Identity verification method and system, intelligent glasses, storage medium and electronic equipment

Abstract

The embodiment of the invention discloses an identity authentication method and system, intelligent glasses, a storage medium and electronic equipment, equipment identity authentication is carried out on the intelligent glasses according to a first secret key stored by a hardware-level security chip, and if the authentication is passed, an equipment trusted environment is provided through the hardware-level security chip; in response to an identity verification request initiated based on a target to-be-authenticated operation executed by a wearing user of the smart glasses, performing local biological feature comparison on the wearing user through an equipment trusted environment to obtain a corresponding first comparison result; when a certain condition is met, whether the intelligent glasses and a cloud end corresponding to the intelligent glasses pass bidirectional authentication is judged, if yes, biological characteristics of a user wearing the intelligent glasses are encrypted according to a first secret key, the encrypted biological characteristics are sent to the cloud end, and a secondary comparison result returned by the cloud end is received; therefore, according to the first comparison result and / or the second comparison result, the identity verification result of the wearing user can be determined.

Description

Technical Field

[0001] This invention relates to computer technology, and more particularly to a method, system, smart glasses, storage medium, and electronic device for authentication. Background Technology

[0002] With the continuous development of artificial intelligence technology, smart glasses, as an emerging smart wearable product, are gradually becoming more common in people's daily lives, bringing them a more diverse experience. Smart glasses are head-mounted devices that integrate microcomputer systems. Based on the form of eyeglasses, they integrate digital information with the physical world through optical displays, voice interaction, and sensing technologies, expanding users' perception of the environment and their interaction methods.

[0003] Existing smart glasses technologies face various risks, including external attack risks, privacy leakage risks, and transaction security risks. External attack risks include man-in-the-middle attacks (attackers hijack communication links to obtain sensitive information) and data theft (unauthorized access to private information stored on or transmitted in the device). Privacy leakage risks involve sensitive data types such as account credentials and payment information, personal documents and video data, and behavioral data such as travel history. A typical scenario is that while the device is temporarily stored, others can directly view the screen content through AR (Augmented Reality) smart glasses, such as in an office setting where others can view a user's daily schedule. Transaction security risks include device theft (stolen glasses may be hacked and used for unauthorized payments) and fraud risks (AR payment scenarios may encounter fake QR codes or interface hijacking attacks). Therefore, identity verification is a core requirement for smart glasses. Summary of the Invention

[0004] The purpose of the embodiments in this specification is to provide an authentication method, system, smart glasses, storage medium, and electronic device.

[0005] This specification provides a method for identity verification, proposes a multi-layered security comparison framework for smart glasses, and achieves standardization of identity verification on smart glasses by defining multiple security levels for smart glasses. It also proposes a comprehensive security solution for smart glasses to define risk control security. The method includes: The smart glasses are authenticated using a first key stored in a hardware-level security chip. If the authentication is successful, a trusted environment for the device is provided through the hardware-level security chip. In response to an authentication request initiated by a target authentication operation performed by a user wearing the smart glasses, the user's biometric features are compared locally through the trusted environment of the device to obtain a corresponding first comparison result; If the target authentication operation meets the first preset condition, or if the first comparison result meets the second preset condition, it is determined whether the smart glasses and the cloud corresponding to the smart glasses have passed two-way authentication. If so, the biometrics of the wearer are encrypted according to the first key, and the encrypted biometrics are sent to the cloud. The cloud returns the second comparison result. After passing two-way authentication, the cloud performs a second comparison of the biometrics of the wearer according to the encrypted biometrics sent by the smart glasses to obtain the second comparison result. The authentication result of the user wearing the device is determined based on the first comparison result and / or the second comparison result.

[0006] Furthermore, the first preset condition includes that the risk level corresponding to the target authentication operation is greater than or equal to a first preset threshold.

[0007] Furthermore, the second preset condition includes the first comparison result indicating that the wearer passes the comparison; Wherein, if the first comparison result meets the second preset condition, determining whether the smart glasses and the cloud corresponding to the smart glasses have passed two-way authentication includes: If the risk level corresponding to the identity verification operation is greater than or equal to the second preset threshold, and the first comparison result indicates that the user wearing the device can determine whether the smart glasses and the cloud corresponding to the smart glasses have passed two-way authentication through comparison.

[0008] Furthermore, the first preset condition includes the fact that the target authentication operation and at least one corresponding historical authentication operation do not satisfy the preset continuity condition.

[0009] Furthermore, the second preset condition includes that the degree of uncertainty corresponding to the first comparison result is greater than or equal to a third preset threshold.

[0010] Furthermore, the method also includes: If the user's identity verification fails multiple times consecutively, a second two-way authentication between the smart glasses and the cloud will be performed.

[0011] Furthermore, the step of performing local biometric comparison of the wearer in the trusted environment of the device includes: Obtain the authentication method corresponding to the authentication request; According to the authentication method, the biometrics of the user wearing the device are collected through the trusted environment of the device, and the biometrics are compared locally.

[0012] Further, obtaining the authentication method corresponding to the authentication request includes: Based on the target authentication operation, determine the authentication method corresponding to the authentication request.

[0013] Further, the step of performing local biometric comparison on the biometric features includes: The biometric feature is encrypted using the first key, and the encrypted biometric feature is sent to the user device corresponding to the smart glasses. The user device performs a local biometric comparison of the biometric feature and returns the corresponding first comparison result to the smart glasses. The smart glasses and the user device have been mutually authenticated.

[0014] Further, the step of encrypting the biometric feature according to the first key, sending the encrypted biometric feature to the user device corresponding to the smart glasses, and enabling the user device to perform local biometric comparison of the biometric feature and return the corresponding first comparison result to the smart glasses includes: The biometric features are lightly processed to obtain corresponding intermediate processing results. The intermediate processing results are then encrypted using the first key. The encrypted intermediate processing results are sent to the user device corresponding to the smart glasses, so that the user device performs local biometric comparison based on the intermediate processing results and returns the corresponding first comparison result to the smart glasses.

[0015] This specification also provides an embodiment of smart glasses for authentication, including: The device authentication module is used to authenticate the smart glasses based on the first key stored through the hardware-level security chip. If the authentication is successful, a trusted environment for the device is provided through the hardware-level security chip. The comparison module is used to respond to an authentication request initiated by a target authentication operation performed by the user wearing the smart glasses, and to perform local biometric comparison of the user wearing the glasses through the trusted environment of the device to obtain the corresponding first comparison result. The judgment module is used to determine whether the smart glasses and the cloud corresponding to the smart glasses have passed two-way authentication if the target authentication operation meets the first preset condition, or if the first comparison result meets the second preset condition. If so, the module encrypts the biometrics of the user wearing the glasses according to the first key, sends the encrypted biometrics to the cloud, and receives the second comparison result returned by the cloud. The cloud performs a second comparison of the biometrics of the user wearing the glasses according to the encrypted biometrics sent by the smart glasses after passing two-way authentication, and obtains the second comparison result. The determining module is used to determine the authentication result of the user wearing the device based on the first comparison result and / or the second comparison result.

[0016] This specification also provides an authentication system, including a cloud and smart glasses as described above; The cloud is used to: after the smart glasses and the cloud have completed two-way authentication, perform a second comparison of the wearer's biometrics based on the encrypted biometrics of the wearer sent by the smart glasses, obtain a corresponding second comparison result, and return the second comparison result to the smart glasses.

[0017] This specification also provides an authentication system, including a user device, a cloud, and smart glasses as described above; The user equipment is used to: perform local biometric comparison on the encrypted biometric features of the user wearing the smart glasses sent by the smart glasses, wherein the smart glasses and the user equipment have passed two-way authentication; The cloud is used to: after the smart glasses and the cloud have completed two-way authentication, perform a second comparison of the wearer's biometric features based on the encrypted biometric features sent by the smart glasses, obtain a corresponding second comparison result, and return the second comparison result to the smart glasses.

[0018] This specification also provides a storage medium storing a computer program adapted to be loaded by a processor and to execute the steps of the method described above.

[0019] This specification also provides an electronic device, including a processor and a memory; wherein the memory stores a computer program adapted to be loaded by the processor and to execute the steps of the method described above.

[0020] This specification also provides a computer program product that stores at least one instruction, characterized in that the at least one instruction, when executed by a processor, implements the steps of the above-described method.

[0021] Based on the embodiments of this specification, a multi-layered security comparison framework scheme for smart glasses is proposed. By defining various security levels for smart glasses, the standardization of identity verification on smart glasses can be achieved. A comprehensive security solution for smart glasses is proposed to define the risk control security of smart glasses. Attached Figure Description

[0022] Figure 1A flowchart illustrating a method for identity verification provided in an embodiment of this specification; Figure 2 A framework diagram of a three-tier security protection system for identity verification provided in the embodiments of this specification; Figure 3 An interaction flowchart between smart glasses and a user device for authentication, provided as an embodiment of this specification; Figure 4 A schematic diagram of the structure of smart glasses for identity verification provided in the embodiments of this specification; Figure 5 A schematic diagram of an identity verification system provided in the embodiments of this specification; Figure 6 A schematic diagram of an identity verification system provided in the embodiments of this specification; Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this specification. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of this specification clearer, the technical solutions of this specification will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of them. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this specification.

[0024] Please see Figure 1 This is a flowchart illustrating a method for authentication provided in an embodiment of this specification. In this embodiment, the method for authentication is applied to smart glasses for authentication as described in this embodiment. The following will focus on... Figure 1 The process shown will be described in detail. The method for authentication may specifically include the following steps: S102, the smart glasses are authenticated using the first key stored in the hardware-level security chip. If the authentication is successful, a trusted environment for the device is provided through the hardware-level security chip.

[0025] In some embodiments, smart glasses include, but are not limited to, AR (Augmented Reality) smart glasses, VR (Virtual Reality) smart glasses, MR (Mixed Reality) smart glasses, smart audio glasses, AI (Artificial Intelligence) smart glasses, etc., and this example embodiment does not impose any special limitations on them.

[0026] In some embodiments, a hardware-level security chip is deployed on the smart glasses. A hardware-level security chip is a physical chip specifically designed to protect device data security and user privacy. Its core function is to ensure that sensitive information is not maliciously attacked or leaked through hardware isolation, encryption algorithms, and tamper-proof design. The types of hardware-level security chips include, but are not limited to, secure elements (SE) and embedded secure elements (eSE). This example embodiment does not impose any special limitations on these types.

[0027] In some embodiments, a first key is stored in the hardware-level security chip. This first key can be used to authenticate the smart glasses, for example, by authenticating the smart glasses when they are powered on, or by authenticating the smart glasses in response to a triggering operation performed by the user wearing the smart glasses. In some embodiments, the device authentication can be performed by verifying the digital signatures of various firmware files on the smart glasses using the first key, thereby verifying the device integrity of the smart glasses and preventing firmware tampering.

[0028] In some embodiments, after the smart glasses pass device authentication, a trusted environment is provided through a hardware-level security chip. The smart glasses provide a trusted environment foundation for subsequent verification through trusted device authentication. For example, the biometrics of the smart glasses wearer that are subsequently extracted can be stored in the trusted device environment, providing encrypted storage protection for the biometrics. The trusted device environment is a secure isolated area constructed through hardware and software collaboration to protect sensitive data (such as keys and biometrics) and perform high-security operations (such as authentication). The trusted device environment includes, but is not limited to, TEE (Trusted Execution Environment), etc. This example embodiment does not impose any special limitations on it.

[0029] S104, in response to the authentication request initiated by the target authentication operation performed by the user wearing the smart glasses, the user wearing the glasses is compared with local biometrics through the trusted environment of the device to obtain the corresponding first comparison result.

[0030] In some embodiments, the target authentication operation performed by the user of the smart glasses refers to a sensitive operation that requires successful authentication of the user before it can be performed. This sensitive operation includes, but is not limited to, payment operations, login operations, and privacy data access operations. This example embodiment does not specifically limit this. In some embodiments, in response to an authentication request initiated based on the target authentication operation, a local algorithm is used within the trusted environment of the device to perform a local biometric comparison of the user of the smart glasses, obtaining a corresponding first comparison result to ensure that information is not injected by attacks. The specific process of local biometric comparison includes, but is not limited to, extracting the user's biometrics and matching the extracted biometrics with biometric template data stored trusted in the trusted environment of the device, preventing the original biometric data from being transmitted externally. The specific data types of the user's biometrics include, but are not limited to, face, fingerprint, voiceprint, and iris. That is, the specific comparison types of local biometric comparison include, but are not limited to, face comparison, fingerprint comparison, voiceprint comparison, and iris comparison. This example embodiment does not specifically limit this. In some embodiments, the biometric template data is encrypted and stored locally in the trusted environment of the device using a first key to ensure that the comparison process cannot be intercepted by intermediate attacks. In some embodiments, in addition to obtaining the first comparison result corresponding to the local biometric comparison, the degree of uncertainty corresponding to the first comparison result is also obtained.

[0031] S106, if the target authentication operation meets the first preset condition, or if the first comparison result meets the second preset condition, determine whether the smart glasses and the cloud corresponding to the smart glasses have passed two-way authentication. If so, encrypt the biometrics of the user wearing the glasses according to the first key, send the encrypted biometrics to the cloud, and receive the secondary comparison result returned by the cloud. The cloud performs a secondary comparison of the biometrics of the user wearing the glasses according to the encrypted biometrics sent by the smart glasses after passing two-way authentication, and obtains the second comparison result.

[0032] In some embodiments, if the target authentication operation meets a first preset condition, it is determined whether the smart glasses and the corresponding cloud have passed two-way authentication. The first preset condition includes, but is not limited to, the risk level corresponding to the target authentication operation being greater than or equal to a first preset threshold, and the target authentication operation and at least one of its corresponding historically authenticated operations not meeting a preset continuity condition. This example embodiment does not specifically limit this. In some embodiments, the smart glasses and the corresponding cloud need to exchange and verify each other's stored digital certificates. That is, the smart glasses verify the cloud's digital certificate, and the cloud verifies the smart glasses' digital certificate to achieve two-way authentication (i.e., two-way identity authentication). This means that both parties verify each other's identities before communication, verify the other party's trustworthiness, and verify the connection's trustworthiness, preventing man-in-the-middle attacks or forgery of the smart glasses / cloud. In some embodiments, the smart glasses and the cloud can negotiate a symmetric key based on their respective built-in root keys, and then each can verify the other's digital certificate based on the negotiated symmetric key. Alternatively, the smart glasses and the cloud can create an asymmetric key during the initial connection, and then each can verify the other's digital certificate based on the asymmetric key.

[0033] In some embodiments, if the first comparison result meets the second preset condition, it is determined whether the smart glasses and the cloud corresponding to the smart glasses have passed two-way authentication. The second preset condition includes, but is not limited to, the first comparison result indicating that the wearer has failed the comparison, and the uncertainty degree corresponding to the first comparison result being greater than or equal to a third preset threshold. This example embodiment does not impose any special limitations on this.

[0034] In some embodiments, the degree of uncertainty is used to characterize the uncertainty of the first comparison result. A higher degree of uncertainty indicates a greater risk to the first comparison result, meaning a higher probability that the first comparison result is incorrect. Conversely, a lower degree of uncertainty indicates a higher probability that the first comparison result is correct. In some embodiments, if the smart glasses and the corresponding cloud have passed two-way authentication, the biometric features of the user extracted by the smart glasses are encrypted using the first key within the trusted environment of the device, and the encrypted biometric features are sent to the cloud for a second comparison. The specific encryption method can be symmetric encryption or asymmetric encryption, which is not specifically limited in this example embodiment. In some embodiments, after receiving the encrypted biometric features, the cloud determines whether the cloud and the smart glasses have passed two-way authentication. If so, the cloud performs a second comparison of the biometric features using a more complex algorithm library (such as a deep learning model, i.e., the cloud has a more powerful model capability than the smart glasses) to obtain the corresponding second comparison result, and returns the second comparison result to the smart glasses. In some embodiments, in addition to obtaining the second comparison result, the degree of uncertainty corresponding to the second comparison result is also obtained. In some embodiments, the secondary comparison in the cloud and the local biometric comparison in the smart glasses form a redundant comparison, and the two work together. In some embodiments, after receiving the encrypted biometric data, the cloud does not send the biometric data out of the cloud; that is, the cloud only processes the biometric data and does not store it, to ensure the privacy and security of the biometric data.

[0035] S108, determine the authentication result of the user based on the first comparison result and / or the second comparison result. In some embodiments, if the smart glasses do not send the encrypted biometrics to the cloud for secondary comparison, the authentication result of the user is determined based on the first comparison result (or the first comparison result and its corresponding degree of uncertainty). In some embodiments, if the smart glasses have sent the encrypted biometrics to the cloud for secondary comparison, after obtaining the second comparison result returned by the cloud, the authentication result of the user can be determined based on the second comparison result (or the second comparison result and its corresponding degree of uncertainty), or the authentication result of the user can be determined simultaneously based on the first comparison result (or the first comparison result and its corresponding degree of uncertainty) and the second comparison result (or the second comparison result and its corresponding degree of uncertainty).

[0036] Figure 2 A framework diagram of a three-tier security protection system for identity verification provided in the embodiments of this specification is shown below. Figure 2As shown in the embodiments of this specification, the solution constructs a three-level security protection system for smart glasses regarding identity verification. These three security levels, from bottom to top, are device trusted authentication, local biometric comparison, and cloud identity comparison. Device trusted authentication serves as the root of trust, ensuring the security of the communication link between the local and cloud platforms. This is a seamless device security level. Local biometric comparison relies on the device's computing power to complete rapid verification. It is suitable for offline scenarios or scenarios with low latency requirements, prioritizing efficiency and privacy. This is a light-interaction identity security level. Cloud identity comparison supplements the accuracy in complex scenarios. This is a tangible financial level, i.e., a higher-dimensional security level.

[0037] Based on the embodiments of this specification, a multi-layered security comparison framework scheme for smart glasses is proposed. By defining various security levels for smart glasses, the standardization of identity verification on smart glasses can be achieved. A comprehensive security solution for smart glasses is proposed to define the risk control security of smart glasses.

[0038] In some embodiments, the first preset condition includes a risk level corresponding to the target operation to be authenticated being greater than or equal to a first preset threshold. In some embodiments, the smart glasses preset a mapping relationship between multiple different operation types and multiple risk levels, and the risk level mapped to the operation type of the target operation to be authenticated can be obtained based on this mapping relationship. In some embodiments, at least one of the operation type, operation object, and operation content corresponding to the target operation to be authenticated can be input into a preset model to obtain the risk level output by the model. In some embodiments, the risk level can be in numerical form, or it can be in string form, such as "high risk", "medium risk", etc.

[0039] In some embodiments, the second preset condition includes the first comparison result indicating that the user has passed the comparison; wherein, if the first comparison result meets the second preset condition, determining whether the smart glasses and the corresponding cloud have passed two-way authentication includes: if the risk level corresponding to the authentication operation is greater than or equal to a second preset threshold, and the first comparison result indicates that the user has passed the comparison, determining whether the smart glasses and the corresponding cloud have passed two-way authentication. In some embodiments, if the risk level corresponding to the authentication operation is greater than or equal to the second preset threshold, and the first comparison result indicates that the user has passed the comparison, then, if the smart glasses and the corresponding cloud have passed two-way authentication, the encrypted biometric features of the user need to be sent to the cloud for a second comparison. In some embodiments, if the first comparison result indicates that the user has failed the comparison, then it is directly confirmed that a second comparison by the cloud is not required, and the user's authentication result is directly determined based on the first comparison result. In some embodiments, if the risk level corresponding to the authentication operation is greater than or equal to the second preset threshold, and the first comparison result indicates that the user has failed the comparison, then it is directly confirmed that a second comparison by the cloud is not required, and the user's authentication result is directly determined based on the first comparison result. In some embodiments, the second preset threshold is the same as the first preset threshold, or the second preset threshold is less than the first preset threshold.

[0040] In some embodiments, the first preset condition includes that the target authentication operation and its corresponding at least one historically authenticated operation do not satisfy a preset continuity condition. In some embodiments, a historically authenticated operation may refer to an authenticated sensitive operation performed before the target authentication operation, or it may refer to an authenticated sensitive operation performed within a preset time range (e.g., one day) before the target authentication operation. In some embodiments, the preset continuity condition may mean that there are no other unauthenticated sensitive operations between the target authentication operation and the most recent historically authenticated operation among the at least one historically authenticated operation, and there are no other unauthenticated sensitive operations between any two historically authenticated operations among the at least one historically authenticated operation; or, in addition, the preset continuity condition may also require that the number of operations corresponding to the at least one historically authenticated operation is greater than or equal to a preset number threshold.

[0041] In some embodiments, the second preset condition includes the uncertainty level corresponding to the first comparison result being greater than or equal to a third preset threshold. In some embodiments, in addition to obtaining the corresponding first comparison result by performing local biometric comparison on the wearer in a trusted device environment, the uncertainty level corresponding to the first comparison result is also obtained.

[0042] In some embodiments, the method further includes: if the authentication result of the user being worn fails multiple times consecutively, re-perform two-way authentication between the smart glasses and the cloud. In some embodiments, if the current authentication result of the user being worn, determined by the smart glasses, fails, at least one preset number of previously determined historical authentication results for the user whose authentication time is closest to the current one are obtained. If all at least one historical authentication result fails, and there are no other successfully authenticated historical authentication results between the most recently authenticated historical authentication result and the current authentication result, and there are no other successfully authenticated historical authentication results between any two historical authentication results, then it can be determined that the user's authentication result has failed multiple times consecutively. In some embodiments, if the user's authentication result fails multiple times consecutively, it is determined that the two-way authentication between the smart glasses and the cloud has failed and needs to be re-performed.

[0043] In some embodiments, the step of performing local biometric comparison of the wearer through the trusted environment of the device includes: obtaining the authentication method corresponding to the authentication request; collecting the biometrics corresponding to the wearer through the trusted environment of the device according to the authentication method, and performing local biometric comparison of the biometrics. In some embodiments, the authentication method includes, but is not limited to, face verification, biometric verification, fingerprint verification, voiceprint verification, iris verification, etc., and this example embodiment does not specifically limit it. In some embodiments, the authentication method corresponding to the authentication request may be determined by the smart glasses or the corresponding cloud, or it may be determined by the application where the target authentication operation is located. In some embodiments, the corresponding authentication method may be determined by making a decision based on at least one of the user profile of the wearer of the smart glasses, the device profile of the smart glasses, the wearer's historical authentication status, and the smart glasses' historical authentication status, or it may be determined by combining the current location of the smart glasses and / or the external environment image of the wearer currently in the area captured by the smart glasses. In some embodiments, according to the authentication method, the biometric features of the user matching the authentication method are first collected in the trusted environment of the device, and then the collected biometric features are compared with the biometric template data trusted in the trusted environment of the device. The specific data types of biometric features include, but are not limited to, face, fingerprint, voiceprint, iris, etc., and this example embodiment does not make any special limitations on them.

[0044] In some embodiments, obtaining the authentication method corresponding to the authentication request includes: determining the authentication method corresponding to the authentication request based on the target operation to be authenticated. In some embodiments, the corresponding authentication method can be determined based on relevant operation information of the target operation to be authenticated (including but not limited to at least one of operation type, operation object, operation content, operation risk level, and operation sensitivity). For example, smart glasses may have preset mapping relationships between various operation types and multiple risk levels. Based on this mapping relationship, the authentication method mapped to the operation type of the target operation to be authenticated can be obtained. Alternatively, the relevant operation information can be input into a preset model to obtain the authentication method output by the model. In some embodiments, the corresponding authentication method can be determined based on the verification time or the time interval between the verification time or operation time of a historically authenticated operation performed by the smart glasses most recently before the target authentication operation that satisfies a preset similarity condition with the target authentication operation. Alternatively, the corresponding authentication method can be determined based on the number of historically authenticated operations performed by the smart glasses within a preset time range before the target authentication operation that satisfies a preset similarity condition with the target authentication operation. Here, satisfying the preset similarity condition with the target authentication operation may refer to the same operation type as the target authentication operation, or it may refer to similar operation objects or operation content as the target authentication operation. This example embodiment does not impose any special limitations on this.

[0045] In some embodiments, the local biometric comparison of the biometric features includes: encrypting the biometric features according to the first key, sending the encrypted biometric features to the user device corresponding to the smart glasses, so that the user device performs a local biometric comparison of the biometric features and returns the corresponding first comparison result to the smart glasses, wherein the smart glasses and the user device have passed two-way authentication. In some embodiments, after the smart glasses collect the biometric features of the user wearing the device in a trusted environment, they encrypt the collected biometric features according to the first key and send the encrypted biometric features to the corresponding user device. The user device then performs a local biometric comparison of the biometric features with biometric template data trusted and stored on the user device and returns the first comparison result to the smart glasses. That is, considering the comparison execution experience or comparison execution efficiency of the smart glasses (for example, if the smart glasses do not have an NPU (Neural Processing Unit)), the local biometric comparison of the collected biometric features is not performed by the smart glasses, but by the corresponding user device. In some embodiments, the smart glasses and their corresponding user devices also need to exchange and verify each other's stored digital certificates. That is, the smart glasses verify the user device's digital certificate, and the user device verifies the smart glasses' digital certificate, to achieve two-way authentication (i.e., two-way identity authentication). This means that both parties verify each other's identities before communication, verifying the other party's trustworthiness and the connection's trustworthiness, preventing man-in-the-middle attacks or forgery of the smart glasses / user device. In some embodiments, the smart glasses and user device can negotiate a symmetric key based on their respective built-in root keys, and then each verify the other's digital certificate based on the negotiated symmetric key. Alternatively, the smart glasses and user device can create an asymmetric key during the initial connection, and then each verify the other's digital certificate based on the asymmetric key. In some embodiments, encrypted biometric features are only sent to the user device after the smart glasses and user device have completed two-way authentication, allowing the user device to perform local biometric comparison.

[0046] In some embodiments, encrypting the biometrics according to the first key and sending the encrypted biometrics to the user device corresponding to the smart glasses, so that the user device performs local biometric comparison on the biometrics and returns the corresponding first comparison result to the smart glasses, includes: performing lightweight processing on the biometrics to obtain a corresponding intermediate processing result, encrypting the intermediate processing result according to the first key, sending the encrypted intermediate processing result to the user device corresponding to the smart glasses, so that the user device performs local biometric comparison on the intermediate processing result and returns the corresponding first comparison result to the smart glasses. In some embodiments, after the smart glasses collect the biometrics of the user wearing the device in a trusted environment, they first perform intermediate processing on the biometrics to obtain a corresponding intermediate processing result, then encrypt the intermediate processing result according to the first key, and send the encrypted intermediate processing result to the corresponding user device, which performs local biometric comparison on the intermediate processing result and returns the obtained first comparison result to the smart glasses. The intermediate processing includes, but is not limited to, simple comparison, signal processing, and other preprocessing operations, which are not specifically limited in this example embodiment. In some embodiments, the comparison model required for local biometric comparison is split into a first model deployed on the smart glasses and a second model deployed on the user device. The model size of the first model needs to be less than or equal to a first preset threshold (e.g., 1M), and the model size of the second model needs to be less than or equal to a second preset threshold (e.g., 10M). The model size of the second model is larger than that of the first model, so that the smart glasses perform a simple comparison based on the first model (i.e., lightweight comparison, i.e., an intermediate processing step before local biometric comparison), and send the corresponding simple comparison result (i.e., intermediate processing result) to the user device. The user device performs a complex comparison based on the second model on the biometric template data trusted and stored on the user device (i.e., heavy comparison, i.e., local biometric comparison), and returns the first comparison result obtained from the complex comparison to the smart glasses. Here, the simple comparison has less computational resources, is faster, and has lower accuracy, while the complex comparison has higher computational complexity, higher accuracy, and higher latency.

[0047] Figure 3 This specification provides an example of an interaction flowchart between smart glasses and a user device for authentication.

[0048] like Figure 3As shown, voiceprint is used as an example of biometric feature. Those skilled in the art can determine that any other biometric feature (e.g., face, fingerprint, iris, etc.) can be used. The Trusted Execution Environment (TEE) / Central Processing Unit (CPU) on the smart glasses preprocesses the voiceprint signal of the collected user's voice data (including simple comparison (i.e., lightweight comparison), signal processing, etc.), compresses the multi-source data (voice data collected by multiple microphones in the microphone array of the smart glasses) according to the principle of minimum transmission, and transmits the compressed data to the user device through communication links such as Bluetooth and Wi-Fi. The transmission security on the communication link is achieved through signal encryption. The TEE / CPU / NPU (Neural Processing Unit) on the user device performs inference calculations on the compressed data through a model deployed in C++, that is, performs local biometric comparison. Then, based on the model output, combined with local accumulated information (e.g., local historical comparison information stored on the user device) and / or cloud capabilities / data requested from the cloud (e.g., historical authentication information of the smart glasses corresponding to the user device, or historical authentication information of the user wearing the smart glasses), a comprehensive decision is made to determine the corresponding comparison result.

[0049] Figure 4 This is a schematic diagram of a smart glasses for identity verification provided in an embodiment of this specification. The smart glasses for identity verification (hereinafter referred to as "smart glasses 1") can be implemented as all or part of an electronic device through software, hardware, or a combination of both. According to some embodiments, the smart glasses 1 includes a device authentication module 11, a comparison module 12, a judgment module 13, and a determination module 14.

[0050] Device authentication module 11 is used to authenticate the smart glasses based on the first key stored through the hardware-level security chip. If the authentication is successful, a trusted environment for the device is provided through the hardware-level security chip. The comparison module 12 is used to respond to an authentication request initiated by the target authentication operation performed by the user wearing the smart glasses, and to perform local biometric comparison of the user wearing the glasses through the trusted environment of the device to obtain the corresponding first comparison result. The judgment module 13 is used to determine whether the smart glasses and the cloud corresponding to the smart glasses have passed two-way authentication if the target authentication operation meets the first preset condition, or if the first comparison result meets the second preset condition. If so, the module encrypts the biometrics of the user wearing the smart glasses according to the first key, sends the encrypted biometrics to the cloud, and receives the second comparison result returned by the cloud. The cloud performs a second comparison of the biometrics of the user wearing the smart glasses according to the encrypted biometrics sent by the smart glasses after passing two-way authentication, and obtains the second comparison result. The determining module 14 is used to determine the authentication result of the user wearing the device based on the first comparison result and / or the second comparison result.

[0051] In some embodiments, the first preset condition includes the risk level corresponding to the target authentication operation being greater than or equal to a first preset threshold.

[0052] In some embodiments, the second preset condition includes the first comparison result indicating that the wearer has passed the comparison; Wherein, if the first comparison result meets the second preset condition, determining whether the smart glasses and the cloud corresponding to the smart glasses have passed two-way authentication includes: If the risk level corresponding to the identity verification operation is greater than or equal to the second preset threshold, and the first comparison result indicates that the user wearing the device can determine whether the smart glasses and the cloud corresponding to the smart glasses have passed two-way authentication through comparison.

[0053] In some embodiments, the first preset condition includes the target authentication operation and its corresponding at least one historical authentication operation not satisfying a preset continuity condition.

[0054] In some embodiments, the second preset condition includes the uncertainty level corresponding to the first comparison result being greater than or equal to a third preset threshold.

[0055] In some embodiments, the smart glasses 1 are also used for: If the user's identity verification fails multiple times consecutively, a second two-way authentication between the smart glasses and the cloud will be performed.

[0056] In some embodiments, the step of performing local biometric comparison of the wearer in the trusted environment of the device includes: Obtain the authentication method corresponding to the authentication request; According to the authentication method, the biometrics of the user wearing the device are collected through the trusted environment of the device, and the biometrics are compared locally.

[0057] In some embodiments, obtaining the authentication method corresponding to the authentication request includes: Based on the target authentication operation, determine the authentication method corresponding to the authentication request.

[0058] In some embodiments, performing local biometric comparison on the biometric features includes: The biometric feature is encrypted using the first key, and the encrypted biometric feature is sent to the user device corresponding to the smart glasses, so that the user device performs a local biometric comparison of the biometric feature, wherein the smart glasses and the user device have passed two-way authentication.

[0059] In some embodiments, encrypting the biometrics according to the first key and sending the encrypted biometrics to the user device corresponding to the smart glasses, so that the user device performs local biometric comparison on the biometrics, includes: The biometric features are lightly processed to obtain corresponding intermediate processing results. The intermediate processing results are then encrypted using the first key. The encrypted intermediate processing results are sent to the user device corresponding to the smart glasses, enabling the user device to perform local biometric comparison based on the intermediate processing results.

[0060] The above-described apparatus embodiments correspond to the aforementioned method embodiments. For detailed descriptions, please refer to the description in the method embodiments section; further details will not be repeated here. The apparatus embodiments are derived from the corresponding method embodiments and have the same technical effects. For detailed descriptions, please refer to the corresponding method embodiments.

[0061] Figure 5 This is a schematic diagram of an identity verification system provided in an embodiment of this specification, such as... Figure 5As shown, the authentication system includes a cloud platform and smart glasses as described above. The cloud platform is used to: after the smart glasses and the cloud platform have completed two-way authentication, perform a second comparison of the wearer's biometrics based on the encrypted biometrics of the wearer sent by the smart glasses, obtain a corresponding second comparison result, and return the second comparison result to the smart glasses. In some embodiments, the smart glasses collect the wearer's biometrics through the trusted environment of the device, perform a local biometric comparison of the biometrics, obtain a corresponding first comparison result, and send the encrypted biometrics to the cloud platform for a second comparison. In some embodiments, the smart glasses and the cloud platform have been described in detail above and will not be repeated here.

[0062] Figure 6 This is a schematic diagram of an identity verification system provided in an embodiment of this specification, such as... Figure 6 As shown, the authentication system includes a user device, a cloud, and the smart glasses described above. The user device is used to: perform local biometric comparison on the encrypted biometric features of the user wearing the smart glasses, as sent by the smart glasses, wherein the smart glasses and the user device have passed two-way authentication. The cloud is used to: after the smart glasses and the cloud have passed two-way authentication, perform a second comparison on the user wearing the encrypted biometric features sent by the smart glasses, obtain a corresponding second comparison result, and return the second comparison result to the smart glasses. In some embodiments, the smart glasses collect the biometric features corresponding to the user wearing the smart glasses through the trusted environment of the device, send the encrypted biometric features to the corresponding user device, wherein the smart glasses and the user device have passed two-way authentication, the user device performs local biometric comparison on the biometric features, returns the corresponding first comparison result to the smart glasses, and the smart glasses send the encrypted biometric features to the cloud for a second comparison. In some embodiments, the smart glasses, user device, and cloud have been described in detail above and will not be repeated here.

[0063] The embodiments in this specification also provide Figure 7 The diagram shows the structure of the electronic device. Figure 7 At the hardware level, the electronic device includes a processor, internal bus, network interface, memory, and non-volatile memory, and may also include other hardware required for business operations. The processor reads the corresponding computer program from the non-volatile memory into memory and then runs it to implement the above method.

[0064] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0065] Those skilled in the art will understand that embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0066] This specification is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0067] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0068] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0069] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0070] This specification can be described in the general context of computer-executable instructions that are executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This specification can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0071] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0072] The above description is merely an embodiment of this specification and is not intended to limit this specification. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.

Claims

1. A method for authentication, applied to smart glasses, comprising: The smart glasses are authenticated using a first key stored in a hardware-level security chip. If the authentication is successful, a trusted environment for the device is provided through the hardware-level security chip. In response to an authentication request initiated by a target authentication operation performed by a user wearing the smart glasses, the user's biometric features are compared locally through the trusted environment of the device to obtain a corresponding first comparison result; If the target authentication operation meets the first preset condition, or if the first comparison result meets the second preset condition, it is determined whether the smart glasses and the cloud corresponding to the smart glasses have passed two-way authentication. If so, the biometrics of the wearer are encrypted according to the first key, and the encrypted biometrics are sent to the cloud. The cloud returns the second comparison result. After passing two-way authentication, the cloud performs a second comparison of the biometrics of the wearer according to the encrypted biometrics sent by the smart glasses to obtain the second comparison result. The authentication result of the user wearing the device is determined based on the first comparison result and / or the second comparison result.

2. The method according to claim 1, wherein the first preset condition includes the risk level corresponding to the target authentication operation being greater than or equal to a first preset threshold.

3. The method according to claim 1 or 2, wherein the second preset condition includes the first comparison result indicating that the wearer passes the comparison; in, If the first comparison result meets the second preset condition, determining whether the smart glasses and the cloud corresponding to the smart glasses have passed two-way authentication includes: If the risk level corresponding to the identity verification operation is greater than or equal to the second preset threshold, and the first comparison result indicates that the user wearing the device can determine whether the smart glasses and the cloud corresponding to the smart glasses have passed two-way authentication through comparison.

4. The method according to claim 1, wherein the first preset condition includes that the target authentication operation and at least one corresponding historical authentication operation do not satisfy a preset continuity condition.

5. The method according to claim 1, wherein the second preset condition includes the uncertainty level corresponding to the first comparison result being greater than or equal to a third preset threshold.

6. The method according to claim 1, further comprising: If the user's identity verification fails multiple times consecutively, a second two-way authentication between the smart glasses and the cloud will be performed.

7. The method according to claim 1, wherein the step of performing local biometric comparison of the wearer in the trusted environment of the device includes: Obtain the authentication method corresponding to the authentication request; According to the authentication method, the biometrics of the user wearing the device are collected through the trusted environment of the device, and the biometrics are compared locally.

8. The method according to claim 7, wherein obtaining the authentication method corresponding to the authentication request includes: Based on the target authentication operation, determine the authentication method corresponding to the authentication request.

9. The method according to claim 7, wherein performing local biometric comparison on the biometric features includes: The biometric feature is encrypted using the first key, and the encrypted biometric feature is sent to the user device corresponding to the smart glasses. The user device performs a local biometric comparison of the biometric feature and returns the corresponding first comparison result to the smart glasses. The smart glasses and the user device have been mutually authenticated.

10. The method according to claim 9, wherein encrypting the biometric feature according to the first key, sending the encrypted biometric feature to the user device corresponding to the smart glasses, so that the user device performs local biometric comparison on the biometric feature, and returns the corresponding first comparison result to the smart glasses, comprises: The biometric features are lightly processed to obtain corresponding intermediate processing results. The intermediate processing results are then encrypted using the first key. The encrypted intermediate processing results are sent to the user device corresponding to the smart glasses, so that the user device performs local biometric comparison based on the intermediate processing results and returns the corresponding first comparison result to the smart glasses.

11. A smart glasses for authentication, comprising: The device authentication module is used to authenticate the smart glasses based on the first key stored through the hardware-level security chip. If the authentication is successful, a trusted environment for the device is provided through the hardware-level security chip. The comparison module is used to respond to an authentication request initiated by a target authentication operation performed by the user wearing the smart glasses, and to perform local biometric comparison of the user wearing the glasses through the trusted environment of the device to obtain the corresponding first comparison result. The judgment module is used to determine whether the smart glasses and the cloud corresponding to the smart glasses have passed two-way authentication if the target authentication operation meets the first preset condition, or if the first comparison result meets the second preset condition. If so, the module encrypts the biometrics of the user wearing the glasses according to the first key, sends the encrypted biometrics to the cloud, and receives the second comparison result returned by the cloud. The cloud performs a second comparison of the biometrics of the user wearing the glasses according to the encrypted biometrics sent by the smart glasses after passing two-way authentication, and obtains the second comparison result. The determining module is used to determine the authentication result of the user wearing the device based on the first comparison result and / or the second comparison result.

12. An authentication system comprising a cloud and smart glasses as claimed in any one of claims 1 to 8; The cloud is used to: after the smart glasses and the cloud have completed two-way authentication, perform a second comparison of the wearer's biometrics based on the encrypted biometrics of the wearer sent by the smart glasses, obtain a corresponding second comparison result, and return the second comparison result to the smart glasses.

13. An authentication system comprising a user device, a cloud, and smart glasses as described in claim 9 or 10; The user equipment is used to: perform local biometric comparison on the encrypted biometric features of the user wearing the smart glasses, as sent by the smart glasses, wherein... The smart glasses and the user device have been mutually authenticated. The cloud is used to: after the smart glasses and the cloud have completed two-way authentication, perform a second comparison of the wearer's biometric features based on the encrypted biometric features sent by the smart glasses, obtain a corresponding second comparison result, and return the second comparison result to the smart glasses.

14. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 10.

15. An electronic device, characterized in that, include: A processor and a memory; wherein the memory stores a computer program adapted to be loaded by the processor and to execute the steps of the method as claimed in any one of claims 1 to 10.

16. A computer program product having at least one instruction stored thereon, characterized in that, When the at least one instruction is executed by the processor, it implements the steps of the method according to any one of claims 1 to 10.

Images