traffic data.

[0041] For example, in some embodiments of the present application, the facial image of the attacker in the communication traffic is replaced with a frontal face photo of the victim (as a specific example of a test image) to obtain replaced traffic data.

[0042] In some embodiments of the present application, before executing S220, the evaluation method for detecting whether face recognition can be bypassed may further include: determining an encoding method for the face image; encoding the replacement image using the encoding method to obtain the test image.

[0043] For example, in some embodiments of the present application, relevant information about a facial image is found from the current traffic data. For example, the facial image is encoded using Base64 (as a specific example of the encoding method); then the replacement image is encoded using Base64 encoding, and after obtaining the test image, it is updated into the traffic data to obtain replacement traffic data.

[0044] In some embodiments of the present application, before executing S220, the evaluation method for detecting whether face recognition can be bypassed may also include: obtaining face encryption data corresponding to the face image in the current traffic data; encrypting the replacement image using the same encryption algorithm as the face encryption data to obtain the test image.

[0045] For example, in some embodiments of the present application, in some apps with high security requirements, the face data in the current traffic data will be encrypted when performing face recognition. At this time, reverse analysis technology is required, using Hook tracking to obtain the part of the face encryption data in the APP source code, and then obtain the corresponding encryption algorithm. After decrypting the face image, obtain its encoding method, and finally use the same method to encode the replacement image, call the encode function therein to encode, and then encrypt it, so as to obtain the test image, and replace it in the traffic data packet to obtain the replacement traffic data.

[0046] It is understandable that the above encoding method and encryption algorithm can be selected according to actual needs, and the embodiments of the present application are not specifically limited here.

[0047] S230, sending the replacement traffic data to a backend so that the backend can verify the test image and obtain a face recognition result, wherein the face recognition result is used to determine a test result of the face recognition system to be tested.

[0048] For example, in some embodiments of the present application, the terminal 100 sends the replacement traffic data to the background. The background can compare the features of the test image in the replacement traffic data with the locally stored image to confirm whether the verification is passed and obtain the face recognition result. The face recognition result can be sent to the terminal 100 for display to determine the final test result.

[0049] In some embodiments of the present application, when the face recognition result is passed, the test result indicates that the face recognition system to be tested is unsafe; when the face recognition result is failed, the test result indicates that the face recognition system to be tested is safe.

[0050] For example, in some embodiments of the present application, when the terminal 100 receives a facial recognition result of passing, it can display a prompt message that the test result is unsafe, otherwise it can display a prompt message that it is safe, so that the tester can know it in time. It can be understood that since the image in the traffic data is replaced before the verification, if the verification is passed, it means that the face recognition system to be tested has not detected the replacement, so it is determined that the face recognition system to be tested is vulnerable to attackers and has poor security, otherwise it has high security.

[0051] The following is combined with Figure 3 The specific process of evaluating whether the detection can bypass face recognition provided by some embodiments of the present application is exemplified.

[0052] Please see attached Figure 3 , Figure 3A flow chart of an evaluation method for detecting whether face recognition can be bypassed is provided for some embodiments of the present application.

[0053] The above process is explained below as an example.

[0054] S310, obtaining current traffic data when the attacker performs face recognition on the face recognition system to be tested.

[0055] S320, obtaining the encoding encryption method of the attacker's face image in the current traffic data.

[0056] S330, encoding and encrypting the replacement image using an encoding and encryption method to obtain a test image.

[0057] S340, replacing the face image in the current traffic data with the test image to obtain replacement traffic data.

[0058] S350, sending replacement traffic data to the back end.

[0059] S360, receiving the face recognition result sent by the back end, and determining the test result of the face recognition system to be tested based on the face recognition result.

[0060] It can be understood that the specific implementation process of S310 to S360 can refer to the method embodiment provided above, and in order to avoid repetition, the detailed description is appropriately omitted here.

[0061] Please refer to Figure 4 , Figure 4 The block diagram of the composition of the evaluation device for detecting whether face recognition can be bypassed provided by some embodiments of the present application is shown. It should be understood that the evaluation device for detecting whether face recognition can be bypassed corresponds to the above method embodiment and can execute each step involved in the above method embodiment. The specific functions of the evaluation device for detecting whether face recognition can be bypassed can refer to the description above. To avoid repetition, the detailed description is appropriately omitted here.

[0062] Figure 4 The evaluation device for detecting whether face recognition can be bypassed includes at least one software function module that can be stored in a memory in the form of software or firmware or solidified in the evaluation device for detecting whether face recognition can be bypassed. The evaluation device for detecting whether face recognition can be bypassed includes: an acquisition module 410, used to obtain current traffic data of a target object when face recognition is performed on a face recognition system to be tested; a replacement module 420, used to replace the face image in the current traffic data with a test image of the target object, and obtain replacement traffic data; a test module 430, used to send the replacement traffic data to a back end, so that the back end can verify the test image and obtain a face recognition result, and the face recognition result is used to determine the test result of the face recognition system to be tested.

[0063] In some embodiments of the present application, before replacing the module 420, the evaluation device for detecting whether face recognition can be bypassed also includes: a processing module (not shown in the figure); the processing module is used to: determine the encoding method of the face image; use the encoding method to encode the replacement image to obtain the test image.

[0064] In some embodiments of the present application, before replacing the module 420, the evaluation device for detecting whether face recognition can be bypassed also includes: an encryption module (not shown in the figure); the encryption module is used to: obtain the face encryption data corresponding to the face image in the current traffic data; use the same encryption algorithm as the face encryption data to encrypt the replacement image to obtain the test image.

[0065] In some embodiments of the present application, when the face recognition result is passed, the test result indicates that the face recognition system to be tested is unsafe; when the face recognition result is failed, the test result indicates that the face recognition system to be tested is safe.

[0066] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method, and will not be described in detail here.

[0067] Some embodiments of the present application further provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the operations of the method corresponding to any of the above methods provided in the above embodiments.

[0068] Some embodiments of the present application further provide a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operations corresponding to any of the above methods provided in the above embodiments.

[0069] like Figure 5 As shown, some embodiments of the present application provide an electronic device 500, which includes: a memory 510, a processor 520, and a computer program stored in the memory 510 and executable on the processor 520, wherein the processor 520 can implement a method as described in any of the above embodiments when reading the program from the memory 510 through a bus 530 and executing the program.

[0070] Processor 520 can process digital signals and can include various computing structures, such as complex instruction set computer structure, reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, processor 520 can be a microprocessor.

[0071] The memory 510 may be used to store instructions executed by the processor 520 or data related to the execution of instructions. These instructions and / or data may include codes for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 520 of the disclosed embodiment may be used to execute instructions in the memory 510 to implement the method shown above. The memory 510 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memory known to those skilled in the art.

[0072] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0073] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0074] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A method for detecting whether face recognition can be bypassed, characterized in that: include: Obtain the current traffic data of the target object when performing face recognition on the face recognition system to be tested; Replacing the face image in the current traffic data with the test image of the target object to obtain replacement traffic data; The replacement traffic data is sent to a back end so that the back end can verify the test image and obtain a face recognition result, wherein the face recognition result is used to determine a test result of the face recognition system to be tested.

2. The evaluation method according to claim 1, characterized in that: Before replacing the face image in the current traffic data with the test image of the target object to obtain the replaced traffic data, the method further includes: Determining an encoding method for the facial image; The replacement image is encoded using the encoding method to obtain the test image.

3. The evaluation method according to claim 1, characterized in that: Before replacing the face image in the current traffic data with the test image of the target object to obtain the replaced traffic data, the method further includes: Obtaining encrypted face data corresponding to the face image in the current traffic data; The replacement image is encrypted using the same encryption algorithm as the face encryption data to obtain the test image.

4. The evaluation method according to any one of claims 1 to 3, characterized in that: When the face recognition result is passed, the test result indicates that the face recognition system to be tested is unsafe; when the face recognition result is failed, the test result indicates that the face recognition system to be tested is safe.

5. A device for detecting whether face recognition can be bypassed, characterized in that: include: An acquisition module is used to obtain current traffic data of the target object when performing face recognition on the face recognition system to be tested; A replacement module, used to replace the face image in the current traffic data with the test image of the target object to obtain replacement traffic data; The test module is used to send the replacement traffic data to the back end so that the back end can verify the test image and obtain the face recognition result, and the face recognition result is used to determine the test result of the face recognition system to be tested.

6. The evaluation device according to claim 5, characterized in that: Before the replacement module, the device further includes: a processing module; the processing module is used to: Determining a coding method for the facial image; The replacement image is encoded using the encoding method to obtain the test image.

7. The evaluation device according to claim 5, characterized in that: Before the replacement module, the device further includes: an encryption module; the encryption module is used to: Obtaining encrypted face data corresponding to the face image in the current traffic data; The replacement image is encrypted using the same encryption algorithm as the face encryption data to obtain the test image.

8. The evaluation device according to any one of claims 5 to 7, characterized in that: When the face recognition result is passed, the test result indicates that the face recognition system to be tested is unsafe; when the face recognition result is failed, the test result indicates that the face recognition system to be tested is safe.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program executes the method according to any one of claims 1 to 4 when executed by a processor.

10. An electronic device, characterized in that: The method comprises a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the computer program executes the method according to any one of claims 1 to 4 when being run by the processor.

Images