WO2017152815A1 - 一种身份认证方法及系统 - Google Patents

一种身份认证方法及系统 Download PDF

Info

Publication number
WO2017152815A1
WO2017152815A1 PCT/CN2017/075725 CN2017075725W WO2017152815A1 WO 2017152815 A1 WO2017152815 A1 WO 2017152815A1 CN 2017075725 W CN2017075725 W CN 2017075725W WO 2017152815 A1 WO2017152815 A1 WO 2017152815A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
authentication
authenticated
data
background server
Prior art date
Application number
PCT/CN2017/075725
Other languages
English (en)
French (fr)
Inventor
李明
Original Assignee
李明
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 李明 filed Critical 李明
Priority to SG11201807605UA priority Critical patent/SG11201807605UA/en
Priority to EP17762501.9A priority patent/EP3428818B1/en
Priority to US16/083,273 priority patent/US20200167450A1/en
Publication of WO2017152815A1 publication Critical patent/WO2017152815A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/32—User authentication using biometric data, e.g. fingerprints, iris scans or voiceprints
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/34—User authentication involving the use of external additional devices, e.g. dongles or smart cards
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0861—Network architectures or network communication protocols for network security for authentication of entities using biometrical features, e.g. fingerprint, retina-scan
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/126—Applying verification of the received information the source of the received data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H04L9/3255—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures using group based signatures, e.g. ring or threshold signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/062—Pre-authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/30—Security of mobile devices; Security of mobile applications
    • H04W12/33—Security of mobile devices; Security of mobile applications using wearable devices, e.g. using a smartwatch or smart-glasses

Definitions

  • the present invention relates to the field of electronic technologies, and in particular, to an identity authentication method and system.
  • biometrics are usually used with the user's password.
  • the matching rate is set higher to avoid the user's account being illegally used, but in this case, since the user's biometrics are in different states.
  • the information collected may be slightly different. For example, if the fingerprint of the user is dry and wet, the fingerprint data collected by the same fingerprint may be different, so that even the same user may need to enter the password. The real fingerprint is regarded as a fake fingerprint, thereby rejecting the user's request, and the user needs to input again.
  • the user may need to input innumerable times, that is, the probability that the real legal user is recognized is high, and the probability is lowered.
  • the user experience, in the related technology, the technical solution to solve the problem is mainly to optimize the fingerprint matching algorithm, but the premise of these solutions is that the collected fingerprint data is complete and accurate, and the collected fingerprint data and the stored fingerprint data are different. And can't work very well.
  • the present invention is directed to solving one of the above problems.
  • the main object of the present invention is to provide an identity authentication method.
  • Another object of the present invention is to provide an identity authentication system.
  • An aspect of the present invention provides an identity authentication method, including: a first device establishes a communication connection with a second device; the first device receives data to be authenticated transmitted by the second device by using a communication connection, where the data to be authenticated includes: digital authentication Information and identity; the first device collects biometric information; the first device sends the data to be authenticated and the biometric information to a background server; the background server receives the data to be authenticated and the biometric information; the background server obtains the pre-stored authentication factor and biometric verification information corresponding to the identity identifier; the background server authenticates the digital authentication information according to the authentication factor, and determines the biometric information.
  • the matching rate with the biometric authentication information is greater than the first preset value; in the case that the digital authentication information is authenticated, and the matching rate of the biometric information and the biometric authentication information is greater than the first preset value, The identity authentication of the second device is passed.
  • the biometric information includes: fingerprint information and/or vein information; and the collecting, by the first device, the biometric information of the biological limb includes: collecting the contact between the biological limb and the first device when the biological limb is in contact with the first device Biometric information of the site.
  • the first device receives, by the communication connection, the to-be-authenticated data transmitted by the second device, where the first device receives the data to be authenticated broadcasted by the second device by using the communication connection, or sends the first device to the second device by using the communication connection.
  • An authentication request the first device receives the data to be authenticated sent by the second device in response to the authentication request through the communication connection.
  • the digital authentication information includes: signature information obtained by digitally signing the signature data by using the signature private key; the authentication factor includes: a signature public key corresponding to the signature private key; and the background server authenticates the digital authentication information according to the authentication factor, including The background server uses the signature public key and the data to be signed to perform verification on the digital authentication information; or the digital authentication information includes: encrypted information obtained by encrypting the encrypted information by using a symmetric key; the authentication factor includes: a symmetric key; The authentication factor authenticates the digital authentication information, including: the background server uses the symmetric key and the information to be encrypted to authenticate the encrypted information; or the digital authentication information includes: a dynamic password; the authentication factor includes: a seed key for verifying the dynamic password The background server authenticates the digital authentication information according to the authentication factor, including: the background server authenticates the dynamic password by using at least the seed key.
  • the first preset value is smaller than the second preset value, where the second preset value is used to indicate that the two biometric information are the matching rate of the same biometric information.
  • the first device establishes a communication connection with the second device, including: the first device establishes a communication connection with the second device by using the biological limb.
  • Another aspect of the present invention provides an identity authentication system, including: a first device and a backend server, wherein the first device is configured to: establish a communication connection with the second device; and receive, by the communication connection, the to-be-authenticated transmission by the second device.
  • the data to be authenticated includes: digital authentication information and an identity identifier; collecting biometric information of the biological limb; the first device sends the data to be authenticated and the biometric information to the background server; and the background server is configured to: receive the data to be authenticated And biometric information; acquiring pre-stored authentication factors and biometrics verification information corresponding to the identity identifier; authenticating the digital authentication information according to the authentication factor, and determining whether the matching rate of the biometric information and the biometric verification information is greater than the first pre- a value, wherein the first preset value is smaller than a second preset value, wherein the second preset value is a matching rate indicating that two biometric information are the same biometric information; In the case of certification, as well as biometric information and biometric verification information With the case where the rate is greater than a first predetermined value, determined by the second device authentication.
  • the biometric information includes: fingerprint information and/or vein information; the first device collects the living in the following manner Biological characteristic information of the limb: in the case where the biological limb is in contact with the first device, the biometric information of the contact portion of the biological limb with the first device is collected.
  • the first device receives the data to be authenticated transmitted by the second device by: the first device receives the data to be authenticated broadcast by the second device by using the communication connection; or the first device sends the authentication to the second device by using the communication connection. And requesting, by the communication connection, the data to be authenticated sent by the second device in response to the authentication request.
  • the digital authentication information includes: signature information obtained by digitally signing the signature data by using the signature private key; the authentication factor includes: a signature public key corresponding to the signature private key; and the background server authenticates the digital authentication information by: The server uses the signature public key and the data to be signed to perform verification on the digital authentication information.
  • the digital authentication information includes: encrypted information obtained by encrypting the encrypted information by using a symmetric key; the authentication factor includes: a symmetric key; the background server passes the following: The method performs authentication on the digital authentication information: the background server authenticates the encrypted information by using the symmetric key and the information to be encrypted; or the digital authentication information includes: a dynamic password; the authentication factor includes: a seed key for verifying the dynamic password; and a background server The digital authentication information is authenticated by the backend server authenticating the dynamic password using at least the seed key.
  • the first device establishes a communication connection with the second device by the first device establishing a communication connection with the second device by the biological limb.
  • the dual authentication of the digital authentication information and the biometric information by the background server can reduce the probability that the real and legitimate users are recognized and failed, and improve the probability. user experience.
  • FIG. 1 is a flowchart of an identity authentication method according to Embodiment 1 of the present invention.
  • FIG. 2 is a schematic structural diagram of an identity authentication system according to Embodiment 2 of the present invention.
  • This embodiment provides an identity authentication method.
  • FIG. 1 is a flowchart of an identity authentication method provided by this embodiment. As shown in FIG. 1 , the method mainly includes the following steps S102 to S116.
  • Step S102 the first device establishes a communication connection with the second device.
  • the first device may be connected by wireless or wired, for example, NFC, Bluetooth, or the like.
  • the first device may establish a communication connection with the second device through the biological limb through a wireless or wired connection, that is, the first device communicates with the second device through the human body (intra-body) Communication, IBC) is established through links, where biological limbs include, but are not limited to, the human body.
  • the first device may be a POS machine, an Alipay application, etc., a scanning terminal, a mobile terminal, a PDA, a desktop computer, a notebook, an access control, etc.
  • the second device may be a device implanted in the human body or worn on the human body, implanted.
  • the device in the human body can be, for example, a blood flow sensor, a pulse sensor, a body temperature sensor or the like implanted in the human body, and the device worn on the human body can be, for example, a wristband, a wristwatch, a necklace, a ring, a belt, etc., which can be worn on the user.
  • Electronic equipment for example, a blood flow sensor, a pulse sensor, a body temperature sensor or the like implanted in the human body
  • the device worn on the human body can be, for example, a wristband, a wristwatch, a necklace, a ring, a belt, etc.
  • the first device establishes a communication connection with the first device by using the biological limb, and the first device detects that the biological limb is within a preset range from the second device and the first The device contacts and establishes a communication connection with the second device through the biological limb. For example, it is detected that a finger of a human body wearing a wristband touches the first device, thereby establishing a communication connection with the wristband through the human body.
  • the second device can be worn on the user's body or placed in the user's body, or loaded in the clothing or accessories worn by the user, thereby being communicatively coupled to the second device, for example, on the user's wrist. Or installed in the pocket of the user's clothing, when the user needs to log in to the network, open the access control, and pay for operations such as authentication, the user can access the first device through his own limb (such as the arm, face) (ie, verify Device), when the limb approaches the first device a certain distance (eg, a few millimeters), the first device establishes a communication connection with the second device through the limb of the user. Since the human body communication has a certain range, for example, 3 to 5 meters, the human body communication connection can be established only when the human body enters the preset range of the first device.
  • the human body communication has a certain range, for example, 3 to 5 meters, the human body communication connection can be established only when the human body enters the preset range of the first device.
  • the first device establishes a communication connection with the second device by using the biological device, and may be in a wired manner and a wireless manner.
  • the first device and the second device may be at least used in the following two manners.
  • the first device and the second device are each provided with an electrode, and the first device is in contact with a biological limb (human body) implanted in the human body or the second device worn on the human body (for example, a user wearing the wristwatch contacts the finger with the POS)
  • a biological limb human body
  • the human body is used as a conductor, and the electrodes of both sides are connected to form a passage in the human body, that is, a so-called wired communication connection.
  • the first device needs to be in contact with a human body wearing the second device.
  • the first device and the second device can detect whether the surrounding electric field changes. If the other party enters the range allowed by the human body communication, the field strength can be detected, and The other party establishes a communication connection.
  • the second device is worn or built in the human body, and the oscillation of the transmitter of the second device causes the body to generate an electric field, and the distance between the second device and the first device is within the range allowed by the human body communication.
  • the receiver of the first device detects a change in the electric field and establishes a communication connection with the second device. In this manner, the first device does not need to be in contact with a human body wearing the second device.
  • the human body is used as a transmission medium of an electrical signal to realize information interaction between the body surface, the body, and the device around the human body (3 to 5 meters).
  • traditional wireless communication technologies such as Bluetooth, WIFI, radio frequency and infrared
  • the signal is transmitted through the human body during human communication, so electromagnetic noise has little influence on it, and has low power consumption, high confidentiality and lower human damage. advantage.
  • the redundant connection problem of the wired communication method can be eliminated.
  • Step S104 The first device receives the data to be authenticated transmitted by the second device by using a communication connection, where the data to be authenticated includes: digital authentication information and an identity identifier.
  • the digital authentication information may include at least one of the following: signature information, encryption information, and dynamic password.
  • the electronic signature information may be a signature information obtained by digitally signing the signature data by using a signature private key (which may be a signature private key of the second device or a private key of a security device (for example, KEY) connected to the second device,
  • a signature private key which may be a signature private key of the second device or a private key of a security device (for example, KEY) connected to the second device
  • the signature public key corresponding to the signature private key is obtained, and the electronic signature information is verified by the signature public key. If the verification is passed, the authentication is passed.
  • the data to be signed may be the above-mentioned identity identifier, or may be a random number generated by the second device or the security device connected to the second device. In this case, the data to be authenticated may further include the second device. a random number. In addition, the data to be signed may also be a random number generated by the first device.
  • the first device may send a verification request to the second device after establishing a communication connection with the second device.
  • the request carries the random number generated by the first device, and after receiving the random number, the second device signs the random number by using the signature private key to obtain the signature information, and uses the random number as the data to be signed, which can prevent the playback. attack.
  • the digital authentication information is signature information such that the identity of the user of the second device can be ensured at the time of authentication.
  • the encrypted information may be a MAC value calculated by the second device by using the symmetric key negotiated with the first device to encrypt the data, and when the encrypted information is authenticated, the symmetric MAC address is also used to calculate the verified MAC value. Comparing the ciphertext information with the verification MAC value, if the agreement is the same, the authentication is passed; or the encryption information may also be the ciphertext data obtained by the second device using the symmetric key negotiated with the first device to the encrypted data, in the encrypted information. When the authentication is performed, the ciphertext data is decrypted by using the symmetric key, and the information obtained by the decryption is compared with the data to be encrypted. If the data is consistent, the authentication is passed.
  • the dynamic password may be a dynamic password generated based on the seed key.
  • the verification value is calculated by using the seed key, and the dynamic password and the verification value are compared. If they are consistent, the authentication is passed.
  • the password may be time-based, or may be an event-based event, and may be a dynamic challenge code, which is not limited in this embodiment.
  • the authentication of the digital authentication information may be implemented by any of the foregoing to ensure the legitimacy of the second device.
  • the second device may calculate the digital authentication information by itself, or may interact with another device (for example, an electronic device having a signature function, an encryption function, or a dynamic password function) to obtain the data authentication information.
  • another device for example, an electronic device having a signature function, an encryption function, or a dynamic password function.
  • the specific embodiment is not limited.
  • the identity identifier may be a device identifier, a user ID, and the like of the second device.
  • Information that can uniquely identify the identity of the user, and the identity identifier can be uniquely associated with the authentication factor used by the second user for authenticating the digital authentication information and the biometric authentication information to perform dual authentication on the digital authentication information and the biometric information, thereby After the two-factor authentication is passed, it can be determined that the biometric information and the digital authentication information are all from the same user, thereby ensuring the legitimacy of the user.
  • the second device may send the foregoing data to be authenticated to the first device after the communication connection is established.
  • a switch may be set on the second device, and the user opens the switch. After the switch, the second device starts to broadcast the data to be authenticated.
  • the first device receives the data to be authenticated broadcasted by the second device, or the second device can actively detect whether The first device establishes a communication connection, and if yes, actively sends the data to be authenticated to the first device.
  • the process can be simplified and the certification speed can be improved.
  • the second device may also send the data to be authenticated after receiving the request of the first device.
  • the first device may send an authentication request to the second device after establishing a communication connection with the second device, and after receiving the authentication request, the second device sends the authentication request to the second device.
  • the data to be authenticated may be sent to the second device.
  • the first device may send the transaction information to the second device in the authentication request, and after receiving the authentication request, the second device sends the data to be authenticated to the first device in response to the authentication request, where After receiving the transaction information, the second device may extract the key information and display the key information, and after receiving the user confirmation, send the to-be-authentication request to the first device to ensure the security of the transaction.
  • the authentication request may further carry the to-be-calculated information determined by the first device, for example, a random number, etc., after receiving the authentication request, the second device may sign the to-be-calculated information, Encrypt or generate a dynamic password.
  • Step S106 the first device collects biometric information of the biological limb.
  • the biometric information includes at least one of the following: fingerprint information, iris information, face information, and vein information.
  • the first device collects biometric information of the biological limb when the biological limb in close contact with the second device approaches, for example, in a short period of time when the user's finger touches the touch component of the POS machine (eg, 3 Second), the touch component of the POS machine collects fingerprint information.
  • the touch component of the POS machine collects fingerprint information.
  • the face information is collected by the payment terminal.
  • the biological limb needs to be in contact with the first device to collect the biometric information
  • collecting The biometric information of the biological limb may include: collecting biometric information of the contact portion of the biological limb with the first device in the case where the biological limb is in contact with the first device.
  • the user's finger touches the fingerprint collection portion of the first device, or the user's wrist contacts the vein information collection portion of the first device.
  • the current authentication can be maintained by the user, thereby avoiding the inadvertent proximity of the first device and the second device. The situation that triggers the authentication process.
  • Step S108 The first device sends the data to be authenticated and the biometric information to the background server.
  • Step S110 the background server receives the data to be authenticated and the biometric information.
  • Step S112 The background server acquires the pre-stored authentication factor and biometric verification information corresponding to the identity identifier.
  • the background server is pre-identified according to the identity (which may be the second device, or the user of the second device, or may be a security device connected to the second device (for example, KEY, dynamic port token, etc.) Storing the user's authentication factor and biometric authentication information, for example, when the second device or the second device is connected to the security device, or when the second device or the second device is connected to the user,
  • the identity which may be the second device, or the user of the second device, or may be a security device connected to the second device (for example, KEY, dynamic port token, etc.)
  • Storing the user's authentication factor and biometric authentication information for example, when the second device or the second device is connected to the security device, or when the second device or the second device is connected to the user.
  • Step S114 The background server authenticates the digital authentication information according to the authentication factor, and determines whether the matching rate of the biometric information and the biometric verification information is greater than a first preset value.
  • the background server obtains the authentication factor and the biometric verification information according to the authentication identifier information, and uses the authentication factor and the biometric verification information to authenticate the digital authentication information and the biometric information.
  • the authentication factor and the biometric verification information are uniquely associated with the authentication identification information. Therefore, the authentication factor and the biometric verification information corresponding to the user can be uniquely queried according to the authentication identification information, so as to use the digital authentication information and the biometric information to pass the dual authentication. , can guarantee the legitimacy of the user.
  • the manner in which the background server authenticates the digital authentication information by using the authentication factor is related to the specific form according to the digital authentication information.
  • the digital authentication information is a signature private key (which may be a private key of the second device, or may be a private key of a security device (eg, KEY) connected to the second device)
  • the signature information obtained by signing the signature data is obtained.
  • the authentication factor is the signature public key corresponding to the signature private key.
  • the signature data is calculated by using the signature public key, and the verification value is obtained, and the verification value is compared with the received signature information. If the agreement is the same, the authentication is passed. Otherwise, the authentication fails.
  • the authentication factor is a symmetric key.
  • the digital authentication information is authenticated, the symmetric information is used to encrypt the encrypted information, and the encrypted information is obtained.
  • the encrypted authentication information is compared with the received encrypted information. If the authentication is consistent, the authentication is passed, otherwise the authentication fails; or the received encrypted information may be decrypted by using the symmetric key, and the decrypted plaintext information is to be encrypted.
  • the information is compared. If they are consistent, the authentication is passed, otherwise the authentication fails.
  • the digital authentication information is a dynamic password
  • the authentication factor is a seed key for verifying the dynamic password. When authenticating the digital authentication information, the seed key is used to generate a dynamic password, and the generated dynamic password is received and received. Dynamic passwords are compared. If they are consistent, the authentication is passed. Otherwise, the authentication fails.
  • the first preset value of the matching rate between the biometric information and the biometric verification information is compared with the matching ratio used to measure whether the two biometric information is the same biometric information in the actual application (ie, the second pre- Set value). For example, suppose that in actual application, when the matching rate of two fingerprint information reaches 99% (that is, the ratio of the two fingerprint information is the same), the two fingerprint information is considered to be the fingerprint information of the same fingerprint (ie, the second preset value). 99%), otherwise, the two fingerprint information is not the fingerprint information of the same fingerprint, and the first preset value in this embodiment may be 80%, that is, the biometric information received in the present embodiment is judged Whether the matching rate of biometric authentication information reaches 80% instead of 99%.
  • step S116 in the case that the digital authentication information is authenticated, and the matching rate between the biometric information and the biometric authentication information is greater than a preset value, the identity authentication of the second device is determined to pass.
  • the background server may further return the authentication result to the first device.
  • the background server may perform subsequent operations after the identity authentication of the second device is passed, for example, granting the second device authorization, opening the access control, etc., or performing the payment process in the payment process, specifically the implementation.
  • the example is not limited.
  • biometric information authentication technology there is a probability that a real and legitimate user is recognized to be failed and an illegal user is recognized successfully.
  • fingerprint recognition as an example, in many cases, the user's fingerprint is real, but the background system is Identifying the error, mistakenly identifying the user's fingerprint as a fake fingerprint, and thus failing to pass the authentication, unable to implement the payment transaction; sometimes, the fingerprint of the illegal user is false, but the background is also authenticated, causing the legitimate user Economic losses, the probability of these occurrences is very high.
  • the double authentication of the digital authentication information and the biometric information can circumvent the situation that the “illegal user is successfully identified”, and can reduce the situation in which the real legitimate user is identified as failed.
  • the background can reduce the similarity of the matching of the two biometric information to reduce the probability that the real legitimate user is recognized, for example, in theory
  • the two biometric information should be matched exactly, and the similarity should be at least 99% (the second preset value). If the background finds that the similarity is only 90%, it will be identified as mismatch and the authentication will not pass.
  • the similarity of the perfect match can be reduced to 80% (the first preset value), that is, Say, as long as the similarity reaches 80% (the first preset value), it is considered to be a match. Therefore, when the similarity of the two biometric information is 90%, Certified, thus, would not be a real legitimate user is identified case of failure, and thereby reducing the probability of biometric authentication technology information in real legitimate user is identified failures.
  • the dual authentication of the digital authentication information and the biometric information by the background server can reduce the probability that the real and legitimate users are recognized and fail, and improve the user experience.
  • This embodiment provides an identity authentication system, which can be used to implement the method of Embodiment 1.
  • FIG. 2 is a schematic structural diagram of an identity authentication system according to the embodiment. As shown in FIG. 2, the system mainly includes: a first device 100 and a background server 200.
  • the first device 100 is configured to: establish a communication connection with the second device, and receive, by the communication connection, data to be authenticated transmitted by the second device, where the data to be authenticated includes: digital authentication information and an identity identifier;
  • the biological limb enters the preset range of the first device 100, and collects the biometric information of the biological limb; the first device 100 sends the data to be authenticated and the biometric information to the background server 200;
  • the background server 200 is configured to: receive data to be authenticated and biometric information; obtain pre-stored authentication factors and biometrics verification information corresponding to the identity identifier; authenticate the digital authentication information according to the authentication factor, and determine the health Whether the matching rate between the feature information and the biometric verification information is greater than the first preset value; in the case that the digital authentication information is authenticated, and the matching rate between the biometric information and the biometric verification information is greater than the first preset value And determining that the identity authentication of the second device is passed, where the first preset value is smaller than the second preset value, where the second preset value is that the two biometric information is the same biometric information. Match rate.
  • the first device 100 may establish a communication connection with the second device by using the biological limb.
  • the first device 100 may be a POS terminal, an Alipay application, or the like, and a mobile terminal.
  • PDA, desktop, notebook, access control, etc. the second device can be implanted in the human body or worn on the human body.
  • the device implanted in the human body can be, for example, a blood flow sensor, a pulse sensor, and a body temperature implanted in the human body.
  • the sensor or the like, the device worn on the human body can be, for example, a wristband, a wristwatch, a necklace, a ring, a waistband, or the like, which can be worn on the user.
  • the first device 100 establishes a communication connection with the first device 100 through the biological limb.
  • the first device 100 may detect that the distance from the second device is within a preset range.
  • a communication connection is established with the second device through the biological limb. For example, it is detected that the finger of the human body wearing the wristband touches the first device 100, thereby establishing a communication connection with the wristband through the human body.
  • the second device can be worn on the user's body or placed in the user's body, or loaded in the clothing or accessories worn by the user, thereby being communicatively coupled to the second device, for example, on the user's wrist.
  • the user can approach the first device 100 through his own limb (such as an arm or a face) (ie, The verification device), when the limb approaches the first device 100 by a certain distance (for example, a few millimeters), the first device 100 establishes a communication connection with the second device through the limb of the user. Since the human body communication has a certain range, for example, 3 to 5 meters, the human body communication connection can be established only when the human body enters the preset range of the first device 100.
  • the first device 100 can establish a communication connection with the second device by using the biological device, and can be wired and wireless.
  • the first device 100 and the second device can pass at least the following two. One way to achieve:
  • the first device 100 and the second device are each provided with an electrode, and the first device 100 is in contact with a biological limb (human body) implanted in the human body or the second device worn on the human body (for example, a user wearing the wristwatch has a finger
  • a biological limb human body
  • the human body is used as a conductor, and the electrodes of both sides are connected to form a passage in the human body, that is, a so-called wired communication connection.
  • the first device 100 needs to be in contact with a human body wearing the second device.
  • the first device 100 and the second device can detect whether the surrounding electric field changes, and if the other party enters the range allowed by the human body communication, the field strength can be detected to be changed. Establish a communication connection with the other party.
  • the second device is worn or built in the human body, and the oscillation of the transmitter of the second device causes the body to generate an electric field, and when the distance between the second device and the first device 100 is in a human body communication permitting Within the scope
  • the receiver of the first device 100 detects a change in the electric field and establishes a communication connection with the second device. In this manner, the first device 100 does not need to be in contact with a human body wearing the second device.
  • the human body is used as a transmission medium of an electrical signal to realize information interaction between the body surface, the body, and the device around the human body (3 to 5 meters).
  • traditional wireless communication technologies such as Bluetooth, WIFI, radio frequency and infrared
  • the signal is transmitted through the human body during human communication, so electromagnetic noise has little influence on it, and has low power consumption, high confidentiality and lower human damage. advantage.
  • the redundant connection problem of the wired communication method can be eliminated.
  • the identity identifier may be a device identifier of the second device, a user ID, and the like, which may uniquely identify the identity of the user, and the identity identifier may be uniquely associated with the second user for authenticating the digital authentication.
  • the authentication factor of the information and the biometric verification information are used to double-authenge the digital authentication information and the biometric information, thereby, after the two-factor authentication is passed, it can be determined that the biometric information and the digital authentication information are all from the same user, and the user is guaranteed legality.
  • the second device may send the foregoing to-be-authenticated data to the first device 100 after the communication connection is established.
  • the first device 100 passes the following.
  • the mode receives the data to be authenticated transmitted by the second device: the first device 100 receives the data to be authenticated broadcast by the second device by using the communication connection.
  • a switch can be set on the second device. After the user turns on the switch, the second device starts to broadcast the data to be authenticated. After the first device 100 establishes a communication connection with the second device, the first device 100 receives the second device.
  • the broadcasted data to be authenticated, or the second device may also actively detect whether to establish a communication connection with the first device 100, and if yes, actively send the data to be authenticated to the first device 100.
  • the process can be simplified and the certification speed can be improved.
  • the second device may also send the data to be authenticated after receiving the request of the first device 100.
  • the first device 100 receives the data to be authenticated transmitted by the second device by: the first device 100 sends an authentication request to the second device by using the communication connection, and the second device responds to the authentication request by using the communication connection.
  • the data to be authenticated sent For example, in the payment process, the first device 100 may carry the transaction information in the authentication request and send it to the second device. After receiving the authentication request, the second device sends the data to be authenticated to the first device 100 in response to the authentication request.
  • the second device may extract the key information from the transaction information after receiving the transaction information, and display the key information, and send the to-be-authentication request to the first device 100 after receiving the user confirmation to ensure the security of the transaction.
  • the authentication request may further carry the information to be calculated determined by the first device 100, for example, a random number, etc., after receiving the authentication request, the second device may sign the to-be-calculated information. , encrypt or generate a dynamic password.
  • the biometric information includes at least one of the following: fingerprint information, iris information, face information, and vein information.
  • the first device 100 collects biometric information of the biological limb when the biological limb in close contact with the second device approaches, for example, in a short period of time when the user's finger touches the touch component of the POS machine (eg, 3 seconds), the touch component of the POS machine collects fingerprint information during the touch time.
  • the touch component of the POS machine collects fingerprint information during the touch time.
  • the user's wristwatch and the Alipay payment terminal the payment terminal has a photographing function, which can be used to collect face information
  • the face is collected through the payment terminal. information.
  • the biometric information includes: fingerprint information and/or vein information; in the optional embodiment, the first device 100 collects biometric information of the biological limb by: In the case where the biological limb is in contact with the first device 100, biometric information of the contact portion of the biological limb with the first device 100 is acquired. For example, the user's finger contacts the fingerprint collection portion of the first device 100, or the user's wrist contacts the vein information collection portion of the first device 100. With this optional implementation, since the user's limb needs to be in contact with the first device 100 to collect the biometric information, the current authentication can be maintained by the user, thereby avoiding the inadvertent situation between the first device 100 and the second device. Approaching and triggering the certification process.
  • the background server 200 is pre-identified according to the identity (which may be the second device, or the user of the second device, or may be a security device connected to the second device (for example, a KEY, a dynamic port token) And storing the user's authentication factor and biometric authentication information, for example, when the second device or the second device is connected to the security device, or when the second device or the second device is connected to the user.
  • the identity which may be the second device, or the user of the second device, or may be a security device connected to the second device (for example, a KEY, a dynamic port token)
  • biometric authentication information for example, when the second device or the second device is connected to the security device, or when the second device or the second device is connected to the user.
  • the background server 200 acquires the authentication factor and the biometrics verification information according to the authentication identification information, and uses the authentication factor and the biometric verification information to authenticate the digital authentication information and the biometric information.
  • the authentication factor and the biometric verification information are uniquely associated with the authentication identification information. Therefore, the authentication factor and the biometric verification information corresponding to the user can be uniquely queried according to the authentication identification information, so as to use the digital authentication information and the biometric information to pass the dual authentication. , can guarantee the legitimacy of the user.
  • the digital authentication information includes: signature information obtained by digitally signing the signature data using the signature private key; the authentication factor includes: a signature public key corresponding to the signature private key; and the background server 200 passes The digital authentication information is authenticated in the following manner: the background server 200 performs verification on the digital authentication information by using the signature public key and the data to be signed; that is, when authenticating the digital authentication information, the background server 200 uses the signature public key to calculate the signature data, and obtains The verification value is compared with the received signature information. If they are consistent, the authentication is passed; otherwise, the authentication fails.
  • the digital authentication information includes: encrypted information obtained by encrypting the encrypted information by using a symmetric key; the authentication factor includes: a symmetric key; and the background server 200 performs digital authentication by:
  • the information is authenticated: the background server 200 authenticates the encrypted information by using the symmetric key and the information to be encrypted; that is, the background server 200 encrypts the encrypted information using the symmetric key when authenticating the digital authentication information, and encrypts the encrypted authentication.
  • the information is compared with the received encrypted information. If the information is consistent, the authentication is passed, otherwise the authentication fails; or the received encrypted information may be decrypted by using the symmetric key, and the decrypted plaintext information and the information to be encrypted are performed. Comparison, if they are consistent, the certification is passed, otherwise the certification will not pass.
  • the digital authentication information includes: a dynamic password; the authentication factor includes: a seed key for verifying the dynamic password; and the background server 200 authenticates the digital authentication information by: The server 200 authenticates the dynamic password using at least the seed key. That is, when the background server 200 authenticates the digital authentication information, the background key is used to generate a dynamic password, and the generated dynamic password and the received dynamic password are entered. If the line is consistent, the authentication is passed. Otherwise, the authentication fails.
  • the first preset value of the matching rate between the biometric information and the biometric verification information is compared with the matching ratio used to measure whether the two biometric information is the same biometric information in the actual application (ie, the second pre- Set value). For example, suppose that in actual application, when the matching rate of two fingerprint information reaches 99% (that is, the ratio of the two fingerprint information is the same), the two fingerprint information is considered to be the fingerprint information of the same fingerprint (ie, the second preset value). 99%), otherwise, the two fingerprint information is not the fingerprint information of the same fingerprint, and the first preset value in this embodiment may be 80%, that is, the biometric information received in the present embodiment is judged Whether the matching rate of biometric authentication information reaches 80% instead of 99%.
  • biometric information authentication technology there is a probability that a real and legitimate user is recognized to be failed and an illegal user is recognized successfully.
  • fingerprint recognition as an example, in many cases, the user's fingerprint is real, but the background system is Identifying the error, mistakenly identifying the user's fingerprint as a fake fingerprint, and thus failing to pass the authentication, unable to implement the payment transaction; sometimes, the fingerprint of the illegal user is false, but the background is also authenticated, causing the legitimate user Economic losses, the probability of these occurrences is very high.
  • the double authentication of the digital authentication information and the biometric information can circumvent the situation that the “illegal user is successfully identified”, and can reduce the situation in which the real legitimate user is identified as failed.
  • the background can reduce the similarity of the matching of the two biometric information to reduce the probability that the real legitimate user is recognized, for example, two theoretically The biometric information needs to be completely matched, and its similarity should be at least 99% (the second preset value). If the background finds that its similarity is only 90%, it will be identified as a mismatch, and the authentication will not pass.
  • the similarity of the perfect match can be reduced to 80% (the first preset value), that is, As long as the similarity reaches 80% (the first preset value), it is considered to be a match, so when the similarity of the two biometric information is 90%, it is also possible to pass Authentication, whereby the user who is not genuine and legitimate is identified as having failed, thereby reducing the probability that the authentic and legitimate user in the biometric information authentication technology is recognized.
  • the dual authentication of the digital authentication information and the biometric information by the background server 200 can reduce the probability that the real and legitimate users are recognized and fail, and improve the user experience.
  • Embodiments of the present invention provide a computer program that, when run on a processor, performs the identity authentication method described above.
  • modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment.
  • the modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components.
  • all combinations of the features disclosed in the specification, as well as any methods or devices disclosed herein may be employed in any combination, unless otherwise It is expressly stated that each feature disclosed in this specification can be replaced by an alternative feature that provides the same, equivalent or similar purpose.
  • the various component embodiments of the present invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Theoretical Computer Science (AREA)
  • Computing Systems (AREA)
  • General Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Health & Medical Sciences (AREA)
  • Biomedical Technology (AREA)
  • Health & Medical Sciences (AREA)
  • Power Engineering (AREA)
  • Measurement Of The Respiration, Hearing Ability, Form, And Blood Characteristics Of Living Organisms (AREA)
  • Collating Specific Patterns (AREA)
  • Telephonic Communication Services (AREA)

Abstract

一种身份认证方法及系统。该方法包括：第一设备与第二设备建立通信连接（S102）；第一设备通过通信连接接收第二设备传输的待认证数据（S104）；第一设备采集生物肢体的生物特征信息（S106）；第一设备将待认证数据和生物特征信息发送给后台服务器（S108）；后台服务器接收待认证数据和生物特征信息（S110）；后台服务器获取预先存储的与身份标识对应的认证因子和生物特征验证信息（S112）；后台服务器根据认证因子对数字认证信息进行认证，判断生物特征信息与生物特征验证信息的匹配率是否大于第一预设值（S114）；在对数字认证信息认证通过且生物特征信息与生物特征验证信息的匹配率大于第一预设值的情况下，确定对第二设备的身份认证通过（S116）。

Description

一种身份认证方法及系统
相关申请的交叉引用
本申请基于申请号为201610127887.X，申请日为2016年3月7日的中国专利申请，并要求上述中国专利申请的优先权，上述中国专利申请的全部内容在此引入本申请作为参考。
技术领域
本发明涉及一种电子技术领域，尤其涉及一种身份认证方法及系统。
背景技术
在用户使用电子设备获取某些特定场所(例如，办公区域、保密区域等)、个人物品(汽车、保险柜等)、危险物品(如枪支弹药等)等的授权时，电子设备与设置在这些场所、个人物品或危险物品上的电子系统建立通信连接，然后将存储的密钥发送给电子系统，电子系统对密钥进行认证。由此可见，现有技术中的这种授权方式，其它人可以使用别人的电子设备进而获得授权，进而执行非法操作，造成用户的财产、信息等损失。
另外，在现有技术中，由于不同的人某些生物特征相同的概率非常小，例如，指纹，因此，生物特征通常被用着用户的密码。在这种应用中，为了保护用户的安全，在验证生物特征信息时，将匹配率设置得比较高，以避免用户的账户被非法使用，但这种情况下，由于用户的生物特征在不同状态下采集出来的信息可能会有细微差别，例如，用户的指纹在指头干燥和湿润的情况下，同一指纹采集得到的指纹数据很可能不相同，从而可能出现即使是同一用户，在需要输入密码时，将真实的指纹认为是假指纹，从而拒绝用户的请求，需要用户再次输入，有的情况下，可能会导致用户需要无数次的输入，即真实合法的用户被识别失败的概率很高，降低了用户体验，在相关技术中，解决该问题的技术方案主要是优化指纹匹配算法，但这些方案的前提是采集的指纹数据完整、准确，对于采集的指纹数据与存储是采集的指纹数据不同情况，并不能起到很好的效果。
发明内容
本发明旨在解决上述问题之一。
本发明的主要目的在于提供一种身份认证方法。
本发明的另一目的在于提供一种身份认证系统。
为达到上述目的，本发明的技术方案具体是这样实现的：
本发明一方面提供了一种身份认证方法，包括：第一设备与第二设备建立通信连接；第一设备通过通信连接接收第二设备传输的待认证数据，其中，待认证数据包括：数字认证信息和身份标识；第一设备采集生物特征信息；第一设备将待认证数据和生物特征信息发送给 后台服务器；后台服务器接收待认证数据和生物特征信息；后台服务器获取预先存储的与身份标识对应的认证因子和生物特征验证信息；后台服务器根据认证因子对数字认证信息进行认证，以及判断生物特征信息与生物特征验证信息的匹配率是否大于第一预设值；在对数字认证信息认证通过的情况下，且生物特征信息与生物特征验证信息的匹配率大于第一预设值的情况下，确定对第二设备的身份认证通过。
可选地，生物特征信息包括：指纹信息和/或静脉信息；第一设备采集生物肢体的生物特征信息包括：在生物肢体与第一设备接触的情况下，采集生物肢体与第一设备的接触部位的生物特征信息。
可选地，第一设备通过通信连接接收第二设备传输的待认证数据，包括：第一设备通过通信连接接收第二设备广播的待认证数据；或者第一设备通过通信连接向第二设备发送认证请求；第一设备通过通信连接接收第二设备响应认证请求发送的待认证数据。
可选地，数字认证信息包括：使用签名私钥对待签名数据进行数字签名得到的签名信息；认证因子包括：签名私钥对应的签名公钥；后台服务器根据认证因子对数字认证信息进行认证，包括：后台服务器利用签名公钥和待签名数据对数字认证信息进行验签；或者数字认证信息包括：利用对称密钥对待加密信息进行加密得到的加密信息；认证因子包括：对称密钥；后台服务器根据认证因子对数字认证信息进行认证，包括：后台服务器利用对称密钥和待加密信息对加密信息进行认证；或者，数字认证信息包括：动态口令；认证因子包括：对动态口令进行验证的种子密钥；后台服务器根据认证因子对数字认证信息进行认证，包括：后台服务器至少利用种子密钥对动态口令进行认证。
可选地，第一预设值小于第二预设值，其中，第二预设值用于指示两个生物特征信息为同一个生物特征信息的匹配率。
可选地，第一设备与第二设备建立通信连接，包括：第一设备通过生物肢体与第二设备建立通信连接。
本发明另一方面提供了一种身份认证系统，包括：第一设备和后台服务器，其中，第一设备，用于：与第二设备建立通信连接；通过通信连接接收第二设备传输的待认证数据，其中，待认证数据包括：数字认证信息和身份标识；采集生物肢体的生物特征信息；第一设备将待认证数据和生物特征信息发送给后台服务器；后台服务器，用于：接收待认证数据和生物特征信息；获取预先存储的与身份标识对应的认证因子和生物特征验证信息；根据认证因子对数字认证信息进行认证，以及判断生物特征信息与生物特征验证信息的匹配率是否大于第一预设值，其中，所述第一预设值小于第二预设值，其中，所述第二预设值为指示两个生物特征信息为同一个生物特征信息的匹配率；在对数字认证信息认证通过的情况下，以及生物特征信息与生物特征验证信息的匹配率大于第一预设值的情况下，确定对第二设备的身份认证通过。
可选地，生物特征信息包括：指纹信息和/或静脉信息；第一设备通过以下方式采集生 物肢体的生物特征信息：在生物肢体与第一设备接触的情况下，采集生物肢体与第一设备的接触部位的生物特征信息。
可选地，第一设备通过以下方式接收第二设备传输的待认证数据：第一设备通过通信连接接收第二设备广播的待认证数据；或者，第一设备通过通信连接向第二设备发送认证请求，通过通信连接接收第二设备响应认证请求发送的待认证数据。
可选地，数字认证信息包括：使用签名私钥对待签名数据进行数字签名得到的签名信息；认证因子包括：签名私钥对应的签名公钥；后台服务器通过以下方式对数字认证信息进行认证：后台服务器利用签名公钥和待签名数据对数字认证信息进行验签；或者，数字认证信息包括：利用对称密钥对待加密信息进行加密得到的加密信息；认证因子包括：对称密钥；后台服务器通过以下方式对数字认证信息进行认证：后台服务器利用对称密钥和待加密信息对加密信息进行认证；或者，数字认证信息包括：动态口令；认证因子包括：对动态口令进行验证的种子密钥；后台服务器通过以下方式对数字认证信息进行认证：后台服务器至少利用种子密钥对动态口令进行认证。
可选地，第一设备通过以下方式与第二设备建立通信连接：第一设备通过生物肢体与第二设备建立通信连接。
由上述本发明提供的技术方案可以看出，本发明提供的身份认证方法中，通过后台服务器对数字认证信息和生物特征信息的双重认证，可以降低真实合法的用户被识别失败的概率，提高了用户体验。
根据下文结合附图对本发明具体实施例的详细描述，本领域技术人员将会更加明了本发明的上述以及其他目的、优点和特征。
附图说明
后文将参照附图以示例性而非限制性的方式详细描述本发明的一些具体实施例。附图中相同的附图标记标示了相同或类似的部件或部分。本领域技术人员应该理解，这些附图未必是按比例绘制的。附图中：
图1为本发明实施例1提供的身份认证方法的流程图；
图2为本发明实施例2提供的身份认证系统的架构示意图。
具体实施方式
实施例1
本实施例提供了一种身份认证方法。
图1是本实施例提供的身份认证方法的流程图，如图1所示，该方法主要包括以下步骤S102至步骤S116。
步骤S102，第一设备与第二设备建立通信连接。
在本实施例中，第一设备可以通过无线或有线的方式连接，例如，NFC、蓝牙等。
在本发明实施例的一个可选实施方案中，第一设备可以通过无线或有线的方式连接通过生物肢体与第二设备建立通信连接，即第一设备与第二设备通过人体通信(intra-body communication，IBC)建立通过链接，其中，生物肢体包括但不限于人体。例如，第一设备可以为POS机、支付宝应用等扫码终端、移动终端、PDA、台式机、笔记本、门禁等终端，第二设备可以为植入人体内或者佩戴在人体身上的装置，植入人体内的装置例如可以为植入人体内的血流传感器、脉搏传感器、体温传感器等传感器，佩戴在人体身上的装置例如可以是手环、腕表、项链、戒指、腰带等可穿戴在用户身上的电子设备。
在本发明实施例的一个可选实施方案中，第一设备通过生物肢体与第一设备建立通信连接可以是第一设备检测到距第二设备的距离在预设范围内的生物肢体与第一设备接触，通过该生物肢体与第二设备建立通信连接。例如，检测到戴有手环的人体的手指触摸到第一设备，从而通过人体与手环建立通信连接。
在本实施例中，第二设备可以穿戴用户的身体上或置入用户的体内上，或者装载在用户穿戴的衣物或配饰中，从而与第二设备通信连接，例如，戴在用户的手腕上，或者装在用户穿戴的衣服兜里，当用户需要登录网络、打开门禁、以及支付等需要进行身份认证的操作时，用户可以通过自己的肢体(例如手臂、脸)接近第一设备(即验证设备)，当肢体接近第一设备一定距离(例如，几毫米)时，第一设备通过用户的肢体与第二设备建立通信连接。由于人体通信有一定的范围，比如3～5米，只有在人体进入第一设备的这个预设范围内，才能建立人体通信连接。
作为本实施例中的一种可选实施方式，第一设备通过生物肢体与第二设备建立通信连接可以通过有线方式和无线方式，例如，第一设备与第二设备至少可以通过以下两种方式之一实现：
有线方式：
第一设备与第二设备均设有电极，在第一设备与植入人体内或者佩戴在人体身上的第二设备的生物肢体(人体)接触(例如，佩戴有腕表的用户将手指接触POS机)时，将人体作为导体，双方的电极连通形成人体内的通路，即所谓的有线方式的通信连接。在该方式中，第一设备需要与佩戴有第二设备的人体接触。
无线方式：
在无线方式中，第一设备和第二设备(如POS机和腕表)均可以检测周围的电场是否发生变化，如果对方进入人体通信允许的范围内，就能检测到场强发生变化，与对方建立通信连接。具体地，以第二设备为例，第二设备佩戴或内置在人体内，利用第二设备的发射器的振荡让人体产生电场，当第二设备与第一设备的距离处于人体通信允许的范围内时，第一设备的接收器检测到电场的变化，与第二设备建立通信连接。在该方式中，第一设备不需要与佩戴有第二设备的人体接触。
上述方式利用人体作为电信号的传输介质，实现体表、体内及人体周围(3～5米)的设备的信息交互。与传统的蓝牙、WIFI、射频和红外等无线通信技术相比，人体通信过程中信号经过人体传输，因而电磁噪声对其影响很小，具有低功耗、高保密性以及更低的人体损害等优点。此外由于不存在多人通信时效率降低的问题，也可免除有线通讯方式冗余的连线困扰。
步骤S104，第一设备通过通信连接接收第二设备传输的待认证数据，其中，待认证数据包括：数字认证信息和身份标识。
本实施例中，数字认证信息可以包括以下至少之一：签名信息、加密信息和动态口令。
电子签名信息可以利用签名私钥(可以是第二设备的签名私钥，也可以是与第二设备连接的安全设备(例如，KEY)的私钥)对待签名数据进行数字签名得到的签名信息，在对该签名信息进行认证时，获取与上述签名私钥对应的签名公钥，利用该签名公钥对电子签名信息进行验签，如果验签通过，则认证通过。其中，待签名数据可以是上述的身份标识，也可以是第二设备或与第二设备连接的安全设备产生的随机数，在这种情况下，待认证数据中还可以包括第二设备产生的随机数，另外，待签名数据还可以为第一设备产生的随机数，在这种情况下，第一设备可以在与第二设备建立通信连接后，先向第二设备发送一个验证请求，该请求中携带第一设备产生的随机数，第二设备接收到该随机数后，再利用签名私钥对该随机数进行签名，得到上述签名信息，采用随机数作为待签名数据，可以预防重放攻击。在该可选实施方式中，数字认证信息为签名信息，从而使得在认证时可以确保第二设备的用户的身份。
加密信息可以为第二设备利用与第一设备协商的对称密钥对待加密数据计算得到的MAC值，在对该加密信息进行认证时，同样利用该对称密钥对待加密数据计算得到验证MAC值，比较密文信息与验证MAC值，如果一致，则认证通过；或者，加密信息也可以为第二设备利用与第一设备协商的对称密钥对待加密数据得到的密文数据，在对该加密信息进行认证时，利用该对称密钥对密文数据进行解密，比较解密得到的信息与待加密数据是否一致，如果一致，则认证通过。
动态口令可以为基于种子密钥生成的动态口令，在对该动态口令进行认证时，同样利用该种子密钥计算得到验证值，比较动态口令与验证值，如果一致，则认证通过，其中，动态口令可以是基于时间的，也可以是基于事件，还可以为动态挑战码，具体本实施例不作限定。
在本实施例中，可以通过上述任一种实现对数字认证信息的认证，以保证第二设备的合法性。
在上述实施方式中，第二设备可以自己计算上述数字认证信息，也可以与另一设备(例如，具有签名功能、加密功能、或动态口令功能的电子设备)进行交互以得到上述数据认证信息，具体本实施例不作限定。
在本实施例一种可选的实施方式中，身份标识可以为第二设备的设备标识、用户ID等 可以唯一标识用户身份的信息，通过身份标识可以唯一关联到第二用户用于认证数字认证信息的认证因子以及生物特征验证信息，以便对数字认证信息以及生物特征信息进行双重认证，由此，在双重认证通过后就可以确定生物特征信息以及数字认证信息都来自于同一用户，保证用户的合法性。
在本实施例的一种可选实施方式中，第二设备可以在通信连接建立后，主动向第一设备发送上述的待认证数据，例如，可以在第二设备上设置一个开关，用户打开该开关之后，第二设备开始广播上述待认证数据，在第一设备与第二设备建立通信连接后，第一设备接收第二设备广播的待认证数据，或者，第二设备也可以主动检测是否与第一设备建立通信连接，如果是，则主动向第一设备发送上述待认证数据。采用这种实施方式，可以简化流程，提高认证速度。
在本发明实施例的另一个可选实施方式中，第二设备也可以是在接收到第一设备的请求后，发送上述待认证数据。在该可选实施方式中，第一设备可以在与第二设备建立通信连接之后，向第二设备发送认证请求，第二设备接收到该认证请求后，响应该认证请求，向第二设备发送该待认证数据。例如，在支付过程中，第一设备可以将交易信息携带在认证请求中发送给第二设备，第二设备接收到该认证请求后，响应该认证请求，向第一设备发送待认证数据，其中，第二设备可以在接收到交易信息后，从中提取关键信息，并显示该关键信息，在接收到用户确认之后，才向第一设备发送待认证请求，以保证交易的安全。另外，在该可选实施方式中，认证请求中还可以携带第一设备确定的待计算信息，例如，随机数等，第二设备在接收该认证请求后，可以对该待计算信息进行签名、加密或生成动态口令。
步骤S106，第一设备采集生物肢体的生物特征信息。
其中，生物特征信息包括以下至少之一：指纹信息、虹膜信息、人脸信息和静脉信息。本实施例中，第一设备在与第二设备近距离接触的生物肢体接近时，采集该生物肢体的生物特征信息，例如，在用户手指触摸POS机的触摸部件的短暂的时间内(如3秒)，，POS机的触摸部件采集指纹信息。又例如，在用户的腕表与支付宝支付终端(该支付终端具有拍照功能，可以用于采集人脸信息)建立人体通信连接的期间，通过支付终端采集人脸信息。
在本步骤中，特别地，在生物特征信息包括：指纹信息和/或静脉信息的情况下，需要生物肢体与第一设备接触才能采集到生物特征信息，作为一种可选的实施方式，采集生物肢体的生物特征信息可以包括：在生物肢体与第一设备接触的情况下，采集生物肢体与第一设备的接触部位的生物特征信息。例如，用户的手指接触第一设备的指纹采集部，或用户的手腕接触第一设备的静脉信息采集部。通过该可选实施方式，由于用户的肢体需要与第一设备接触才能采集到生物特征信息，因此，可以保持本次认证是用户许可的，进而避免由于第一设备和第二设备不经意间接近而触发认证流程的情况。
步骤S108，第一设备将待认证数据和生物特征信息发送给后台服务器。
步骤S110，后台服务器接收待认证数据和生物特征信息。
步骤S112，后台服务器获取预先存储的与身份标识对应的认证因子和生物特征验证信息。
在本实施例中，后台服务器预先按照身份标识(可以是第二设备的，也可以是第二设备的用户的，还可以是与第二设备连接的安全设备(例如，KEY、动态口令牌等))存储该用户的认证因子和生物特征验证信息，例如，在第二设备或第二设备连接的安全设备注册时、或在将第二设备或第二设备连接的安全设备分配给用户时，具体本实施例不作限定。
步骤S114，后台服务器根据认证因子对数字认证信息进行认证，以及判断生物特征信息与生物特征验证信息的匹配率是否大于第一预设值。
本实施例中，后台服务器根据认证标识信息获取认证因子和生物特征验证信息，并利用认证因子和生物特征验证信息对数字认证信息以及生物特征信息进行认证的认证结果。该认证因子和生物特征验证信息与认证标识信息唯一关联，因此根据认证标识信息可以唯一查询到该用户对应的认证因子和生物特征验证信息，以便利用数字认证信息以及生物特征信息的双重认证通过后，可以保证用户的合法性。
本步骤中，后台服务器利用认证因子对数字认证信息的认证的方式与根据数字认证信息的具体形式相关。例如，如果数字认证信息为使用签名私钥(可以是第二设备的私钥，也可以是与第二设备连接的安全设备(例如，KEY)的私钥)对待签名数据进行签名得到的签名信息，则认证因子为签名私钥对应的签名公钥，在认证数字认证信息时，利用签名公钥对待签名数据进行计算，得到验签值，将该验签值与接收到的签名信息进行比对，如果一致，则认证通过，否则，认证不通过。如果数字认证信息为利用对称密钥对待加密信息进行加密得到的加密信息，则认证因子为对称密钥，在对数字认证信息进行认证时，使用对称密钥对待加密信息进行加密，将加密得到的加密验证信息与接收到的加密信息进行比较，如果一致，则认证通过，否则认证不通过；或者，也可以利用对称密钥对接收到的加密信息进行解密，将解密得到的明文信息与待加密信息进行比较，如果一致，则认证通过，否则认证不通过。在数字认证信息为动态口令的情况下，认证因子为对动态口令进行验证的种子密钥，在对数字认证信息进行认证时，使用种子密钥生成动态口令，将生成的动态口令与接收到的动态口令进行比较，如果一致，则认证通过，否则，认证不通过。
在本实施例中，衡量生物特征信息与生物特征验证信息的匹配率的第一预设值比实际应用中用于衡量两个生物特征信息是否为同一生物特征信息的匹配率(即第二预设值)。例如，假设在实际应用中，当两个指纹信息的匹配率达到99％(即两个指纹信息相同的比例)时，认为两个指纹信息为同一个指纹的指纹信息(即第二预设值为99％)，否则，认为两个指纹信息不是同一个指纹的指纹信息，而本实施例中的第一预设值可能为80％，即在本实施例中判断接收到的生物特征信息与生物特征验证信息的匹配率是否达到80％而不是99％。
步骤S116，在对数字认证信息认证通过的情况下，以及生物特征信息与生物特征验证信息的匹配率大于预设值的情况下，确定对第二设备的身份认证通过。
在本发明实施例的一个可选实施方案中，后台服务器还可以将认证结果返回给第一设备。另外，后台服务器也可以在对第二设备的身份认证通过后，执行后续的操作，例如，给予第二设备授权，打开门禁等，或者，在支付流程中，也可以执行支付流程，具体本实施例不作限定。
在现有技术的生物特征信息认证技术中存在真实合法的用户被识别失败的概率和非法的用户被识别成功的概率，以指纹识别为例，很多时候，用户的指纹是真实的，但是后台系统识别错误，误将该用户的指纹识别为假指纹，从而不能通过认证，无法实现支付交易；而有的时候，非法用户的指纹明明是假的，但后台也认证通过了，给合法用户造成了经济上的损失，这些情况发生的概率都是很高的。而本实施例通过对数字认证信息和生物特征信息的双重认证可以规避“非法的用户被识别成功”的情况，而且可以降低真实合法的用户被识别失败发生的情况。首先，通过上述3种对数字认证信息的认证，可以确定该用户为合法用户，如果是非法用户则无法通过该数字认证，那么就不会出现对假指纹认证的操作，从而规避了“非法的用户被识别成功”的情况；其次，在保证用户为合法用户的情况下，后台可以将两个生物特征信息匹配的相似度降低，以降低真实合法的用户被识别失败的概率，例如，理论上两个生物特征信息要完全匹配，其相似度至少要达到99％(第二预设值)，而如果后台发现其相似度仅为90％时，就会识别为不匹配，认证不通过，而出现将真的指纹识别为假指纹的情况，在本发明中，由于数字认证已经保证用户为合法用户，所以，可以将完全匹配的相似度降低为80％(第一预设值)，也就是说，只要相似度达到80％(第一预设值)就认为匹配，因此，当两个生物特征信息的相似度为90％时，也可以通过认证，由此，就不会真实合法的用户被识别失败的情况了，从而降低了生物特征信息认证技术中真实合法的用户被识别失败的概率。
通过本发明实施例提供的身份认证方法，通过后台服务器对数字认证信息和生物特征信息的双重认证，可以降低真实合法的用户被识别失败的概率，提高了用户体验。
实施例2
本实施例提供了一种身份认证系统，该系统可以用于实现实施例1的方法。
图2为本实施例提供的身份认证系统的架构示意图，如图2所示，该系统主要包括：第一设备100和后台服务器200。
在本实施例中，第一设备100，用于：与第二设备建立通信连接；通过通信连接接收第二设备传输的待认证数据，其中，待认证数据包括：数字认证信息和身份标识；在生物肢体进入第一设备100的预设范围内，采集生物肢体的生物特征信息；第一设备100将待认证数据和生物特征信息发送给后台服务器200；
后台服务器200，用于：接收待认证数据和生物特征信息；获取预先存储的与身份标识对应的认证因子和生物特征验证信息；根据认证因子对数字认证信息进行认证，以及判断生 物特征信息与生物特征验证信息的匹配率是否大于第一预设值；在对数字认证信息认证通过的情况下，以及生物特征信息与生物特征验证信息的匹配率大于第一预设值的情况下，确定对第二设备的身份认证通过，其中，所述第一预设值小于第二预设值，其中，所述第二预设值为指示两个生物特征信息为同一个生物特征信息的匹配率。
在本发明实施例的一个可选实施方案中，第一设备100可以通过生物肢体与第二设备建立通信连接，例如，第一设备100可以为POS机、支付宝应用等扫码终端、移动终端、PDA、台式机、笔记本、门禁等终端，第二设备可以为植入人体内或者佩戴在人体身上的装置，植入人体内的装置例如可以为植入人体内的血流传感器、脉搏传感器、体温传感器等传感器，佩戴在人体身上的装置例如可以是手环、腕表、项链、戒指、腰带等可穿戴在用户身上的电子设备。
在本发明实施例的一个可选实施方案中，第一设备100通过生物肢体与第一设备100建立通信连接可以是第一设备100检测到距第二设备的距离在预设范围内的生物肢体与第一设备100接触，通过该生物肢体与第二设备建立通信连接。例如，检测到戴有手环的人体的手指触摸到第一设备100，从而通过人体与手环建立通信连接。
在本实施例中，第二设备可以穿戴用户的身体上或置入用户的体内上，或者装载在用户穿戴的衣物或配饰中，从而与第二设备通信连接，例如，戴在用户的手腕上，或者装在用户穿戴的衣服兜里，当用户需要登录网络、打开门禁、以及支付等需要进行身份认证的操作时，用户可以通过自己的肢体(例如手臂、脸)接近第一设备100(即验证设备)，当肢体接近第一设备100一定距离(例如，几毫米)时，第一设备100通过用户的肢体与第二设备建立通信连接。由于人体通信有一定的范围，比如3～5米，只有在人体进入第一设备100的这个预设范围内，才能建立人体通信连接。
作为本实施例中的一种可选实施方式，第一设备100通过生物肢体与第二设备建立通信连接可以通过有线方式和无线方式，例如，第一设备100与第二设备至少可以通过以下两种方式之一实现：
有线方式：
第一设备100与第二设备均设有电极，在第一设备100与植入人体内或者佩戴在人体身上的第二设备的生物肢体(人体)接触(例如，佩戴有腕表的用户将手指接触POS机)时，将人体作为导体，双方的电极连通形成人体内的通路，即所谓的有线方式的通信连接。在该方式中，第一设备100需要与佩戴有第二设备的人体接触。
无线方式：
在无线方式中，第一设备100和第二设备(如POS机和腕表)均可以检测周围的电场是否发生变化，如果对方进入人体通信允许的范围内，就能检测到场强发生变化，与对方建立通信连接。具体地，以第二设备为例，第二设备佩戴或内置在人体内，利用第二设备的发射器的振荡让人体产生电场，当第二设备与第一设备100的距离处于人体通信允许的范围内 时，第一设备100的接收器检测到电场的变化，与第二设备建立通信连接。在该方式中，第一设备100不需要与佩戴有第二设备的人体接触。
上述方式利用人体作为电信号的传输介质，实现体表、体内及人体周围(3～5米)的设备的信息交互。与传统的蓝牙、WIFI、射频和红外等无线通信技术相比，人体通信过程中信号经过人体传输，因而电磁噪声对其影响很小，具有低功耗、高保密性以及更低的人体损害等优点。此外由于不存在多人通信时效率降低的问题，也可免除有线通讯方式冗余的连线困扰。
在本实施例一种可选的实施方式中，身份标识可以为第二设备的设备标识、用户ID等可以唯一标识用户身份的信息，通过身份标识可以唯一关联到第二用户用于认证数字认证信息的认证因子以及生物特征验证信息，以便对数字认证信息以及生物特征信息进行双重认证，由此，在双重认证通过后就可以确定生物特征信息以及数字认证信息都来自于同一用户，保证用户的合法性。
在本实施例的一种可选实施方式中，第二设备可以在通信连接建立后，主动向第一设备100发送上述的待认证数据，在该可选实施方式中，第一设备100通过以下方式接收第二设备传输的待认证数据：第一设备100通过通信连接接收第二设备广播的待认证数据。例如，可以在第二设备上设置一个开关，用户打开该开关之后，第二设备开始广播上述待认证数据，在第一设备100与第二设备建立通信连接后，第一设备100接收第二设备广播的待认证数据，或者，第二设备也可以主动检测是否与第一设备100建立通信连接，如果是，则主动向第一设备100发送上述待认证数据。采用这种实施方式，可以简化流程，提高认证速度。
在本发明实施例的另一个可选实施方式中，第二设备也可以是在接收到第一设备100的请求后，发送上述待认证数据。在该可选实施方式中，第一设备100通过以下方式接收第二设备传输的待认证数据：第一设备100通过通信连接向第二设备发送认证请求，通过通信连接接收第二设备响应认证请求发送的待认证数据。例如，在支付过程中，第一设备100可以将交易信息携带在认证请求中发送给第二设备，第二设备接收到该认证请求后，响应该认证请求，向第一设备100发送待认证数据，其中，第二设备可以在接收到交易信息后，从中提取关键信息，并显示该关键信息，在接收到用户确认之后，才向第一设备100发送待认证请求，以保证交易的安全。另外，在该可选实施方式中，认证请求中还可以携带第一设备100确定的待计算信息，例如，随机数等，第二设备在接收该认证请求后，可以对该待计算信息进行签名、加密或生成动态口令。
其中，生物特征信息包括以下至少之一：指纹信息、虹膜信息、人脸信息和静脉信息。本实施例中，第一设备100在与第二设备近距离接触的生物肢体接近时，采集该生物肢体的生物特征信息，例如，在用户手指触摸POS机的触摸部件的短暂的时间内(如3秒)，该触摸时间内，POS机的触摸部件采集指纹信息。又例如，在用户的腕表与支付宝支付终端(该支付终端具有拍照功能，可以用于采集人脸信息)接近一定距离时，通过支付终端采集人脸 信息。
在本发明实施例的一个可选实施方案中，生物特征信息包括：指纹信息和/或静脉信息；在该可选实施方案中，第一设备100通过以下方式采集生物肢体的生物特征信息：在生物肢体与第一设备100接触的情况下，采集生物肢体与第一设备100的接触部位的生物特征信息。例如，用户的手指接触第一设备100的指纹采集部，或用户的手腕接触第一设备100的静脉信息采集部。通过该可选实施方式，由于用户的肢体需要与第一设备100接触才能采集到生物特征信息，因此，可以保持本次认证是用户许可的，进而避免由于第一设备100和第二设备不经意间接近而触发认证流程的情况。
在本实施例中，后台服务器200预先按照身份标识(可以是第二设备的，也可以是第二设备的用户的，还可以是与第二设备连接的安全设备(例如，KEY、动态口令牌等))存储该用户的认证因子和生物特征验证信息，例如，在第二设备或第二设备连接的安全设备注册时、或在将第二设备或第二设备连接的安全设备分配给用户时，具体本实施例不作限定。
本实施例中，后台服务器200根据认证标识信息获取认证因子和生物特征验证信息，并利用认证因子和生物特征验证信息对数字认证信息以及生物特征信息进行认证的认证结果。该认证因子和生物特征验证信息与认证标识信息唯一关联，因此根据认证标识信息可以唯一查询到该用户对应的认证因子和生物特征验证信息，以便利用数字认证信息以及生物特征信息的双重认证通过后，可以保证用户的合法性。
在本发明实施例的一个可选实施方案中，数字认证信息包括：使用签名私钥对待签名数据进行数字签名得到的签名信息；认证因子包括：签名私钥对应的签名公钥；后台服务器200通过以下方式对数字认证信息进行认证：后台服务器200利用签名公钥和待签名数据对数字认证信息进行验签；即在认证数字认证信息时，后台服务器200利用签名公钥对待签名数据进行计算，得到验签值，将该验签值与接收到的签名信息进行比对，如果一致，则认证通过，否则，认证不通过。
在本发明实施例的另一个可选实施方案中，数字认证信息包括：利用对称密钥对待加密信息进行加密得到的加密信息；认证因子包括：对称密钥；后台服务器200通过以下方式对数字认证信息进行认证：后台服务器200利用对称密钥和待加密信息对加密信息进行认证；即后台服务器200在对数字认证信息进行认证时，使用对称密钥对待加密信息进行加密，将加密得到的加密验证信息与接收到的加密信息进行比较，如果一致，则认证通过，否则认证不通过；或者，也可以利用对称密钥对接收到的加密信息进行解密，将解密得到的明文信息与待加密信息进行比较，如果一致，则认证通过，否则认证不通过
在本发明实施例的又一个可选实施方案中，数字认证信息包括：动态口令；认证因子包括：对动态口令进行验证的种子密钥；后台服务器200通过以下方式对数字认证信息进行认证：后台服务器200至少利用种子密钥对动态口令进行认证。即后台服务器200在对数字认证信息进行认证时，使用种子密钥生成动态口令，将生成的动态口令与接收到的动态口令进 行比较，如果一致，则认证通过，否则，认证不通过。
在本实施例中，衡量生物特征信息与生物特征验证信息的匹配率的第一预设值比实际应用中用于衡量两个生物特征信息是否为同一生物特征信息的匹配率(即第二预设值)。例如，假设在实际应用中，当两个指纹信息的匹配率达到99％(即两个指纹信息相同的比例)时，认为两个指纹信息为同一个指纹的指纹信息(即第二预设值为99％)，否则，认为两个指纹信息不是同一个指纹的指纹信息，而本实施例中的第一预设值可能为80％，即在本实施例中判断接收到的生物特征信息与生物特征验证信息的匹配率是否达到80％而不是99％。
在现有技术的生物特征信息认证技术中存在真实合法的用户被识别失败的概率和非法的用户被识别成功的概率，以指纹识别为例，很多时候，用户的指纹是真实的，但是后台系统识别错误，误将该用户的指纹识别为假指纹，从而不能通过认证，无法实现支付交易；而有的时候，非法用户的指纹明明是假的，但后台也认证通过了，给合法用户造成了经济上的损失，这些情况发生的概率都是很高的。而本实施例通过对数字认证信息和生物特征信息的双重认证可以规避“非法的用户被识别成功”的情况，而且可以降低真实合法的用户被识别失败发生的情况。首先，通过上述对数字认证信息的认证，可以确定该用户为合法用户，如果是非法用户则无法通过该数字认证，那么就不会出现对假指纹认证的操作，从而规避了“非法的用户被识别成功”的情况；其次，在保证用户为合法用户的情况下，后台可以将两个生物特征信息匹配的相似度降低，以降低真实合法的用户被识别失败的概率，例如，理论上两个生物特征信息要完全匹配，其相似度至少要达到99％(第二预设值)，而如果后台发现其相似度仅为90％时，就会识别为不匹配，认证不通过，而出现将真的指纹识别为假指纹的情况，在本发明中，由于数字认证已经保证用户为合法用户，所以，可以将完全匹配的相似度降低为80％(第一预设值)，也就是说，只要相似度达到80％(第一预设值)就认为匹配，因此，当两个生物特征信息的相似度为90％时，也可以通过认证，由此，就不会真实合法的用户被识别失败的情况了，从而降低了生物特征信息认证技术中真实合法的用户被识别失败的概率。
通过本发明实施例提供的身份认证系统，通过后台服务器200对数字认证信息和生物特征信息的双重认证，可以降低真实合法的用户被识别失败的概率，提高了用户体验。
本发明的实施例提供了一种计算机程序，当其在处理器上运行时，执行上述的身份认证方法。
在此处所提供的说明书中，说明了大量具体细节。然而，能够理解，本发明的实施例可以在没有这些具体细节的情况下实践。在一些实例中，并未详细示出公知的方法、结构和技术，以便不模糊对本说明书的理解。
类似地，应当理解，为了精简本公开并帮助理解各个发明方面中的一个或多个，在上面对本发明的示例性实施例的描述中，本发明的各个特征有时被一起分组到单个实施例、图、或者对其的描述中。然而，并不应将该公开的方法解释成反映如下意图：即所要求保护的本 发明要求比在每个权利要求中所明确记载的特征更多的特征。更确切地说，如下面的权利要求书所反映的那样，发明方面在于少于前面公开的单个实施例的所有特征。因此，遵循具体实施方式的权利要求书由此明确地并入该具体实施方式，其中每个权利要求本身都作为本发明的单独实施例。
本领域那些技术人员可以理解，可以对实施例中的设备中的模块进行自适应性地改变并且把它们设置在与该实施例不同的一个或多个设备中。可以把实施例中的模块或单元或组件组合成一个模块或单元或组件，以及此外可以把它们分成多个子模块或子单元或子组件。除了这样的特征和/或过程或者单元中的至少一些是相互排斥之外，可以采用任何组合对本说明书(中公开的所有特征以及如此公开的任何方法或者设备的所有过程或单元进行组合。除非另外明确陈述，本说明书中公开的每个特征可以由提供相同、等同或相似目的的替代特征来代替。
本发明的各个部件实施例可以以硬件实现，或者以在一个或者多个处理器上运行的软件模块实现，或者以它们的组合实现。
至此，本领域技术人员应认识到，虽然本文已详尽示出和描述了本发明的多个示例性实施例，但是，在不脱离本发明精神和范围的情况下，仍可根据本发明公开的内容直接确定或推导出符合本发明原理的许多其他变型或修改。因此，本发明的范围应被理解和认定为覆盖了所有这些其他变型或修改。

Claims (11)

  1. 一种身份认证方法，其特征在于，包括：
    第一设备与所述第二设备建立通信连接；
    所述第一设备通过所述通信连接接收所述第二设备传输的待认证数据，其中，所述待认证数据包括：数字认证信息和身份标识；
    所述第一设备采集生物特征信息；
    所述第一设备将所述待认证数据和所述生物特征信息发送给后台服务器；
    所述后台服务器接收所述待认证数据和所述生物特征信息；
    所述后台服务器获取预先存储的与所述身份标识对应的认证因子和生物特征验证信息；
    所述后台服务器根据所述认证因子对所述数字认证信息进行认证，以及判断所述生物特征信息与所述生物特征验证信息的匹配率是否大于第一预设值，其中，所述第一预设值小于第二预设值，其中，所述第二预设值为指示两个生物特征信息为同一个生物特征信息的匹配率；
    在对所述数字认证信息认证通过的情况下，且所述生物特征信息与所述生物特征验证信息的匹配率大于所述第一预设值的情况下，确定对所述第二设备的身份认证通过。
  2. 根据权利要求1所述的方法，其特征在于，
    所述生物特征信息包括：指纹信息和/或静脉信息；
    所述第一设备采集所述生物肢体的生物特征信息包括：在生物肢体与所述第一设备接触的情况下，采集所述生物肢体与所述第一设备的接触部位的所述生物特征信息。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第一设备通过所述通信连接接收所述第二设备传输的待认证数据，包括：
    所述第一设备通过所述通信连接接收所述第二设备广播的所述待认证数据；或者
    所述第一设备通过所述通信连接向所述第二设备发送认证请求；所述第一设备通过所述通信连接接收所述第二设备响应所述认证请求发送的所述待认证数据。
  4. 根据权利要求1至3任一项所述的方法，其特征在于，
    所述数字认证信息包括：使用签名私钥对待签名数据进行数字签名得到的签名信息；所述认证因子包括：所述签名私钥对应的签名公钥；所述后台服务器根据所述认证因子对所述数字认证信息进行认证，包括：所述后台服务器利用所述签名公钥和所述待签名数据对所述数字认证信息进行验签；或者
    所述数字认证信息包括：利用对称密钥对待加密信息进行加密得到的加密信息；所述认 证因子包括：所述对称密钥；所述后台服务器根据所述认证因子对所述数字认证信息进行认证，包括：所述后台服务器利用所述对称密钥和所述待加密信息对所述加密信息进行认证；或者，
    所述数字认证信息包括：动态口令；所述认证因子包括：对所述动态口令进行验证的种子密钥；所述后台服务器根据所述认证因子对所述数字认证信息进行认证，包括：所述后台服务器至少利用所述种子密钥对所述动态口令进行认证。
  5. 根据权利要求1至4任一项所述的方法，其特征在于，第一设备与所述第二设备建立通信连接，包括：
    所述第一设备通过所述生物肢体与所述第二设备建立通信连接。
  6. 一种身份认证系统，其特征在于，包括：第一设备和后台服务器，其中，
    所述第一设备，用于：
    与第二设备建立通信连接；
    通过所述通信连接接收所述第二设备传输的待认证数据，其中，所述待认证数据包括：数字认证信息和身份标识；
    采集生物肢体的生物特征信息；
    所述第一设备将所述待认证数据和所述生物特征信息发送给所述后台服务器；
    所述后台服务器，用于：
    接收所述待认证数据和所述生物特征信息；
    获取预先存储的与所述身份标识对应的认证因子和生物特征验证信息；
    根据所述认证因子对所述数字认证信息进行认证，以及判断所述生物特征信息与所述生物特征验证信息的匹配率是否大于第一预设值，其中，所述第一预设值小于第二预设值，其中，所述第二预设值为指示两个生物特征信息为同一个生物特征信息的匹配率；
    在对所述数字认证信息认证通过的情况下，以及所述生物特征信息与所述生物特征验证信息的匹配率大于所述第一预设值的情况下，确定对所述第二设备的身份认证通过。
  7. 根据权利要求6所述的系统，其特征在于，
    所述生物特征信息包括：指纹信息和/或静脉信息；
    所述第一设备通过以下方式采集所述生物肢体的生物特征信息：在所述生物肢体与所述第一设备接触的情况下，采集所述生物肢体与所述第一设备的接触部位的所述生物特征信息。
  8. 根据权利要求6或7所述的系统，其特征在于，所述第一设备通过以下方式接收所 述第二设备传输的待认证数据：
    所述第一设备通过所述通信连接接收所述第二设备广播的所述待认证数据；或者，
    所述第一设备通过所述通信连接向所述第二设备发送认证请求，通过所述通信连接接收所述第二设备响应所述认证请求发送的所述待认证数据。
  9. 根据权利要求6至8任一项所述的系统，其特征在于，
    所述数字认证信息包括：使用签名私钥对待签名数据进行数字签名得到的签名信息；所述认证因子包括：所述签名私钥对应的签名公钥；所述后台服务器通过以下方式对所述数字认证信息进行认证：所述后台服务器利用所述签名公钥和所述待签名数据对所述数字认证信息进行验签；或者，
    所述数字认证信息包括：利用对称密钥对待加密信息进行加密得到的加密信息；所述认证因子包括：所述对称密钥；所述后台服务器通过以下方式对所述数字认证信息进行认证：所述后台服务器利用所述对称密钥和所述待加密信息对所述加密信息进行认证；或者，
    所述数字认证信息包括：动态口令；所述认证因子包括：对所述动态口令进行验证的种子密钥；所述后台服务器通过以下方式对所述数字认证信息进行认证：所述后台服务器至少利用所述种子密钥对所述动态口令进行认证。
  10. 根据权利要求6至9任一项所述的系统，其特征在于，第一设备通过以下方式与所述第二设备建立通信连接：
    所述第一设备通过所述生物肢体与所述第二设备建立通信连接。
  11. 一种计算机程序，当其在处理器上运行时，执行如权利要求1-5中任一项所述的身份认证方法方法。
PCT/CN2017/075725 2016-03-07 2017-03-06 一种身份认证方法及系统 WO2017152815A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
SG11201807605UA SG11201807605UA (en) 2016-03-07 2017-03-06 Identity authentication method and system
EP17762501.9A EP3428818B1 (en) 2016-03-07 2017-03-06 Identity authentication method and system
US16/083,273 US20200167450A1 (en) 2016-03-07 2017-03-06 Identity authentication method and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610127887.XA CN105938526A (zh) 2016-03-07 2016-03-07 一种身份认证方法及系统
CN201610127887.X 2016-03-07

Publications (1)

Publication Number Publication Date
WO2017152815A1 true WO2017152815A1 (zh) 2017-09-14

Family

ID=57151907

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/075725 WO2017152815A1 (zh) 2016-03-07 2017-03-06 一种身份认证方法及系统

Country Status (5)

Country Link
US (1) US20200167450A1 (zh)
EP (1) EP3428818B1 (zh)
CN (1) CN105938526A (zh)
SG (1) SG11201807605UA (zh)
WO (1) WO2017152815A1 (zh)

Families Citing this family (30)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105938526A (zh) * 2016-03-07 2016-09-14 李明 一种身份认证方法及系统
CN106418757B (zh) * 2016-09-29 2018-06-12 华中科技大学 一种ecg身份验证智慧衣
CN107967417A (zh) * 2016-10-19 2018-04-27 宏碁股份有限公司 动态验证方法及相关电脑系统
CN106656983A (zh) * 2016-10-28 2017-05-10 李国兴 商务账户网络系统用户身份认证方法及装置与系统
CN106850201B (zh) * 2017-02-15 2019-11-08 济南晟安信息技术有限公司 智能终端多因子认证方法、智能终端、认证服务器及系统
CN107391983B (zh) * 2017-03-31 2020-10-16 创新先进技术有限公司 一种基于物联网的信息处理方法及装置
WO2018218541A1 (zh) * 2017-05-31 2018-12-06 华为技术有限公司 一种连接建立方法及设备
CN107872451B (zh) * 2017-09-30 2022-03-01 深圳壹账通智能科技有限公司 用户身份验证方法及身份验证装置
JP7020901B2 (ja) * 2017-12-21 2022-02-16 トヨタ自動車株式会社 認証システムおよび認証装置
CN108921563A (zh) * 2018-06-01 2018-11-30 珠海格力电器股份有限公司 一种基于人体通信的安全验证方法及设备
TWI687838B (zh) * 2018-12-10 2020-03-11 宏碁股份有限公司 檔案保護方法及其檔案處理系統
CN109919597B (zh) * 2019-02-01 2022-03-15 Oppo广东移动通信有限公司 支付信息处理方法、装置、移动终端及系统
CN109886670B (zh) * 2019-02-01 2022-04-19 Oppo广东移动通信有限公司 支付方法、装置、系统、移动终端、支付机具及服务器
CN109934976A (zh) * 2019-02-01 2019-06-25 Oppo广东移动通信有限公司 门禁管理方法、装置、系统、电子设备及存储介质
CN110535649B (zh) * 2019-04-15 2020-11-03 清华大学 数据流通方法、系统及服务平台、第一终端设备
US11151542B2 (en) * 2019-05-07 2021-10-19 Paypal, Inc. Wearable payment device
US11113383B2 (en) * 2019-07-17 2021-09-07 Lenovo (Singapore) Pte. Ltd. Permitting login with password having dynamic character(s)
CN110457882B (zh) * 2019-07-18 2020-10-30 创新先进技术有限公司 一种身份识别预处理、身份识别方法及系统
CN112578763B (zh) * 2019-09-30 2023-01-17 北京国双科技有限公司 安全授权方法、故障诊断方法、系统及相关产品
CN111259346A (zh) * 2020-01-09 2020-06-09 深圳市东深电子股份有限公司 一种水利rtu的信息验证方法
CN111292484A (zh) * 2020-01-15 2020-06-16 深圳耀宇信息技术有限公司 一种基于安卓的智能POS机防止root及应用权限管控的方法
CN111444491B (zh) * 2020-04-20 2021-09-14 维沃移动通信（杭州）有限公司 一种信息处理方法和电子设备
CN113660670B (zh) * 2020-05-12 2024-02-06 哈尔滨工程大学 基于射频指纹的无线设备身份认证方法及其装置
CN113672890A (zh) * 2020-05-15 2021-11-19 中移(上海)信息通信科技有限公司 身份认证方法、装置、电子设备及计算机存储介质
CN112287319A (zh) * 2020-11-02 2021-01-29 刘高峰 一种基于生物特征的身份验证方法、客户端、服务端及系统
CN112509204A (zh) * 2020-11-20 2021-03-16 鲁班长（深圳）科技有限公司 用户通行控制方法及装置、设备、存储介质
CN112995998B (zh) * 2020-11-30 2023-02-21 中国银联股份有限公司 提供安全认证机制的方法、计算机系统和计算机可读介质
CN112422587B (zh) * 2021-01-21 2021-04-13 腾讯科技（深圳）有限公司 身份校验方法、装置、计算机设备及存储介质
WO2023108635A1 (zh) * 2021-12-17 2023-06-22 华为技术有限公司 一种认证方法、装置、设备及系统
CN115150072A (zh) * 2022-06-20 2022-10-04 中国联合网络通信集团有限公司 云网签发认证方法、设备、装置及存储介质

Citations (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101296080A (zh) * 2007-04-29 2008-10-29 晨星半导体股份有限公司 授权使用者确认方法及其相关装置
CN102930436A (zh) * 2012-10-23 2013-02-13 江苏乐买到网络科技有限公司 一种移动支付的方法和装置
CN103679453A (zh) * 2013-12-06 2014-03-26 金硕澳门离岸商业服务有限公司 基于生物认证的支付系统及支付方法
CN105245341A (zh) * 2015-09-07 2016-01-13 天地融科技股份有限公司 远程身份认证方法和系统以及远程开户方法和系统
CN105939195A (zh) * 2016-03-07 2016-09-14 李明 一种交易方法及系统
CN105939336A (zh) * 2016-03-07 2016-09-14 李明 一种身份认证方法及系统
CN105938526A (zh) * 2016-03-07 2016-09-14 李明 一种身份认证方法及系统
CN105956844A (zh) * 2016-03-18 2016-09-21 李明 一种支付方法及系统
CN105989496A (zh) * 2016-03-07 2016-10-05 李明 一种交易方法及设备
CN105989498A (zh) * 2016-03-18 2016-10-05 李明 一种支付方法及系统
CN105989497A (zh) * 2016-03-07 2016-10-05 李明 一种支付方法及系统
CN105991653A (zh) * 2016-03-07 2016-10-05 李明 一种身份认证方法及装置
CN105989495A (zh) * 2016-03-07 2016-10-05 李明 一种支付方法及系统
CN105991654A (zh) * 2016-03-07 2016-10-05 李明 一种授权认证方法、装置和系统
CN105989488A (zh) * 2016-03-18 2016-10-05 李明 一种支付方法及系统
CN105991652A (zh) * 2016-03-07 2016-10-05 李明 一种身份认证方法及系统

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070168671A1 (en) * 2006-01-16 2007-07-19 Fujitsu Limited Digital document management system, digital document management method, and digital document management program
US20100242102A1 (en) * 2006-06-27 2010-09-23 Microsoft Corporation Biometric credential verification framework
CN103873244B (zh) * 2012-12-13 2017-05-10 航天信息股份有限公司 基于指纹识别的移动支付中的身份认证方法和系统
CN103995997B (zh) * 2014-05-15 2017-09-12 华为技术有限公司 一种用户权限的分配方法和设备
CN204796894U (zh) * 2015-06-19 2015-11-25 曹淼 智能手环

Patent Citations (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101296080A (zh) * 2007-04-29 2008-10-29 晨星半导体股份有限公司 授权使用者确认方法及其相关装置
CN102930436A (zh) * 2012-10-23 2013-02-13 江苏乐买到网络科技有限公司 一种移动支付的方法和装置
CN103679453A (zh) * 2013-12-06 2014-03-26 金硕澳门离岸商业服务有限公司 基于生物认证的支付系统及支付方法
CN105245341A (zh) * 2015-09-07 2016-01-13 天地融科技股份有限公司 远程身份认证方法和系统以及远程开户方法和系统
CN105989496A (zh) * 2016-03-07 2016-10-05 李明 一种交易方法及设备
CN105939336A (zh) * 2016-03-07 2016-09-14 李明 一种身份认证方法及系统
CN105938526A (zh) * 2016-03-07 2016-09-14 李明 一种身份认证方法及系统
CN105939195A (zh) * 2016-03-07 2016-09-14 李明 一种交易方法及系统
CN105989497A (zh) * 2016-03-07 2016-10-05 李明 一种支付方法及系统
CN105991653A (zh) * 2016-03-07 2016-10-05 李明 一种身份认证方法及装置
CN105989495A (zh) * 2016-03-07 2016-10-05 李明 一种支付方法及系统
CN105991654A (zh) * 2016-03-07 2016-10-05 李明 一种授权认证方法、装置和系统
CN105991652A (zh) * 2016-03-07 2016-10-05 李明 一种身份认证方法及系统
CN105956844A (zh) * 2016-03-18 2016-09-21 李明 一种支付方法及系统
CN105989498A (zh) * 2016-03-18 2016-10-05 李明 一种支付方法及系统
CN105989488A (zh) * 2016-03-18 2016-10-05 李明 一种支付方法及系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3428818A4 *

Also Published As

Publication number Publication date
EP3428818B1 (en) 2020-11-25
EP3428818A1 (en) 2019-01-16
SG11201807605UA (en) 2018-10-30
EP3428818A4 (en) 2019-07-24
CN105938526A (zh) 2016-09-14
US20200167450A1 (en) 2020-05-28

Similar Documents

Publication Publication Date Title
WO2017152815A1 (zh) 一种身份认证方法及系统
US11012438B2 (en) Biometric device pairing
JP6703151B2 (ja) ブルートゥースインタフェースを備える認証装置
US7725717B2 (en) Method and apparatus for user authentication
EP3138265B1 (en) Enhanced security for registration of authentication devices
JP6130044B2 (ja) ワイヤレスネットワーキングがイネーブルされた個人識別システム
US20140380445A1 (en) Universal Authentication and Data Exchange Method, System and Service
US11086978B2 (en) Transaction authentication by a token, contingent on personal presence
WO2017152818A1 (zh) 一种支付方法及系统
WO2012042775A1 (ja) 生体認証システム、通信端末装置、生体認証装置、および生体認証方法
US20190174304A1 (en) Universal Authentication and Data Exchange Method, System and Service
TWI770422B (zh) 用於操作物聯網設備的方法和系統
JP2016506101A (ja) 近傍ベースのマルチファクタ認証
CN105939336A (zh) 一种身份认证方法及系统
WO2017152819A1 (zh) 一种授权认证方法、装置和系统
CN105991654A (zh) 一种授权认证方法、装置和系统
CN105991652A (zh) 一种身份认证方法及系统
US9294921B2 (en) Device for mobile communication
EP2959420B1 (en) Methods, apparatus and computer programs for entity authentication
KR101652966B1 (ko) Rf 카드와 스마트 폰의 페어링을 이용한 스마트 인증 시스템 및 스마트 인증 방법
KR102339949B1 (ko) 인증 정보 처리 방법 및 장치와 인증 정보 처리 방법 장치를 포함한 사용자 단말
CN107026732A (zh) 一种通过可穿戴设备减少密码输入次数的系统
KR101814078B1 (ko) 본인 부인 방지 인증 서비스 제공 방법, 인증 서비스 장치 및 인증 어플리케이션이 탑재된 사용자 모바일 단말기
CN111259362A (zh) 一种硬件数字证书载体的身份鉴别方法
CN109005158B (zh) 基于模糊保险箱的动态手势认证系统的认证方法

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 11201807605U

Country of ref document: SG

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2017762501

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2017762501

Country of ref document: EP

Effective date: 20181008

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17762501

Country of ref document: EP

Kind code of ref document: A1