Identity identification information generation method and device, authentication method and device, storage medium, program product and computer equipment

Abstract

The invention discloses an identity identification information generation method and device, an authentication method and device, a storage medium, a program product and computer equipment, and the method comprises the steps: obtaining a plurality of pieces of identification information corresponding to a target user, the multiple pieces of identification information comprise first user identification information of a target user and first equipment identification information of first equipment associated with the target user; first encryption processing is carried out on the multiple pieces of identification information, and first identification encryption information corresponding to the multiple pieces of identification information is obtained; obtaining encryption parameters; based on the encryption parameter and each piece of first identification encryption information, generating second identification encryption information corresponding to each piece of first identification encryption information; and the identity identification information of the target user is generated at least based on the second identification encryption information, so that the encryption effect can be effectively improved, the risk of privacy disclosure can be reduced, and in addition, the uniqueness and reliability of the generated identity identification information can be effectively improved.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a method for generating identity information, an authentication method, an apparatus, a storage medium, a program product, and a computer device. Background Technology

[0002] In the fields of the Internet and the Internet of Things, users have multiple identity tags when browsing the web, and they also leave behind many identity identifiers. These identifiers can be used to uniquely identify the user's identity within the same business or the same single point system.

[0003] In related technologies, an anonymous identity document (ID) can be generated by collecting some basic user identity information. This anonymous ID can then be used as the user's identity identifier in a specific business or point-of-sight system. However, such anonymous IDs may lead to the leakage of identity information, thus posing a risk of privacy breaches. Summary of the Invention

[0004] To address the aforementioned technical issues, this application proposes an identity information generation method, authentication method, apparatus, storage medium, program product, and computer equipment, which can reduce the risk of privacy leakage.

[0005] In a first aspect, embodiments of this application provide a method for generating identity information, including: Obtain multiple identification information corresponding to the target user, wherein the multiple identification information includes the first user identification information of the target user and the first device identification information of the first device associated with the target user; The plurality of identification information are subjected to a first encryption process to obtain the first identification encryption information corresponding to each of the plurality of identification information; Obtain the encryption parameters; Based on the encryption parameters and each first identifier encryption information, generate second identifier encryption information corresponding to each first identifier encryption information; The identity information of the target user is generated based at least on each of the second identifier encryption information.

[0006] Optionally, obtaining the encryption parameters includes: Based on current time information, distributed system identification information, and / or sequence information, the snowflake algorithm is used to generate encryption parameters, wherein the distributed system identification information represents the identifier assigned to the computer device used to perform the method in the distributed system, and the sequence information represents a randomly generated sequence.

[0007] Optionally, generating second identifier encryption information corresponding to each first identifier encryption information based on the encryption parameters and each first identifier encryption information includes: For each of the first identifier encryption information, the encryption parameters and the first identifier encryption information are fused to obtain first fused information, and the first fused information is subjected to second encryption processing to obtain second identifier encryption information corresponding to the first identifier encryption information.

[0008] Optionally, the method further includes: Obtain the business identification information corresponding to the business party, wherein the business party is used to request the identification information; The step of generating the target user's identity information based at least on each of the second identifier encryption information includes: Based on the business identification information and each of the second identification encryption information, the identity identification information of the target user is generated.

[0009] Secondly, embodiments of this application provide an authentication method, which is executed by an authentication platform and includes: Receive a first authentication request from the business party, wherein the first authentication request is used to request the return of the target user's identity information; The identity information generation method according to any one of the first aspects above generates the identity information of the target user; The identity information is returned to the business party, wherein the identity information is used by the business party to authenticate the target user.

[0010] Optionally, before generating the identity information, the method further includes: Perform a first verification operation on the first authentication request; The acquisition of multiple identifiers corresponding to the target user includes: After the first verification operation is successful, multiple identification information corresponding to the target user is obtained from the gateway.

[0011] Optionally, before returning the identity information to the business party, the method further includes: Generate a first intermediate credential that matches the identity information; The identity information is synchronized to the first data storage unit, and the first intermediate credential is sent to the business party. Receive the intermediate verification request sent by the business party in response to the first intermediate credential, and perform a second verification operation based on the intermediate verification request; After the second verification operation is successful, the identity information is retrieved from the first data storage unit using the first intermediate credential, and the identity information is returned to the business party.

[0012] Optionally, the identity information and each of the second identity encryption information are synchronized to the first data storage unit, and the method further includes: Receive a second authentication request sent by the business party, wherein the second authentication request is associated with the target user; Based on the second authentication request, obtain the second device identification information and the second user identification information; Based on the second device identification information and the second user identification information, a matching is performed in the first data storage unit to obtain a matching result; If the matching result meets the voiceprint recognition trigger condition, the following operation is performed: Obtain the user voice data corresponding to the second authentication request; Voiceprint recognition is performed based on the user's voice data; Based on the voiceprint recognition results, update information corresponding to the matching results is generated; and The first data storage unit is updated using the update information, and the update information is sent to the business party, wherein the update information is used to update the identity information of the target user.

[0013] Optionally, the voiceprint recognition triggering condition includes any of the following: The matching result is characterized as follows: the second device identification information matches the second identification encryption information corresponding to the first device identification information, and the second user identification information does not match the second identification encryption information corresponding to the first user identification information; The matching result is characterized as follows: the second device identification information does not match the second identification encryption information corresponding to the first device identification information, and the second user identification information matches the second identification encryption information corresponding to the first user identification information.

[0014] Optionally, the voiceprint recognition based on the user's voice data includes: Based on the user's voice data, a pre-trained Gaussian Mixture Model (GMM) is invoked for voiceprint recognition. The training process of the GMM includes: Based on the sound samples, an initial GMM and a deep neural network (DNN) are constructed respectively. Based on the test set corresponding to the sound sample, the DNN is invoked to obtain a first test result and the initial GMM is invoked to obtain a second test result; Based on the first test result and the second test result, the initial GMM is adjusted to obtain the GMM.

[0015] Optionally, the step of constructing an initial GMM and a deep neural network (DNN) based on sound samples includes: The sound samples are preprocessed; The preprocessed audio samples are segmented into frames using the Hamming window function to obtain short frame signals; Based on the short frame signal, feature extraction is performed to obtain voiceprint features; Based on the aforementioned voiceprint features, initial GMM and DNN are constructed respectively.

[0016] Optionally, the user voice data is generated based on the voice emitted by the user corresponding to the second authentication request, and before performing voiceprint recognition based on the user voice data, the method further includes: Based on the user's voice data, it is determined whether the spoken voice matches a randomly generated sentence to obtain a first liveness detection result; The facial image of the target user is detected to obtain facial movements that match the spoken voice, so as to obtain a second liveness detection result; Based on the first liveness detection result and / or the second liveness detection result, determine whether to perform voiceprint recognition.

[0017] Thirdly, embodiments of this application provide an identity information generation apparatus, comprising: The identification information acquisition module is used to acquire multiple identification information corresponding to the target user, wherein the multiple identification information includes the first user identification information of the target user and the first device identification information of the first device associated with the target user; The first encryption module is used to perform a first encryption process on the plurality of identification information respectively to obtain the first identification encryption information corresponding to each of the plurality of identification information; The parameter acquisition module is used to acquire encrypted parameters; The second encryption module is used to generate second identifier encryption information corresponding to each first identifier encryption information based on the encryption parameters and each first identifier encryption information. An identity generation module is used to generate the identity information of the target user based at least on each of the second identity encryption information.

[0018] Fourthly, embodiments of this application provide an authentication device, which is applied to an authentication platform and includes: The receiving module is used to receive a first authentication request from the business party, wherein the first authentication request is used to request the return of the target user's identity information; The processing module is configured to generate the identity information of the target user according to the identity information generation method described in any one of the first aspects above; The sending module is used to return the identity information to the business party, wherein the identity information is used by the business party to authenticate the target user.

[0019] Fifthly, embodiments of this application provide a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method described in any of the preceding claims.

[0020] Sixthly, embodiments of this application provide a computer program product, including computer instructions that, when executed by a processor, implement the steps of the method described in any of the preceding claims.

[0021] In a seventh aspect, embodiments of this application provide a computer device including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the steps of the method described in any of the preceding claims.

[0022] In summary, the embodiments of this application have at least the following beneficial effects: Using the embodiments of this application, multiple identification information corresponding to a target user is obtained, wherein the multiple identification information includes a first user identification information of the target user and a first device identification information of a first device associated with the target user; the multiple identification information is subjected to a first encryption process to obtain first identification encryption information corresponding to each of the multiple identification information; encryption parameters are obtained; based on the encryption parameters and each first identification encryption information, second identification encryption information corresponding to each first identification encryption information is generated; at least based on each second identification encryption information, the target user's identity identification information is generated. In this way, by first performing preliminary encryption on different identification information to obtain first identification encryption information, and then combining the encryption parameters to generate second identification encryption information for different identification information, and generating the final target user identity identification information accordingly, the encryption effect can be effectively improved, thereby reducing the risk of privacy leakage. In addition, combining user identification information and device identification information as the basis for generating identity identification information can also effectively improve the uniqueness and reliability of the generated identity identification information. Attached Figure Description

[0023] Figure 1 This is a flowchart illustrating the identity information generation method provided in the embodiments of this application.

[0024] Figure 2 This is a flowchart illustrating the authentication method provided in the embodiments of this application.

[0025] Figure 3 This is a schematic diagram of the machine-card consistency determination process provided in the embodiments of this application.

[0026] Figure 4 This is a schematic diagram of the structure of the identity information generation device provided in the embodiments of this application.

[0027] Figure 5 This is a schematic diagram of the authentication device provided in the embodiments of this application.

[0028] Figure 6 This is a schematic diagram of the structure of the computer device provided in the embodiments of this application. Detailed Implementation

[0029] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments / examples are only a part of the embodiments / examples of this application, and not all of the embodiments / examples. Based on the embodiments / examples in this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0030] In the description of this application, the terms "first," "second," "third," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined with "first," "second," "third," etc., may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "multiple" means two or more. In the description of this application, the term "comprising" and its variations are open-ended, meaning "including but not limited to." The term "based on" means "at least partially based on." The term "according to" means "at least partially according to." The term "one embodiment / example" means "at least one embodiment / example"; the term "another embodiment / example" means "at least one additional embodiment / example"; the term "some embodiments / examples" means "at least some embodiments / examples."

[0031] In the description of this application, it should be noted that, unless otherwise expressly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection between two components. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0032] In the description of this application, it should be noted that, unless otherwise defined, all technical and scientific terms used in this application have the same meaning as commonly understood by one of ordinary skill in the art. The terminology used in this application is for the purpose of describing specific embodiments only and is not intended to limit the application. Those skilled in the art can understand the specific meaning of the above terms in this application according to the specific circumstances.

[0033] Firstly, see [the following] Figure 1 The diagram shows a flowchart of an identity information generation method provided in an embodiment of this application. The above-mentioned identity information generation method can be applied to computer devices with data processing capabilities (such as terminal devices, servers, or authentication platforms described in the embodiments of this application). The method includes S101-S105, as follows.

[0034] S101, obtain multiple identification information corresponding to the target user, wherein the multiple identification information includes the first user identification information of the target user and the first device identification information of the first device associated with the target user.

[0035] In some examples, since users can generally connect to the network by using a device, the first device in this embodiment may refer to the device used by the target user. Thus, at least one of the plurality of identification information may be identification information associated with the first device, and one or more of the plurality of identification information may be identification information associated with the target user.

[0036] In some examples, the aforementioned first user identification information can be used to indicate the identity / user identification of the target user. For example, the first user identification information may include the target user's number (such as a mobile phone number).

[0037] In some cases, the aforementioned first device identification information can be used to indicate the device identification of the first device. For example, the first device identification information may include the device information of the first device, or the first device identification information may be generated from the device information of the first device. The device information may include at least one of the following: the region where the device is located, the language used by the device, the device startup time (accurate to the second), the device system version, the device name, the device carrier information, physical memory, hard disk, system update time (accurate to the second), the device model, and the time zone where the device is located.

[0038] However, while the various types of information contained in the device information mentioned above can serve to identify the first device in some cases, in other scenarios, these types of information may only remain stable for a period of time. For example, after the first device is restarted or reset, these types of information may be refreshed, which may affect the stability of subsequent identity information and lead to inaccurate acquisition of identity information, resulting in defects in stability and uniqueness.

[0039] In response to the above scenario, the first device identification information in this embodiment may include the International Mobile Equipment Identity (IMEI)-A of the first device A, making the first device identification information unique and effectively avoiding the problem that various types of information remain stable only for a period of time in the above scenario.

[0040] In some examples, obtaining multiple identifiers corresponding to the target user includes obtaining multiple identifiers corresponding to the target user from the gateway.

[0041] S102, perform a first encryption process on the plurality of identification information respectively to obtain the first identification encryption information corresponding to each of the plurality of identification information.

[0042] In some cases, the first encryption process described above may include encryption algorithms such as the MD5 Message-Digest Algorithm. However, the MD5 algorithm used in this case is theoretically prone to hash collisions in certain scenarios and is susceptible to brute-force attacks.

[0043] To address the above issues, the first encryption process in this embodiment may include the Advanced Encryption Standard (AES) algorithm. The AES algorithm can reduce hash collisions after encryption and improve the uniqueness and security of subsequently generated identity information. In this embodiment, the first identifier encryption information generated using the AES algorithm can be represented as a 128-bit encrypted string, which helps prevent the leakage of individual identifier information.

[0044] In some examples, each first identifier encryption information may be obtained by performing a first encryption process on the corresponding identifier information.

[0045] S103, obtain encryption parameters.

[0046] In some examples, the aforementioned encryption parameters can be used to assist in secondary encryption of each first identifier encryption information to obtain the corresponding second identifier encryption information. For example, the encryption parameters can be generated and obtained in real time, in which case the encryption parameters can include at least one random number (such as any one of the at least one random number can be associated with at least one of the following parameters: the current time, the current location of the target user, and the random number of the current location of the first device). In addition, the encryption parameters can also be obtained from an encryption parameter library, which can contain encryption parameters adapted to various general encryption algorithms.

[0047] S104, based on the encryption parameters and each of the first identifier encryption information, generate the second identifier encryption information corresponding to each of the first identifier encryption information.

[0048] In some examples, step S104 may use the encryption parameter to encrypt each of the first identifier encryption information (such as the first encryption process and / or the second encryption process in the embodiments of this application, with the encryption parameter as the basis for the encryption process) to obtain the second identifier encryption information corresponding to each of the first identifier encryption information.

[0049] In some examples, step S104 may further involve fusing the encryption parameter with each of the first identifier encryption information before performing encryption processing to obtain the second identifier encryption information corresponding to each of the first identifier encryption information. This fusing may include splicing or merging.

[0050] S105, at least based on each of the second identifier encryption information, generate the identity information of the target user.

[0051] In some examples, step S105 may at least fuse each of the second identifier encryption information before encrypting it to generate the target user's identity information. This fusion may include splicing or merging.

[0052] In some examples, the aforementioned identification information can be used to indicate the anonymous ID of the target user.

[0053] In one optional implementation, obtaining the encryption parameters includes: Based on current time information, distributed system identification information, and / or sequence information, the snowflake algorithm is used to generate encryption parameters, wherein the distributed system identification information represents the identifier assigned to the computer device used to perform the method in the distributed system, and the sequence information represents a randomly generated sequence.

[0054] In some examples, the aforementioned current time information may include a current timestamp, for example, a 31-bit timestamp. In this embodiment, the timestamp can be in the millisecond range, thus representing a time range of 2^31 / (1000 * 60 * 60 * 24 * 365) ≈ 68.1 years. Therefore, this embodiment can improve the uniqueness of the encrypted parameter.

[0055] In some examples, the computer device used to perform the method may be located in a distributed system, and the computer device may be assigned a unique identifier (e.g., a 4-bit machine ID) within the distributed system, which may be characterized by the distributed system's identification information. Therefore, this embodiment can improve the uniqueness of the encryption parameter and ensure that the generated identity information is unique and continuous, even in a distributed scenario.

[0056] In some examples, the sequence information described above can be used to characterize a randomly generated sequence, for example, a 26-bit sequence number generated within the same millisecond. Since a 26-bit sequence number can represent a range of 2^26 ≈ 67.1 million, this embodiment can improve the uniqueness of the encryption parameter.

[0057] In some examples, one or more of the current time information, distributed system identification information, and sequence information can be used as input parameters for the snowflake algorithm to generate encryption parameters. It can be understood that if there are missing parts in the input parameters of the snowflake algorithm (e.g., only one of the current time information, distributed system identification information, and sequence information is used as an input parameter), the corresponding part of the preset parameters can be used to fill in the missing parts, thereby satisfying the operational requirements of the snowflake algorithm.

[0058] In some examples, when using the snowflake algorithm to generate encryption parameters, the algorithm may also include a sign bit, which can be 1 bit or fixed to 0 to indicate that the generated encryption parameter is a positive number. In this embodiment, the encryption parameter generated using the snowflake algorithm can be a 32-bit string.

[0059] It is understandable that when using all of the current time information, distributed system identification information, and sequence information as input parameters for the snowflake algorithm, the snowflake algorithm can also ensure the global uniqueness and increasing trend of the generated identity information.

[0060] In one optional implementation, generating second identifier encryption information corresponding to each first identifier encryption information based on the encryption parameters and each first identifier encryption information includes: For each of the first identifier encryption information, the encryption parameters and the first identifier encryption information are fused to obtain first fused information, and the first fused information is subjected to second encryption processing to obtain second identifier encryption information corresponding to the first identifier encryption information.

[0061] In some examples, the above-mentioned fusion of the encryption parameters and the first identifier encryption information to obtain the first fused information may include: concatenating the encryption parameters and the first identifier encryption information to obtain the first fused information.

[0062] In some examples, the first identifier encryption information and encryption parameters can be represented as corresponding strings. In this case, the first fusion information can be represented as a string that is longer than the strings corresponding to the first identifier encryption information and encryption parameters.

[0063] In some examples, the second encryption process described above may include Bcrypt encryption. In this embodiment, the second identifier encrypted information generated by Bcrypt encryption can be a 60-bit string. Compared to the first identifier encrypted information generated using the AES algorithm, which is a 128-bit string, this second identifier encrypted information string is neither too long, nor does it have excessively long uniqueness and security, and it also facilitates information storage and transmission. Furthermore, the second identifier encrypted information (uuid1) corresponding to the first user identifier information and the second identifier encrypted information (uuid2) corresponding to the first device identifier information can be combined to form the target user's identity identifier information, which can be a 120-bit string.

[0064] It should be noted that the AES algorithm can be used to improve the security of encrypted raw data; the Bcrypt encryption algorithm can be used to generate a fixed-length hash value; and the snowflake algorithm can be used to generate a unique 120-bit ID, which can serve as a unique identifier for data or events.

[0065] Because the ciphertext generated by Bcrypt from the same plaintext is different each time, it is impossible to reverse the plaintext by directly comparing the ciphertexts. In addition, Bcrypt is a slow hash algorithm with a relatively long execution time, which increases the difficulty of brute-force cracking by several orders of magnitude, making it more difficult to crack and making the generated identity information more secure.

[0066] Of course, in other examples, the second encryption process can also use the first encryption process described in any embodiment of this application, which will not be repeated here.

[0067] In an optional implementation, the method further includes: Obtain the business identification information corresponding to the business party, wherein the business party is used to request the identification information; The step of generating the target user's identity information based at least on each of the second identifier encryption information includes: Based on the business identification information and each of the second identification encryption information, the identity identification information of the target user is generated.

[0068] In some examples, the business entity may be a user / terminal / server that requests the identity information by sending a first authentication request.

[0069] In some examples, the business identification information and each of the second identification encryption information can be merged (concatenated) together before the first encryption process and / or the second encryption process described above are performed to obtain the target user's identity identification information.

[0070] Secondly, see Figure 2 The diagram illustrates a flowchart of an authentication method provided in an embodiment of this application. The authentication method is executed by an authentication platform, which may, exemplarily, include a cloud or a server. The method includes steps S201-S203, as detailed below.

[0071] S201, Receive a first authentication request from the business party, wherein the first authentication request is used to request the return of the target user's identity information.

[0072] In some examples, the business entity may include a business server and a business application (APP) running on the primary terminal currently being used by the target user. See also Figure 3 Target user A can access the service app through the first terminal, and target user A can control the first terminal or the service server to send a first authentication request to the authentication platform by inputting control information on the service app. For example, the service app can be pre-configured with corresponding functional settings, which may include at least one of the following: application ID (APPID, i.e., the unique identifier of the service app; for example, the APPID may be assigned to the service app by the authentication platform), a whitelist of IP addresses, an application key (APPKey), supported platform types (including Android, iOS, and / or H5), and the ability to request the return of the target user's identity information.

[0073] In some examples, the first authentication request may include at least one of the following: APPID, signature information (e.g., signature information generated using the RSA encryption algorithm corresponding to the business party), user authorization credential, or user authorization code.

[0074] S202, generate the identity information of the target user according to the identity information generation method described in any one of the first aspects above.

[0075] In some examples, step S202 may employ any of the embodiments of the first aspect described above to generate the identity information of the target user.

[0076] S203, return the identity information to the business party, wherein the identity information is used by the business party to authenticate the target user.

[0077] In some examples, after receiving the identity information, the business entity can associate the target user's account information with the identity information and store it in a second data storage unit corresponding to the business entity, so as to facilitate subsequent authentication of the target user.

[0078] See in some examples Figure 3 This identity information can be referred to as an anonymous ID.

[0079] In one optional implementation, before generating the identity information, the method further includes: The first authentication request undergoes a first verification operation. In some examples, the authentication platform may perform a first verification operation on the first authentication request, which may include at least one of the following: parameter validity check, signature verification, and APPID availability confirmation. Here, the APPID, business type, and signature in the parameters included in the first authentication request can be matched with the corresponding information stored in the system database associated with the authentication platform to verify whether the first authentication request has the necessary permissions. Furthermore, the fields of the first authentication request are concatenated according to rules and then subjected to signature verification to check whether the first authentication request has been tampered with.

[0080] The acquisition of multiple identifiers corresponding to the target user includes: After the first verification operation is successful, multiple identification information corresponding to the target user is obtained from the gateway.

[0081] In some examples, after confirming that the first verification operation is successful, the authentication platform can directly obtain multiple identification information corresponding to the target user from the gateway, such as the first user identification information (such as mobile phone number) and the first device identification information (such as IMEI-A) directly from the gateway.

[0082] In some cases, identity information is not interoperable across system platforms and / or devices. The identity information generation system of related technologies mainly exists in Android devices, making it impossible to identify users across system platforms and / or devices. For example, identity information on Android devices is not interoperable with identity information on iOS platforms. Since the collected information mainly consists of device details (such as device location, language, startup time (accurate to the second), system version, device name, carrier information, physical memory, hard drive space, system update time (accurate to the second), device model, and time zone), these parameters can only remain stable for a period of time in certain scenarios. If a user resets or restarts their device, it may affect the stability of the identity information, leading to inaccurate data acquisition. Due to these instability and uniqueness deficiencies, identity information sometimes requires secondary authentication / verification using other technologies to determine the consistency between the target user's terminal device and the corresponding mobile phone number, thus achieving accuracy requirements.

[0083] In this embodiment, the acquisition and subsequent processing of multiple identification information (such as the first user identification information and the first device identification information) can be carried out without relying on the underlying capabilities of a specific device and / or system platform. Instead, the information can be obtained directly through the gateway, thus seamlessly supporting iOS and Android systems and promoting the free flow of information between different devices, thereby greatly improving the user experience and the flexibility of data management.

[0084] In an optional implementation, before returning the identity information to the business party, the method further includes: Generate a first intermediate credential token A that matches the identity information; The identity information is synchronized to the first data storage unit, and the first intermediate credential is sent to the business party. Receive the intermediate verification request sent by the business party in response to the first intermediate credential, and perform a second verification operation based on the intermediate verification request; After the second verification operation is successful, the identity information is retrieved from the first data storage unit using the first intermediate credential, and the identity information is returned to the business party.

[0085] In some examples, the authentication platform may also associate and store identity information, as well as multiple identification information (or the first user identification information, the first device identification information) and / or network IP address in a first data storage unit. The first data storage unit associated with the authentication platform may include a database and / or cache associated with the authentication platform. For example, the cache may be a Redis cache.

[0086] In some examples, the intermediate verification request may carry at least one of the following: the first intermediate credential token A, the business identification information (e.g., APPID) corresponding to the business party, and the signature information (e.g., signature information generated using the RSA encryption algorithm corresponding to the business party) corresponding to the business party. In this way, the authentication platform can perform a second verification operation on the intermediate verification request. The second verification operation may include at least one of the following: parameter validity check, signature verification, and APPID availability confirmation (for details, please refer to the relevant embodiments of the first verification operation mentioned above, which will not be repeated here). After the second verification operation is passed, the first intermediate credential token A carried in the intermediate verification request can be used to query the first data storage unit to retrieve the corresponding identity identification information from the first data storage unit and return it to the business server and / or business APP in the business party.

[0087] In an optional implementation, the identity information and each of the second identity encryption information are synchronized to the first data storage unit, and the method further includes: Receive a second authentication request sent by the business party, wherein the second authentication request is associated with the target user; Based on the second authentication request, obtain the second device identification information and the second user identification information; Based on the second device identification information and the second user identification information, a matching is performed in the first data storage unit to obtain a matching result; If the matching result meets the voiceprint recognition trigger condition, the following operation is performed: Obtain user voice data corresponding to the second authentication request; wherein, the user voice data is collected with user authorization and can be generated by recording user voice through the sound acquisition component of the terminal device; Voiceprint recognition is performed based on the user's voice data; Based on the voiceprint recognition results, update information corresponding to the matching results is generated; and The first data storage unit is updated using the update information, and the update information is sent to the business party, wherein the update information is used to update the identity information of the target user.

[0088] In some examples, the identity information and each of the second identifier encryption information can be synchronized to the first data storage unit for storage. Afterwards, the service provider can continue to send a second authentication request associated with the target user to the authentication platform. The authentication platform can obtain the second device identifier information and the second user identifier information based on the second authentication request. For example, the second authentication request may carry the second device identifier information and the second user identifier information associated with the target user. Here, it can be understood that the service provider sends a second authentication request for the target user, requesting the authentication platform to match the second device identifier information and the second user identifier information in the first data storage unit to obtain a matching result. This matching result can be used to indicate whether the second identifier encryption information corresponding to the first device identifier information stored in the first data storage unit matches the second device identifier information, and it can also be used to indicate whether the second identifier encryption information corresponding to the first user identifier information stored in the first data storage unit matches the second user identifier information.

[0089] In some examples, the authentication platform may store the target user's voiceprint information. This allows for voiceprint recognition by comparing the voiceprint information with the voiceprint in the user's voice data. Specifically, the voiceprint similarity between the voiceprint information and the voiceprint in the user's voice data can be compared to a preset voiceprint similarity threshold. Generally, if the voiceprint similarity is less than the preset threshold, the voiceprint recognition is considered to have failed. For example, see... Figure 3The authentication platform can obtain the target user's baseline voiceprint to get the target user's voiceprint information, and after generating identity information (anonymous ID), it associates and stores the identity information with the baseline voiceprint / voiceprint information, so that it can be directly called in subsequent voiceprint recognition.

[0090] In some examples, if the voiceprint recognition result indicates a voiceprint match, updated information corresponding to the matching result can be generated. Here, the updated information can be directly used to represent the matching result. Thus, the second identifier encrypted information stored in the first data storage unit can be updated accordingly based on whether the second identifier encrypted information corresponding to the first device identifier information stored in the first data storage unit matches the second device identifier information, and whether the second identifier encrypted information corresponding to the first user identifier information stored in the first data storage unit matches the second user identifier information. If a mismatch exists, the mismatched second device identifier information or second user identifier information can be used to generate second identifier encrypted information corresponding to the mismatched second device identifier information or second user identifier information according to the second identifier encrypted information generation method described in any embodiment of this application. The regenerated second identifier encrypted information can then be used to update the target user's identity information.

[0091] In one optional implementation, the voiceprint recognition trigger condition includes any of the following: The matching result is characterized as follows: the second device identification information matches the second identification encryption information corresponding to the first device identification information, and the second user identification information does not match the second identification encryption information corresponding to the first user identification information; The matching result is characterized as follows: the second device identification information does not match the second identification encryption information corresponding to the first device identification information, and the second user identification information matches the second identification encryption information corresponding to the first user identification information.

[0092] In this embodiment, if the second device identification information matches the second identification encryption information corresponding to the first device identification information, and the second user identification information does not match the second identification encryption information corresponding to the first user identification information, then the second device identification information and the first device identification information can be considered to be substantially the same (e.g., they each contain the same IMEI). In this case, it can be said that the second device currently used by the target user is still the first device, but the second user identification information is significantly different from the first user identification information (e.g., they each contain different mobile phone numbers). In this case, it can be said that the target user has changed the user account indicated by the first user identification information to the user account indicated by the second user identification information (e.g., in the first device, the first mobile phone number corresponding to the first user identification information has been changed to the second mobile phone number corresponding to the second user identification information), that is, it can be said that the target user has changed the number.

[0093] Accordingly, if the second device identification information does not match the second identification encryption information corresponding to the first device identification information, and the second user identification information matches the second identification encryption information corresponding to the first user identification information, it can be inferred that the target user has changed the device currently being used. The second device currently being used by the target user is different from the first device, but the second mobile phone number used by the target user in the first device is the original first mobile phone number.

[0094] Here, regardless of whether the target user has changed their phone number or changed their current device, in order to verify whether the user who triggered the second authentication request is still the target user, the user's voice data corresponding to the second authentication request can be obtained and voiceprint recognition can be performed, and then the subsequent update can be completed based on the voiceprint recognition result.

[0095] In some examples, the matching result may also be characterized as follows: the second device identification information matches the second identification encryption information corresponding to the first device identification information, and the second user identification information matches the second identification encryption information corresponding to the first user identification information; or it may be characterized as follows: the first data storage unit contains identity identification information that matches both the second device identification information and the second user identification information. In either case, it can be indicated that the first data storage unit contains identity identification information that completely matches the second authentication request, thus indicating that the target user has not changed the device they are currently using or the mobile phone number they are using. Here, the method may further include: obtaining the target user's user profile and user behavior data based on the second device identification information and the second user identification information (or, the first device identification information and the first user identification information), and calculating the user's risk control level based on this using a risk control model. Thus, the matching result can be used to determine the target user's SIM card consistency, which can be used to characterize whether the target user has changed their phone number and / or the device they are using.

[0096] For specific implementation, please refer to Figure 3 Assuming the identity information is a string, where the first 60 characters are the second encrypted identifier corresponding to the first device identifier, and the last 60 characters are the second encrypted identifier corresponding to the first user identifier, if the first 60 characters and the last 60 characters do not match (the first 60 characters match but the last 60 characters do not match, or the first 60 characters do not match but the last 60 characters match), it indicates that the target user has changed their phone number or changed the device they are currently using.

[0097] In one optional implementation, the voiceprint recognition based on the user's voice data includes: Based on the user's voice data, a pre-trained Gaussian Mixture Model (GMM) is invoked for voiceprint recognition. The training process of the GMM includes: Based on the sound samples, an initial Gaussian Mixture Model (GMM) and a deep neural network (DNN) were constructed respectively. Based on the test set corresponding to the sound sample, the DNN is invoked to obtain a first test result and the initial GMM is invoked to obtain a second test result; Based on the first test result and the second test result, the initial GMM is adjusted to obtain the GMM.

[0098] In one optional implementation, the step of constructing an initial GMM and a deep neural network (DNN) based on sound samples includes: The sound samples are preprocessed; The preprocessed audio samples are segmented into frames using the Hamming window function to obtain short frame signals; Based on the short frame signal, feature extraction is performed to obtain voiceprint features; Based on the aforementioned voiceprint features, initial GMM and DNN are constructed respectively.

[0099] In some examples, the above preprocessing may include at least one of the following: noise reduction (e.g., using a filter to remove background noise) or normalization (e.g., adjusting the amplitude range of the audio signal).

[0100] In some examples, this frame segmentation can be used to divide a continuous audio signal into short frames, where each short frame... It typically contains several hundred sample points. The frame length is Frames may overlap, as common frame lengths are 20ms and 25ms. Therefore, a frame overlap rate of 0.54 can be set for optimal performance. In addition, a Hamming window function was applied to reduce the impact of frame boundaries: For example, the final formula value after parameter tuning is: This can significantly improve the quality of short frame signals after frame segmentation, among which For the number of samples, This is the sample number.

[0101] In some examples, the aforementioned voiceprint features may include Mel-Frequency Cepstral Coefficients (MFCCs) and / or Line Spectral Frequencies (LSFs), where MFCCs are a mathematical model of human auditory characteristics, which can be expressed as: ,in It is the energy spectrum after Fourier transform. It is the center frequency of the k-th Mel filter. In the voiceprint training, this embodiment compares the training results of MFCCs and the extraction results of LSF, and finds that MFCCs can achieve better results in real-time voiceprint extraction scenarios.

[0102] In some examples, each component of the initial GMM described above can be represented as: ,in, These are the model parameters, and M is the number of mixture components. It is the mean. It is the covariance matrix. It's the weights, which have been trained and tested multiple times. The final value is set to 1. The initial GMM can then be trained and optimized using the maximum likelihood estimation method.

[0103] In some examples, the DNN can be used as an end-to-end model, containing one locally connected layer, multiple fully connected layers, and linear layers. By training the DNN multiple times and adjusting the threshold settings of the corresponding loss function and ReLU function, the optimal error rate for that DNN can be achieved.

[0104] In an optional implementation, the user voice data is generated based on the voice emitted by the user corresponding to the second authentication request, and before performing voiceprint recognition based on the user voice data, the method further includes: Based on the user's voice data, it is determined whether the spoken voice matches a randomly generated sentence to obtain a first liveness detection result; The facial image of the target user is detected to obtain facial movements that match the spoken voice, so as to obtain a second liveness detection result; Based on the first liveness detection result and / or the second liveness detection result, determine whether to perform voiceprint recognition.

[0105] In some examples, the randomly generated statements mentioned above can be obtained by randomly arranging and combining statements from a preset statement database. Here, one or two statements can be randomly generated from the database, for example: "I love my home, 237698".

[0106] In this embodiment, cheating methods such as recording playback, waveform splicing, speech synthesis, and speech imitation can be resisted by randomly arranging and combining the sentences in the sentence library read by the user, and by performing liveness detection on the user's facial movements.

[0107] In some examples, determining whether to perform voiceprint recognition based on the first liveness detection result and / or the second liveness detection result may include: determining to perform voiceprint recognition if the first liveness detection result indicates that the spoken voice matches a randomly generated statement, and / or if the second liveness detection result indicates that the corresponding facial movements meet the criteria for determining a real person.

[0108] In some examples, determining whether to perform voiceprint recognition based on the first liveness detection result and / or the second liveness detection result may include: if the first liveness detection result indicates that the spoken voice does not match the randomly generated sentence, acquiring fixed-sentence user voice data generated by capturing sound when the target user reads a fixed sentence, and determining that voiceprint recognition needs to be performed on the fixed-sentence user voice data. This improves both the security of voiceprint recognition and ensures a high success rate.

[0109] Thirdly, correspondingly, the embodiments of this application also provide an identity information generation device, which can implement all the processes of the identity information generation method provided in the above embodiments.

[0110] See Figure 4 The diagram shows a schematic representation of an identity information generation device provided in an embodiment of this application. The identity information generation device includes: The identification information acquisition module 401 is used to acquire multiple identification information corresponding to the target user, wherein the multiple identification information includes the first user identification information of the target user and the first device identification information of the first device associated with the target user; The first encryption module 402 is used to perform a first encryption process on the plurality of identification information respectively to obtain the first identification encryption information corresponding to each of the plurality of identification information; Parameter acquisition module 403 is used to acquire encrypted parameters; The second encryption module 404 is used to generate second identifier encryption information corresponding to each first identifier encryption information based on the encryption parameters and each first identifier encryption information. The identity generation module 405 is used to generate the identity information of the target user based at least on each of the second identity encryption information.

[0111] In one optional implementation, obtaining the encryption parameters includes: Based on current time information, distributed system identification information, and / or sequence information, the snowflake algorithm is used to generate encryption parameters, wherein the distributed system identification information represents the identifier assigned to the computer device used to perform the method in the distributed system, and the sequence information represents a randomly generated sequence.

[0112] In one optional implementation, generating second identifier encryption information corresponding to each first identifier encryption information based on the encryption parameters and each first identifier encryption information includes: For each of the first identifier encryption information, the encryption parameters and the first identifier encryption information are fused to obtain first fused information, and the first fused information is subjected to second encryption processing to obtain second identifier encryption information corresponding to the first identifier encryption information.

[0113] In an optional implementation, the identification information acquisition module is further configured to: Obtain the business identification information corresponding to the business party, wherein the business party is used to request the identification information; The step of generating the target user's identity information based at least on each of the second identifier encryption information includes: Based on the business identification information and each of the second identification encryption information, the identity identification information of the target user is generated.

[0114] Fourthly, correspondingly, this application also provides an authentication device capable of implementing all the processes of the authentication method provided in the above embodiments.

[0115] See Figure 5 The diagram shows a schematic representation of an authentication device provided in an embodiment of this application. This authentication device is applied to an authentication platform and includes: The receiving module 501 is used to receive a first authentication request from the business party, wherein the first authentication request is used to request the return of the identity information of the target user; Processing module 502 is used to generate the identity information of the target user according to the identity information generation method described in any one of the first aspects above; The sending module 503 is used to return the identity information to the business party, wherein the identity information is used by the business party to authenticate the target user.

[0116] In one optional embodiment, the device further includes: The first verification module is used to perform a first verification operation on the first authentication request before generating the identity information; The acquisition of multiple identifiers corresponding to the target user includes: After the first verification operation is successful, multiple identification information corresponding to the target user is obtained from the gateway.

[0117] In one optional implementation, the apparatus further includes a first intermediate credential generation module and a lookup module: The first intermediate credential generation module is used to generate a first intermediate credential that matches the identity information before returning the identity information to the business party. The sending module is also used to synchronize the identity information to the first data storage unit, and to send the first intermediate credential to the business party; The receiving module is further configured to receive an intermediate verification request sent by the business party in response to the first intermediate credential, and perform a second verification operation based on the intermediate verification request; The lookup module is used to retrieve the identity information from the first data storage unit using the first intermediate credential after the second verification operation is successful. The sending module is also used to return the identity information to the business party.

[0118] In one optional implementation, the identity information and each of the second identity encryption information are synchronized to the first data storage unit, and the device further includes a second authentication module and a voiceprint recognition module: The receiving module is further configured to receive a second authentication request sent by the business party, wherein the second authentication request is associated with the target user; The second authentication module is used to obtain second device identification information and second user identification information according to the second authentication request; and to perform matching in the first data storage unit based on the second device identification information and the second user identification information to obtain a matching result. The voiceprint recognition module is used to perform the following operations when the matching result meets the voiceprint recognition triggering conditions: Obtain the user voice data corresponding to the second authentication request; Voiceprint recognition is performed based on the user's voice data; Based on the voiceprint recognition results, update information corresponding to the matching results is generated; and The first data storage unit is updated using the update information, and the update information is sent to the business party, wherein the update information is used to update the identity information of the target user.

[0119] In one optional implementation, the voiceprint recognition trigger condition includes any of the following: The matching result is characterized as follows: the second device identification information matches the second identification encryption information corresponding to the first device identification information, and the second user identification information does not match the second identification encryption information corresponding to the first user identification information; The matching result is characterized as follows: the second device identification information does not match the second identification encryption information corresponding to the first device identification information, and the second user identification information matches the second identification encryption information corresponding to the first user identification information.

[0120] In one optional implementation, the voiceprint recognition based on the user's voice data includes: Based on the user's voice data, a pre-trained Gaussian Mixture Model (GMM) is invoked for voiceprint recognition. The training process of the GMM includes: Based on the sound samples, an initial GMM and a deep neural network (DNN) are constructed respectively. Based on the test set corresponding to the sound sample, the DNN is invoked to obtain a first test result and the initial GMM is invoked to obtain a second test result; Based on the first test result and the second test result, the initial GMM is adjusted to obtain the GMM.

[0121] In one optional implementation, the step of constructing an initial GMM and a deep neural network (DNN) based on sound samples includes: The sound samples are preprocessed; The preprocessed audio samples are segmented into frames using the Hamming window function to obtain short frame signals; Based on the short frame signal, feature extraction is performed to obtain voiceprint features; Based on the aforementioned voiceprint features, initial GMM and DNN are constructed respectively.

[0122] In an optional implementation, the user voice data is generated based on the voice emitted by the user corresponding to the second authentication request, and before performing voiceprint recognition based on the user voice data, the voiceprint recognition module is further configured to: Based on the user's voice data, it is determined whether the spoken voice matches a randomly generated sentence to obtain a first liveness detection result; The facial image of the target user is detected to obtain facial movements that match the spoken voice, so as to obtain a second liveness detection result; Based on the first liveness detection result and / or the second liveness detection result, determine whether to perform voiceprint recognition.

[0123] Fifthly, embodiments of this application provide a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method described in any of the preceding claims.

[0124] Sixthly, embodiments of this application provide a computer program product, including computer instructions that, when executed by a processor, implement the steps of the method described in any of the preceding claims.

[0125] In a seventh aspect, embodiments of this application provide a computer device including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the steps of the method described in any of the preceding claims.

[0126] See Figure 6 The computer device in this embodiment includes a processor 601, a memory 602, and a computer program stored in the memory 602 and executable on the processor 601, such as an identity information generation program and / or authentication program. When the processor 601 executes the computer program, it implements the steps in the various identity information generation and / or authentication method embodiments described above.

[0127] For example, the computer program may be divided into one or more modules / units, which are stored in the memory 602 and executed by the processor 601 to complete this application. The one or more modules / units may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in the computer device.

[0128] The computer device may be a desktop computer, laptop, handheld computer, or cloud server, etc. The computer device may include, but is not limited to, a processor 601 and a memory 602. Those skilled in the art will understand that the schematic diagram is merely an example of a computer device and does not constitute a limitation on the computer device. It may include more or fewer components than shown, or combine certain components, or different components. For example, the computer device may also include input / output devices, network access devices, buses, etc.

[0129] The processor 601 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor, or processor 601 can be any conventional processor. The processor 601 is the control center of the computer device, connecting various parts of the entire computer device through various interfaces and lines.

[0130] The memory 602 can be used to store the computer programs and / or modules. The processor 601 implements various functions of the computer device by running or executing the computer programs and / or modules stored in the memory 602 and calling the data stored in the memory 602. The memory 602 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory 602 may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0131] Wherein, if the modules / units integrated into the computer device are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a non-transitory computer-readable storage medium. When the computer program is executed by the processor 601, it can implement the steps of the various method embodiments described above. Wherein, the computer program includes computer program code, which can be in the form of source code, object code, executable file, or some intermediate form, etc. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal, and software distribution medium, etc.

[0132] In summary, the embodiments of this application have at least the following beneficial effects: Using the embodiments of this application, multiple identification information corresponding to a target user is obtained, wherein the multiple identification information includes a first user identification information of the target user and a first device identification information of a first device associated with the target user; the multiple identification information is subjected to a first encryption process to obtain first identification encryption information corresponding to each of the multiple identification information; encryption parameters are obtained; based on the encryption parameters and each first identification encryption information, second identification encryption information corresponding to each first identification encryption information is generated; at least based on each second identification encryption information, the target user's identity identification information is generated. In this way, by first performing preliminary encryption on different identification information to obtain first identification encryption information, and then combining the encryption parameters to generate second identification encryption information for different identification information, and generating the final target user identity identification information accordingly, the encryption effect can be effectively improved, thereby reducing the risk of privacy leakage. In addition, combining user identification information and device identification information as the basis for generating identity identification information can also effectively improve the uniqueness and reliability of the generated identity identification information.

[0133] Through the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary hardware platforms, or it can be implemented entirely by hardware. Based on this understanding, all or part of the technical solutions of this application that contribute to the background technology can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM (Read-Only Memory) / RAM (Random Access Memory), magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments of this application.

[0134] The above description is the preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications are also considered to be within the scope of protection of this application.

Claims

1. A method for generating identity information, characterized in that, include: Obtain multiple identification information corresponding to the target user, wherein the multiple identification information includes the first user identification information of the target user and the first device identification information of the first device associated with the target user; The plurality of identification information are subjected to a first encryption process to obtain the first identification encryption information corresponding to each of the plurality of identification information; Obtain the encryption parameters; Based on the encryption parameters and each first identifier encryption information, generate second identifier encryption information corresponding to each first identifier encryption information; The identity information of the target user is generated based at least on each of the second identifier encryption information.

2. The method according to claim 1, characterized in that, The process of obtaining encryption parameters includes: Based on current time information, distributed system identification information, and / or sequence information, the snowflake algorithm is used to generate encryption parameters, wherein the distributed system identification information represents the identifier assigned to the computer device used to perform the method in the distributed system, and the sequence information represents a randomly generated sequence.

3. The method according to claim 1, characterized in that, The step of generating second identifier encryption information corresponding to each first identifier encryption information based on the encryption parameters and each first identifier encryption information includes: For each of the first identifier encryption information, the encryption parameters and the first identifier encryption information are fused to obtain first fused information, and the first fused information is subjected to second encryption processing to obtain second identifier encryption information corresponding to the first identifier encryption information.

4. The method according to any one of claims 1-3, characterized in that, The method further includes: Obtain the business identification information corresponding to the business party, wherein the business party is used to request the identification information; The step of generating the target user's identity information based at least on each of the second identifier encryption information includes: Based on the business identification information and each of the second identification encryption information, the identity identification information of the target user is generated.

5. An authentication method, characterized in that, The method is executed by the authentication platform and includes: Receive a first authentication request from the business party, wherein the first authentication request is used to request the return of the target user's identity information; The identity information generation method according to any one of claims 1-4 generates the identity information of the target user; The identity information is returned to the business party, wherein the identity information is used by the business party to authenticate the target user.

6. The method according to claim 5, characterized in that, Before generating the identity information, the method further includes: Perform a first verification operation on the first authentication request; The acquisition of multiple identifiers corresponding to the target user includes: After the first verification operation is successful, multiple identification information corresponding to the target user is obtained from the gateway.

7. The method according to claim 5, characterized in that, Before returning the identity information to the business party, the method further includes: Generate a first intermediate credential that matches the identity information; The identity information is synchronized to the first data storage unit, and the first intermediate credential is sent to the business party. Receive the intermediate verification request sent by the business party in response to the first intermediate credential, and perform a second verification operation based on the intermediate verification request; After the second verification operation is successful, the identity information is retrieved from the first data storage unit using the first intermediate credential, and the identity information is returned to the business party.

8. The method according to claim 5, characterized in that, The identity information and the encrypted information of each of the second identities are synchronized to the first data storage unit, and the method further includes: Receive a second authentication request sent by the business party, wherein the second authentication request is associated with the target user; Based on the second authentication request, obtain the second device identification information and the second user identification information; Based on the second device identification information and the second user identification information, a matching is performed in the first data storage unit to obtain a matching result; If the matching result meets the voiceprint recognition trigger condition, the following operation is performed: Obtain the user voice data corresponding to the second authentication request; Voiceprint recognition is performed based on the user's voice data; Based on the voiceprint recognition results, update information corresponding to the matching results is generated; and The first data storage unit is updated using the update information, and the update information is sent to the business party, wherein the update information is used to update the identity information of the target user.

9. The method according to claim 8, characterized in that, The voiceprint recognition triggering condition includes any of the following: The matching result is characterized as follows: the second device identification information matches the second identification encryption information corresponding to the first device identification information, and the second user identification information does not match the second identification encryption information corresponding to the first user identification information; The matching result is characterized as follows: the second device identification information does not match the second identification encryption information corresponding to the first device identification information, and the second user identification information matches the second identification encryption information corresponding to the first user identification information.

10. The method according to claim 8, characterized in that, The voiceprint recognition based on the user's voice data includes: Based on the user's voice data, a pre-trained Gaussian Mixture Model (GMM) is invoked for voiceprint recognition. The training process of the GMM includes: Based on the sound samples, an initial GMM and a deep neural network (DNN) are constructed respectively. Based on the test set corresponding to the sound sample, the DNN is invoked to obtain a first test result and the initial GMM is invoked to obtain a second test result; Based on the first test result and the second test result, the initial GMM is adjusted to obtain the GMM.

11. The method according to claim 10, characterized in that, The process of constructing an initial GMM and a deep neural network (DNN) based on sound samples includes: The sound samples are preprocessed; The preprocessed audio samples are segmented into frames using the Hamming window function to obtain short frame signals; Based on the short frame signal, feature extraction is performed to obtain voiceprint features; Based on the aforementioned voiceprint features, initial GMM and DNN are constructed respectively.

12. The method according to any one of claims 8-11, characterized in that, The user voice data is generated based on the voice emitted by the user corresponding to the second authentication request. Before performing voiceprint recognition based on the user voice data, the method further includes: Based on the user's voice data, it is determined whether the spoken voice matches a randomly generated sentence to obtain a first liveness detection result; The facial image of the target user is detected to obtain facial movements that match the spoken voice, so as to obtain a second liveness detection result; Based on the first liveness detection result and / or the second liveness detection result, determine whether to perform voiceprint recognition.

13. An identity information generation device, characterized in that, include: The identification information acquisition module is used to acquire multiple identification information corresponding to the target user, wherein the multiple identification information includes the first user identification information of the target user and the first device identification information of the first device associated with the target user; The first encryption module is used to perform a first encryption process on the plurality of identification information respectively to obtain the first identification encryption information corresponding to each of the plurality of identification information; The parameter acquisition module is used to acquire encrypted parameters; The second encryption module is used to generate second identifier encryption information corresponding to each first identifier encryption information based on the encryption parameters and each first identifier encryption information. An identity generation module is used to generate the identity information of the target user based at least on each of the second identity encryption information.

14. An authentication device, characterized in that, The device is used in an authentication platform and includes: The receiving module is used to receive a first authentication request from the business party, wherein the first authentication request is used to request the return of the target user's identity information; The processing module is configured to generate the identity information of the target user according to the identity information generation method according to any one of claims 1-4; The sending module is used to return the identity information to the business party, wherein the identity information is used by the business party to authenticate the target user.

15. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1-12.

16. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the method described in any one of claims 1-12.

17. A computer device, characterized in that, The method includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements the method of any one of claims 1-12.

Images