Face data encryption method and device, electronic equipment and storage medium

Abstract

The invention provides a face data encryption method and device, electronic equipment and a storage medium, and belongs to the technical field of computers. The method comprises: in response to a face registration operation, generating a first derived parameter associated with an identity identifier of a target user account, the target user account being a user account currently logged in by a terminal; generating a first key based on an initial key, the identity identifier and the first derived parameter, the initial key being a symmetric key associated with a device identifier of the terminal, and the first key being a symmetric key associated with the identity identifier; and through the first key, encrypting first face data authorized to be collected by the target user account to obtain first face encrypted data of the target user account. According to the scheme, the face data under different user accounts can be encrypted by using different keys, the risk that the face encrypted data is leaked is reduced, and the data security is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a facial data encryption method, device, electronic device and storage medium. Background Art

[0002] Face recognition is a biometric technology that identifies people based on their facial features. For the face recognition function of a terminal, when a user uses the terminal to enter their face for the first time, the terminal can extract facial features based on the user's face image and obtain the user's face data. The face data is used as a reference for subsequent face recognition of the user and needs to be encrypted and saved on the terminal to avoid data leakage. Therefore, how to encrypt face data is a technical problem that needs to be solved.

[0003] In the related art, before the terminal leaves the factory, the factory will configure a key for encrypting facial data for each terminal. The key remains unchanged after leaving the factory, and the facial data of different users on the terminal are all encrypted using the key.

[0004] However, in the above scheme, since the facial data of different users are encrypted with the same key, if the terminal is attacked and the key is leaked, the attacker can use the key to decrypt the facial data of all users on the terminal, causing serious leakage of user facial data and poor security. Summary of the invention

[0005] The embodiments of the present application provide a facial data encryption method, device, electronic device, and storage medium, which can realize the use of different keys to encrypt facial data under different user accounts, reduce the risk of facial encrypted data being leaked, and improve data security. The technical solution is as follows:

[0006] According to one aspect of an embodiment of the present application, a method for encrypting face data is provided, the method comprising:

[0007] In response to the face registration operation, generating a first derived parameter associated with an identity identifier of a target user account, wherein the target user account is a user account currently logged in by the terminal;

[0008] Generate a first key based on an initial key, the identity identifier and the first derived parameter, wherein the initial key is a symmetric key associated with the device identifier of the terminal, and the first key is a symmetric key associated with the identity identifier;

[0009] The first face data authorized to be collected by the target user account is encrypted by using the first key to obtain the first face encrypted data of the target user account.

[0010] According to another aspect of an embodiment of the present application, a face data encryption device is provided, the device comprising:

[0011] A first generating module, configured to generate, in response to a face registration operation, a first derived parameter associated with an identity identifier of a target user account, wherein the user account is a user account currently logged in by the terminal;

[0012] A second generating module, configured to generate a first key based on an initial key, the identity identifier and the first derived parameter, wherein the initial key is a symmetric key associated with the device identifier of the terminal, and the first key is a symmetric key associated with the identity identifier;

[0013] The encryption module is used to encrypt the first facial data authorized to be collected by the target user account through the first key to obtain the first facial encrypted data of the target user account.

[0014] In some embodiments, the first generating module includes:

[0015] An acquiring unit, configured to acquire the identity identifier of the target user account in response to the face registration operation;

[0016] A generating unit is used to randomly generate a random number for the target user account as a first derived parameter associated with the identity identifier.

[0017] In some embodiments, the first generation module is also used to display authorization prompt information in response to the face registration operation, and the authorization prompt information is used to prompt whether to authorize the collection of face images; in response to a confirmation operation on the authorization prompt information, obtain the first face image authorized for collection by the target user account; perform feature extraction on the first face image to obtain the first face data.

[0018] In some embodiments, the apparatus further comprises:

[0019] A storage module, configured to store the identity identifier of the target user account, the first derived parameter, and the first face encrypted data in a storage unit corresponding to the identity identifier in a trusted execution environment;

[0020] The clearing module is used to clear the identity identifier and the first derived parameter stored in the storage unit when the terminal is restored to factory settings or is in a flashing mode.

[0021] In some embodiments, the apparatus further comprises:

[0022] an acquisition module, configured to acquire, in response to a face recognition operation, second face data authorized to be collected by the target user account, a first derived parameter associated with the identity identifier of the target user account, and first face encrypted data of the target user account when the terminal is in a locked mode;

[0023] The second generating module is further used to generate the first key based on the identity identifier, the first derived parameter and the initial key;

[0024] a decryption module, configured to decrypt the first face encrypted data using the first key to obtain the first face data;

[0025] The unlocking module is used to perform an unlocking operation when the second facial data is consistent with the first facial data, so as to put the terminal into an unlocking mode.

[0026] In some embodiments, the acquisition module is used to obtain the second facial data authorized to be collected by the target user account and the identity identifier of the target user account in response to the facial recognition operation; when the first facial encrypted data is stored in the storage unit corresponding to the identity identifier, obtain the first derived parameter associated with the first facial encrypted data and the identity identifier from the storage unit.

[0027] In some embodiments, the unlocking module is also used to keep the unlocking mode unchanged and display a prompt message when the first facial encryption data is not stored in the storage unit corresponding to the identity identifier or the second facial data is inconsistent with the first facial data, and the prompt message is used to indicate that the unlocking failed.

[0028] In some embodiments, the unlocking module is used to match the second facial data with the first facial data, determine the similarity between the second facial data and the first facial data, and the similarity is used to indicate the degree of similarity between the second facial data and the first facial data; when the similarity is greater than a similarity threshold, the unlocking operation is performed.

[0029] In some embodiments, the acquisition module is further used to obtain the third face data authorized to be collected by the target user account in response to the face registration operation;

[0030] The encryption module is also used to encrypt the third facial data based on the first key to obtain second facial encrypted data of the target user account when the third facial data is inconsistent with the first facial data.

[0031] In some embodiments, the acquisition module is further used to obtain the third face data authorized to be collected by the target user account in response to the face registration operation;

[0032] The first generating module is further configured to generate a second derived parameter associated with the identity identifier based on the third facial data when the third facial data is inconsistent with the first facial data;

[0033] The second generating module is further used to generate a second key based on the second derived parameter, the identity identifier and the initial key, where the second key is a symmetric key associated with the identity identifier;

[0034] The encryption module is also used to encrypt the third facial data using the second key to obtain the second facial encrypted data of the target user account.

[0035] In some embodiments, the identity identifier is associated with a plurality of derived parameters, the target user account includes a plurality of face encryption data, and the plurality of derived parameters correspond one-to-one to the plurality of face encryption data;

[0036] The acquisition module is further configured to acquire, in response to a face recognition operation, the fourth face data authorized to be collected by the target user account, the multiple derived parameters, and the multiple face encrypted data when the terminal is in a locked mode;

[0037] The second generating module is further used to generate a target key for any derived parameter based on the initial key, the identity identifier and the derived parameter, wherein the target key is a symmetric key associated with the identity identifier;

[0038] The decryption module is further used to decrypt the face encrypted data corresponding to the derived parameters based on the target key to obtain the face data;

[0039] The decryption module is further configured to, when the fourth facial data is consistent with the facial data, perform an unlocking operation to put the terminal into an unlocking mode.

[0040] According to another aspect of an embodiment of the present application, an electronic device is provided, comprising a processor and a memory; the memory stores at least one program code, and the at least one program code is used to be executed by the processor to implement the face data encryption method as described in the above aspects.

[0041] According to another aspect of an embodiment of the present application, a computer-readable storage medium is provided, wherein the storage medium stores at least one program code, and the at least one program code is used to be executed by a processor to implement the face data encryption method as described in the above aspects.

[0042] According to another aspect of an embodiment of the present application, a chip is provided, which includes a programmable logic circuit and / or program instructions. When the chip runs on a computer device, it is used to implement the facial data encryption method described in the above aspects.

[0043] According to another aspect of an embodiment of the present application, a computer program product is provided, wherein the computer program product stores at least one program code, and the at least one program code is used to be executed by a processor to implement the facial data encryption method described in the above aspect.

[0044] The embodiment of the present application provides a facial data encryption method. When a user's facial registration operation is detected, the terminal can obtain the facial data authorized to be collected by the target user account and the identity of the target user account. The terminal generates a derived parameter associated with the identity of the target user account, and can generate a symmetric key for encrypting the facial data under the target user account based on the derived parameter, the identity and the initial key stored in the terminal, thereby realizing that facial data under different user accounts are encrypted using different keys. Even if the key of a user account is leaked, the attacker cannot directly decrypt the face encrypted data of other user accounts, which can reduce the risk of face encrypted data being leaked and improve data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0046] Figure 1 It is a schematic diagram of an implementation environment of a face data encryption method provided in an embodiment of the present application;

[0047] Figure 2 is a flow chart of a face data encryption method provided in an embodiment of the present application;

[0048] Figure 3 is a flow chart of another face data encryption method provided in an embodiment of the present application;

[0049] Figure 4 It is a structural schematic diagram of a face data encryption device provided in an embodiment of the present application;

[0050] Figure 5 It is a structural schematic diagram of another face data encryption device provided in an embodiment of the present application;

[0051] Figure 6 It is a structural block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0052] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0053] In this article, "at least one" means one or more, and "plurality" means two or more. "And / or" describes the association relationship of the associated objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0054] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions. For example, the facial data and facial images involved in this application are obtained with full authorization.

[0055] The face data encryption method provided in the embodiment of the present application can be executed by an electronic device. Taking the electronic device as a terminal as an example, Figure 1 Schematic diagram of the implementation environment of a face data encryption method provided in an embodiment of the present application. Figure 1 , the implementation environment includes a terminal 101 and a server 102. The terminal 101 and the server 102 are connected via a wireless network.

[0056] In some embodiments, the terminal 101 can be a mobile phone, a desktop computer, a laptop computer, a tablet computer, an intelligent voice interaction device, a vehicle-mounted terminal, and other types of terminals. A trusted execution environment TEE (Trusted Execution Environment) runs on the terminal 101. TEE provides a secure execution environment for trusted applications TA (Trusted Application), while also protecting the confidentiality, integrity, and access rights of TA's resources and data. A face recognition trusted application is installed on the terminal 101. The face recognition trusted application is a trusted application that runs in the TEE and is used to encrypt and decrypt face data.

[0057] In some embodiments, server 102 is an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. Server 102 is used to provide background services for face trust applications.

[0058] In some embodiments, the server 102 undertakes the main computing work and the terminal 101 undertakes the secondary computing work; or, the server 102 undertakes the secondary computing work and the terminal 101 undertakes the main computing work; or, the server 102 and the terminal 101 adopt a distributed computing architecture to perform collaborative computing.

[0059] Figure 2 This is a flow chart of a face data encryption method provided in an embodiment of the present application. The method is executed by an electronic device. In the embodiment of the present application, the method is described by taking execution by a terminal as an example. Figure 2 , the method comprising:

[0060] 201. In response to a face registration operation, the terminal generates a first derived parameter associated with an identity identifier of a target user account, where the target user account is a user account currently logged in by the terminal.

[0061] In an embodiment of the present application, a face recognition function is installed on the terminal. When the user turns on the face recognition function in the terminal for the first time, the terminal will require the user to register the face in order to register the user's face information on the terminal. Therefore, when the target user account authorizes the collection of face data, the terminal can respond to the user's face registration operation, collect the user's face through the camera, and obtain the user's first face data. Since the first face data is used as a reference for subsequent face recognition of the user, it needs to be encrypted and saved on the terminal. Therefore, in order to avoid the leakage of the first face data, the terminal can generate a first derived parameter associated with the identity identifier of the target user account. Among them, the target user account is the user account currently logged in by the terminal, and the identity identifier is used to identify and verify the identity of the target user account. Each user account has a unique corresponding identity identifier. The first derived parameter is used to generate a symmetric key for encrypting the first face data.

[0062] 202. The terminal generates a first key based on the initial key, the identity identifier and the first derived parameter, where the initial key is a symmetric key associated with the device identifier of the terminal, and the first key is a symmetric key associated with the identity identifier.

[0063] In the embodiment of the present application, the initial key is a symmetric key associated with the device identifier of the terminal. Before the terminal leaves the factory, the terminal can randomly generate a symmetric key as the initial key for subsequent encryption of facial data in the terminal. After generating the first derived parameter, the terminal can generate a first key associated with the identity identifier based on the initial key, the identity identifier of the currently logged-in user account, and the first derived parameter associated with the identity identifier. Among them, the first key is a symmetric key, which can be used as both an encryption key and a decryption key.

[0064] 203. The terminal encrypts the first facial data authorized and collected by the target user account using the first key to obtain the first facial encrypted data of the target user account.

[0065] In an embodiment of the present application, since the first key is a symmetric key associated with the identity identifier of the target user account, when the first key is used as an encryption key, the terminal can use the first key to encrypt the first facial data authorized to be collected by the target user account, obtain the first facial encrypted data of the target user account, and store the first facial encrypted data in the storage unit corresponding to the identity identifier.

[0066] The embodiment of the present application provides a facial data encryption method. When a user's facial registration operation is detected, the terminal can obtain the facial data authorized to be collected by the target user account and the identity of the target user account. The terminal generates a derived parameter associated with the identity of the target user account, and can generate a symmetric key for encrypting the facial data under the target user account based on the derived parameter, the identity and the initial key stored in the terminal, thereby realizing that facial data under different user accounts are encrypted using different keys. Even if the key of a user account is leaked, the attacker cannot directly decrypt the face encrypted data of other user accounts, which can reduce the risk of face encrypted data being leaked and improve data security.

[0067] Figure 3 This is a flowchart of another face data encryption method provided in an embodiment of the present application. The method is executed by an electronic device. In the embodiment of the present application, the method is described by taking the execution by a terminal as an example. Figure 3 , the method comprising:

[0068] 301. In response to a face registration operation, the terminal obtains an identity identifier of a target user account, where the target user account is a user account currently logged in by the terminal.

[0069] In an embodiment of the present application, a face recognition function is installed on the terminal. When the user turns on the face recognition function in the terminal for the first time, the terminal will require the user to register the face in order to register the user's face information on the terminal. Therefore, when the target user account authorizes the collection of face data, in response to the user's face registration operation, the terminal can collect the user's face through the camera, obtain the user's first face data, and obtain the identity of the target user account. Among them, the target user account is the user account currently logged in by the terminal, and the identity is used to identify and verify the identity of the target user account. Each user account has a unique corresponding identity. Optionally, the first face data can be a face image of the user, or a face feature vector obtained after feature extraction of the face image of the user, which is not limited in the embodiment of the present application.

[0070] 302. The terminal randomly generates a random number for the target user account as a first derived parameter associated with the identity identifier.

[0071] In the embodiment of the present application, the first facial data is used as a reference for subsequent facial recognition of the user and needs to be encrypted and stored on the terminal. Therefore, in order to avoid leakage of the first facial data, in the security hardware, the terminal can randomly generate a random number as the first derived parameter associated with the identity identifier based on the identity identifier of the target user account. The first derived parameter is used to generate a symmetric key for encrypting the first facial data. If the terminal can generate different random numbers for different user accounts, the derived parameters associated with the identity identifiers of different user accounts will also be different.

[0072] In some embodiments, when the user first turns on the face recognition function in the terminal, in the trusted execution environment, the face recognition trusted application of the terminal can receive the face registration instruction, the identity of the target user account, and the first face data authorized to be collected by the target user account through the face recognition service. Then, the face recognition trusted application can send the face registration instruction and the identity of the target user account to the security hardware storing the initial key, so that the terminal can randomly generate a random number for the target user account in the security hardware as the first derived parameter associated with the identity.

[0073] In some embodiments, in addition to using the random number as the first derived parameter, the terminal can also randomly generate a random number for the target user account and then concatenate the random number and the identity identifier of the target user account to obtain the first derived parameter.

[0074] 303. The terminal generates a first key based on the initial key, the identity identifier and the first derived parameter, where the initial key is a symmetric key associated with the device identifier of the terminal, and the first key is a symmetric key associated with the identity identifier.

[0075] In the embodiment of the present application, the initial key is a symmetric key associated with the device identifier of the terminal. Before the terminal leaves the factory, the face recognition trusted application running in the trusted execution environment can randomly generate a symmetric key as the initial key for subsequent encryption of face data in the terminal. The face recognition trusted application can communicate with the security hardware of the terminal and transmit the initial key to the security hardware for storage. After generating the first derived parameter, the terminal can generate a first key associated with the identity identifier in the security hardware based on the initial key, the identity identifier of the currently logged-in user account, and the first derived parameter associated with the identity identifier through a key derivation algorithm. Among them, the first key is a symmetric key, which can be used as both an encryption key and a decryption key. The key derivation algorithm can adopt the international standard HKDF (HMAC-based Extract-and-Expand Key Derivation Function, a key derivation algorithm based on a hash function), and other derivation algorithms can also be adopted, which is not limited by the present application. The embodiment of the present application completes the key derivation operation in the security hardware, thereby ensuring that the first derived parameter associated with the initial key and the target user account is always in the security hardware, reducing the possibility of leakage of the initial key and the first derived parameter, and improving data security.

[0076] 304. The terminal encrypts the first facial data authorized and collected by the target user account using the first key to obtain the first facial encrypted data of the target user account.

[0077] In the embodiment of the present application, since the first key is a symmetric key associated with the identity identifier of the target user account, when the first key is used as an encryption key, the face recognition trusted application in the terminal can encrypt the first face data authorized to be collected by the target user account through the first key, obtain the first face encrypted data of the target user account, and store the first face encrypted data in the storage unit corresponding to the identity identifier. Optionally, the face recognition trusted application can store the first face encrypted data in the file directory corresponding to the identity identifier, and store the relevant information of the first face encrypted data (such as the size of the first face encrypted data, storage path, etc.) in the index file.

[0078] In some embodiments, the first face data is a face feature vector obtained after feature extraction of the first face image authorized to be collected by the target user account. Accordingly, in response to the face registration operation, the terminal displays an authorization prompt message, which is used to prompt whether to authorize the collection of face images; in response to the confirmation operation of the authorization prompt message, the terminal obtains the first face image authorized to be collected by the target user account; the terminal extracts features from the first face image to obtain the first face data. Among them, in response to the face registration operation, the terminal can collect the first face image of the user through the camera when obtaining the authorization of the target user account. After the face recognition trusted application in the terminal obtains the first face image through the face recognition server, the face recognition trusted application can extract features from the first face image to obtain the first face data. The first face data is used to indicate the face features of the user. Optionally, when collecting the face image of the user, the terminal can require the user to complete a specified action (such as blinking, shaking the head, turning the head to the left, etc.) for the camera to collect face images in different states.

[0079] In some embodiments, in a trusted execution environment, the terminal can store the identity of the target user account, the first derived parameter associated with the identity, and the first face encrypted data of the target user account in a storage unit corresponding to the identity. And, when the terminal is restored to factory settings or is in a flash mode, the terminal can clear the identity and the first derived parameter stored in the storage unit. Wherein, the storage unit is located in the security hardware, and the terminal can ensure the security of the data by storing and maintaining the identity of the target user account and the first derived parameter associated with it in the security hardware. And when the terminal is restored to factory settings or is in a flash mode, it indicates that the terminal is clearing its stored user data operation, and the terminal is likely to be in a lost state at this time, so the face recognition trusted application in the terminal can send a clear instruction to the security hardware to clear the identity and derived parameters stored in the security hardware to avoid data leakage.

[0080] In some embodiments, the terminal can perform a second encryption on the first face data to obtain the first face encrypted data. Specifically, the terminal first encrypts the first face data for the first time using the initial key. Then, the face encrypted data obtained by the first encryption is encrypted for the second time using the first key generated by the initial key, the identity identifier, and the first derived parameter to obtain the first face encrypted data. Accordingly, in the process of decrypting the first face encrypted data, the terminal needs to first decrypt the first face encrypted data using the first key, and then decrypt the first decrypted data based on the initial key to finally obtain the first face data. By performing a second encryption on the face data, the security of the face encrypted data can be improved.

[0081] 305. When the terminal is in a locked mode, in response to a face recognition operation, the terminal obtains the second face data collected with the authorization of the target user account, the first derived parameter associated with the identity identifier of the target user account, and the first face encrypted data of the target user account.

[0082] In an embodiment of the present application, the terminal can be in a locked mode when there is no operation for a long time or a lock operation is performed on the terminal using a specific function key. When the terminal is in a locked mode, the terminal can perform an unlocking operation based on the user's face recognition operation when the user's face data is consistent with the pre-stored face data. Accordingly, in response to the face recognition operation, the terminal can collect the user's second face data through the camera after obtaining authorization from the target user account, and obtain the first derived parameter associated with the identity identifier and the first face encrypted data obtained by encrypting the first face data during face registration.

[0083] In some embodiments, during the face registration process, the terminal can store the identity of the target user account, the first derived parameter associated with the identity, and the first face encrypted data of the target user account in a storage unit corresponding to the identity. Accordingly, in response to the face recognition operation, the terminal can obtain the second face data authorized to be collected by the target user account and the identity of the target user account. Based on the identity, the terminal can search for the first face encrypted data in the storage unit corresponding to the identity, and when the first face encrypted data is found, obtain the first face encrypted data and the first derived parameter associated with the identity from the storage unit.

[0084] In some embodiments, when a user performs face recognition, in a trusted execution environment, the terminal's face recognition trusted application can receive face recognition instructions, real-time captured second face data, and the identity of the target user account through the face recognition service. Then, the face recognition trusted application can search for the first face encrypted data in the storage unit corresponding to the identity based on the identity, and obtain the first face encrypted data from the storage unit when the first face encrypted data is found. The face recognition trusted application can also transmit the face recognition instruction and the identity to the terminal's security hardware, so that the terminal can search for the first derived parameter associated with the identity in the security hardware according to the identity, and obtain the first derived parameter when the first derived parameter is found.

[0085] 306. The terminal generates a first key based on the identity identifier, the first derived parameter, and the initial key.

[0086] In an embodiment of the present application, after the first face data is encrypted using the first key, the terminal can clear the first key in time, which can reduce the storage burden and the risk of the first key being stolen, thereby improving the security of the data. Therefore, after the terminal obtains the identity identifier and the first derived parameter associated with the identity identifier, the terminal can regenerate the first key associated with the identity identifier in the security hardware based on the initial key, the identity identifier and the first derived parameter through a key derivation algorithm. Among them, the first key is a symmetric key, which can be used as both an encryption key and a decryption key. The key derivation algorithm can adopt the international standard HKDF (HMAC-based Extract-and-Expand KeyDerivation Function, a key derivation algorithm based on a hash function), and other derivation algorithms can also be adopted, which is not limited by the present application. The embodiment of the present application completes the key derivation operation in the security hardware, thereby ensuring that the initial key and the first derived parameter are always in the security hardware, reducing the possibility of leakage of the initial key and the first derived parameter, and improving data security.

[0087] 307. The terminal decrypts the first face encrypted data using the first key to obtain the first face data.

[0088] In an embodiment of the present application, since the first key is a symmetric key associated with the identity identifier of the target user account, when the first key is used as a decryption key, the terminal can use the first key to decrypt the first face encrypted data obtained during face registration to obtain the first face data of the target user account.

[0089] 308. When the second facial data is consistent with the first facial data, the terminal performs an unlocking operation to put the terminal in an unlocked mode.

[0090] In an embodiment of the present application, when the second facial data is consistent with the first facial data, it indicates that the second facial data collected by the terminal during the facial recognition process and the first facial data collected during the facial registration process are facial data of the same person, so the terminal can perform an unlocking operation to put the terminal in unlocked mode.

[0091] In some embodiments, the terminal can perform an unlocking operation when the similarity between the first face data and the second face data is greater than a similarity threshold. Accordingly, the terminal determines the similarity between the second face data and the first face data by matching the second face data with the first face data, and the similarity is used to indicate the degree of similarity between the second face data and the first face data; when the similarity is greater than the similarity threshold, the terminal performs an unlocking operation. When the similarity is not greater than the similarity threshold, the terminal does not perform an unlocking operation and keeps the lock mode unchanged. Wherein, when the first face data and the second face data are face images, before performing face comparison, the terminal can first perform feature extraction on the first face data and the second face data respectively to obtain a feature vector of the face data. Then the terminal can determine the similarity between the first face data and the second face data by determining the distance between the feature vector of the first face data and the feature vector of the second face data. The smaller the distance, the higher the similarity, and the higher the degree of similarity between the face data. When the similarity is greater than the similarity threshold, it indicates that the first face data and the second face data are very similar, and the second face data and the first face data are largely the face data of the same person, and the terminal can perform the unlocking operation. Optionally, the first face data and the second face data can also be face data obtained by extracting features from face images, that is, feature vectors.

[0092] In some embodiments, when the first face encryption data is not stored in the storage unit corresponding to the identity identifier or the second face data is inconsistent with the first face data, the terminal maintains the unlock mode unchanged and displays a prompt message, which is used to prompt that the unlocking failed. Among them, when the first face encryption data is not stored in the storage unit corresponding to the identity identifier, it indicates that the terminal does not store the face encryption data of the user account that is undergoing face recognition, so the terminal cannot perform the unlocking operation based on the second face data of the user account. When the second face data is inconsistent with the first face data, it indicates that the second face data collected by the terminal during the face recognition process and the first face data collected during the face registration process are not the face data of the same person, and the terminal cannot perform the unlocking operation, and the unlocking mode needs to be kept unchanged.

[0093] In some embodiments, for a target user account, when the terminal is able to record multiple facial data collected with authorization by the target user account, the terminal can encrypt the newly recorded facial data through the following method one and method two.

[0094] Method 1: The terminal can use the same key to encrypt different facial data authorized to be collected by the target user account. Accordingly, in response to the face registration operation, the terminal obtains the third facial data authorized to be collected by the target user account; when the third facial data is inconsistent with the first facial data, the terminal encrypts the third facial data based on the first key to obtain the second facial encrypted data of the target user account. After the terminal enters the first facial data authorized to be collected by the target user account, the user performs the face registration operation, and the terminal can obtain the third facial data authorized to be collected by the target user account. When the third facial data is inconsistent with the first facial data, it indicates that the third facial data and the first facial data are not facial data of the same person. For example, the first facial data is the facial data of the user himself, and the third facial data is the facial data of the user's relatives. At this time, the terminal can encrypt the third facial data based on the first key used to encrypt the first facial data to obtain the encrypted data of the third facial data, that is, the second facial encrypted data of the target user account.

[0095] Method 2: The terminal can use different keys to encrypt different facial data authorized to be collected by the target user account. Accordingly, in response to the face registration operation, the terminal obtains the third facial data authorized to be collected by the target user account; when the third facial data is inconsistent with the first facial data, the terminal generates a second derived parameter associated with the identity identifier based on the third facial data; based on the second derived parameter, the identity identifier and the initial key, a second key is generated, and the second key is a symmetric key associated with the identity identifier; the third facial data is encrypted by the second key to obtain the second facial encrypted data of the target user account. Among them, after the terminal enters the first facial data authorized to be collected by the target user account, the user performs the face registration operation, and the terminal can obtain the third facial data authorized to be collected by the target user account. When the third facial data is inconsistent with the first facial data, it indicates that the third facial data and the first facial data are not facial data of the same person. Therefore, in order to ensure that different facial data are encrypted using different keys, the terminal can regenerate the derived parameters used to generate the key for the third facial data, that is, generate the second derived parameters associated with the identity identifier of the target user account. The second derived parameter is a derived parameter used to generate a key for encrypting third facial data and is different from the first derived parameter. Similar to the process of generating the first key, the terminal can also generate a second key based on the second derived parameter, the identity identifier and the initial key. The second key is a symmetric key, which can be used as an encryption key or a decryption key. The terminal can encrypt the third facial data through the second key to obtain the encrypted data of the third facial data, that is, the second facial encrypted data of the target user account. In addition to using different keys to encrypt facial data under different user accounts, the terminal can also use different keys to encrypt different facial data under the same user account, further improving the security of facial data.

[0096] In some embodiments, when the terminal stores multiple face encryption data of the target user account, when performing face recognition, the terminal can sequentially compare the face data collected during face recognition with the multiple face data after decryption of the multiple face encryption data to see if they are consistent. Accordingly, when the terminal is in a locked mode, in response to the face recognition operation, the fourth face data, multiple derived parameters and multiple face encryption data authorized to be collected by the target user account are obtained; for any derived parameter, a target key is generated based on the initial key, the identity identifier and the derived parameter, and the target key is a symmetric key associated with the identity identifier; based on the target key, the face encryption data corresponding to the derived parameter is decrypted to obtain the face data; when the fourth face data and the face data are consistent, an unlocking operation is performed to put the terminal in a non-locked mode. Among them, the identity identifier of the target user account is associated with multiple derived parameters, and each derived parameter is used to generate a key for encrypting face data. Therefore, the terminal stores multiple face encryption data of the target user account, and the multiple derived parameters correspond to the multiple face encryption data one by one. When the terminal is in lock mode, the terminal can collect the fourth face data of the user through the camera according to the face recognition operation of the user and obtain the authorization of the target user account, and obtain multiple derived parameters associated with the identity identifier and multiple face encrypted data of the target user account. Then, the terminal can generate multiple target keys for decrypting the face encrypted data based on multiple derived parameters, the identity identifier and the initial key, so that the terminal can decrypt the multiple face encrypted data of the multiple derived parameters one by one based on the multiple target keys to obtain multiple face data. When the fourth face data is consistent with any face data of the multiple face data, it indicates that the fourth face data and the face data belong to the same person, so the terminal can perform the unlocking operation.

[0097] The embodiment of the present application provides a facial data encryption method. When a user's facial registration operation is detected, the terminal can obtain the facial data authorized to be collected by the target user account and the identity of the target user account. The terminal generates a derived parameter associated with the identity of the target user account, and can generate a symmetric key for encrypting the facial data under the target user account based on the derived parameter, the identity and the initial key stored in the terminal, thereby realizing that facial data under different user accounts are encrypted using different keys. Even if the key of a user account is leaked, the attacker cannot directly decrypt the face encrypted data of other user accounts, which can reduce the risk of face encrypted data being leaked and improve data security.

[0098] All the above optional technical solutions can be arbitrarily combined to form optional embodiments of the present application, which will not be described one by one here.

[0099] The following is an embodiment of the device of the present application, which can be used to execute the embodiment of the method of the present application. For details not disclosed in the embodiment of the device of the present application, please refer to the embodiment of the method of the present application.

[0100] Figure 4 Schematic diagram of the structure of a face data encryption device provided in an embodiment of the present application. Figure 4 , the device comprises:

[0101] A first generating module 401 is used to generate a first derived parameter associated with an identity identifier of a target user account in response to a face registration operation, where the user account is a user account currently logged in by the terminal;

[0102] A second generating module 402, configured to generate a first key based on an initial key, an identity identifier and a first derived parameter, wherein the initial key is a symmetric key associated with a device identifier of the terminal, and the first key is a symmetric key associated with the identity identifier;

[0103] The encryption module 403 is used to encrypt the first facial data authorized and collected by the target user account using the first key to obtain the first facial encrypted data of the target user account.

[0104] In some embodiments, Figure 5 FIG. 1 is a schematic diagram of another facial data encryption device provided in an embodiment of the present application. Figure 5 , the first generation module 401 includes:

[0105] The acquisition unit 501 is used to obtain the identity of the target user account in response to the face registration operation;

[0106] The generating unit 502 is used to randomly generate a random number for the target user account as a first derived parameter associated with the identity identifier.

[0107] In some embodiments, the first generation module 401 is also used to display authorization prompt information in response to a face registration operation, and the authorization prompt information is used to prompt whether to authorize the collection of face images; in response to a confirmation operation on the authorization prompt information, obtain the first face image authorized for collection by the target user account; perform feature extraction on the first face image to obtain the first face data.

[0108] In some embodiments, see Figure 5 , the device further comprises:

[0109] The storage module 404 is used to store the identity identifier of the target user account, the first derived parameter, and the first face encryption data in a storage unit corresponding to the identity identifier in the trusted execution environment;

[0110] The clearing module 405 is used to clear the identity identifier and the first derived parameter stored in the storage unit when the terminal is restored to factory settings or is in a flashing mode.

[0111] In some embodiments, see Figure 5 , the device further comprises:

[0112] The acquisition module 406 is used to acquire, in response to the face recognition operation, the second face data authorized to be collected by the target user account, the first derived parameter associated with the identity identifier of the target user account, and the first face encrypted data of the target user account when the terminal is in the locked mode;

[0113] The second generating module 402 is further used to generate a first key based on the identity identifier, the first derived parameter and the initial key;

[0114] The decryption module 407 is used to decrypt the first face encrypted data using the first key to obtain the first face data;

[0115] The unlocking module 408 is used to perform an unlocking operation when the second face data is consistent with the first face data, so as to put the terminal into an unlocking mode.

[0116] In some embodiments, the acquisition module 406 is used to obtain the second facial data authorized to be collected by the target user account and the identity identifier of the target user account in response to the facial recognition operation; when the first facial encrypted data is stored in the storage unit corresponding to the identity identifier, the first derived parameter associated with the first facial encrypted data and the identity identifier is obtained from the storage unit.

[0117] In some embodiments, the unlocking module 408 is also used to keep the unlocking mode unchanged and display a prompt message when the first face encryption data is not stored in the storage unit corresponding to the identity identifier or the second face data is inconsistent with the first face data, and the prompt message is used to indicate that the unlocking failed.

[0118] In some embodiments, the unlocking module 408 is used to match the second facial data with the first facial data, determine the similarity between the second facial data and the first facial data, and the similarity is used to indicate the degree of similarity between the second facial data and the first facial data; when the similarity is greater than a similarity threshold, perform an unlocking operation.

[0119] In some embodiments, the acquisition module 406 is further used to obtain the third face data authorized to be collected by the target user account in response to the face registration operation;

[0120] The encryption module 403 is also used to encrypt the third facial data based on the first key to obtain the second facial encrypted data of the target user account when the third facial data is inconsistent with the first facial data.

[0121] In some embodiments, the acquisition module 406 is further used to obtain the third face data authorized to be collected by the target user account in response to the face registration operation;

[0122] The first generating module 401 is further configured to generate a second derived parameter associated with the identity identifier based on the third facial data when the third facial data is inconsistent with the first facial data;

[0123] The second generating module 402 is further used to generate a second key based on the second derived parameter, the identity identifier and the initial key, where the second key is a symmetric key associated with the identity identifier;

[0124] The encryption module 403 is also used to encrypt the third face data using the second key to obtain the second face encrypted data of the target user account.

[0125] In some embodiments, the identity identifier is associated with a plurality of derived parameters, the target user account includes a plurality of face encrypted data, and the plurality of derived parameters correspond one-to-one to the plurality of face encrypted data;

[0126] The acquisition module 406 is further used to acquire, in response to the face recognition operation, the fourth face data, the multiple derived parameters and the multiple face encrypted data authorized to be collected by the target user account when the terminal is in the locked mode;

[0127] The second generating module 402 is further used to generate a target key for any derived parameter based on the initial key, the identity identifier and the derived parameter, where the target key is a symmetric key associated with the identity identifier;

[0128] The decryption module 407 is further used to decrypt the face encrypted data corresponding to the derived parameters based on the target key to obtain the face data;

[0129] The decryption module 408 is further configured to, when the fourth facial data is consistent with the facial data, perform an unlocking operation to put the terminal into an unlocking mode.

[0130] The embodiment of the present application provides a facial data encryption device. When a user's facial registration operation is detected, the terminal can obtain the facial data authorized to be collected by the target user account and the identity of the target user account. The terminal generates a derived parameter associated with the identity of the target user account, and can generate a symmetric key for encrypting the facial data under the target user account based on the derived parameter, the identity and the initial key stored in the terminal, thereby realizing that facial data under different user accounts are encrypted with different keys. Even if the key of a user account is leaked, the attacker cannot directly decrypt the face encrypted data of other user accounts, which can reduce the risk of face encrypted data being leaked and improve data security.

[0131] It should be noted that the device provided in the above embodiment, when implementing its functions, only uses the division of the above functional modules as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the server is divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiment belong to the same concept, and their specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0132] An embodiment of the present application provides an electronic device, which includes a processor and a memory; the memory stores at least one program code, and the at least one program code is used to be executed by the processor to implement the face data encryption method provided in the above-mentioned method embodiments.

[0133] Figure 6 6 is a block diagram of a structure of an electronic device 600 provided according to an embodiment of the present application. In some embodiments, the electronic device 600 is a smart phone, a tablet computer, a computer with wireless communication function, or a wearable device. The electronic device 600 in the present application includes at least one or more of the following components: a processor 610, a memory 620, and at least two wireless links 630.

[0134] In some embodiments, the processor 610 includes one or more processing cores. The processor 610 uses various interfaces and lines to connect various parts of the entire electronic device 600, and executes various functions and processes data of the electronic device 600 by running or executing program codes stored in the memory 620, and calling data stored in the memory 620. In some embodiments, the processor 610 is implemented in at least one hardware form of digital signal processing (DSP), field programmable gate array (FPGA), and programmable logic array (PLA). The processor 610 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), a neural network processor (NPU), and a modem. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the NPU is used to implement artificial intelligence (AI) functions; and the modem is used to process wireless communications. It is understandable that the above-mentioned modem may not be integrated into the processor 610, but may be implemented by a separate chip.

[0135] In some embodiments, the processor 610 is used to control the working conditions of at least two wireless links 630. Accordingly, the processor 610 is a processor integrated with a wireless fidelity (Wireless Fidelity, Wi-Fi) chip. The Wi-Fi chip is a chip with dual Wi-Fi processing capabilities. For example, the Wi-Fi chip is a dual-band dual concurrent (Dual Band Dual Concurrent, DBDC) chip, or a dual-band synchronous (Dual Band Simultaneous, DBS) chip, etc.

[0136] In some embodiments, the memory 620 includes a random access memory (RAM), and in some embodiments, the memory 620 includes a read-only memory (ROM). In some embodiments, the memory 620 includes a non-transitory computer-readable storage medium. The memory 620 can be used to store program codes. The memory 620 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the following various method embodiments, etc.; the data storage area may store data (such as audio data, a phone book) created according to the use of the electronic device 600, etc.

[0137] In some embodiments, the memory 620 stores reception schemes for receiving beacon frames of different wireless links 630, as well as identifiers of access nodes connected to different wireless links 630, identifiers of wireless links 630, and the like.

[0138] The at least two wireless links 630 are used to connect different access points (APs) to receive downlink data sent by the APs, wherein the different access points are access points in the same router or access points in different routers.

[0139] In some embodiments, the electronic device 600 also includes a display screen. The display screen is a display component that displays a user interface. In some embodiments, the display screen is a display screen with a touch function, through which the user can use any suitable object such as a finger or a stylus to perform touch operations on the display screen. In some embodiments, the display screen is generally arranged on the front panel of the electronic device 600. In some embodiments, the display screen is designed to be a full screen, a curved screen, a special-shaped screen, a double-sided screen, or a folding screen. In some embodiments, the display screen is also designed to be a combination of a full screen and a curved screen, a combination of a special-shaped screen and a curved screen, etc., which is not limited in this embodiment.

[0140] In addition, those skilled in the art will appreciate that the structure of the electronic device 600 shown in the above figures does not limit the electronic device 600, and the electronic device 600 includes more or fewer components than shown, or combines certain components, or arranges components differently. For example, the electronic device 600 also includes components such as a microphone, a speaker, an input unit, a sensor, an audio circuit, a module, a power supply, and a Bluetooth module, which will not be described in detail here.

[0141] The present application also provides a computer-readable storage medium, which stores at least one program code, and the at least one program code is loaded and executed by the processor to implement the face data encryption method shown in the above embodiments.

[0142] The present application also provides a chip, which includes a programmable logic circuit and / or program instructions. When the chip runs on a terminal, it is used to implement the facial data encryption method shown in the above embodiments.

[0143] The present application also provides a computer program product, which stores at least one program code, and the at least one program code is used to be executed by a processor to implement the face data encryption method shown in the above embodiments.

[0144] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0145] A person of ordinary skill in the art can understand that all or part of the steps in the face data encryption method of the above embodiment can be completed by hardware, or by a program to instruct the relevant hardware to complete the steps. The program can be stored in a computer-readable storage medium, and the storage medium mentioned above can be a read-only memory, a disk or an optical disk, etc. The above is only an optional embodiment of the present application and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A facial data encryption method, characterized in that: The method comprises: In response to the face registration operation, generating a first derived parameter associated with an identity identifier of a target user account, wherein the target user account is a user account currently logged in by the terminal; Generate a first key based on an initial key, the identity identifier and the first derived parameter, wherein the initial key is a symmetric key associated with the device identifier of the terminal, and the first key is a symmetric key associated with the identity identifier; The first face data authorized to be collected by the target user account is encrypted by using the first key to obtain the first face encrypted data of the target user account.

2. The method according to claim 1, characterized in that The step of generating, in response to the face registration operation, a first derived parameter associated with the identity identifier of the target user account comprises: In response to the face registration operation, obtaining the identity identifier of the target user account; A random number is randomly generated for the target user account as a first derived parameter associated with the identity identifier.

3. The method according to claim 1, characterized in that The method further comprises: In response to the face registration operation, displaying authorization prompt information, wherein the authorization prompt information is used to prompt whether to authorize the collection of face images; In response to a confirmation operation on the authorization prompt information, obtaining a first facial image authorized to be collected by the target user account; Perform feature extraction on the first face image to obtain the first face data.

4. The method according to claim 1, characterized in that The method further comprises: Storing the target user account's identity, the first derived parameter, and the first face encrypted data in a storage unit corresponding to the identity in a trusted execution environment; When the terminal is restored to factory settings or is in a flashing mode, the identity identifier and the first derived parameter stored in the storage unit are cleared.

5. The method according to claim 1, characterized in that The method further comprises: When the terminal is in a locked mode, in response to a face recognition operation, obtaining second face data authorized to be collected by the target user account, a first derived parameter associated with the identity identifier of the target user account, and first face encrypted data of the target user account; Generate the first key based on the identity, the first derived parameter and the initial key; Decrypting the first face encrypted data using the first key to obtain the first face data; When the second facial data is consistent with the first facial data, an unlocking operation is performed to put the terminal in an unlocked mode.

6. The method according to claim 5, characterized in that The step of obtaining, in response to the face recognition operation, the second face data authorized to be collected by the target user account, the first derived parameter associated with the identity identifier of the target user account, and the first face encrypted data of the target user account includes: In response to the face recognition operation, obtaining the second face data authorized to be collected by the target user account and the identity identifier of the target user account; In a case where the first face encrypted data is stored in a storage unit corresponding to the identity identifier, a first derived parameter associated with the first face encrypted data and the identity identifier is obtained from the storage unit.

7. The method according to claim 6, characterized in that The method further comprises: When the first facial encryption data is not stored in the storage unit corresponding to the identity identifier or the second facial data is inconsistent with the first facial data, the unlocking mode is maintained unchanged and a prompt message is displayed, wherein the prompt message is used to indicate that the unlocking fails.

8. The method according to claim 5, characterized in that The performing an unlocking operation when the second face data is consistent with the first face data includes: matching the second facial data with the first facial data to determine the similarity between the second facial data and the first facial data, wherein the similarity is used to indicate the degree of similarity between the second facial data and the first facial data; When the similarity is greater than a similarity threshold, the unlocking operation is performed.

9. The method according to claim 1, characterized in that: The method further comprises: In response to the face registration operation, obtaining third-party face data collected with authorization from the target user account; When the third facial data is inconsistent with the first facial data, the third facial data is encrypted based on the first key to obtain second facial encrypted data of the target user account.

10. The method according to claim 1, characterized in that The method further comprises: In response to the face registration operation, obtaining third-party face data collected with authorization from the target user account; In the case where the third facial data is inconsistent with the first facial data, generating a second derived parameter associated with the identity identifier based on the third facial data; Generate a second key based on the second derived parameter, the identity identifier and the initial key, where the second key is a symmetric key associated with the identity identifier; The third facial data is encrypted using the second key to obtain the second facial encrypted data of the target user account.

11. The method according to claim 1, characterized in that: The identity identifier is associated with a plurality of derived parameters, the target user account includes a plurality of face encryption data, and the plurality of derived parameters correspond one-to-one to the plurality of face encryption data; The method further comprises: When the terminal is in a locked mode, in response to a face recognition operation, obtaining the fourth face data, the multiple derived parameters, and the multiple face encrypted data authorized to be collected by the target user account; For any derived parameter, generating a target key based on the initial key, the identity identifier and the derived parameter, the target key being a symmetric key associated with the identity identifier; Based on the target key, decrypt the face encrypted data corresponding to the derived parameter to obtain face data; When the fourth facial data is consistent with the facial data, an unlocking operation is performed to put the terminal in an unlocked mode.

12. A facial data encryption device, characterized in that: The device comprises: A first generating module, configured to generate, in response to a face registration operation, a first derived parameter associated with an identity identifier of a target user account, wherein the user account is a user account currently logged in by the terminal; A second generating module, configured to generate a first key based on an initial key, the identity identifier and the first derived parameter, wherein the initial key is a symmetric key associated with the device identifier of the terminal, and the first key is a symmetric key associated with the identity identifier; The encryption module is used to encrypt the first facial data authorized to be collected by the target user account through the first key to obtain the first facial encrypted data of the target user account.

13. An electronic device, characterized in that: The electronic device includes a processor and a memory; the memory stores at least one program code, and the at least one program code is used to be executed by the processor to implement the face data encryption method as described in any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that: The storage medium stores at least one program code, and the at least one program code is used to be executed by a processor to implement the face data encryption method as described in any one of claims 1 to 11.

15. A chip, characterized in that: The chip includes a programmable logic circuit and / or program instructions, and when the chip runs on the terminal, it is used to implement the facial data encryption method as described in any one of claims 1 to 11.

16. A computer program product comprising a computer program, characterized in that The computer program product stores at least one program code, and the at least one program code is used to be executed by a processor to implement the face data encryption method as described in any one of claims 1 to 11.

Images