User authentication methods, devices and equipment

Abstract

This application provides a user verification method, apparatus, and device, relating to the field of computer technology. The method includes: acquiring a user's face image to be verified and a device identifier of a target device; encrypting the face image to obtain first encrypted information; sending the device identifier and the first encrypted information to a server, the device identifier instructing the server to acquire second encrypted information of the target face corresponding to the device identifier, and determining third encrypted information based on the first and second encrypted information; receiving the third encrypted information sent by the server and decrypting the third encrypted information to obtain a similarity score; and determining that user verification is successful if the similarity score is less than or equal to a similarity threshold. This application avoids the leakage of the face image to be verified during the user verification process by not transmitting the key during the transmission of the first or third encrypted information.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a user authentication method, apparatus, and device. Background Technology

[0002] Users must be verified before they can use a target device. For example, in a ride-hailing scenario, drivers need to be verified to ensure that the driver and vehicle match when accepting a ride.

[0003] Currently, user verification mainly involves encrypting relevant data and sending it along with a key to the server for verification. The server then uses the key to decrypt the encrypted data and verify it. Once the verification is successful, the user can use the target device. It is evident that the current verification method has the problem of easy leakage of relevant data. Summary of the Invention

[0004] This application provides a user authentication method, apparatus, and device to solve the technical problem that current user authentication methods are prone to data leakage.

[0005] Firstly, this application provides a user authentication method applied to a terminal device, the user authentication method comprising:

[0006] Obtain the user's face image to be verified and the device identifier of the target device. The face image includes the face to be verified.

[0007] The face to be verified is encrypted to obtain the first encrypted information;

[0008] Send a device identifier and first encrypted information to the server. The device identifier is used to instruct the server to obtain the second encrypted information of the target face corresponding to the device identifier. Then, determine the third encrypted information based on the first and second encrypted information. The third encrypted information is the encrypted information of the similarity between the face to be verified and the target face.

[0009] Receive the third encrypted information sent by the server and decrypt the third encrypted information to obtain the similarity;

[0010] If the similarity is less than or equal to the similarity threshold, the user verification is deemed successful.

[0011] In some optional implementations, the face to be verified is encrypted to obtain first encrypted information, including:

[0012] Feature extraction is performed on the face image to be verified to obtain multiple first face feature vectors of the face to be verified;

[0013] Based on a preset fully homomorphic encryption algorithm, multiple first facial feature vectors are encrypted to obtain the first encrypted information.

[0014] In some optional implementations, the first encrypted information includes: first sub-encryption information and second sub-encryption information. Multiple first facial feature vectors are encrypted using a preset fully homomorphic encryption algorithm to obtain the first encrypted information, which includes:

[0015] Based on the fully homomorphic encryption algorithm, each first face feature vector is encrypted to obtain the first sub-encryption information of each first face feature vector;

[0016] Determine the first dot product among multiple first face feature vectors;

[0017] The first dot product is encrypted using a fully homomorphic encryption algorithm to obtain the second sub-encrypted information.

[0018] In some optional implementations, the face to be verified is encrypted to obtain first encrypted information, including:

[0019] Retrieve the public key of a preset key pair;

[0020] The first encrypted information is obtained by encrypting the face to be verified using the public key;

[0021] Decrypting the third encrypted information yields the similarity score, including:

[0022] Retrieve the private key of a preset key pair;

[0023] The similarity is obtained by decrypting the third encrypted information using the private key.

[0024] In some alternative implementations, the terminal device includes an in-vehicle terminal, the target device includes a vehicle, and after confirming that the user authentication is successful, it further includes:

[0025] Send the verification result to the server; the verification result indicates that the user has passed the verification.

[0026] Receive vehicle dispatch information from the server.

[0027] Secondly, this application provides a user authentication method applied to a server, the user authentication method including:

[0028] The receiving terminal device sends the device identifier and the first encrypted information of the face to be verified.

[0029] Obtain the second encrypted information of the target face corresponding to the device identifier;

[0030] Based on the first and second encrypted information, the third encrypted information is determined. The third encrypted information is the encrypted information of the similarity between the face to be verified and the target face.

[0031] A third encrypted message is sent to the terminal device, which instructs the terminal device to determine the verification result based on the third encrypted message.

[0032] In some alternative implementations, it also includes:

[0033] Receive a registration request from a terminal device. The registration request includes: device identifier and target face image.

[0034] Feature extraction is performed on the target face image to obtain multiple second face feature vectors of the target face;

[0035] Based on a preset fully homomorphic encryption algorithm, multiple second facial feature vectors are encrypted to obtain second encrypted information;

[0036] Store the second encrypted information.

[0037] In some optional implementations, the second encrypted information includes: third sub-encryption information and fourth sub-encryption information. Multiple second facial feature vectors are encrypted using a preset fully homomorphic encryption algorithm to obtain the second encrypted information, which includes:

[0038] Based on the fully homomorphic encryption algorithm, each second face feature vector is encrypted to obtain the third sub-encryption information of each second face feature vector;

[0039] Determine the second dot product among multiple second face feature vectors;

[0040] The second dot product is encrypted using a fully homomorphic encryption algorithm to obtain the fourth sub-encrypted information.

[0041] In some optional implementations, the first encrypted information includes: first sub-encrypted information and second sub-encrypted information; and the third encrypted information is determined based on the first encrypted information and the second encrypted information, including:

[0042] The third encrypted information is determined according to the following expression:

[0043]

[0044] Where d represents the similarity, E represents the fully homomorphic encryption algorithm, and E(d) 2 E(Dot) represents the third encrypted information. x E(Dot) represents the second encrypted sub-message. y E(x) represents the fourth encrypted information. i E(y) represents the first sub-encrypted information of the i-th first face feature vector. i ) represents the third sub-encrypted information of the i-th second facial feature.

[0045] In some alternative implementations, it also includes:

[0046] Receive the verification result sent by the terminal device; the verification result indicates that the user has passed the verification.

[0047] Send dispatch information to terminal devices.

[0048] Thirdly, this application provides a user authentication device applied to a terminal device, the user authentication device comprising:

[0049] The acquisition module is used to acquire the user's face image to be verified and the device identifier of the target device. The face image includes the face to be verified.

[0050] The encryption module is used to encrypt the face to be verified to obtain the first encrypted information;

[0051] The sending module is used to send a device identifier and first encrypted information to the server. The device identifier is used to instruct the server to obtain the second encrypted information of the target face corresponding to the device identifier, and to determine the third encrypted information based on the first encrypted information and the second encrypted information. The third encrypted information is encrypted information on the similarity between the face to be verified and the target face.

[0052] The decryption module is used to receive third-party encrypted information sent by the server and decrypt the third-party encrypted information to obtain the similarity.

[0053] The determination module is used to determine whether user verification is successful when the similarity is less than or equal to the similarity threshold.

[0054] Fourthly, this application provides a user authentication device applied to a server, the user authentication device comprising:

[0055] The receiving module is used to receive the device identifier and the first encrypted information of the face to be verified sent by the terminal device;

[0056] The acquisition module is used to acquire the second encrypted information of the target face corresponding to the device identifier;

[0057] The determining module is used to determine the third encrypted information based on the first encrypted information and the second encrypted information. The third encrypted information is encrypted information on the similarity between the face to be verified and the target face.

[0058] The sending module is used to send third encrypted information to the terminal device. The third encrypted information is used to instruct the terminal device to determine the verification result based on the third encrypted information.

[0059] Fifthly, this application provides a user authentication system, comprising: a terminal device and a server; wherein:

[0060] The terminal device is used to: acquire the user's face image to be verified and the device identifier of the target device, wherein the face image includes: the face to be verified; encrypt the face to be verified to obtain first encrypted information; and send the device identifier and the first encrypted information to the server.

[0061] The server is used to: obtain the second encrypted information of the target face corresponding to the device identifier; determine the third encrypted information based on the first and second encrypted information, wherein the third encrypted information is encrypted information on the similarity between the face to be verified and the target face; and send the third encrypted information to the terminal device.

[0062] The terminal device is also used to: decrypt the third encrypted information to obtain the similarity; and determine that the user verification is successful if the similarity is less than or equal to the similarity threshold.

[0063] Sixthly, this application provides a terminal device, including: a memory for storing computer programs;

[0064] A transceiver is used to send and receive data under the control of a processor.

[0065] A processor is used to read computer programs from memory and perform the following operations:

[0066] Obtain the user's face image to be verified and the device identifier of the target device. The face image includes the face to be verified.

[0067] The face to be verified is encrypted to obtain the first encrypted information;

[0068] Send a device identifier and first encrypted information to the server. The device identifier is used to instruct the server to obtain the second encrypted information of the target face corresponding to the device identifier. Then, determine the third encrypted information based on the first and second encrypted information. The third encrypted information is the encrypted information of the similarity between the face to be verified and the target face.

[0069] Receive the third encrypted information sent by the server and decrypt the third encrypted information to obtain the similarity;

[0070] If the similarity is less than or equal to the similarity threshold, the user verification is deemed successful.

[0071] In a seventh aspect, this application provides a server, including: a memory for storing computer programs;

[0072] A transceiver is used to send and receive data under the control of a processor.

[0073] A processor is used to read computer programs from memory and perform the following operations:

[0074] The receiving terminal device sends the device identifier and the first encrypted information of the face to be verified.

[0075] Obtain the second encrypted information of the target face corresponding to the device identifier;

[0076] Based on the first and second encrypted information, the third encrypted information is determined. The third encrypted information is the encrypted information of the similarity between the face to be verified and the target face.

[0077] A third encrypted message is sent to the terminal device, which instructs the terminal device to determine the verification result based on the third encrypted message.

[0078] Eighthly, this application provides a processor-readable storage medium storing a computer program for causing a processor to perform a user authentication method as provided in the first and / or second aspects.

[0079] Ninthly, this application provides a computer program product, comprising: a computer program that, when executed by a processor, implements the user authentication method provided in the first and / or second aspects.

[0080] This application provides a user verification method comprising: acquiring a user's face image to be verified and a device identifier of a target device, the face image including the face to be verified; encrypting the face to be verified to obtain first encrypted information; sending the device identifier and the first encrypted information to a server, the device identifier being used to instruct the server to acquire second encrypted information of the target face corresponding to the device identifier, and determining third encrypted information based on the first and second encrypted information, the third encrypted information being encrypted information of the similarity between the face to be verified and the target face; receiving the third encrypted information sent by the server and decrypting the third encrypted information to obtain a similarity; and determining that user verification is successful if the similarity is less than or equal to a similarity threshold. This application avoids the leakage of the face image to be verified during the user verification process by not transmitting the key during the transmission of the first or third encrypted information.

[0081] It should be understood that the content described in the foregoing summary section is not intended to limit the key or essential features of the embodiments of this application, nor is it intended to limit the scope of this application. Other features of this application will become readily apparent from the following description. Attached Figure Description

[0082] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0083] Figure 1 This is an application scenario diagram of a user authentication method provided in an embodiment of this application;

[0084] Figure 2 A flowchart illustrating the steps of a user authentication method provided in an embodiment of this application;

[0085] Figure 3 A flowchart illustrating the steps of another user authentication method provided in an embodiment of this application;

[0086] Figure 4 This is a schematic diagram of the structure of a user verification device provided in one embodiment of this application;

[0087] Figure 5 This is a schematic diagram of the structure of another user verification device provided in an embodiment of this application;

[0088] Figure 6 This application provides a schematic diagram of the structure of a user authentication system according to an embodiment of the present application.

[0089] Figure 7 This is a schematic diagram of the structure of a terminal device provided in an embodiment of this application;

[0090] Figure 8 This is a schematic diagram of the structure of a server provided in an embodiment of this application. Detailed Implementation

[0091] In this application, the term "and / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. In the embodiments of this application, the term "multiple" refers to two or more, and other quantifiers are similar.

[0092] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0093] To regulate ride-hailing operations, platforms need to remotely collect drivers' facial data before dispatching orders. This data is then transmitted to the server, which compares the facial image with the verified facial data of the vehicle stored in the platform's database to confirm the driver's identity. Currently, data collection is typically done through the driver's mobile phone camera. The platform dispatches orders only after verifying the driver and vehicle match. To improve system security, a cryptographic system is used to encrypt the facial data transmitted over the network and stored in the database. However, typical encryption schemes still require decryption of the facial data to perform the basic arithmetic operations needed for facial matching, and the private key needs to be sent to the server during the transmission of encrypted facial data, posing a risk of facial data leakage.

[0094] In view of this, the present application provides a user verification method in which the server does not need to decrypt the first encrypted information to realize user verification, thus avoiding the leakage of the face to be verified and improving the security of the verification process.

[0095] Reference Figure 1 The diagram illustrates an application scenario for a user authentication method. Figure 1 The system includes: a target device 11, a terminal device 12, a user 13, and a server 14. The target device 11 is, for example, a vehicle; the terminal device 12 is, for example, an in-vehicle terminal; and the server 14 is, for example, a server of a ride-hailing platform. If user 13 needs to drive the target device 11 and receive orders from the server 14 via the terminal device 12, user 13 needs to be verified to ensure consistency between the person and the vehicle. After user 13 is verified, an order is assigned to user 13 via the terminal device 12. This application aims to ensure the security of the user's face during the verification process.

[0096] The user verification method provided in this application can be applied not only to ride-hailing scenarios, but also to various cloud-edge collaborative privacy protection scenarios such as taxi driver facial verification and smart car safety officer facial verification, demonstrating strong generalization capabilities. Furthermore, the application does not limit the specific application scenarios.

[0097] It should be noted that the name of the terminal device may differ in different systems. For example, in this application, the terminal device may also be referred to as User Equipment (UE), or it may be a wireless terminal. The wireless terminal can communicate with one or more core networks (CNs) via a Radio Access Network (RAN). The wireless terminal can be a mobile terminal, such as a mobile phone (or "cellular" phone) or a computer with a mobile terminal. For example, it can be a portable, pocket-sized, handheld, computer-embedded, or vehicle-mounted mobile device that exchanges voice and / or data with the RAN. Examples include Personal Communication Service (PCS) phones, cordless phones, Session Initiated Protocol (SIP) phones, Wireless Local Loop (WLL) stations, and Personal Digital Assistants (PDAs). The wireless terminal may also be referred to as a system, subscriber unit, subscriber station, mobile station, mobile, remote station, access point, remote terminal, access terminal, user terminal, user agent, or user device, but is not limited to these terms in the embodiments of this application.

[0098] It should be noted that the methods and apparatus provided in the embodiments of this application are based on the same application concept. Since the methods and apparatus solve problems in similar principles, the implementation of the apparatus and methods can refer to each other, and repeated parts will not be described again.

[0099] The technical solutions of the embodiments of this application and how the technical solutions of this application solve the above-mentioned technical problems are described in detail below with specific examples. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0100] Please refer to Figure 2 , Figure 2 This is a flowchart illustrating the steps of a user authentication method provided in one embodiment of this application. Figure 2 As shown, this user authentication method is applied to a terminal device and specifically includes the following steps:

[0101] S201. Obtain the user's face image to be verified and the device identifier of the target device.

[0102] The facial image includes: the face to be verified. (See reference...) Figure 1 The user can be the driver of the vehicle, the target device can be the vehicle, and the face image to be verified can be one or more frames of image captured by the camera on the terminal device.

[0103] The device identifier of the target device can be preset. When the target device is a vehicle, the device identifier of the vehicle can be the license plate number.

[0104] S202, encrypt the face to be verified to obtain the first encrypted information.

[0105] In this embodiment, the face to be verified is encrypted, but the device identifier does not need to be encrypted, which can improve encryption efficiency.

[0106] In one optional embodiment, encrypting the face to be verified to obtain first encrypted information includes: obtaining the public key of a preset key pair; and encrypting the face to be verified according to the public key to obtain the first encrypted information.

[0107] It is understood that the terminal device initializes system parameters, which include: device identifier, similarity threshold, and preset key pair. This preset key pair includes a public key and a private key. The terminal device then stores the public and private keys, while the server stores the public key. In this embodiment, the private key is stored only on the terminal device, ensuring end-to-end encryption of the face to be verified. Only the terminal device can decrypt the data, thus achieving privacy protection.

[0108] Specifically, in the embodiments of this application, the key generation algorithm KeyGen(1) can be used first. λ Generates a preset key pair. The KeyGen() function uses a random algorithm with a security parameter of 1. λ The default key pair for the input is a public key pk and a private key sk.

[0109] It is understandable that encrypting the face to be verified to obtain the first encrypted information includes: extracting features from the face image to obtain multiple first face feature vectors of the face to be verified; and encrypting the multiple first face feature vectors according to a preset fully homomorphic encryption algorithm to obtain the first encrypted information.

[0110] In this embodiment, a preset neural network model is used to extract features from the face image to be verified to obtain multiple first face feature vectors, wherein the multiple first face feature vectors can be represented as x = {x1, ..., x...} m}, where m represents the number of multiple first face feature vectors, and xi Let i represent the first face feature vector of the i-th face.

[0111] Among them, neural network models such as FaceNet (a face recognition model) can be used. In addition, other neural network models can also be used, which are not limited here.

[0112] Furthermore, the public key of the fully homomorphic encryption algorithm is the public key of a preset key pair. The fully homomorphic encryption algorithm is such as CKKS (a fully homomorphic encryption algorithm) or TFHE (a fully homomorphic encryption algorithm). This application does not limit the specific fully homomorphic encryption algorithm.

[0113] In this embodiment of the application, the use of a fully homomorphic encryption algorithm can realize the encrypted transmission of the face to be verified to the server for calculation, and the verification of the face to be verified can be completed without decryption, thus possessing the feature of protecting the security of the face to be verified.

[0114] Furthermore, the first encrypted information includes: first sub-encryption information and second sub-encryption information. The first encrypted information is obtained by encrypting multiple first face feature vectors according to a preset fully homomorphic encryption algorithm, including: encrypting each first face feature vector according to the fully homomorphic encryption algorithm to obtain first sub-encryption information for each first face feature vector; determining the first dot product between multiple first face feature vectors; and encrypting the first dot product according to the fully homomorphic encryption algorithm to obtain second sub-encryption information.

[0115] Wherein, each first face feature vector x i This corresponds to a first sub-encrypted message. If the fully homomorphic encryption algorithm is represented by E, then the first facial feature vector x i The first sub-encrypted information is represented as E(x) i ).

[0116] Furthermore, the first point of accumulation (Dot) x The following expression (1) is used to determine:

[0117]

[0118] Among them, Dot x Let x = {x1, ..., x2} represent the first dot product. m} and x={x1,…,x m The dot product of}.

[0119] In this embodiment of the application, the second sub-encryption information adopts E(Dot) x )express.

[0120] It is understood that in this embodiment of the application, the encrypted transmission of the first face feature vector includes the encryption of each first face feature vector and the encryption of the first dot product, which further improves the security of the face to be verified.

[0121] S203, send the device identifier and first encrypted information to the server.

[0122] In this embodiment of the application, the terminal device sends the device identifier and the first encrypted information to the server together.

[0123] The device identifier is used to instruct the server to obtain the second encrypted information of the target face corresponding to the device identifier, and to determine the third encrypted information based on the first and second encrypted information. The third encrypted information is encrypted information on the similarity between the face to be verified and the target face.

[0124] It is understandable that the server stores the second encrypted information corresponding to the device identifier. The second encrypted information is obtained by encrypting the target face, and the encryption method of the target face is the same as the encryption method of the face to be verified.

[0125] S204: Receive the third encrypted information sent by the server and decrypt the third encrypted information to obtain the similarity score.

[0126] In this embodiment of the application, after determining the third encrypted information, the server sends the third encrypted information to the terminal device. The third encrypted information is also obtained using a fully homomorphic encryption algorithm.

[0127] In one optional embodiment, decrypting the third encrypted information to obtain a similarity score includes: obtaining the private key of a preset key pair; and decrypting the third encrypted information based on the private key to obtain a similarity score.

[0128] It can be understood that the decryption key for the third encrypted information is the private key sk of the aforementioned predetermined key pair. Using this private key sk to decrypt the third encrypted information yields the similarity d between the face to be verified and the target face.

[0129] S205, if the similarity is less than or equal to the similarity threshold, the user verification is deemed successful.

[0130] In this embodiment of the application, a similarity threshold D can be preset. If d≤D, it can be determined that the user verification is successful. If d>D, it can be determined that the user verification failed.

[0131] The terminal device in this application has a certain computing power and can deploy neural network models and fully homomorphic encryption algorithms.

[0132] In one optional embodiment, the terminal device includes an in-vehicle terminal, the target device includes a vehicle, and after determining that the user has passed verification, the method further includes: sending a verification result to the server, the verification result indicating that the user has passed verification; and receiving the server's dispatch information for the vehicle.

[0133] The face image to be verified can be captured by a camera on the vehicle terminal. This can prevent users from sending target face data to the server using face-swapping technology, thereby improving the accuracy of user verification and avoiding violations and security risks.

[0134] Furthermore, in-vehicle terminals can be upgraded, including in-vehicle cameras or dashcams.

[0135] It is understandable that if the user verification is successful, the terminal device sends the verification result to the server, and the server can then send dispatch information to the vehicle, which is the order information for the ride-hailing service.

[0136] Furthermore, if user verification fails, the terminal device can also send a verification failure message to the server.

[0137] In this embodiment, the terminal device acquires the face image to be verified, extracts features, and then performs fully homomorphic encryption to obtain first encrypted information. This first encrypted information is sent to the server. The server performs cryptomorphic calculations on the first encrypted information and pre-stored second encrypted information to obtain third encrypted information, which is then returned to the terminal device. The terminal device decrypts the third encrypted information to obtain a similarity score, compares the similarity score with a similarity threshold to obtain a verification result, and returns the verification result to the server. The server then triggers a subsequent order dispatch process based on the verification result.

[0138] In summary, this application firstly applies fully homomorphic encryption only to the critical and sensitive face to be verified, stores and transmits the device identifier in plaintext, and calculates x in advance under plaintext. i y i Dot x and Dot y Then for x i y i Dot x and Dot y Performing fully homomorphic encryption yields E(x) i ), E(y i ), E(Dot) x ) and E(Dot y ), and then calculate E(d) 2 It directly participates in the calculation, speeds up the ciphertext processing, and thus improves the efficiency of face verification.

[0139] Secondly, this application only stores the private key on the terminal device, and all data transmission, storage, and computation throughout the entire process are conducted in encrypted form, effectively protecting the sensitive data of the face being verified. Even if any link in the chain is compromised, the original data cannot be recovered from the encrypted data, effectively protecting user privacy.

[0140] Furthermore, this application is used in vehicle-mounted terminals, which prevent ordinary users from deploying illegal applications such as intelligent face-swapping, thus solving the problem of fake faces.

[0141] Please refer to Figure 3 , Figure 3 A flowchart illustrating the steps of another user authentication method provided in an embodiment of this application.

[0142] like Figure 3 As shown, this user authentication method is applied to the server and specifically includes the following steps:

[0143] S301, receive the device identifier and the first encrypted information of the face to be verified sent by the terminal device.

[0144] The specific implementation process of this step is described in S201 and S202, and will not be repeated here.

[0145] S302, Obtain the second encrypted information of the target face corresponding to the device identifier.

[0146] In this embodiment of the application, the second encrypted information may be pre-stored on the server side.

[0147] In one embodiment, before S302, the method further includes: receiving a registration request from a terminal device, the registration request including: a device identifier and a target face image; extracting features from the target face image to obtain multiple second face feature vectors of the target face; encrypting the multiple second face feature vectors according to a preset fully homomorphic encryption algorithm to obtain second encrypted information; and storing the second encrypted information.

[0148] In this embodiment, when a user registers a target device with the server, they send a device identifier and a target face image to the server. The server performs feature extraction on the target face image to obtain multiple second face feature vectors y = {y1, ..., y2}. m}. Where y i Let represent the i-th second face feature vector.

[0149] Furthermore, the second encrypted information includes: third sub-encryption information and fourth sub-encryption information. Multiple second face feature vectors are encrypted using a preset fully homomorphic encryption algorithm to obtain the second encrypted information, which includes: encrypting each second face feature vector using the fully homomorphic encryption algorithm to obtain the third sub-encryption information for each second face feature vector; determining the second dot product between multiple second face feature vectors; and encrypting the second dot product using the fully homomorphic encryption algorithm to obtain the fourth sub-encryption information.

[0150] In this embodiment of the application, the server will y i With Dot y Perform fully homomorphic encryption to obtain E(y) i ) and E(Dot y ), and E(y) i ) and E(Dot y The device identifier is stored together with the terminal device identifier in the server's database. The terminal device identifier serves as the primary key in the database and is used for subsequent retrieval and comparison of data reported by that terminal device, thereby accelerating the query of E(y). i ) and E(Dot y The speed is such that the data stored on the server side is encrypted, meaning the target face is encrypted. The server does not need to decrypt it, thus protecting the user's privacy.

[0151] Specifically, each second face feature vector y i This corresponds to a third sub-encrypted message. If the fully homomorphic encryption algorithm is represented by E, then the first facial feature vector y i The corresponding third sub-encrypted information is represented as E(y) i ).

[0152] Furthermore, the second point is the product of Dots. y The following expression (2) is used to determine:

[0153]

[0154] Among them, Dot y This represents the second dot product, which is y = {y1, ..., y2}. m} and y={y1,…,y m The dot product of}.

[0155] In this embodiment of the application, the fourth sub-encryption information adopts E(Dot) y )express.

[0156] In another embodiment, the target face can be encrypted on the terminal device side to obtain E(y). i ) and E(Dot y Then E(y) i ), E(Dot)y The device identifier and E(y) are sent to the server for registration. The server stores E(y) i ), E(Dot) y ) and device identifier. Using this method, the server cannot access E(y) i ), E(Dot) y The target face is decrypted, meaning the server cannot obtain the target face, thus further enhancing user privacy.

[0157] S303, determine the third encryption information based on the first encryption information and the second encryption information.

[0158] The third encrypted information is the encrypted information on the similarity between the face to be verified and the target face.

[0159] The first encrypted information includes: a first sub-encrypted information and a second sub-encrypted information. Based on the first encrypted information and the second encrypted information, the third encrypted information is determined, including:

[0160] The third encrypted information is determined according to the following expression:

[0161]

[0162] Where d represents the similarity, E represents the fully homomorphic encryption algorithm, and E(d) 2 E(Dot) represents the third encrypted information. x E(Dot) represents the second encrypted sub-message. y E(x) represents the fourth encrypted information. i E(y) represents the first sub-encrypted information of the i-th first face feature vector. i ) represents the third sub-encrypted information of the i-th second facial feature.

[0163] It is understandable that the server receives E(Dot) data sent by the terminal device. x ) and E(x i Then retrieve E(Dot) from the local database. y ) and E(y i E(d) can be directly determined from expression (3). 2 As can be seen, the server's calculation process is simple, which can improve the efficiency of user verification.

[0164] Furthermore, based on the following derivation process, expression (3) and expression (4) can be obtained as follows:

[0165]

[0166] Furthermore, in this application, the similarity d is the Euclidean distance between the first face feature vector and the second face feature vector.

[0167] From the above derivation process, it can be concluded that E(d) 2 ) can be generated by Dot x The encrypted text, Dot y The ciphertext, and The conclusion is as follows.

[0168] S304, sends third encrypted information to the terminal device.

[0169] The third encrypted information is used to instruct the terminal device to determine the verification result based on the third encrypted information.

[0170] Furthermore, the system receives the verification result sent by the terminal device, indicating that the user has passed verification; and sends the order dispatch information to the terminal device.

[0171] In this embodiment, the terminal device receives the third encrypted information and performs verification. The specific verification method is the same as described in S205 above, and will not be repeated here.

[0172] This application can enable x on a terminal device. i When performing fully homomorphic encryption, and generating E(Dot) x ), then E(x) i ) and E(Dot x Both are sent to the server. Similarly, the server sends data to y. i When performing fully homomorphic encryption, and generating E(Dot) y This application saves server resources for real-time computation of E(Dot) values, and stores these values ​​in a local database for subsequent dense-state calculations. x ), E(Dot) y This reduces processing overhead, speeds up user verification, and since the server cannot obtain the private key in this application, it can improve the security of the face to be verified.

[0173] One embodiment of this application provides a user authentication device applied to a terminal device. Figure 4 A schematic diagram of the structure of a user verification device provided in an embodiment of this application. Figure 1 .like Figure 4 As shown, the user authentication device 40 includes:

[0174] The acquisition module 401 is used to acquire the user's face image to be verified and the device identifier of the target device. The face image includes the face to be verified.

[0175] Encryption module 402 is used to encrypt the face to be verified to obtain the first encrypted information;

[0176] The sending module 403 is used to send a device identifier and first encrypted information to the server. The device identifier is used to instruct the server to obtain the second encrypted information of the target face corresponding to the device identifier, and to determine the third encrypted information based on the first encrypted information and the second encrypted information. The third encrypted information is encrypted information on the similarity between the face to be verified and the target face.

[0177] The decryption module 404 is used to receive the third encrypted information sent by the server and decrypt the third encrypted information to obtain the similarity.

[0178] The determination module 405 is used to determine whether user verification is successful when the similarity is less than or equal to the similarity threshold.

[0179] In some optional implementations, the encryption module 402 is specifically used to extract features from the face image to be verified to obtain multiple first face feature vectors of the face to be verified.

[0180] Based on a preset fully homomorphic encryption algorithm, multiple first facial feature vectors are encrypted to obtain the first encrypted information.

[0181] In some optional implementations, the first encrypted information includes: first sub-encrypted information and second sub-encrypted information. When the encryption module 402 encrypts multiple first facial feature vectors according to a preset fully homomorphic encryption algorithm to obtain the first encrypted information, it is specifically used for:

[0182] Based on the fully homomorphic encryption algorithm, each first face feature vector is encrypted to obtain the first sub-encryption information of each first face feature vector;

[0183] Determine the first dot product among multiple first face feature vectors;

[0184] The first dot product is encrypted using a fully homomorphic encryption algorithm to obtain the second sub-encrypted information.

[0185] In some alternative implementations, the encryption module 402 is specifically used for:

[0186] Retrieve the public key of a preset key pair;

[0187] The first encrypted information is obtained by encrypting the face to be verified using the public key;

[0188] The decryption module 404 is specifically used for:

[0189] Retrieve the private key of a preset key pair;

[0190] The similarity is obtained by decrypting the third encrypted information using the private key.

[0191] In some optional implementations, the terminal device includes an in-vehicle terminal, the target device includes a vehicle, and the sending module 401 is further configured to send a verification result to the server after determining that the user has passed the verification, the verification result indicating that the user has passed the verification.

[0192] The receiving module is used to receive the vehicle dispatch information from the server.

[0193] It should be noted that the user authentication device provided in this application can implement all the steps of the user authentication method implemented on the network device side in the above method embodiment, and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiment and the beneficial effects will not be described in detail.

[0194] This application also provides a user authentication device, applied to a server, such as... Figure 5 As shown, the user authentication device 50 includes:

[0195] The receiving module 501 is used to receive the device identifier and the first encrypted information of the face to be verified sent by the terminal device;

[0196] The acquisition module 502 is used to acquire the second encrypted information of the target face corresponding to the device identifier;

[0197] The determining module 503 is used to determine the third encrypted information based on the first encrypted information and the second encrypted information. The third encrypted information is encrypted information on the similarity between the face to be verified and the target face.

[0198] The sending module 504 is used to send third encrypted information to the terminal device. The third encrypted information is used to instruct the terminal device to determine the verification result based on the third encrypted information.

[0199] In some optional implementations, the receiving module 501 is further configured to receive a registration request from the terminal device, the registration request including: device identifier and target face image;

[0200] It also includes: an encryption module (not shown), used to extract features from the target face image to obtain multiple second face feature vectors of the target face; to encrypt the multiple second face feature vectors according to a preset fully homomorphic encryption algorithm to obtain second encrypted information; and to store the second encrypted information.

[0201] In some optional implementations, the second encrypted information includes: third sub-encrypted information and fourth sub-encrypted information. When the encryption module encrypts multiple second facial feature vectors according to a preset fully homomorphic encryption algorithm to obtain the second encrypted information, it is specifically used for:

[0202] Based on the fully homomorphic encryption algorithm, each second face feature vector is encrypted to obtain the third sub-encryption information of each second face feature vector;

[0203] Determine the second dot product among multiple second face feature vectors;

[0204] The second dot product is encrypted using a fully homomorphic encryption algorithm to obtain the fourth sub-encrypted information.

[0205] In some optional implementations, the first encrypted information includes: first sub-encrypted information and second sub-encrypted information. The determining module 503 is specifically used for:

[0206] The third encrypted information is determined according to the following expression:

[0207]

[0208] Where d represents the similarity, E represents the fully homomorphic encryption algorithm, and E(d) 2 E(Dot) represents the third encrypted information. x E(Dot) represents the second encrypted sub-message. y E(x) represents the fourth encrypted information. i E(y) represents the first sub-encrypted information of the i-th first face feature vector. i ) represents the third sub-encrypted information of the i-th second facial feature.

[0209] In some optional implementations, the receiving module 501 is further configured to receive a verification result sent by the terminal device, the verification result indicating that the user verification is successful; the sending module 502 is further configured to send dispatch information to the terminal device.

[0210] It should be noted that the user authentication device provided in this application can implement all the steps of the user authentication method implemented on the network device side in the above method embodiment, and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiment and the beneficial effects will not be described in detail.

[0211] Furthermore, this application provides a user verification system 60, such as... Figure 6 As shown, it includes: terminal equipment and server; wherein:

[0212] The terminal device is used to: acquire the user's face image to be verified and the device identifier of the target device, wherein the face image includes: the face to be verified; encrypt the face to be verified to obtain first encrypted information; and send the device identifier and the first encrypted information to the server.

[0213] The server is used to: obtain the second encrypted information of the target face corresponding to the device identifier; determine the third encrypted information based on the first and second encrypted information, wherein the third encrypted information is encrypted information on the similarity between the face to be verified and the target face; and send the third encrypted information to the terminal device.

[0214] The terminal device is also used to: decrypt the third encrypted information to obtain the similarity; and determine that the user verification is successful if the similarity is less than or equal to the similarity threshold.

[0215] This application also provides a terminal device. Figure 7 This is a schematic diagram of the structure of a terminal device provided in an embodiment of this application. Figure 7 As shown, the terminal device includes:

[0216] Transceiver 701 is used to send and receive data under the control of processor 702;

[0217] Memory 703 is used to store computer programs;

[0218] Processor 702 is used to read computer programs from memory and perform the following operations:

[0219] Obtain the user's face image to be verified and the device identifier of the target device. The face image includes the face to be verified.

[0220] The face to be verified is encrypted to obtain the first encrypted information;

[0221] Send a device identifier and first encrypted information to the server. The device identifier is used to instruct the server to obtain the second encrypted information of the target face corresponding to the device identifier. Then, determine the third encrypted information based on the first and second encrypted information. The third encrypted information is the encrypted information of the similarity between the face to be verified and the target face.

[0222] Receive the third encrypted information sent by the server and decrypt the third encrypted information to obtain the similarity;

[0223] If the similarity is less than or equal to the similarity threshold, the user verification is deemed successful.

[0224] Among them, Figure 7In this context, the bus architecture can include any number of interconnected buses and bridges, specifically linking various circuits together, represented by one or more processors (processor 702) and memory (memory 703). The bus architecture can also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. The transceiver 701 can be multiple elements, including a transmitter and a receiver, providing a unit for communicating with various other devices over a transmission medium, including wireless channels, wired channels, optical fibers, etc. The processor 702 is responsible for managing the bus architecture and general processing, and the memory 703 can store data used by the processor 702 during operation.

[0225] The processor 702 is responsible for managing the bus architecture and general processing, while the memory 603 can store the data used by the processor 602 when performing operations.

[0226] Optionally, the processor 702 can be a central processing unit (CPU), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a complex programmable logic device (CPLD), and the processor can also adopt a multi-core architecture.

[0227] The processor 702 executes any of the methods provided in an embodiment of this application according to the obtained executable instructions by calling a computer program stored in the memory 703. The processor and the memory may also be physically separated.

[0228] It should be noted that the terminal device provided in this application can implement all the method steps implemented on the terminal device side in the above method embodiments and can achieve the same technical effect. Therefore, the parts and beneficial effects that are the same as those in the method embodiments will not be described in detail here.

[0229] The application embodiment also provides a server, Figure 8 This is a schematic diagram of the structure of a server provided in one embodiment of this application. Figure 8 As shown, the server includes:

[0230] Transceiver 801 is used to send and receive data under the control of processor 802;

[0231] Memory 803 is used to store computer programs;

[0232] Processor 802 is used to read computer programs from memory and perform the following operations:

[0233] The receiving terminal device sends the device identifier and the first encrypted information of the face to be verified.

[0234] Obtain the second encrypted information of the target face corresponding to the device identifier;

[0235] Based on the first and second encrypted information, the third encrypted information is determined. The third encrypted information is the encrypted information of the similarity between the face to be verified and the target face.

[0236] A third encrypted message is sent to the terminal device, which instructs the terminal device to determine the verification result based on the third encrypted message.

[0237] Among them, Figure 8 In this context, the bus architecture can include any number of interconnected buses and bridges, specifically linking various circuits together, represented by one or more processors (processor 802) and memory (memory 803). The bus architecture can also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. The transceiver 801 can be multiple elements, including transmitters and receivers, providing a unit for communicating with various other devices over transmission media, including wireless channels, wired channels, optical fibers, etc. The processor 802 is responsible for managing the bus architecture and general processing, and the memory 803 can store data used by the processor 802 during operation.

[0238] The processor 802 is responsible for managing the bus architecture and general processing, while the memory 803 can store the data used by the processor 802 when performing operations.

[0239] Optionally, the processor 802 can be a central processing unit (CPU), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a complex programmable logic device (CPLD), and the processor can also adopt a multi-core architecture.

[0240] The processor 802 executes any of the methods provided in an embodiment of this application according to the obtained executable instructions by calling a computer program stored in the memory 803. The processor and the memory may also be physically separated.

[0241] It should be noted that the terminal device provided in this application can implement all the method steps implemented on the terminal device side in the above method embodiments and can achieve the same technical effect. Therefore, the parts and beneficial effects that are the same as those in the method embodiments will not be described in detail here.

[0242] It should be noted that the division of units in the embodiments of this application is illustrative and only represents one logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated units described above can be implemented in hardware or as software functional units.

[0243] If the aforementioned integrated units are implemented as software functional units and sold or used as independent products, they can be stored in a processor-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0244] This application provides a processor-readable storage medium storing a computer program. The computer program is used to cause the processor to execute the user verification method provided in any embodiment of this application, so that the processor can implement all the method steps in the above method embodiments and achieve the same technical effect. Here, the parts that are the same as those in the method embodiments and the beneficial effects will not be described in detail.

[0245] The processor-readable storage medium can be any available medium or data storage device that the processor can access, including but not limited to magnetic storage (e.g., floppy disk, hard disk, magnetic tape, magneto-optical disk (MO)), optical storage (e.g., CD, DVD, BD, HVD), semiconductor storage (e.g., ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD)).

[0246] An embodiment of this application also provides a computer program product containing instructions. The computer program is stored in a storage medium. At least one processor can read the computer program from the storage medium. When the at least one processor executes the computer program, it can implement all the method steps of the resource allocation method in any of the above method embodiments and achieve the same technical effect. Here, the parts that are the same as those in the method embodiments and the beneficial effects will not be described in detail.

[0247] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0248] This application is described with reference to signaling interaction diagrams and / or block diagrams of methods, apparatus, and computer program products according to embodiments of this application. It should be understood that each block of the signaling interaction diagrams and / or block diagrams, and combinations of blocks in the signaling interaction diagrams and / or block diagrams, can be implemented by computer-executable instructions. These computer-executable instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the signaling interaction diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0249] These processor-executable instructions may also be stored in a processor-readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the processor-readable memory produce an article of manufacture including instruction means, which are implemented in a signaling interaction diagram. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0250] These processors can execute instructions that can also be loaded onto a computer or other programmable data processing equipment, causing a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing signaling interaction diagrams. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0251] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A user authentication method characterized by, The user verification method applied to a terminal device comprises: Obtaining a face image to be verified of a user and a device identifier of a target device, wherein the face image comprises a face to be verified; Encrypting the face to be verified to obtain first encrypted information; Sending the device identifier and the first encrypted information to a server, wherein the device identifier is used to instruct the server to obtain second encrypted information of a target face corresponding to the device identifier, and to determine third encrypted information according to the first encrypted information and the second encrypted information, wherein the third encrypted information is encrypted information of a similarity between the face to be verified and the target face; Receiving the third encrypted information sent by the server and decrypting the third encrypted information to obtain the similarity; In a case where the similarity is less than or equal to a similarity threshold, determining that the user verification is passed; The first encrypted information comprises first sub-encrypted information and second sub-encrypted information, and the encryption of the face to be verified to obtain the first encrypted information comprises: Extracting features of the face image to be verified to obtain a plurality of first face feature vectors of the face to be verified; Encrypting each first face feature vector according to a full homomorphic encryption algorithm to obtain first sub-encrypted information of each first face feature vector; Determining a first dot product between the plurality of first face feature vectors; Encrypting the first dot product according to the full homomorphic encryption algorithm to obtain the second sub-encrypted information.

2. The user authentication method according to claim 1, characterized by, The encryption of the face to be verified to obtain the first encrypted information comprises: Obtaining a public key of a preset key pair; Encrypting the face to be verified according to the public key to obtain the first encrypted information; The decryption of the third encrypted information to obtain the similarity comprises: Obtaining a private key of the preset key pair; Decrypting the third encrypted information according to the private key to obtain the similarity.

3. The user authentication method according to claim 1, characterized by, The terminal device comprises a vehicle-mounted terminal, the target device comprises a vehicle, and after the determination that the user verification is passed, the method further comprises: Sending a verification result to the server, wherein the verification result indicates that the user verification is passed; Receiving dispatching information of the vehicle sent by the server.

4. A user authentication method characterized by, The user verification method applied to a server comprises: Receiving a device identifier and first encrypted information of a face to be verified sent by a terminal device; Obtaining second encrypted information of a target face corresponding to the device identifier, wherein the second encrypted information comprises third sub-encrypted information and fourth sub-encrypted information; Determining third encrypted information according to the first encrypted information and the second encrypted information, wherein the third encrypted information is encrypted information of a similarity between the face to be verified and the target face; Sending the third encrypted information to the terminal device, wherein the third encrypted information is used to instruct the terminal device to determine a verification result according to the third encrypted information; The method further comprises: Receiving a registration request of a terminal device, wherein the registration request comprises the device identifier and a target face image; Extracting features of the target face image to obtain a plurality of second face feature vectors of the target face; According to a preset homomorphic encryption algorithm, each second face feature vector is encrypted to obtain third sub-encryption information of each second face feature vector; Second dot products between the plurality of second face feature vectors are determined; The second dot products are encrypted according to the homomorphic encryption algorithm to obtain the fourth sub-encryption information; The third sub-encryption information and the fourth sub-encryption information are stored.

5. The user authentication method according to claim 4, characterized by, The first encryption information includes first sub-encryption information and second sub-encryption information, and the third encryption information is determined according to the first encryption information and the second encryption information, including: The third encryption information is determined according to the following expression: Wherein, the d represents the similarity, the E represents the full homomorphism encryption algorithm, the The third encryption information is represented by E (Xi, Yi, d), and the The first dot product between the plurality of first face feature vectors is represented by The second sub-encryption information is represented by E (Xi, Yi, d), and the The fourth sub-encryption information is represented by E (Xi, Yi, d), and the The first sub-encryption information of the i-th first face feature vector is represented by E (Xi, Yi, d), and the The third sub-encryption information of the i-th second face feature is represented by E (Xi, Yi, d), and the first face feature vector is obtained by feature extraction on the face to be verified.

6. The user authentication method according to claim 4 or 5, characterized by, Further comprising: Receiving a verification result sent by a terminal device, the verification result indicating that the user verification is passed; Sending dispatching information to the terminal device.

7. A user authentication apparatus characterized by comprising: Applied to a terminal device, the user verification apparatus includes: An acquisition module configured to acquire a to-be-verified face image of a user and a device identifier of a target device, the face image including a to-be-verified face; An encryption module configured to encrypt the to-be-verified face to obtain first encryption information; A sending module configured to send the device identifier and the first encryption information to a server, the device identifier being used to instruct the server to acquire second encryption information of a target face corresponding to the device identifier, and to determine third encryption information according to the first encryption information and the second encryption information, the third encryption information being encryption information of a similarity between the to-be-verified face and the target face; A decryption module configured to receive the third encryption information sent by the server and to decrypt the third encryption information to obtain the similarity; A determination module configured to determine that the user verification is passed in a case where the similarity is less than or equal to a similarity threshold. The first encryption information includes first sub-encryption information and second sub-encryption information, and the encryption module is specifically configured to: Extract features from the to-be-verified face image to obtain a plurality of first face feature vectors of the to-be-verified face; Encrypt each first face feature vector according to a homomorphic encryption algorithm to obtain first sub-encryption information of each first face feature vector; Determine first dot products between the plurality of first face feature vectors; Encrypt the first dot products according to the homomorphic encryption algorithm to obtain the second sub-encryption information.

8. A user authentication apparatus characterized by comprising: Applied to a server, the user verification apparatus includes: A receiving module configured to receive a device identifier and first encryption information of a to-be-verified face sent by a terminal device; An acquisition module configured to acquire second encryption information of a target face corresponding to the device identifier, the second encryption information including third sub-encryption information and fourth sub-encryption information; A determination module configured to determine third encryption information according to the first encryption information and the second encryption information, the third encryption information being encryption information of a similarity between the to-be-verified face and the target face; A sending module configured to send the third encryption information to the terminal device, the third encryption information being used to instruct the terminal device to determine a verification result according to the third encryption information; The receiving module is further configured to receive a registration request of a terminal device, the registration request comprising the device identifier and a target face image; The encryption module is configured to perform feature extraction on the target face image to obtain a plurality of second face feature vectors of the target face; Each second face feature vector is encrypted according to a preset homomorphic encryption algorithm to obtain third sub-encryption information of each second face feature vector; Second dot products between the plurality of second face feature vectors are determined; The second dot products are encrypted according to the homomorphic encryption algorithm to obtain the fourth sub-encryption information; The third sub-encryption information and the fourth sub-encryption information are stored.

9. A terminal device, comprising: Comprise: a memory for storing computer programs; a transceiver for transceiving data under the control of a processor; a processor for reading computer programs in the memory and performing the following operations: obtaining a face image to be verified of a user and a device identifier of a target device, the face image comprising a face to be verified; encrypting the face to be verified to obtain first encryption information; sending the device identifier and the first encryption information to a server, the device identifier being used to instruct the server to obtain second encryption information of a target face corresponding to the device identifier, and to determine third encryption information according to the first encryption information and the second encryption information, the third encryption information being encryption information of a similarity between the face to be verified and the target face; receiving the third encryption information sent by the server and decrypting the third encryption information to obtain the similarity; in a case where the similarity is less than or equal to a similarity threshold, determining that the user passes verification; the first encryption information comprises first sub-encryption information and second sub-encryption information, and the encryption of the face to be verified comprises: performing feature extraction on the face image to be verified to obtain a plurality of first face feature vectors of the face to be verified; encrypting each first face feature vector according to a homomorphic encryption algorithm to obtain first sub-encryption information of each first face feature vector; determining first dot products between the plurality of first face feature vectors; encrypting the first dot products according to the homomorphic encryption algorithm to obtain the second sub-encryption information.

10. A server, characterized by Comprise: a memory for storing computer programs; a transceiver for transceiving data under the control of a processor; a processor for reading computer programs in the memory and performing the following operations: receiving first encryption information of a face to be verified and a device identifier sent by a terminal device; obtaining second encryption information of a target face corresponding to the device identifier; determining third encryption information according to the first encryption information and the second encryption information, the third encryption information being encryption information of a similarity between the face to be verified and the target face; sending the third encryption information to the terminal device, the third encryption information being used to instruct the terminal device to determine a verification result according to the third encryption information; The processor is further configured to read a computer program in the memory and perform the following operations: receiving a registration request of a terminal device, the registration request comprising the device identifier and a target face image; performing feature extraction on the target face image to obtain a plurality of second face feature vectors of the target face; encrypting each second face feature vector according to a preset homomorphic encryption algorithm to obtain third sub-encryption information of each second face feature vector; determining a second dot product between the plurality of second face feature vectors; encrypting the second dot product according to the homomorphic encryption algorithm to obtain fourth sub-encryption information; storing the third sub-encryption information and the fourth sub-encryption information.

11. A user authentication system characterized by comprising: Comprise: a terminal device and a server; wherein: the terminal device is configured to: obtain a to-be-verified face image of a user and a device identifier of a target device, the face image comprising a to-be-verified face; perform encryption on the to-be-verified face to obtain first encryption information; and send the device identifier and the first encryption information to the server; the first encryption information comprises first sub-encryption information and second sub-encryption information, and the encryption on the to-be-verified face comprises: performing feature extraction on the to-be-verified face image to obtain a plurality of first face feature vectors of the to-be-verified face; encrypting each first face feature vector according to a homomorphic encryption algorithm to obtain first sub-encryption information of each first face feature vector; determining a first dot product between the plurality of first face feature vectors; and encrypting the first dot product according to the homomorphic encryption algorithm to obtain the second sub-encryption information; the server is configured to: obtain second encryption information of a target face corresponding to the device identifier; determine third encryption information according to the first encryption information and the second encryption information, the second encryption information comprising third sub-encryption information and fourth sub-encryption information, and the third encryption information being encryption information of a similarity between the to-be-verified face and the target face; send the third encryption information to the terminal device; receive a registration request of a terminal device, the registration request comprising the device identifier and a target face image; perform feature extraction on the target face image to obtain a plurality of second face feature vectors of the target face; encrypt each second face feature vector according to a preset homomorphic encryption algorithm to obtain third sub-encryption information of each second face feature vector; determine a second dot product between the plurality of second face feature vectors; encrypt the second dot product according to the homomorphic encryption algorithm to obtain the fourth sub-encryption information; and store the third sub-encryption information and the fourth sub-encryption information; the terminal device is further configured to: decrypt the third encryption information to obtain the similarity; and determine that the user passes verification if the similarity is less than or equal to a similarity threshold.

12. A processor-readable storage medium, characterized in that, The processor-readable storage medium stores a computer program, and the computer program is configured to cause the processor to perform the user verification method in any one of claims 1-6.

13. A computer program product, characterised in that, Comprise: A computer program which, when executed by a processor, implements the user verification method of any one of claims 1-6.

Images