IDENTITY AUTHENTICATION METHOD, DEVICE, TERMINAL, STORAGE MEDIUM, AND PROGRAM PRODUCT

Abstract

The identity authentication method, device, terminal, storage medium and program product belong to the field of cloud security technology. The method includes: displaying password conversion prompt information in response to an identity verification command (201); extracting facial features from an identity verification image captured by a camera to obtain facial feature data (202); detecting activity from the identity verification image to obtain a posture sequence (203); converting the password according to the posture sequence to obtain an original password (204); and authenticating the identity according to the original password and the facial feature data (205). The above method, device, terminal, storage medium and program product can simplify the process of user identity authentication, ensure that the user password is not leaked during the recording stage, and protect face recognition from the attack of fake facial features.

Description

[Technical field]

[0001] The embodiments of the present application relate to the technical field of cloud security, and in particular to an identity authentication method, device, terminal, storage medium, and program product. [Background technology]

[0002] Two-factor authentication (2FA) refers to a method of authenticating a user's identity by combining two different types of authentication factors (such as account PIN, short message authentication code, biometric features, etc.). In the process of identity verification, a user needs to provide two different authentication factors to prove his / her identity, which can play a better role in protecting the user's credentials and accessible resources than a verification method that employs a single factor.

[0003] In the related art, two-factor identity authentication usually adopts two of the following three types of authentication factors: 1. User's private information (e.g., user's password, personal identification number (PIN)); 2. User's biometric feature information (e.g., voiceprint feature, face feature, fingerprint feature, etc.); 3. User's personal belongings (e.g., Short Message Service (SMS) authentication code, electronic token, etc.).

[0004] However, the identity authentication methods in the related art, whether they are based on two types of biometric characteristics, a password and a PIN, or a biometric characteristic and a user's private information, all require the user to perform at least two verification input operations (for example, inputting a voiceprint and a fingerprint separately, or inputting a fingerprint and a PIN separately), making the verification operations relatively complicated and the verification process relatively long. Summary of the Invention [Means for solving the problem]

[0005] In the embodiments of the present application, an identity authentication method, an apparatus, a terminal, a storage medium and a program product are provided. The technical solutions are as follows:

[0006] In one aspect, an embodiment of the present application provides an identity authentication method, the method including: In response to an identity verification command, display a password conversion prompt, the password conversion prompt is used to prompt a conversion of password characters in an original password into a form, different password characters correspond to different forms, and a password character conversion manner indicated by the password conversion prompt is randomly generated; extracting facial features from the identification verification image captured by the camera to obtain facial feature data; performing activity detection on the identification image to obtain a sequence of postures; converting the password based on the sequence of the postures to obtain the original password; performing identity authentication based on the original password and the facial feature data; Includes.

[0007] In another aspect, an embodiment of the present application provides an identity authentication device, the device comprising: The system includes a first display module, a first feature extraction module, an activity detection module, a password conversion module, and an identity authentication module; The first display module is used to display password conversion prompt information in response to an identity verification command, the password conversion prompt information is used to prompt a password character in an original password to be converted into a figure, and the figures corresponding to different password characters are different, and the password character conversion manner indicated by the password conversion prompt information is randomly generated; The first feature extraction module is used to extract facial features from the identity verification image captured by the camera to obtain facial feature data; the activity detection module is used to perform activity detection on the identification verification image to obtain a sequence of postures; The password conversion module is used to convert the password according to the sequence of the postures to obtain the original password; The identity authentication module is used to perform identity authentication based on the original password and the facial feature data.

[0008] In another aspect, an embodiment of the present application provides a terminal, the terminal including a processor and a memory, the memory storing at least one instruction, at least one program segment, code set or instruction set, the at least one instruction, the at least one program segment, code set or instruction set being loaded and executed by the processor to realize the identity authentication method described in the above aspect.

[0009] In another aspect, an embodiment of the present application is provided with a computer-readable storage medium, and at least one computer program is stored in the computer-readable storage medium, and the computer program is loaded and executed by a processor to realize the identity authentication method described in the above aspect.

[0010] According to one aspect of the present application, a computer program product or computer program is provided, the computer program product or computer program including computer instructions, the computer instructions being stored in a computer-readable storage medium, a processor of a terminal reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, thereby causing the terminal to perform the identity authentication method provided in the various selectable implementation manners of the above aspect.

[0011] The technical solutions provided in the embodiments of the present application at least include the following beneficial effects:

[0012] In the embodiment of the present application, an identity authentication mechanism based on two authentication factors, namely, user password and facial features, is provided, and the user only needs to record his / her posture once to simultaneously complete password input and facial recognition, which simplifies the process of identity authentication and improves the efficiency of identity authentication. A random password character conversion method is provided, so that what the user records is a random posture sequence converted from the original password, which can ensure that the user's original password is not leaked during the password recording stage, and can only be authenticated if the real-time password is obtained based on the correct original password, which can protect facial recognition from the attack of fake facial features and improve the security and accuracy of identity authentication. [Brief description of the drawings]

[0013] [Figure 1] FIG. 1 is a schematic diagram of an implementation environment shown in one exemplary embodiment of the present application. [Diagram 2] 1 shows a flowchart of an identity authentication method provided in an exemplary embodiment of the present application. [Diagram 3] 4 shows a flowchart of an identity authentication method provided in another exemplary embodiment of the present application. [Figure 4] FIG. 2 is a schematic diagram of a virtual keyboard shown in an exemplary embodiment of the present application. [Diagram 5] 4 shows a flowchart of an identity authentication method provided in another exemplary embodiment of the present application. [Figure 6] 4 shows a flowchart of an identity authentication method provided in another exemplary embodiment of the present application. [Figure 7] FIG. 2 shows a structural block diagram of an identity authentication device provided in an exemplary embodiment of the present application. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] In order to make the objectives, technical solutions and advantages of the present application clearer, the following describes the embodiments of the present application in more detail with reference to the accompanying drawings.

[0015] As used herein, "plurality" means two or more than two. "And / or" describes a relationship between related objects and indicates that three types of relationships can exist, for example, A and / or B can represent three cases: A exists alone, A and B exist simultaneously, and B exists alone. The character " / " generally indicates that the related objects before and after are in an "or" relationship.

[0016] In the related art, two-factor identity authentication generally adopts two of the following three types of authentication factors: 1. User's private information (e.g., user's password, PIN); 2. User's biometric feature information (e.g., voiceprint feature, face feature, fingerprint feature, etc.); 3. User's personal belongings (e.g., SMS authentication code, electronic token, etc.). However, in the identity authentication methods in the related art, the 2FA methods based on voiceprint and other biometric features (e.g., fingerprint, face) require the user's device to be equipped with an additional special sensor (e.g., fingerprint sensor) or additional software or hardware token, and the 2FA methods based on password and graphic code often require the user to input information multiple times. Regardless of whether the method is based on two types of biometric features, a method based on password and PIN, or a method based on biometric features and the user's private information, they all require the user to perform at least two verification input operations (e.g., inputting voiceprint and fingerprint respectively, or inputting fingerprint and PIN respectively), which makes the verification operation relatively cumbersome and the verification process relatively long.

[0017] In order to solve the above technical problems, improve the efficiency of 2FA and simplify the process, an embodiment of the present application provides an identity verification method. Figure 1 shows a schematic diagram of an implementation environment provided in one embodiment of the present application. The implementation environment can include a terminal 110 and a background server 120.

[0018] The terminal 110 includes a password conversion module 111 and a feature extraction module 112. When an identity verification command is received, the password conversion module 111 generates a password character conversion scheme that is randomly generated. The terminal 110 displays the password character conversion scheme through an interface. The user performs conversion on the original password according to the scheme, and records a sequence of postures using a camera, and the terminal 110 performs feature extraction and activity detection on the identity verification image captured by the camera. The password conversion module 111 performs a return on the recognized sequence of postures based on the password character conversion scheme to obtain the original password. The feature extraction module 112 performs facial feature extraction on the identity verification image to obtain facial feature data. The terminal 110 transmits the original password and the facial feature data to the background server 120 to perform identity authentication. This realizes that the recording of two types of authentication factors is completed with one user data, and simplifies the user's operation flow.

[0019] After the background server 120 receives the original password and the facial feature data, it performs identity authentication based on the database and returns the authentication result to the terminal 110. Only one terminal 110 is shown in Fig. 1, and in actual application, more terminals can communicate with the background server 120 to perform identity authentication. The background server 120 stores the original password and facial feature data corresponding to each account.

[0020] Hereinafter, application scenarios of the identity authentication method provided in the embodiments of the present application will be briefly described.

[0021] 1. Online Payments

[0022] The identity authentication method can be realized as an application such as a shopping application, an online payment application, or an online payment function in a web page, and realizes completing a two-factor identity authentication process with a single input. When a payment operation is accepted, the terminal randomly generates a password character conversion method, displays the password character conversion method through an interface, and simultaneously starts to collect identity verification images using a camera. The user converts the original password of his / her account into an instantaneous pose sequence according to the password character conversion method displayed on the terminal, and makes corresponding poses in front of the camera. The terminal performs feature extraction on the identity verification image, obtains facial feature data, and recognizes the pose sequence. The terminal performs return on the recognized pose sequence to obtain the original password, and then performs identity authentication based on the original password and facial features, and completes the payment operation when both of the two-factor authentications are successful.

[0023] 2. Account Login

[0024] For some user accounts related to important information or resources of the user, the identity authentication method can be used to perform identity authentication at the time of login. When an account login operation is accepted, the user inputs an account identifier to start the identity authentication process, and performs identity authentication by inputting an original password and facial features at once according to the recorded posture sequence. In addition, the identity authentication method can be applied to the account login of an application in a terminal, and can also be applied to the account login scene on a web page.

[0025] 2 shows a flowchart of an identity authentication method provided in an exemplary embodiment of the present application. In this embodiment, the method is described by taking as an example that the method is applied to a terminal having the functions of image acquisition and image processing. The method includes the following steps:

[0026] Step 201: In response to an identity verification command, display password conversion suggestion information.

[0027] Here, the password conversion presentation information is used to present the conversion of password characters in the original password into shapes, and different shapes correspond to different password characters, and the password character conversion method indicated by the password conversion presentation information is randomly generated.

[0028] In one possible embodiment, identity authentication requires obtaining two kinds of authentication factors, namely, a user password and a facial feature. In order to simplify the flow of identity authentication of a user, the embodiment of the present application adopts a facial recognition method to realize the completion of the recording of the above two kinds of authentication factors in one operation. In order to prevent the original password from being leaked, the terminal provides a random password character conversion method. When the terminal receives an identity verification command, the terminal provides the password character conversion method to the user by displaying the password conversion presentation information. The user needs to convert the original password of his / her account into an instantaneous pose sequence according to the password character conversion method provided by the terminal, and then execute the pose sequence to record it in the camera of the terminal. Here, the password character conversion method is a randomly generated non-fixed conversion method, so that it cannot be deciphered by others.

[0029] As an option, the password character conversion scheme can implement conversion between characters and poses, mapping characters to poses that the user can take, for example, characters can include numbers, letters, punctuation marks, or special symbols, and poses can include facial expressions, head movements, or combined head and hand movements, etc. The embodiments of the present application are not limited thereto.

[0030] Step 202: Extract facial features from the identity verification image captured by the camera to obtain facial feature data.

[0031] After displaying the password conversion information, the terminal turns on the camera and uses the camera to collect image data such as video or pictures. After the identity verification image is collected, the terminal performs facial feature extraction on the image to obtain the user's facial feature data.

[0032] As an option, after receiving an identity verification command, the terminal automatically turns on the camera and collects identity verification images; or the terminal displays password conversion prompt information, and after receiving a password record confirmation operation (e.g., a trigger operation for a face recognition control), turns on the camera and collects images. When the camera is turned on for a time threshold, the terminal turns off the camera and ends image collection; or when the terminal receives a password record completion operation (e.g., a trigger operation for an information record completion control), turns off the camera; or the terminal performs real-time recognition on the collected identity verification images, and automatically turns off the camera if it is determined that no face is detected or the person's appearance in the image has not changed within a target time. The embodiment of the present application is not limited thereto.

[0033] In one possible embodiment, a feature extraction model is installed in the terminal, and the terminal inputs the identity verification image into the feature extraction model to obtain data of facial features.

[0034] As an option, the identity verification image is a photo taken by the terminal via a camera, or a video frame image extracted from a video taken by the terminal via a camera.

[0035] Step 203: Perform activity detection on the identification image to obtain a pose sequence.

[0036] After obtaining the identity verification image, the terminal further performs activity detection on the identity verification image to obtain each pose performed by the figure, and determines a sequence of the poses according to time order.

[0037] In one possible embodiment, a liveness detection model is installed in the terminal, and the terminal inputs an identity verification image into the liveness detection model, performs recognition on the posture in the image, and obtains a posture sequence.

[0038] As one option, the terminal inputs all collected identity verification images into the feature extraction model and the liveness detection model; or the terminal selects suitable images (e.g., images containing clear and complete faces) from the collected identity verification images based on the image collection criteria of the face recognition system, and inputs the selected images into the feature extraction model and the liveness detection model, thereby improving the efficiency and accuracy of identity verification.

[0039] It should be noted that FIG. 2 only shows the flow of one possible method, and the order of steps 202 and 203 is not strictly sequential, and the terminal may first perform step 203 and then perform step 202, or may perform steps 202 and 203 synchronously.

[0040] Step 204: Password conversion is performed based on the posture sequence to obtain an original password.

[0041] After obtaining the posture sequence, the terminal performs reverse conversion on the posture sequence based on the password character conversion method provided for this identity authentication (i.e., password recovery, which performs conversion according to the password character conversion method depending on which characters and how many characters there are, and confirms that the above posture sequence has been obtained) to obtain the original password.

[0042] For example, in a password character conversion method randomly generated by a terminal, the character "1" corresponds to "turn head to the left." When the terminal detects that the posture "turn head to the left" exists in the posture sequence, it determines that the character corresponding to the posture is "1."

[0043] Step 205: identity authentication is performed based on the original password and facial feature data.

[0044] The terminal performs identity authentication based on two factors, the original password and the facial feature data, and only when the "translated" original password matches the registered password corresponding to the account, and the facial feature data matches the registered facial feature data corresponding to the account, the terminal can determine that the identity authentication is successful. If one of the factors does not match, the identity authentication can be determined to be unsuccessful.

[0045] As one option, after obtaining the original password and facial feature data, the terminal performs identity authentication locally; alternatively, the terminal transmits the original password and facial feature data to the cloud, and the cloud server performs identity authentication and feeds back the identity authentication result.

[0046] As mentioned above, the embodiment of the present application provides an identity authentication mechanism based on two authentication factors, namely, user password and facial features, and allows a user to record his / her appearance only once, and simultaneously completes password input and facial recognition, simplifying the process of identity authentication and improving the efficiency of identity authentication. A random password character conversion method is provided, so that what the user records is a random sequence of appearances converted from the original password, which can ensure that the user's original password is not leaked during the password recording stage, and can only be authenticated if the real-time password is obtained based on the correct original password, thereby protecting facial recognition from the attack of fake facial features, and improving the security and accuracy of identity authentication.

[0047] In one possible embodiment, the terminal determines the password character conversion manner according to a random mapping function, and displays the password character conversion manner as a virtual keyboard. Figure 3 shows a flowchart of an identity authentication method provided in another exemplary embodiment of the present application. This embodiment is described by taking the method as an example that is applied to a terminal having the functions of image acquisition and image processing, and the method includes the following steps:

[0048] Step 301: Generate a target random mapping function in response to an identity verification command.

[0049] Here, the random mapping function is a function for randomly mapping characters into shapes.

[0050] In one possible embodiment, the terminal pre-stores a type of posture, and the terminal randomly generates a target random mapping function every time identity authentication is performed to define the correspondence between the password characters and the posture, and the types of postures are equal to or greater than the types of password characters.

[0051] Generally speaking, the characters for setting the password are the digits 0 to 9, and the target random mapping function Hrand(X)=FaceExp generated by the terminal is as follows:

number

[0052] Here, X corresponds to a character, and FaceExp corresponds to a posture identifier. The correspondence between the identifier and the posture is shown in Table 1. [Table 1]

[0053] Step 302: displaying a virtual keyboard based on the target random mapping function, and displaying a password conversion suggestion corresponding to the target random mapping function on the virtual keyboard.

[0054] The terminal shows password conversion information through an interface in the form of a virtual keyboard, and displays a set of password conversion units at the same key positions of the virtual keyboard. According to the original password, the user can first find the characters in the original password from the virtual keyboard, and then determine the sequence of the postures that need to be recorded according to the password conversion units, and produce the corresponding postures.

[0055] In one possible embodiment, step 302 includes the following steps:

[0056] Step 302a: determining a password conversion unit according to the target random mapping function, the password conversion unit being composed of a password character and a form that the password character corresponds to in the target random mapping function;

[0057] The terminal determines a password conversion unit composed of password characters and a form according to the target random mapping function. The user converts the original password into a sequence of forms according to the password characters in the original password and the password conversion unit indicated by the terminal.

[0058] According to the example of step 301, the password conversion units determined by the terminal include (1, LV), (2, RV), (3, UP), (4, DW), (5, LT), (6, RT), (7, LW), (8, RW), (9, CE), and (0, SM).

[0059] In another possible embodiment, the password conversion unit may include a password character and multiple forms.

[0060] In step 302b, a password conversion unit is displayed on the virtual keyboard according to a first display manner corresponding to the password characters and a second display manner corresponding to the posture identifier of the posture, where the first display manner and the second display manner are different.

[0061] In one possible embodiment, in order to avoid the password characters and the appearance identifier at the same key position being displayed according to the same display manner, the terminal displays the password characters and the appearance identifier according to two different display manners, respectively, so as to avoid the user from taking a long time to recognize the characters and the identifier. Here, the first and second display manners being different include at least one of the following:

[0062] The password characters and the characters of the appearance identifier are different in type. The display color of the password characters and the display color of the appearance identifier are different. The font for the display of the password characters and the font for the display of the appearance identifier are different. The character size for the display of the password characters and the character size for the display of the appearance identifier are different. The special display effects of the password characters and the special display effects of the appearance identifier are different.

[0063] Schematically, FIG. 4 shows a schematic diagram of a virtual keyboard. The virtual keyboard includes 10 key positions, and one password conversion unit is displayed for each key position, and in each password conversion unit, the left side is a password character, and the right side is a posture identifier. In the virtual keyboard, two special display effects, namely, bold and underline, are added to the posture identifier compared with the password character. In particular, the posture identifier may be a different color from the password character, for example, the password character is black and the posture identifier is red.

[0064] In one possible embodiment, the password characters and the posture identifier can be synchronously displayed on the virtual keyboard, and the above step 302b specifically can include the following steps:

[0065] Step 1: determining a first display position of a password character on a virtual keyboard;

[0066] Step 2, according to the first display manner and the second display manner, a password conversion unit corresponding to each password character is displayed on the virtual keyboard according to the first display position.

[0067] In one possible embodiment, the display position of the password character on the virtual keyboard is fixed, and the terminal first determines a first display position of the password character on the virtual keyboard, and then displays the password character at the first display position.

[0068] For example, for the virtual keyboard shown in Fig. 4, password characters are displayed in the order from top to bottom and left to right every time, starting from digit 1 to 0. The terminal first determines the first keyboard positions of the 10 password characters based on the order, and then displays 10 password conversion units corresponding to the 10 password characters at corresponding first display positions, for example, the password conversion unit (1, LV) corresponding to digit 1 is displayed at the position of the key in the upper left corner, and the password conversion unit (2, RV) corresponding to digit 2 is displayed at the position of the key in the middle position of the first row.

[0069] The user needs to observe and consider the process of remembering the original password, finding the display position of each password character in the original password, and determining the posture corresponding to each password character, so if the terminal starts to display the password characters and the posture identifier at the same time, there may be many characters at the virtual key position, which may cause confusion. In another possible embodiment, the terminal can first display only the password characters on the virtual keyboard, and further display the posture identifier after confirming that the user can start password conversion, and the above step 302b can further include the following steps:

[0070] Step 3, displaying the password characters on the virtual keyboard according to a first display position and a first display manner of the password characters on the virtual keyboard.

[0071] Similarly, the terminal displays the password characters at the first keyboard position on the virtual keyboard according to the default order, so that the user can quickly determine the display position of each password character in the original password at a familiar position, and it is convenient for the user to determine the subsequent posture sequence as quickly as possible.

[0072] Step 4, in response to a display operation of the conversion scheme, the password conversion unit determines a second display position of the posture identifier on the virtual keyboard according to a password character corresponding to the posture identifier.

[0073] When the user is ready to convert the password, perform a display operation of the conversion method, make the terminal display the appearance identifier on the virtual keyboard, and complete the display of the password conversion unit.

[0074] As an option, the display operation of the conversion method may be a trigger operation on a conversion confirmation control, or the user may voice input a password conversion command, etc., and the embodiment of the present application is not limited thereto.

[0075] After the terminal accepts the display operation of the conversion manner, the password conversion unit determines the second display position of each posture identifier according to the password character to which the posture identifier corresponds and the first display position of the password character.

[0076] For example, for the virtual keyboard in FIG. 4, the terminal first displays the numbers on the left side of each key position, and then displays the posture identifiers on the right side after accepting the display operation of the conversion method.

[0077] Step 5, displaying the appearance identifier on the virtual keyboard according to the second display position based on the second display manner.

[0078] After determining the second display positions of all the posture identifiers, the terminal determines the user's immediate posture sequence by displaying the posture identifiers on a virtual keyboard.

[0079] The above steps display the virtual keyboard so that the password character display position is fixed, that is, the display position of the password conversion unit is determined by the first display position of the password character, and the first display position is a fixed position, which is convenient for users to quickly determine the sequence of the posture according to the keyboard position they are familiar with. In practical application, the first display position can be random.

[0080] Step 303: extracting facial features from the identity verification image captured by the camera to obtain facial feature data.

[0081] Step 304: Perform activity detection on the identification image to obtain a pose sequence.

[0082] For the specific implementation of step 303 to step 304, reference can be made to the above step 202 to step 203, and the embodiments of the present application will not be described in detail here.

[0083] Step 305: Perform password conversion on the sequence of postures based on the target random mapping function to obtain an original password.

[0084] After obtaining a sequence of postures based on the identity verification image, the terminal performs inverse transformation (reversion) on each posture in the sequence of postures according to the target random mapping function generated this time, obtains password characters corresponding to each posture, and then determines the original password.

[0085] In summary, taking the password character conversion method in the virtual keyboard shown in Figure 4 as an example, if the original password is "1234", the user determines that the posture sequence is "turn head left-turn head right-raise head-lower head", executes the posture sequence, and the terminal collects and recognizes the identity verification image, obtains the posture sequence "turn head left-turn head right-raise head-lower head", and then analyzes that the original password is "1234" based on the target random mapping function.

[0086] Step 306: Perform identity authentication based on the original password and facial feature data.

[0087] For a specific embodiment of step 306, reference can be made to step 205 above, and the embodiment of the present application will not be described in detail here.

[0088] In an embodiment of the present application, the terminal generates a target random mapping function, determines a conversion method of password characters, and intuitively displays the password conversion unit indicated by the target random mapping function in the form of a virtual keyboard, thereby facilitating the user to quickly and correctly convert the password, and improving the efficiency and accuracy of password input.

[0089] The above embodiments show the process in which the terminal determines and indicates the password character conversion method, and performs the conversion according to the real-time posture sequence to obtain the original password. In the identity authentication step, specifically, the terminal transmits the acquired original password and facial feature data to the background server, and the background server can determine the identity authentication result according to the database. Before the identity authentication step, the user needs to first record his / her facial features and original password, and store them in the background server. Figure 5 shows a flow chart of the identity authentication method provided in another exemplary embodiment of the present application. This embodiment takes as an example that the method is applied to a terminal having the functions of image collection and image processing, and the method includes the following steps:

[0090] Step 501: In response to a facial feature record command, a set of poses is displayed.

[0091] The set of poses includes all poses that can be used to transform the password characters.

[0092] In one possible embodiment, the user needs to record his / her facial features in advance in order to activate the above two-factor identity authentication function. Considering that in the identity authentication stage, the terminal may randomly convert the password characters in the original password into any of the poses in the pose collection, and different users may have large differences when making the same pose, in order to improve the accuracy of pose recognition, the terminal obtains images of all poses of the user. A pose is a facial expression or a head movement, and the terminal can extract facial features when the user makes a corresponding pose. When a facial feature recording command is received, the terminal displays a pose collection, allowing the user to record poses in order.

[0093] Step 502: Extract features from the face images captured by the camera to obtain target face feature data corresponding to each posture.

[0094] In the facial feature registration stage, the terminal also performs feature extraction on the collected facial images to obtain target facial feature data in each posture, or the terminal can directly transmit the collected facial images to a background server, which performs feature extraction and stores the facial feature data.

[0095] Step 503: Send the target facial feature data and the account identifier to the background server.

[0096] The background server is used to update a database that contains the correspondence between accounts, target original passwords, and target facial feature data.

[0097] The terminal transmits the target facial feature data and the account identifier to the background server, and after the background server receives the facial feature data and the account identifier, the account identifier and the target facial feature data are associated and stored in the database. Then, in the identity authentication stage, the database stores information such as the account identifier, facial feature data, and original password of each account, so as to perform identity authentication based on the database and the received authentication information.

[0098] Of course, when adopting the above two-factor identity authentication mechanism, the user needs to further record an original password. The original password can be recorded before collecting the target facial feature data, or after collecting the target facial feature data. The embodiment of the present application is not limited thereto.

[0099] Step 504: In response to the identity verification command, display the password conversion suggestion information.

[0100] Step 505: extracting facial features from the identification verification image captured by the camera to obtain facial feature data.

[0101] Step 506: Perform activity detection on the identification image to obtain a pose sequence.

[0102] Step 507: convert the password based on the sequence of the postures to obtain the original password.

[0103] For specific implementations of steps 504 to 507, reference can be made to the above steps 201 to 204, and the embodiments of the present application will not be described in detail here.

[0104] Step 508: Send the original password and facial feature data to the background server.

[0105] The background server is used to perform identity authentication based on the original password and facial feature data.

[0106] As one option, the terminal obtains the original password and facial feature data recorded by the identity authentication person, and then transmits the two kinds of authentication information to the background server synchronously, so that the background server can simultaneously perform the two kinds of authentication and determine the final identity authentication result according to the two kinds of authentication results. Alternatively, the terminal obtains the original password and facial feature data recorded by the identity authentication person, and then transmits one kind of authentication information to the background server first, and after the background server confirms that the authentication using the one kind of authentication information is successful, the terminal can further transmit the other kind of authentication information to the background server. If the authentication using the first kind of authentication information fails, the terminal does not need to transmit the second kind of authentication information, and can directly confirm that the authentication has failed. This improves the accuracy and security of identity authentication, and also improves the authentication efficiency.

[0107] After the terminal obtains the original password and the facial feature data, the terminal first transmits a kind of authentication information, and after the authentication by the authentication information is successful, the terminal transmits another kind of authentication information. In one possible embodiment, the terminal first transmits the original password and performs password authentication. Step 508 can include the following steps:

[0108] Step 508a: sending the original password and the account identifier of the current login account to the background server, which is used to determine a first identity authentication result according to the target original password corresponding to the current login account in the database;

[0109] The terminal sends the account identifier (e.g., user name) of the current login account and the converted original password to the background server. The background server searches the database based on the received account identifier to obtain the target original password corresponding to the account identifier, and compares the target original password with the original password sent by the terminal. If the two are completely identical, the background server determines that the password authentication is successful, and if the two are not completely identical, the background server determines that the password authentication is unsuccessful. The background server sends the first identity authentication result to the terminal.

[0110] Step 508b: receiving the first identity authentication result sent by the background server, and in response to the first identity authentication result indicating successful password authentication, sending facial feature data to the background server, which is used by the background server to determine a second identity authentication result based on the target facial feature data corresponding to the current login account in the database.

[0111] After receiving the first identity authentication result indicating the success of the password authentication, the terminal sends the facial feature data to the background server. The background server searches a database based on the account identifier to obtain the target facial feature data corresponding to the account identifier. The background server performs feature matching between the target facial feature data and the facial feature data of the identity authenticated person sent by the terminal, and determines the second identity authentication result.

[0112] In one possible embodiment, a similarity threshold is set in the background server, and if the similarity between the target facial feature data and the facial feature data of the identity authentication person sent by the terminal is higher than the similarity threshold, the facial recognition is confirmed as successful, and if the similarity between the two is lower than the similarity threshold, the facial recognition is confirmed as unsuccessful. The background server sends a second identity authentication result to the terminal.

[0113] After step 508a, the identity authentication method provided in the embodiment of the present application further includes the following steps:

[0114] The first identity authentication result sent by the background server is received, and in response to the first identity authentication result indicating a failure of the password authentication, the identity authentication is determined to be a failure, and the transmission of the facial feature data is canceled.

[0115] If the first identity authentication result indicates that the password authentication has failed, the terminal will no longer transmit facial feature data, and the final result will directly confirm that the authentication has failed, thereby reducing the amount of data transmission and improving the efficiency of identity authentication.

[0116] In another possible embodiment, the terminal may first transmit facial feature data to perform voiceprint authentication, and step 508 may further include the following steps:

[0117] Step 508c: sending the facial feature data and the account identifier of the current login account to the background server, which is used to determine a third identity authentication result according to the target facial feature data corresponding to the current login account in the database.

[0118] The terminal sends the account identifier (e.g., user name) of the current login account and the extracted facial feature data to the background server. The background server searches the database based on the received account identifier to obtain target facial feature data corresponding to the account identifier. The background server performs feature matching between the target facial feature data and the facial feature data of the identity authentication person sent by the terminal, and determines the third identity authentication result.

[0119] Step 508d: receive the third identity authentication result sent by the background server, and in response to the third identity authentication result indicating successful face authentication, send an original password to the background server, which is used by the background server to determine a fourth identity authentication result based on the target original password corresponding to the current login account in the database.

[0120] After receiving the third identity authentication result indicating the success of the face authentication, the terminal sends the original password to the background server. The background server searches the database based on the account identifier to obtain the target original password corresponding to the account identifier, and compares the target original password with the original password sent by the terminal. If the two are completely identical, the background server confirms the success of the password authentication, and if the two are not completely identical, the background server confirms the failure of the password authentication. The background server sends a fourth identity authentication result to the terminal.

[0121] After step 508c, the identity authentication method provided in the embodiment of the present application further includes the following steps:

[0122] The third identity authentication result sent by the background server is received, and in response to the third identity authentication result indicating a failure of the face authentication, the identity authentication is confirmed as a failure, and the sending of the original password is canceled.

[0123] Step 509: receiving the identity authentication result sent by the background server, the identity authentication result being used to indicate authentication success or authentication failure.

[0124] When the terminal synchronously sends two kinds of authentication information, i.e., facial feature data and original password, to the background server, the terminal determines whether the authentication is successful or unsuccessful according to the identity authentication result returned by the background server at one time; when the terminal first sends one kind of authentication information, it immediately determines whether the identity authentication is unsuccessful upon receiving the first or third identity authentication result indicating authentication unsuccessful, or determines whether the authentication is successful or unsuccessful according to the second or fourth identity authentication result.

[0125] In the embodiment of the present application, the terminal sends original password and facial feature data to the background server, and the background server performs identity authentication according to the database, thereby improving the security and confidentiality of user information.In addition, the terminal first sends one type of authentication information to the background server, and judges whether to send the second type of authentication information according to the authentication result of the first type of authentication information, and can directly determine the authentication result when the authentication of the first type of authentication information fails, thereby minimizing data transmission and leakage and improving the efficiency of identity authentication.

[0126] Combining the above embodiments, in one schematic example, the two-factor identity authentication task flow performed by the terminal and the background server is shown in FIG. 6, which includes the following steps:

[0127] Step 601: the terminal displays a virtual keyboard according to a password character conversion method.

[0128] Step 602: the terminal captures a face image through a camera.

[0129] Step 603: the terminal performs feature extraction on the face image to obtain face feature data, performs activity detection, and obtains an original password corresponding to the pose sequence.

[0130] Step 604: The terminal transmits the original password, the facial feature data, and the account identifier to the background server.

[0131] Step 605: The background server performs identity authentication based on the facial feature data and the original password.

[0132] Step 606: the background server sends the identity authentication result to the terminal.

[0133] FIG. 7 is a structural block diagram of a cell selection device provided in an exemplary embodiment of the present application, the device including: a first display module 701, a first feature extraction module 702, an activity detection module 703, a password conversion module 704, and an identity authentication module 705; The first display module 701 is used to display password conversion prompt information in response to an identity verification command, the password conversion prompt information is used to prompt a password character in an original password to be converted into a form, and different password characters correspond to different forms, and the password character conversion manner indicated by the password conversion prompt information is randomly generated; The first feature extraction module 702 is used to extract facial features from the identification verification image captured by the camera to obtain facial feature data; The activity detection module 703 is used to perform activity detection on the identification image to obtain a sequence of postures; A password conversion module 704 is used to convert the password according to the sequence of the postures to obtain the original password; The identity authentication module 705 is used to perform identity authentication based on the original password and the facial feature data.

[0134] As an option, the first display module 701 includes a generating unit and a display unit; The generating unit is used to generate a target random mapping function in response to the identity verification command, where the random mapping function is a function for randomly mapping characters into a figure; A display unit is used to display a virtual keyboard according to the target random mapping function, and a presentation information of the password conversion corresponding to the target random mapping function is displayed on the virtual keyboard; The password conversion module 704 includes a conversion unit, A conversion unit is used to perform password conversion on the sequence of postures based on the target random mapping function to obtain the original password.

[0135] Optionally, the display unit further comprises: A password conversion unit is determined according to the target random mapping function, and the password conversion unit is composed of one of the password characters and a form that the password character corresponds to in the target random mapping function; A first display manner corresponding to the password characters and a second display manner corresponding to a posture identifier of the posture are used to display the password conversion unit on the virtual keyboard, and the first display manner and the second display manner are different.

[0136] Optionally, the display unit further comprises: determining a first display position of the password character on the virtual keyboard; Displaying the password conversion units corresponding to each of the password characters on the virtual keyboard according to the first display manner and the second display manner and according to the first display position; Used for:

[0137] Optionally, the display unit further comprises: displaying the password characters on the virtual keyboard based on a first display position of the password characters on the virtual keyboard and the first display manner; In response to a display operation of a conversion manner, determine a second display position of the posture identifier on the virtual keyboard according to the corresponding password character of the posture identifier in the password conversion unit; displaying the appearance identifier on the virtual keyboard according to the second display position based on the second display manner; Used for:

[0138] As one option, the first display method and the second display method are different from each other, the password characters and the character type of the pose identifier are different; The color of the display of the password characters is different from the color of the display of the appearance identifier; The font for displaying the password characters is different from the font for displaying the appearance identifier; The character size of the password characters displayed is different from the character size of the appearance identifier displayed; The special display effect of the password characters is different from the special display effect of the posture identifier; Includes at least one of the following:

[0139] Optionally, the pose includes facial expressions and head movements; The device further includes a second display module, a feature collection module, and an information sending module; The second display module is used to display a set of poses in response to the facial feature recording command, and the set of poses includes all poses that can be used to convert the password characters; The feature collection module is used to extract features from the face images captured by the camera and obtain target face feature data corresponding to each posture; The information sending module sends the data of the target facial features and the account identifier to a background server, which is used to update a database containing the correspondence between the account, the target original password, and the data of the target facial features.

[0140] As an option, the identity authentication module 705 includes an information sending unit and an information receiving unit; The information sending unit is used for sending the original password and the facial feature data to the background server, and the background server is used for performing identity authentication according to the original password and the facial feature data; The information receiving unit is used for receiving the identity authentication result sent by the background server, and the identity authentication result is used for indicating the success or failure of the authentication.

[0141] As an option, the information sending unit further comprises: The original password and the account identifier of the current login account are used to send to the background server, and the background server is used to determine a first identity authentication result according to the target original password corresponding to the current login account in the database; receive the first identity authentication result sent by the background server, and in response to the first identity authentication result indicating success of password authentication, send the facial feature data to the background server; and the background server is used to determine a second identity authentication result according to the target facial feature data corresponding to the current login account in the database; The apparatus further includes a first determination module; The first confirmation module is used for receiving the first identity authentication result sent by the background server, and in response to the first identity authentication result indicating a failure of password authentication, for determining a failure of identity authentication and canceling the transmission of the facial feature data.

[0142] As an option, the information sending unit further comprises: Send the facial feature data and the account identifier of the current login account to the background server, and the background server determines a third identity authentication result according to the target facial feature data corresponding to the current login account in the database; receiving the third identity authentication result sent by the background server, and in response to the third identity authentication result indicating success of face authentication, sending the original password to the background server, and the background server determines a fourth identity authentication result according to the target original password corresponding to the current login account in the database; Used for The apparatus further includes a second determination module; The second confirmation module is used to receive the third identity authentication result sent by the background server, and in response to the third identity authentication result indicating a failure of face authentication, confirm the failure of identity authentication and cancel the transmission of the original password.

[0143] As mentioned above, in the embodiment of the present application, an identity authentication mechanism based on two authentication factors, namely, a user's password and facial features, is provided, and a user only needs to record his / her appearance once to simultaneously complete password input and facial recognition, which simplifies the process of identity authentication and improves the efficiency of identity authentication. A random password character conversion method is provided, so that what the user records is a random sequence of appearances converted from the original password, which can ensure that the user's original password is not leaked during the password recording stage, and can only be authenticated if the real-time password is obtained based on the correct original password, which can protect facial recognition from the attack of fake facial features and improve the security and accuracy of identity authentication.

[0144] In an exemplary embodiment, a terminal is further provided, the terminal including a processor and a memory, the memory storing at least one instruction, at least one program segment, code set or instruction set, the at least one instruction, at least one program segment, code set or instruction set being loaded and executed by the processor to realize the identity authentication method performed by the terminal provided in the above embodiment.

[0145] In an embodiment of the present application, a computer-readable storage medium is further provided, in which at least one instruction is stored, and the at least one instruction is loaded and executed by a processor to realize the identity authentication method as described in each of the above embodiments.

[0146] According to one aspect of the present application, a computer program product or computer program is provided, the computer program product or computer program including computer instructions, the computer instructions being stored in a computer-readable storage medium, a processor of a terminal reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, thereby causing the terminal to perform the identity authentication method provided in the various selectable implementation manners of the above aspect.

[0147] Those skilled in the art can recognize that the functions described in the embodiments of the present application in one or more of the above examples can be implemented in hardware, software, firmware, or any combination thereof. If implemented using software, these functions can be stored in a computer-readable storage medium or transferred as one or more instructions or codes in a computer-readable storage medium. Computer-readable storage media include computer storage media and communication media, where communication media includes any medium that facilitates the transfer of a computer program from one place to another. Storage media may be any available medium accessible by a general-purpose or special-purpose computer.

[0148] In addition, the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data for analysis, stored data, displayed data, etc.) and signals related to this application are all obtained with the permission of the user or sufficient permission from various parties, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of relevant countries and regions. For example, the account identifier, original password, facial feature data, etc. related to this application are all obtained with sufficient permission.

[0149] The above are merely optional embodiments of the present application, and do not limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. [Explanation of symbols]

[0150] 110 Terminal 120 Background Server 701 First display module 702 First feature extraction module 703 Activity Detection Module 704 Password conversion module 705 Identity Verification Module

Claims

1. In response to an identity verification command, display a password conversion prompt, the password conversion prompt is used to prompt a conversion of password characters in an original password into a form, different password characters correspond to different forms, and a password character conversion manner indicated by the password conversion prompt is randomly generated; extracting facial features from the identification verification image captured by the camera to obtain facial feature data; performing activity detection on the identification image to obtain a sequence of postures; converting the password based on the sequence of the postures to obtain the original password; performing identity authentication based on the original password and the facial feature data; Including, Identity authentication method.

2. displaying a password conversion prompt in response to the identity verification command; generating a target random mapping function in response to the identity verification command, the random mapping function being a function for randomly mapping characters into a form; Displaying a virtual keyboard based on the target random mapping function, and displaying the password conversion presentation information corresponding to the target random mapping function on the virtual keyboard; Including, converting the password based on the sequence of the postures to obtain the original password; performing a password transformation on the sequence of the postures based on the target random mapping function to obtain the original password; The method of claim 1.

3. displaying a virtual keyboard based on the target random mapping function Determine a password conversion unit according to the target random mapping function, the password conversion unit being composed of one of the password characters and a form that the password character corresponds to in the target random mapping function; Displaying the password conversion unit on the virtual keyboard according to a first display manner corresponding to the password characters and a second display manner corresponding to a posture identifier of the posture, the first display manner and the second display manner being different; Including, The method of claim 2.

4. Displaying the password conversion unit on the virtual keyboard according to a first display manner corresponding to the password characters and a second display manner corresponding to a posture identifier of the posture; determining a first display position on the virtual keyboard of the password character; Displaying the password conversion units corresponding to each of the password characters on the virtual keyboard according to the first display position based on the first display manner and the second display manner; Including, The method according to claim 3.

5. Displaying the password conversion unit on the virtual keyboard according to a first display manner corresponding to the password characters and a second display manner corresponding to a posture identifier of the posture; displaying the password characters on the virtual keyboard based on a first display position of the password characters on the virtual keyboard and the first display manner; In response to a display operation of a conversion manner, determining a second display position of the posture identifier on the virtual keyboard according to the corresponding password character in the password conversion unit of the posture identifier; displaying the posture identifier on the virtual keyboard according to the second display position based on the second display manner; Including, The method according to claim 3.

6. The first display method and the second display method are different from each other, the password characters and the character type of the pose identifier are different; The color of the display of the password characters is different from the color of the display of the appearance identifier; The font for displaying the password characters is different from the font for displaying the appearance identifier; The character size of the password characters displayed is different from the character size of the appearance identifier displayed; The special display effect of the password characters is different from the special display effect of the posture identifier; At least one of The method according to claim 3.

7. The pose includes facial expressions and head movements; Prior to displaying a password conversion proposal in response to the identity verification command, the method further comprises: displaying a set of poses in response to a facial feature recording command, the set of poses including all poses that can be used to convert password characters; Extracting features from the facial images captured by the camera to obtain target facial feature data corresponding to each pose; Sending the target facial feature data and the account identifier to a background server, the background server being used to update a database containing the correspondence between the account, the target original password, and the target facial feature data; Including, The method according to any one of claims 1 to 6.

8. performing identity authentication based on the original password and the facial feature data; Sending the original password and the facial feature data to the background server, and the background server is used to perform identity authentication according to the original password and the facial feature data; receiving an identity authentication result sent by the background server, and using the identity authentication result to indicate authentication success or authentication failure; Including, The method of claim 7.

9. transmitting the original password and the facial feature data to the background server, Sending the original password and an account identifier of a current login account to the background server, which is used by the background server to determine a first identity authentication result according to the target original password corresponding to the current login account in the database; receiving the first identity authentication result sent by the background server, and in response to the first identity authentication result indicating success of password authentication, sending the facial feature data to the background server, which is used by the background server to determine a second identity authentication result according to the target facial feature data corresponding to the current login account in the database; Including, The method comprises: receiving the first identity authentication result sent by the background server, and in response to the first identity authentication result indicating a failure of password authentication, determining a failure of identity authentication and canceling the sending of the facial feature data; The method according to claim 8.

10. transmitting the original password and the facial feature data to the background server, Sending the facial feature data and an account identifier of the current login account to the background server, which is used by the background server to determine a third identity authentication result according to the target facial feature data corresponding to the current login account in the database; receiving the third identity authentication result sent by the background server, and in response to the third identity authentication result indicating successful face authentication, sending the original password to the background server, which is used by the background server to determine a fourth identity authentication result according to the target original password corresponding to the current login account in the database; The method comprises: receiving the third identity authentication result sent by the background server, and in response to the third identity authentication result indicating a face authentication failure, determining the identity authentication failure and canceling the sending of the original password; The method according to claim 8.

11. The system includes a first display module, a first feature extraction module, an activity detection module, a password conversion module, and an identity authentication module; The first display module is used to display password conversion prompt information in response to an identity verification command, the password conversion prompt information is used to prompt a password character in an original password to be converted into a figure, the figure corresponding to different password characters is different, and the password character conversion manner indicated by the password conversion prompt information is randomly generated; The first feature extraction module is used to extract facial features from the identity verification image captured by the camera to obtain facial feature data; the activity detection module is used to perform activity detection on the identification verification image to obtain a sequence of postures; The password conversion module is used to convert the password according to the sequence of the postures to obtain the original password; The identity authentication module is used for performing identity authentication according to the original password and the facial feature data; Identity authentication device.

12. A processor and a memory are included. At least one instruction, at least one program segment, code set or instruction set is stored in the memory, and the at least one instruction, the at least one program segment, code set or instruction set is loaded and executed by the processor to realize the identity authentication method according to any one of claims 1 to 10. Terminal.

13. At least one computer program is stored; The computer program is loaded and executed by a processor to realize the identity authentication method according to any one of claims 1 to 10. A computer-readable storage medium.

14. Contains computer instructions, The computer instructions are stored in a computer-readable storage medium, and a processor of a terminal reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions to cause the terminal to perform the identity authentication method according to any one of claims 1 to 10. A computer program product or a computer program.

Images