CN111475793A

CN111475793A - Access control method, user registration method, user login method, device and equipment

Info

Publication number: CN111475793A
Application number: CN202010565112.7A
Authority: CN
Inventors: 贺三元
Original assignee: Alipay Hangzhou Information Technology Co Ltd
Current assignee: Alipay Hangzhou Information Technology Co Ltd
Priority date: 2020-06-19
Filing date: 2020-06-19
Publication date: 2020-07-31

Abstract

In the user registration process, a client provides a function of inputting a user login identifier and a function of collecting biological characteristic data to obtain the user login identifier and the biological characteristic data of a user, and a server establishes an account record for the user based on the user login identifier and the biological identification characteristic; in the user login process, only the user login identification and the biological characteristic data in the login request of the current user need to be acquired, whether an account record matching the user identification and the biological characteristic data exists is searched, if yes, the user is allowed to login, and if not, the user is refused to login.

Description

Access control method, user registration method, user login method, device and equipment

Technical Field

The present disclosure relates to the field of internet technologies, and in particular, to methods, apparatuses, and devices for access control, user registration, and user login.

Background

After the popularization of the internet technology, various business services emerge, and various convenience in work and life is brought to the life of the general public. For many years, business parties have adopted access control policies that authenticate user names and passwords. Based on this, there is a need to provide a more convenient access control scheme.

Disclosure of Invention

In order to overcome the problems in the related art, the specification provides access control, user registration and user login methods, devices and equipment.

According to a first aspect of embodiments herein, there is provided an access control method, the method comprising:

acquiring a user login identifier and biological characteristic data in a registration request of a current user, and creating an account record for the user based on the user login identifier and the biological characteristic data in the registration request;

and acquiring a user login identifier and biological characteristic data in a login request of a current user, searching whether an account record matching the user login identifier and the biological characteristic data exists, if so, allowing the user to login, and otherwise, refusing the user to login.

Optionally, the biometric data is: and biological characteristic data detected by the living body.

Optionally, the biometric data includes: face feature data.

Optionally, the user login identifier includes: the identity document number of the user, or the mobile phone number.

Optionally, before creating an account record for the user based on the user login identifier and the biometric data in the registration request, the method further includes: and confirming that the user login identification in the registration request passes the uniqueness verification according to the account record.

Optionally, the uniqueness verification includes: and searching whether the user login identification in the registration request exists in the account record.

According to a second aspect of embodiments herein, there is provided a user registration method, including:

providing a user registration page, wherein the user registration page is used for a user to input a user login identifier;

starting a biological characteristic data acquisition process to acquire biological characteristic data of a user;

and sending the user login identification and the biological characteristic data to a server, so that the server creates an account record for the user based on the user login identification and the biological characteristic data.

Optionally, the acquired biometric data of the user refers to biometric data detected by a living body.

Optionally, the user registration page is further configured to prompt the user to input an identity document number, or a mobile phone number is used as the user login identifier.

Optionally, the biometric data includes: face feature data.

According to a third aspect of embodiments of the present specification, there is provided a user login method including:

providing a user login page, wherein the user login page is used for acquiring a user login identifier;

and sending the user login identification and the biological characteristic data to a server side so that the server side can find whether an account record matching the user login identification and the biological characteristic data exists or not, if so, allowing the user to login, and otherwise, refusing the user to login.

Optionally, the method includes: the acquired biological characteristic data of the user refers to biological characteristic data detected by a living body.

Optionally, the biometric data includes: face feature data.

Optionally, the method further includes: and searching locally stored user data, acquiring a user login identifier from the user data, and filling the user login identifier to an input position of the user login identifier in the user login page.

According to a fourth aspect of embodiments herein, there is provided an access control method including:

acquiring a user login identifier and biological characteristic data in a login request of a current user, and searching whether the biological characteristic data corresponding to the user login identifier exists in an account record;

if the biological characteristic data corresponding to the user login identification is found, constructing an access verification transaction by combining the login request;

sending the access check transaction to node equipment in a blockchain, so that the node equipment can respond to the access check transaction, call a check logic in an intelligent contract issued to the blockchain, and verify whether the biological characteristic data in the login request is matched with the searched biological characteristic data;

and obtaining a verification result of the intelligent contract, if the verification result is matched with the intelligent contract, allowing the user to log in, and otherwise, refusing the user to log in.

Optionally, the biometric data includes: face feature data.

According to a fifth aspect of embodiments herein, there is provided an access control method, the method comprising:

receiving an access verification transaction sent by a service party; wherein the access check transaction comprises: the biological characteristic data in the login request and the biological characteristic data which is searched by the service party and corresponds to the user login identification;

responding to the access verification transaction, calling verification logic issued to an intelligent contract on a block chain, and verifying whether the biological characteristic data in the login request is matched with the searched biological characteristic data;

and acquiring a verification result of the intelligent contract, and determining whether the user is allowed to log in according to the verification result.

According to a sixth aspect of embodiments herein, there is provided an access control apparatus, the apparatus comprising:

a registration module to: acquiring a user login identifier and biological characteristic data in a registration request of a current user, and creating an account record for the user based on the user login identifier and the biological characteristic data in the registration request;

a login module to: and acquiring a user login identifier and biological characteristic data in a login request of a current user, searching whether an account record matching the user login identifier and the biological characteristic data exists, if so, allowing the user to login, and otherwise, refusing the user to login.

According to a seventh aspect of embodiments herein, there is provided a user registration apparatus, including:

providing a module for: providing a user registration page, wherein the user registration page is used for a user to input a user login identifier;

an acquisition module to: starting a biological characteristic data acquisition process to acquire biological characteristic data of a user;

a sending module configured to: and sending the user login identification and the biological characteristic data to a server, so that the server creates an account record for the user based on the user login identification and the biological characteristic data.

According to an eighth aspect of embodiments herein, there is provided a user login apparatus including:

providing a module for: providing a user login page, wherein the user login page is used for acquiring a user login identifier;

a sending module configured to: and sending the user login identification and the biological characteristic data to a server side so that the server side can find whether an account record matching the user login identification and the biological characteristic data exists or not, if so, allowing the user to login, and otherwise, refusing the user to login.

According to a ninth aspect of embodiments herein, there is provided an access control apparatus comprising:

a login module to:

According to a tenth aspect of embodiments herein, there is provided an access control apparatus, the apparatus comprising:

a receiving module to: receiving an access verification transaction sent by a service party; wherein the access check transaction comprises: the biological characteristic data in the login request and the biological characteristic data which is searched by the service party and corresponds to the user login identification;

a calling module to: responding to the access verification transaction, calling verification logic issued to an intelligent contract on a block chain, and verifying whether the biological characteristic data in the login request is matched with the searched biological characteristic data;

an acquisition module to: and acquiring a verification result of the intelligent contract, and determining whether the user is allowed to log in according to the verification result.

According to an eleventh aspect of embodiments herein, there is provided a computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements the aforementioned access control method/user login method/user registration method when executing the program.

The technical scheme provided by the embodiment of the specification can have the following beneficial effects:

the embodiment of the specification breaks through the usual design idea that the account name and the password are needed by the user account, allows the user to register by adopting the user login identification and the biological identification characteristic without inputting the password during the registration, and allows the user not to input the password during the registration, so that the efficiency of the user account login registration is very high, and the access control efficiency of the server side is also very high.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the specification.

Drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present specification and together with the description, serve to explain the principles of the specification.

Fig. 1A is a diagram illustrating an application scenario of an access control method according to an exemplary embodiment.

FIG. 1B is a schematic diagram illustrating a user operation according to an exemplary embodiment of the present disclosure.

Fig. 2A is a flow chart illustrating an access control method according to an exemplary embodiment of the present description.

Fig. 2B is a flow chart illustrating a method of user registration according to an example embodiment.

Fig. 2C is a flowchart illustrating a user login method according to an exemplary embodiment of the present description.

Fig. 3 is a diagram illustrating an application scenario of another access control method according to an exemplary embodiment of the present disclosure.

Fig. 4A and 4B are flow diagrams illustrating another access control method according to an example embodiment of the present description.

Fig. 5 is a block diagram of an apparatus where an access control device/user registration device/user login device is shown according to an exemplary embodiment.

Fig. 6 is a block diagram of an access control device shown in accordance with an exemplary embodiment of the present description.

Fig. 7 is a block diagram of a user registration apparatus, shown in accordance with an example embodiment.

FIG. 8 is a block diagram of a user login device shown in accordance with an exemplary embodiment of the present description.

Fig. 9 and 10 are block diagrams of another access control device shown in this specification according to an example embodiment.

Detailed Description

Reference will now be made in detail to the exemplary embodiments, examples of which are illustrated in the accompanying drawings. When the following description refers to the accompanying drawings, like numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present specification. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the specification, as detailed in the appended claims.

The terminology used in the description herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the description. As used in this specification and the appended claims, the singular forms "a", "an", and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and/or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

It should be understood that although the terms first, second, third, etc. may be used herein to describe various information, these information should not be limited to these terms. These terms are only used to distinguish one type of information from another. For example, the first information may also be referred to as second information, and similarly, the second information may also be referred to as first information, without departing from the scope of the present specification. The word "if" as used herein may be interpreted as "at … …" or "when … …" or "in response to a determination", depending on the context.

First, the overall concept of the embodiments of the present specification will be described. The traditional access control usually adopts a policy of a user name and a password, an embodiment of the present specification provides a brand-new access control scheme, as shown in fig. 1A, which is an application scenario schematic diagram of an access control scheme shown in the present specification according to an exemplary embodiment, in a user registration process, a client provides a function of inputting a user login identifier to a user, and a function of collecting biometric data is provided, so as to obtain the user login identifier and the biometric data of the user, and a server creates an account record for the user based on the user login identifier and the biometric feature; in the user login process, only the user login identification and the biological characteristic data in the login request of the current user need to be acquired, whether an account record matching the user identification and the biological characteristic data exists is searched, if yes, the user is allowed to login, and if not, the user is refused to login.

The embodiment of the specification breaks through the conventional design idea that a user account needs a user name and a password, as shown in fig. 1B, the embodiment allows a user to register by using a biometric feature without customizing the password during registration, and the user only needs to cooperate with a client to acquire biometric data during login, so that the login and registration efficiency of the user account is very high, and the access control efficiency of a server side is also very high.

As can be seen from the above embodiments, in the user registration process, the operations required by the user are only to input the user login identifier and to cooperate with the client to collect the biometric data, as understood from the perspective of the user; therefore, the user operation can be simplified, and the user does not need to remember the password any more. From the client perspective, it is understood that the client provides the biometric data collection function and the function of inputting the user login identification, and the function of inputting the user password by the user is not required.

The biometric data in the embodiments of the present specification is different from the password in the conventional policy. In the traditional strategy, a user needs to remember own password, and the biometric data of the embodiment of the specification does not need to be memorized by the user; moreover, the password is changeable, and the biological characteristic data has uniqueness which the password does not have, so that the situation that the user forgets the password and needs to reset in the traditional technology can be avoided; in actual business, it is very common that a user forgets a password, and a traditional policy needs to provide a function of resetting the password, and the process of resetting the password is usually complicated. Due to the variability of the password, the function support of the server-side database is also needed, and data updating, storage and other processing are needed. On the other hand, the password is a string of characters, and the user needs to perform an input operation, which cannot meet the requirements of some special scenes, for example, the user cannot input the password in a scene because the user holds the device with one hand or the hands are inconvenient. The biological characteristic data of the application does not need to be input on a keyboard by a user, and the client can finish automatic acquisition only by simple matching operation (such as aligning a human face to a camera, placing fingers in a fingerprint acquisition area and the like).

The biometric data in the conventional solution is mainly used for the business party to perform additional authentication on the registered user, and the purpose of "authentication" here is to confirm that the user who claims to be a certain identity currently is indeed the claimed user. For example, the server additionally collects biometric data for a user who has registered an account, the collection of the biometric data is after the login operation of the account, and after the server detects that the account has logged in, the server verifies that the user currently logged in the account is not an illegal user, and indeed is the user who logged in. The collection of the biometric data in this embodiment is performed in the registration phase of the account, and is not used for authenticating the identity of the registered user, but may be understood as that the user cooperates with the user login identifier in the login process as the login credential.

The scheme of the embodiment of the specification can be applied to scenes with large-scale user number, such as online scenes. In the user login process, the server needs to match the biometric data, although the biometric data has a certain complexity, in the account record in this embodiment, the biometric data is in one-to-one correspondence with the user login identifier, so the server finds the corresponding account record through the user login identifier in the login request, and matches the biometric data in the found account record with the biometric data in the registration request, so the processing speed of the login process is very high, and the server does not need to verify the face data to be verified with each biometric data in the database one by one. In a scene that the number of users of an online access control and the like is small, an access control strategy without user names is adopted, user characteristic data needs to be compared with all characteristic data in a database one by one when a user accesses the database, the processing speed is low, and the method cannot be applied to large-scale user scenes.

In the traditional scheme, some access control strategies without user-defined passwords are realized in a login mode of short message verification codes, and if the number of users is large and the users log in frequently, the scheme needs a service party to invest very large economic cost. The scheme of the embodiment of the application does not need the short message verification code during login, so that the operation cost can be obviously reduced.

According to the scheme of the embodiment of the specification, even if the user login identification and the biological characteristic data are leaked due to the fact that a certain database of a certain business party has a problem, the negative influence caused by the data leakage is low. According to the traditional access control strategy of the user name and the password, most users often adopt the same user name and password at a plurality of different websites, so that once the user name and the password of a certain website are leaked, other websites can be collided with the library, and a large-area security problem occurs. Because the password is a string of characters essentially, the biometric data is composed of a plurality of characteristics, and the authentication of the biometric data and the matching of the password are more complicated, even if a certain website leaks the user login identification and the biometric data, the difficulty of cracking is higher, and the security problem can be ensured more.

The following provides a detailed description of examples of the present specification.

As shown in fig. 2A, which is a flowchart of an access control method shown in this specification according to an exemplary embodiment, where this embodiment is described from the perspective of interaction between a server and a client, and may include the following steps:

in step 202, the client provides a user registration page, where the user registration page is used for a user to input a user login identifier.

The user login identification of the embodiment can have uniqueness so as to distinguish each user; as an example, the identification may be a user-defined identification, or an email address, or an identity document number of the user, such as an identification having uniqueness, e.g., an identification number of an identity document, a passport number, or a mobile phone number; the identification has uniqueness, is convenient for a user to remember and cannot be forgotten easily.

Optionally, after receiving the user login identifier submitted by the user during registration, the client may send the user login identifier to the server for uniqueness verification, for example, the server compares the identifier submitted by the user with the login identifiers of each registered user in the account record to find whether the user login identifier in the registration request exists in the account record, so as to determine whether the user login identifier of the current user is already registered. If the client is registered, the server side can send a registered prompt to the client side. For the registered user login identification, the user can be prompted to adopt other user login identifications. In practical application, the user login identifier may be occupied, taking the user login identifier as a mobile phone number as an example, the mobile phone number faces a situation of secondary number allocation, an operator gives the mobile phone number to a new user for a period of time after an old user logs out the mobile phone number, and at this time, the new user may find that the mobile phone number is registered when registering with the mobile phone number. Based on this, if the service end finds that the mobile phone number is registered, a verification function can be provided, the optional service end sends target verification information (such as a short message verification code or a voice verification code) to the mobile phone number, determines whether the verification is passed according to whether the target verification information is received within a set time, and further determines whether to create an account record for the user login identification in the registration request at a subsequent stage. For example, target authentication information is received within a set time, it is determined that the current user really holds the mobile phone number, and the user login identification passes the uniqueness authentication, so that the user is allowed to register.

Optionally, in an actual application, a verification process of the user login identifier may also be performed in the process, where the verification determines whether the user actually holds the user login identifier, for example, when the user login identifier is a mailbox address, a verification link or a verification code may be sent to the mailbox; when the user login identification is a mobile phone number, a short message verification code, a language verification code and the like can be sent to the mobile phone number. Through the verification, the verification process of malicious registration can be prevented; based on the verification result, it can be determined whether to continue the registration procedure or terminate the registration.

In step 204, the client starts a biometric data collection process to obtain biometric data of the user.

The biometric data in this embodiment may have various options in practical application, for example, may be a fingerprint, a palm print, a human face, an iris, a retina, or the like; correspondingly, the client device may be a device having a function of acquiring the biometric data; as an example, the biometric data may be face feature data, and the face feature data may be collected by the camera module, which is low in cost and easy to implement. Alternatively, the biometric data of the present embodiment may be one type of biometric data, or may be two or more types of biometric data.

Optionally, the living body detection process may also be executed when the biometric data is acquired; the living body detection is used for determining that a real user submits real physiological characteristics, and by taking human face characteristic data as an example, the living body detection can verify whether the user operates for the real living body per se through technologies such as blinking, mouth opening, head shaking, head nodding, language, challenge question answering, voiceprint recognition and the like, so that common attack means such as photos, face changing, masks, sheltering, screen copying and the like can be effectively resisted. In some examples, it may be that the client performs the live body detection itself, for example, the client is configured with a live body detection program, or the client is configured with hardware capable of performing the live body detection, and so on. The client performs living body authentication on the biological characteristic data and then sends the biological characteristic data to the server. In other examples, the client may cooperate with the server to perform living body detection, the biometric data acquired by the client may carry data that can be used by the server to perform living body detection, for example, the server returns a challenge question and answer to the client, the client acquires data such as behavior posture fed back by the user according to the challenge question and answer while acquiring face data, the server performs living body detection by using the biometric data acquired by the client, and the server may determine whether to continue to register or terminate registration according to a result of the living body detection. In the present embodiment, malicious registration is effectively prevented by live body detection of biometric data.

In step 206, the client sends a registration request to the server, where the registration request may include the user login identification and biometric data.

The client sends the user login identification and the biological characteristic data to the server to initiate a registration request. The user login identification and the biological characteristic data can be sent simultaneously or separately, for example, the user login identification is sent to the server after the user login identification input by the user is obtained, and then the biological characteristic data is collected and sent to the server; or the user login identification input by the user is firstly acquired, then the biological characteristic data is acquired, and then the biological characteristic data and the biological characteristic data are sent to the server side together.

In step 208, the server obtains the user login identifier and the biometric data in the registration request of the current user, and creates an account record for the user based on the user login identifier and the biometric data in the registration request.

The server side creates an account for the current user in the account record, the account corresponds to the user login identification and the biological characteristic data of the user, and the user login identification of the user is associated with the biological characteristic data through the account record. In practical application, the server may further perform relevant processing, such as encryption processing, on the user login identifier and/or the biometric data and then store the processed data. Optionally, since the account record includes records of a plurality of users (i.e. user login identifiers and corresponding biometric data), in order to realize faster search, the server may further generate account identifiers for each record in the account record, namely the account record stores the corresponding relation of the account identifier, the user login identifier and the biological characteristic data, the optional account identification may be incremented by a number, or may be in other arrangements for ease of retrieval, the account identifier can be sent to the client for storage, so that the client can also carry the account identifier when sending a login request, and when receiving the login request, the server, the user login identification and the biological characteristic data of the user can be inquired in the account record more quickly according to the account identification, and the more quick login processing is realized.

In step 210, a login process of the client is triggered, and the client provides a user login page, where the user login page is used to obtain a user login identifier.

The client is provided with a login page for acquiring a user login identifier; optionally, the client outputs a login page, a user login identifier input function is provided through the login page, and the user inputs the user login identifier; in another example, the client may store the user data locally after the user logs in, and the user data may include the user login identifier of the logged-in user, in which case, the user login identifier may be automatically filled in the login page by the client to the input position of the user login identifier in the user login page, and then the user may not input the user login identifier, thereby reducing the user operation.

In step 212, the client initiates a biometric data collection process to obtain biometric data of the user.

The implementation of this step can refer to step 202. After the user login identification is obtained, the client can call a biological characteristic data acquisition function to acquire biological characteristic data of the user, so that quick login processing is realized; the user has very few operations in the login process, and the interference to the user is obviously reduced. Optionally, the collecting process of this embodiment may also perform live detection, and if the live detection fails, it may be malicious login, for example, in case of hacking, and the user login process may be terminated. Therefore, the biological characteristic data in the embodiment can realize safe and reliable access control effect through living body detection; even if the user name and the biological characteristic data of the user on other websites are leaked, the biological characteristic data forged by an attacker can be identified by the living body detection strategy, and the biological characteristic data which can be detected by the living body is difficult to forge by the attacker, so that the safety problem can be effectively solved.

In step 214, the client sends a login request to the server, where the login request carries the user login identifier and the biometric data.

In step 216, the server receives the login request, obtains the user login identifier and the biometric data in the login request of the current user, searches whether an account record matching the user login identifier and the biometric data exists, allows the user to log in if the account record exists, and rejects the user to log in if the account record does not exist.

Next, the embodiment will be described again by taking the user login identifier as a mobile phone number and the biometric data as the face feature data as an example.

Step 1, after the client is started, the client can detect whether user data is stored locally; if yes, obtaining the account identification from the user data, and directly jumping to the step 9.

And 2, the client detects that the user data is not stored locally, and a registration function and a login function can be provided in a client page for being triggered by a user. The current user triggers the registration function and provides a registration page user for the user to input the mobile phone number.

And 3, the client sends the mobile phone number to the server to request the server to verify the mobile phone number.

And 3.2, the server receives the mobile phone number, detects whether the mobile phone number is registered or not, and generates a verification code if the mobile phone number is not registered. And sending the verification code to the mobile phone number.

And 3.3, the server side sends the verification code to the mobile phone number.

Step 3.3.1 the user enters the verification code in the registration page.

And 4, starting the face acquisition module by the client.

And 5, the client acquires face data.

Step 6 the client performs a liveness check.

And 7, the client sends the face data and the verification code input by the user to the server.

And 7.1, the server receives the face data and the verification code input by the user, performs living body detection on the face data and verifies the verification code.

And 7.2, after the living body detection is passed and the verification code is verified, the server side performs processing such as feature extraction from the face data to store the face feature data.

And 7.3, the server generates an account identifier and creates an account record based on the account identifier, the mobile phone number and the face feature data.

7.4, the server side returns a registration result to the client side; the server side also sends the account identifier for the client side to store to the local.

The above is a registration process, and then a login process is entered.

And 8, triggering a login process by the current user, and providing the page user for the user to input the mobile phone number by the client.

And 9, prompting a user to perform face authentication by the client, starting a face data acquisition module to acquire face data, and executing living body detection in the acquisition process.

Step 10, the client acquires the face data for executing the living body detection and sends the face data and the mobile phone number to the server.

And step 11, the server receives the face data and the mobile phone number.

Step 11.1, the server detects the living body of the face data.

And 11.2, after the living body detection is passed, the server side extracts the face feature data from the face data.

And 11.3, the server searches the face feature data corresponding to the mobile phone number from the account record through the mobile phone number, and matches the face feature data with the extracted face feature data.

And step 11.4, the server side determines whether the authentication is passed or not, and returns an authentication result to the client side.

Step 11.5 the client receives the authentication result and prompts the user for a login status.

As shown in fig. 2B, the flowchart of a user registration method according to an exemplary embodiment is shown in this specification, and this embodiment describes a processing flow of a user registration phase from the perspective of a client, including the following steps:

in step 222, providing a user registration page, where the user registration page is used for a user to input a user login identifier;

in step 224, starting a biometric data collection process to obtain biometric data of the user;

in step 226, the user login identifier and the biometric data are sent to a server, so that the server creates an account record for the user based on the user login identifier and the biometric data.

Optionally, the biometric data includes: face feature data.

The specific processing procedure of this embodiment can refer to the embodiment shown in fig. 2A, and is not described herein again.

As shown in fig. 2C, the flowchart is a flowchart of a user login method shown in this specification according to an exemplary embodiment, and this embodiment describes a processing flow of a user login phase from a client perspective, including the following steps:

step 232, providing a user login page, wherein the user login page is used for acquiring a user login identifier;

step 234, starting a biological characteristic data acquisition process to acquire biological characteristic data of the user;

step 236, sending the user login identification and the biological characteristic data to a server, so that the server searches whether an account record matching the user login identification and the biological characteristic data exists, if so, allowing the user to login, otherwise, rejecting the user to login.

Optionally, the biometric data includes: face feature data.

Fig. 3 is a schematic view of an application scenario of an access control scheme based on a blockchain according to an exemplary embodiment, where the access control scheme based on a blockchain includes a client, a service system, and a blockchain system, where the blockchain system may include a plurality of node devices, and fig. 3 illustrates an example of 4 devices. The service system provides a registration function and a login function for a user, when the user needs to log in, the user can initiate a login request to the service system through a client, the service system searches biological characteristic data corresponding to a user login identifier according to the login request of the user and then constructs an access check transaction, then the access check transaction is submitted to the blockchain system, and any node equipment in the blockchain system calls an access check logic in an intelligent contract after receiving the access check transaction to verify whether the biological characteristic data in the login request is matched with the searched biological characteristic data. And the service system acquires the verification result of the intelligent contract, if the verification result is matched with the intelligent contract, the user is allowed to log in, and otherwise, the user is refused to log in.

Because the biological characteristic data related to the user is submitted to the block chain system and verified by the intelligent contract, the verification logic aiming at the biological characteristic data can be ensured to be real and effective, and the safety and the reliability of the biological characteristic verification are ensured.

The access control method based on a blockchain according to the present specification is introduced from a blockchain system side, as shown in fig. 4A, a flowchart of the access control method based on a blockchain according to an exemplary embodiment is shown in the present specification, and the method is applicable to any node device in a blockchain, and the method may include the following steps:

in step 402, receiving an access verification transaction sent by a service party; wherein the access check transaction comprises: the biological characteristic data in the login request and the biological characteristic data which is searched by the service party and corresponds to the user login identification;

in step 404, in response to the access verification transaction, invoking a verification logic issued to an intelligent contract on a blockchain to verify whether the biometric data in the login request matches the found biometric data;

in step 406, a verification result of the intelligent contract is obtained, and whether the user is allowed to log in is determined according to the verification result.

The blockchain described in this specification may specifically include a private chain, a common chain, a federation chain, and the like, and is not particularly limited in this specification.

For example, in one scenario, the block chain may specifically be a federation chain formed by each service node as a federation member; the operator of the alliance chain can deploy corresponding services by relying on the alliance chain. Each service node can distribute the service data generated or received by itself in a form of transaction in the alliance chain, and store the transaction in a distributed database in the alliance chain after the transaction is processed by the consensus node in the alliance chain.

It should be noted that the Transaction (Transaction) described in this specification refers to a piece of data created by a client of a blockchain and needs to be finally issued to a distributed database of the blockchain.

Transactions in a blockchain, generally have a narrow sense of transaction and a broad sense of transaction score. A narrowly defined transaction refers to a transfer of value issued by a user to a blockchain; for example, in a conventional bitcoin blockchain network, the transaction may be a transfer initiated by the user in the blockchain. The broad transaction refers to a piece of business data with business intention, which is issued to the blockchain by a user; for example, an operator may build a federation chain based on actual business requirements, relying on the federation chain to deploy some other types of online business unrelated to value transfer (e.g., electronic ticket uploading or issuing, etc.), and in such federation chain, a transaction may be a business request with a business intent issued by a user in the federation chain via a business system.

In block chain techniques, nodes in the block chain typically need to rely on a corresponding smart contract (Smartcontract) to operate on the block. Operations such as storing, modifying, deleting, etc. in a blockchain all need to rely on smart contracts. The intelligent contract may be a computer protocol intended for application to propagate, verify, or execute contracts in an informational manner that may be deployed on a blockchain. Performing the corresponding operation can be realized by declaring the business logic in the smart contract. Smart contracts allow trusted transactions to be conducted without third parties. These transactions are traceable and irreversible. Smart contracts can provide security over traditional contract methodologies and reduce other transaction costs associated with contracts. In general, the intelligent contracts can be deployed locally at block link points, and when a node needs to execute a certain action, the corresponding intelligent contract can be called, and the intelligent contract is executed to execute the business logic stated in the intelligent contract, so as to obtain an execution result.

In this embodiment, the node device of the blockchain receives an access check transaction sent by the client, and invokes, in response to the access check transaction, an access check logic declared in the intelligent contract issued on the blockchain, thereby verifying whether the biometric data in the login request matches the found biometric data.

Wherein the access check logic may be program code (e.g., some callable program method or function) declared in the smart contract related to the execution logic that verifies whether the biometric data in the login request matches the found biometric data.

In this embodiment, the service system searches for biometric data corresponding to the user login identifier according to a login request of the user, then constructs an access check transaction, and then submits the access check transaction to the blockchain system, and after receiving the access check transaction, any node device in the blockchain system invokes an access check logic in the intelligent contract to verify whether the biometric data in the login request matches with the found biometric data. And the service system acquires the verification result of the intelligent contract, if the verification result is matched with the intelligent contract, the user is allowed to log in, and otherwise, the user is refused to log in.

As shown in fig. 4B, the method for block chain based access control according to the present specification is introduced from the service system side, and the method is applicable to the service system side, and includes the following steps:

in step 410, obtaining a user login identifier and biometric data in a registration request of a current user, and creating an account record for the user based on the user login identifier and the biometric data in the registration request;

in step 412, obtaining a user login identifier and biometric data in a login request of a current user, and searching whether biometric data corresponding to the user login identifier exists in an account record;

in step 414, if the biometric data corresponding to the user login identification is found, an access verification transaction is constructed in combination with the login request;

in step 416, the access check transaction is sent to the node device in the blockchain, so that the node device invokes a check logic in the intelligent contract issued to the blockchain in response to the access check transaction to verify whether the biometric data in the login request matches the found biometric data;

in step 418, the verification result of the intelligent contract is obtained, if the verification result is matched with the intelligent contract, the user is allowed to log in, otherwise, the user is refused to log in.

In this regard, with regard to the processing procedure of the registration phase, reference may be made to the description of the foregoing embodiments. Different from the foregoing embodiment, in this embodiment, after the business system finds the biometric data corresponding to the user login identifier from the account record, the intelligent contract on the block chain is invoked for verification. Specifically, the access check transaction constructed by the service system includes: the biological characteristic data in the login request and the searched biological characteristic data; and submitting the access verification transaction to node equipment in the block chain, wherein the node equipment responds to the access verification transaction, calls verification logic issued to an intelligent contract on the block chain, and verifies whether the biological characteristic data in the login request is matched with the searched biological characteristic data. And the service system acquires the verification result of the intelligent contract, and allows the user to log in if the verification result is matched with the intelligent contract, otherwise, refuses the user to log in.

In this embodiment, because the biometric data related to the user is submitted to the blockchain system, and the biometric data is verified by the intelligent contract, the verification logic for the biometric data can be ensured to be true and effective, and the security and reliability of the biometric verification can be ensured.

Corresponding to the embodiments of the aforementioned access control method/user login method/user registration method, the present specification also provides embodiments of access control, user registration, user login apparatus and terminal applied thereto.

The embodiments of the access control device, the user registration device and the user login device in the present specification can be applied to computer equipment, such as a server or terminal equipment. The device embodiments may be implemented by software, or by hardware, or by a combination of hardware and software. The software implementation is taken as an example, and is formed by reading corresponding computer program instructions in the nonvolatile memory into the memory for operation through the processor in which the software implementation is located. From a hardware aspect, as shown in fig. 5, a hardware structure diagram of a computer device in which an access control device/a user registration device/a user login device of this specification is located is shown, except for the processor 510, the memory 530, the network interface 520, and the nonvolatile memory 540 shown in fig. 5, a server or an electronic device in which the device 531 is located in the embodiment may also include other hardware according to an actual function of the computer device, which is not described again.

As shown in fig. 6, fig. 6 is a block diagram of an access control device shown in the present specification according to an exemplary embodiment, the device including:

a registration module 61 configured to: acquiring a user login identifier and biological characteristic data in a registration request of a current user, and creating an account record for the user based on the user login identifier and the biological characteristic data in the registration request;

a logging module 62 for: the method comprises the steps of obtaining a user login identification and biological characteristic data in a login request of a current user, searching whether an account record matching the user login identification and the biological characteristic data exists, allowing the user to login if the account record exists, and rejecting the user to login if the account record does not exist.

Optionally, the biometric data includes: face feature data.

Optionally, the registration module is further configured to: and after the uniqueness verification is carried out on the user login identification in the registration request according to the account record, establishing an account record for the user based on the user login identification and the biological characteristic data in the registration request.

As shown in fig. 7, fig. 7 is a block diagram of a user registration apparatus shown in this specification according to an exemplary embodiment, including:

providing means 71 for: providing a user registration page, wherein the user registration page is used for a user to input a user login identifier;

an acquisition module 72 for: starting a biological characteristic data acquisition process to acquire biological characteristic data of a user;

a sending module 73, configured to: and sending the user login identification and the biological characteristic data to a server, so that the server creates an account record for the user based on the user login identification and the biological characteristic data.

Optionally, the biometric data collection process further includes: a liveness detection sub-procedure is performed during the collection of the biometric data.

Optionally, the biometric data includes: face feature data.

As shown in fig. 8, fig. 8 is a block diagram of a user login device shown in the present specification according to an exemplary embodiment, including:

providing a module 81 for: providing a user login page, wherein the user login page is used for acquiring a user login identifier;

an acquisition module 82 for: starting a biological characteristic data acquisition process to acquire biological characteristic data of a user;

a sending module 83, configured to: and sending the user login identification and the biological characteristic data to a server side so that the server side can find whether an account record matching the user login identification and the biological characteristic data exists or not, if so, allowing the user to login, and otherwise, refusing the user to login.

Optionally, the biometric data includes: face feature data.

As shown in fig. 9, fig. 9 is a block diagram of an access control device shown in the present specification according to an exemplary embodiment, including:

a registration module 91 configured to: acquiring a user login identifier and biological characteristic data in a registration request of a current user, and creating an account record for the user based on the user login identifier and the biological characteristic data in the registration request;

a logging module 92 for:

As shown in fig. 10, fig. 10 is a block diagram of an access control device shown in the present specification according to an exemplary embodiment, including:

a receiving module 110, configured to: receiving an access verification transaction sent by a service party; wherein the access check transaction comprises: the biological characteristic data in the login request and the biological characteristic data which is searched by the service party and corresponds to the user login identification;

a calling module 120 configured to: responding to the access verification transaction, calling verification logic issued to an intelligent contract on a block chain, and verifying whether the biological characteristic data in the login request is matched with the searched biological characteristic data;

an obtaining module 130, configured to: and acquiring a verification result of the intelligent contract, and determining whether the user is allowed to log in according to the verification result.

Accordingly, the present specification also provides a computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements the aforementioned access control method/user login method/user registration method when executing the program.

The implementation processes of the functions and actions of each module in the access control device/user login device/user registration device are specifically detailed in the implementation processes of the corresponding steps in the access control method/user login method/user registration method, and are not described herein again.

For the device embodiments, since they substantially correspond to the method embodiments, reference may be made to the partial description of the method embodiments for relevant points. The above-described embodiments of the apparatus are merely illustrative, wherein the modules described as separate parts may or may not be physically separate, and the parts displayed as modules may or may not be physical modules, may be located in one place, or may be distributed on a plurality of network modules. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution in the specification. One of ordinary skill in the art can understand and implement it without inventive effort.

The foregoing description has been directed to specific embodiments of this disclosure. Other embodiments are within the scope of the following claims. In some cases, the actions or steps recited in the claims may be performed in a different order than in the embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing may also be possible or may be advantageous.

Other embodiments of the present description will be apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein. This specification is intended to cover any variations, uses, or adaptations of the specification following, in general, the principles of the specification and including such departures from the present disclosure as come within known or customary practice within the art to which the specification pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the specification being indicated by the following claims.

It will be understood that the present description is not limited to the precise arrangements described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present description is limited only by the appended claims.

The above description is only a preferred embodiment of the present disclosure, and should not be taken as limiting the present disclosure, and any modifications, equivalents, improvements, etc. made within the spirit and principle of the present disclosure should be included in the scope of the present disclosure.

Claims

1. A method of access control, the method comprising:

2. The method of claim 1, wherein the biometric data is: and biological characteristic data detected by the living body.

3. The method of claim 1 or 2, the biometric data comprising: face feature data.

4. The method of claim 1, the user login identification comprising: the identity document number of the user, or the mobile phone number.

5. The method of claim 1, further comprising, prior to said creating an account record for the user based on the user login identification and biometric data in the registration request: and confirming that the user login identification in the registration request passes the uniqueness verification according to the account record.

6. The method of claim 5, the uniqueness verification comprising: and searching whether the user login identification in the registration request exists in the account record.

7. A user registration method, comprising:

8. The method of claim 7, the biometric data acquisition procedure further comprising: a liveness detection sub-procedure is performed during the collection of the biometric data.

9. The method of claim 7, wherein the user registration page is further used for prompting a user to input an identity document number or a mobile phone number as the user login identifier.

10. The method of claim 7, the biometric data comprising: face feature data.

11. A user login method comprises the following steps:

12. The method of claim 11, the obtaining biometric data of the user comprising: and biological characteristic data detected by the living body.

13. The method of claim 11, the biometric data comprising: face feature data.

14. The method of claim 11, further comprising: and searching locally stored user data, acquiring a user login identifier from the user data, and filling the user login identifier to an input position of the user login identifier in the user login page.

15. An access control method comprising:

16. The method of claim 15, wherein the biometric data is: and biological characteristic data detected by the living body.

17. The method of claim 15, the biometric data comprising: face feature data.

18. The method of claim 15, the user login identification comprising: the identity document number of the user, or the mobile phone number.

19. The method of claim 15, further comprising, prior to said creating an account record for the user based on the user login identification and biometric data in the registration request: and confirming that the user login identification in the registration request passes the uniqueness verification according to the account record.

20. The method of claim 19, the uniqueness verification comprising: and searching whether the user login identification in the registration request exists in the account record.

21. A method of access control, the method comprising:

and acquiring the verification result of the intelligent contract pair, and determining whether the user is allowed to log in according to the verification result.

22. An access control apparatus, the apparatus comprising:

23. A user registration apparatus, comprising:

24. A user login apparatus comprising:

25. An access control device comprising:

a login module to:

26. An access control apparatus, the apparatus comprising:

27. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements the method of any of claims 1 to 21 when executing the program.