WO2020029566A1

WO2020029566A1 - Remote authorization method, device and equipment, and storage medium

Info

Publication number: WO2020029566A1
Application number: PCT/CN2019/074355
Authority: WO
Inventors: 顾宏超
Original assignee: 顾宏超
Priority date: 2018-08-09
Filing date: 2019-02-01
Publication date: 2020-02-13
Also published as: CN109067881B; CN109067881A

Abstract

The present invention relates to the field of communications, and disclosed thereby are a remote authorization method, device and equipment, and a storage medium. The remote authorization method according to the present invention comprises: acquiring a first biometric feature of a user collected at a device to be authorized; transmitting the first biometric feature to a mobile terminal; and if a first terminal ID identifying the mobile terminal and a first user ID of a user of the mobile terminal are received from the mobile terminal, sending to a server a first device ID, the first terminal ID and the first user ID which identify the device to be authorized. The remote authorization method according to the present invention may ensure that only the user personally requests authentication and enjoys related services at a physical location, thereby effectively avoiding a situation where a user identity or a mobile terminal is misappropriated, and simultaneously avoiding the risk of revealing the biometric feature of the user.

Description

Remote authorization method, device, equipment and storage medium thereof

Technical field

The present invention relates to the field of communications, and in particular, to a remote authorization method and device, device, and storage medium thereof.

Background technique

With the popularization of networked lifestyles, more and more demands for network authentication or authentication are required in daily life, such as mobile payment and bicycle sharing. Existing networked devices based on the Internet or Bluetooth communication technology, such as shared bicycle locks, smart door locks, and other related products such as smart locks, the authentication method is one-way authentication, that is, the mobile terminal or other methods initiate authentication To apply, verify the identity of the applicant in the lock body or the cloud, and authorize the relevant implementing agencies to unlock, authenticate, and check attendance after the authentication is passed. Most of the methods relying on the mobile Internet for one-way authentication have the problem of easily forging address information. In the case that the mobile terminal is stolen, compromised, or copied, an attacker can remotely operate the mobile terminal to authorize the terminal that requires authentication. .

Due to the characteristics of the Internet, this kind of remote information transmission is almost imperceptible, so it is impossible to determine whether the mobile terminal is near a terminal that needs authorization (that is, the execution device described herein), and then confirm whether an authorized user initiates an authentication application.

That is, only by checking the identity information of the authentication or authentication initiator (mobile phone SN, mobile phone number, authentication functions built into the mobile terminal OS such as a lock screen password), it has been confirmed that they can be forged / hacked. In this case, you can no longer rely on these traditional identity authentication methods and authentication methods in situations where higher security is required.

However, there is a problem that user information must be stored in a centralized manner to perform authentication by using a user's unique identification code such as a biometric feature. When the related services are for the mass market, a large amount of user information is stored in a centralized manner, especially user information that cannot be changed such as biometric characteristics. Once leaked, it will cause significant losses to customers. In other words, any service that centrally stores user information is high-risk. Collecting and transmitting personal biometric information is a sensitive act involving security and law in China and around the world.

Summary of the invention

An object of the present invention is to provide a remote authorization method, a device, a device and a storage medium thereof, which can ensure that it is a user who requests authentication and enjoys related services at a physical location, and effectively prevents the identity of the user or the theft of a mobile terminal, At the same time, the user's biometric characteristics are not stored to avoid the risk of leaking the user's biometric characteristics.

In order to solve the above technical problems, an embodiment of the present invention discloses a remote authorization method. The method includes:

Acquiring a first biometric feature of a user collected at a device to be authorized;

Sending a first biometric feature to a mobile terminal, where the first biometric feature is used to match a second biometric feature of a user stored in the mobile terminal;

If a first terminal ID identifying the mobile terminal and a first user ID of a user of the mobile terminal sent by the mobile terminal are received, a first device ID, a first terminal ID, and a first user identifying the device to be authorized are sent to the server ID, the first device ID, the first terminal ID, and the first user ID are used to match the second device ID, the second terminal ID, and the second user ID received by the server from the mobile terminal, respectively;

The first terminal ID and the first user ID are sent by the mobile terminal after the first biometric feature matches the second biometric feature.

In an exemplary embodiment, in the method, after sending the first device ID, the first terminal ID, and the first user ID identifying the device to be authorized to the server, the method further includes:

If authorization information is received from the server, the corresponding operation requested by the user is authorized on the device to be authorized.

In another exemplary embodiment, in the method, after sending the first biometric feature to the mobile terminal, the method further includes:

Delete the first biometric feature.

In another example, the biometric feature is a fingerprint.

An embodiment of the present invention also discloses a remote authorization method. The method includes:

The mobile terminal receives the first biometric feature of the user collected at the device to be authorized;

The mobile terminal matches the received first biometric feature with the stored second biometric feature of the user of the mobile terminal;

If the matching is successful, the mobile terminal sends a first terminal ID identifying the mobile terminal and a first user ID of a user of the mobile terminal to the detection device that sends the first biometric feature, and

Sending to the server a second terminal ID identifying the mobile terminal and a second user ID of a user of the mobile terminal and the received second device ID identifying the device to be authorized;

The second device ID, the second terminal ID, and the second user ID are used to match the first device ID, the first terminal ID, and the first user ID received by the server from the detection device, respectively.

The server receives the second device ID, the second terminal ID, and the second user ID from the mobile terminal, and receives the first device ID, the first terminal ID, and the first user ID from the detection device;

The server matches the received first device ID, first terminal ID, and first user ID with the second device ID, second terminal ID, and second user ID, respectively;

If the match is successful, the authorization information is sent;

The first biometric feature is collected at the place to be authorized and sent by the detection device to the mobile terminal, the first device ID is sent by the detection device to the mobile terminal, and

When the first biometric feature matches the second biometric feature of the user stored in the mobile terminal, the mobile terminal sends the second device ID, the second terminal ID, and the second user ID to the server, and sends the first A terminal ID and a first user ID, and

The authorization information is used to authorize the corresponding operation requested by the user on the device to be authorized.

An embodiment of the present invention also discloses a remote authorization device. The device includes:

An obtaining unit, configured to obtain a first biometric feature of a user collected at a device to be authorized;

A first sending unit, configured to send a first biometric feature to a mobile terminal, where the first biometric feature is used to match a second biometric feature of a user stored in the mobile terminal;

The second sending unit is configured to send the first device ID, the first device ID identifying the device to be authorized to the server when the first terminal ID identifying the mobile terminal and the first user ID of the user of the mobile terminal sent by the mobile terminal are received. A terminal ID and a first user ID, the first device ID, the first terminal ID, and the first user ID are used to match the second device ID, the second terminal ID, and the second user ID received by the server from the mobile terminal, respectively ;

In an exemplary embodiment, the remote authorization device further includes:

A deleting unit, configured to delete the first biometric feature.

An embodiment of the present invention also discloses a mobile terminal. The mobile terminal includes:

A first receiving unit, configured to receive a first biometric feature of a user collected at a device to be authorized;

A first matching unit, configured to match the received first biometric feature with a stored second biometric feature of a user of the mobile terminal;

A third sending unit, configured to send a first terminal ID identifying the mobile terminal and a first user ID of a user of the mobile terminal to the detection device that sends the first biometric feature after the first matching unit is successfully matched, and

An embodiment of the present invention also discloses a server, including:

A second receiving unit, configured to receive the second device ID, the second terminal ID, and the second user ID from the mobile terminal, and receive the first device ID, the first terminal ID, and the first user ID from the detection device;

A second matching unit, configured to match the received first device ID, first terminal ID, and first user ID with the second device ID, second terminal ID, and second user ID, respectively;

A fourth sending unit, configured to send authorization information after the second matching unit has successfully matched;

An embodiment of the present invention also discloses a device including a memory and a processor storing computer-executable instructions, and the processor is configured to execute the remote authorization method disclosed in the foregoing embodiment when the computer-executable instructions are executed.

An embodiment of the present invention also discloses a non-volatile computer storage medium encoded using a computer program, wherein the computer program includes instructions, and when the instructions are executed by one or more computers, the instructions cause the one or more computers to execute the foregoing embodiments. Open remote authorization method.

Compared with the prior art, the embodiments of the present invention have the following main differences and effects:

In the remote authorization process, it is possible to ensure that the user who requests authorization and enjoys related services is physically located at the physical location, which effectively prevents the identity of the user or the misappropriation of related resources after the mobile terminal is stolen, and improves the security of remote authorization.

Further, the biometric feature of the user is not stored, and the biometric feature does not need to be transmitted remotely, so as to ensure the security of authorization while avoiding the leakage of the biometric feature of the user.

Further, the existing electronic physical identity authentication mainly relies on the security of the mobile terminal to ensure the reliability and security of its authentication process. Therefore, the core security process of the security system is left to an external uncontrollable link, thereby seriously weakening the entire system. Safety, that is, the entire system is prone to single point failure. The centralized storage of user information will lead to a huge risk of information leakage. The invention solves the single dependence of the existing electronic physical authentication on the security of the mobile terminal, thereby avoiding the failure of the authentication mechanism of the entire security system due to the failure of the mobile terminal, and there is no centralized storage user in the system constructed according to the invention The problem of biological information does not easily lead to large-scale user information leakage events.

BRIEF DESCRIPTION OF THE DRAWINGS

1 is a schematic flowchart of a remote authorization method according to a first embodiment of the present invention;

2 is a schematic flowchart of a remote authorization method according to a second embodiment of the present invention;

3 is a schematic flowchart of a remote authorization method according to a third embodiment of the present invention;

4 is a schematic flowchart of a remote authorization method according to a fourth embodiment of the present invention;

5 is a schematic structural diagram of a remote authorization device according to a fourth embodiment of the present invention;

6 is a schematic structural diagram of a mobile terminal according to a sixth embodiment of the present invention;

7 is a schematic structural diagram of a server according to a seventh embodiment of the present invention;

8 is a block diagram of a system according to an embodiment of the present invention;

FIG. 9 is a block diagram of a SoC (System On Chip) according to an embodiment of the present invention.

detailed description

In the following description, many technical details are proposed in order to make the reader better understand this application. However, those of ordinary skill in the art can understand that even without these technical details and various changes and modifications based on the following embodiments, the technical solutions claimed in the claims of this application can be implemented.

In addition, it can be understood that, in the present invention, the mobile terminal includes various movable smart devices, such as a smart phone, a tablet computer, and the like. The server can be a remote server or a cloud server. The device ID refers to information that can uniquely identify the device to be authorized, such as an identification code or identification number set for the authorized device. The terminal ID of a mobile terminal also refers to information that can uniquely identify the mobile terminal, such as a MAC address or an identifier set specifically for the terminal. The user ID refers to identification information that can uniquely indicate the identity of the user, such as the machine code (SN code) of the user's mobile phone, mobile phone number, user name, and the like. It is worth noting that this article distinguishes the above-mentioned various IDs with different transmission sources received by the server by adding a first or a second. For example, the first terminal ID and the second terminal ID both identify the mobile terminal. IDs are different because they are sent directly from different devices.

To make the objectives, technical solutions, and advantages of the present invention clearer, the embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.

The first embodiment of the present invention relates to a remote authorization method. FIG. 1 is a schematic flowchart of the remote authorization method.

Specifically, as shown in FIG. 1, the method includes the following steps:

Step 101: Obtain a first biometric feature of a user collected at a device to be authorized.

It can be understood that, in the present invention, a biometric feature refers to a biometric feature that can uniquely identify a user, such as a fingerprint, an iris, a facial feature, a sound, and the like.

Thereafter, the process proceeds to step 102.

In step 102, a first biometric feature is sent to a mobile terminal, and the first biometric feature is used for matching with a second biometric feature of a user stored in the mobile terminal.

Thereafter, the process proceeds to step 103.

In step 103, it is determined whether a first terminal ID identifying the mobile terminal and a first user ID of a user of the mobile terminal sent by the mobile terminal are received.

If yes, go to step 104; otherwise, end this process.

In step 104, a first device ID, a first terminal ID, and a first user ID identifying the device to be authorized are sent to the server, and the first device ID, the first terminal ID, and the first user ID are used to receive from the mobile terminal with the server. The obtained second device ID, second terminal ID, and second user ID are respectively matched.

After that, the process ends.

It can be understood that, in the present invention, after the ID is successfully matched, the server may directly send authorization information to the device to be authorized, and the device to be authorized authorizes the corresponding operation requested by the user after receiving the authorization information. The server may also send authorization information to the device that obtains the first biometric feature (assuming the device does not belong to the device to be authorized, and is an additional auxiliary tool for the device to be authorized), and then the device controls the device to be authorized to perform the corresponding operation requested by the user. For example, when the device to be authorized is a door lock or a car lock, unlock the door or car lock; when the device to be authorized is a vending machine, sell the goods; when the device to be authorized is a computer, the computer enters the user operation interface and allows the user to perform related operations. Operation, etc.

In an exemplary embodiment, in step 102, the second device ID is also sent along with the first biometric feature to the mobile terminal. In addition, the second device ID may also be sent at other times, which is not limited herein.

In order to prevent the leakage of the user's biometric characteristics, preferably, in an exemplary embodiment, after the above step 102, the method further includes:

Delete the acquired first biometric feature. Wherein, if the devices for collecting and acquiring biometric characteristics are not the same device, the collecting device for collecting biometric characteristics will also delete the collected biometric characteristics after sending the collected biometric characteristics. In this way, the user's biometric feature is not stored, and there is no need to send the biometric feature remotely, thereby ensuring the security of authorization while avoiding the leakage of the user's biometric feature.

In an exemplary embodiment, the device that collects the first biometric feature is placed or integrated on the device to be authorized.

In addition, in other exemplary embodiments of the present invention, the collection device may also be an external device, and the collected biometric characteristic information is transmitted to the device to be authorized through a wireless or wired connection.

In an exemplary embodiment, the first biometric feature and the second biometric feature are fingerprints.

A second embodiment of the present invention relates to a remote authorization method. FIG. 2 is a schematic flowchart of the method.

Specifically, as shown in FIG. 2, the method includes the following steps:

Step 201: The mobile terminal receives the first biometric feature of the user collected at the device to be authorized.

Thereafter, the process proceeds to step 202.

In step 202, the mobile terminal matches the received first biometric feature with the stored second biometric feature of the user of the mobile terminal.

If the matching is successful, the process proceeds to step 203; otherwise, the process ends.

In step 203, the mobile terminal sends a first terminal ID identifying the mobile terminal and a first user ID of a user of the mobile terminal to the detection device that sends the first biometric feature, and

Sending to the server a second terminal ID identifying the mobile terminal and a second user ID of a user of the mobile terminal and a received second device ID identifying the device to be authorized; wherein the second device ID, the second terminal ID, and the first The two user IDs are used to match the first device ID, the first terminal ID, and the first user ID received by the server from the detection device, respectively.

After that, the process ends.

It can be understood that, in the present invention, after the ID is successfully matched, the server may directly send authorization information to the device to be authorized, and the device to be authorized authorizes the corresponding operation requested by the user after receiving the authorization information. The server may also send authorization information to the device that obtains the first biometric feature (assuming the device does not belong to the device to be authorized, and is an additional auxiliary tool for the device to be authorized), and then the device controls the device to be authorized to perform the corresponding operation requested by the user. For example, when the device to be authorized is a door lock or a car lock, unlock the door or car lock; when the device to be authorized is a vending machine, sell the goods; when the device to be authorized is a computer, the computer enters the user operation interface and allows the user to perform related operations Operation, etc.

In addition, it can be understood that, in the embodiments of the present invention, the detection device may be a part of the device to be authorized, or may be an independent device, which is not limited herein.

A third embodiment of the present invention relates to a remote authorization method. FIG. 3 is a schematic flowchart of the method.

Specifically, as shown in FIG. 3, the method includes the following steps:

Step 301: The server receives the second device ID, the second terminal ID, and the second user ID from the mobile terminal, and receives the first device ID, the first terminal ID, and the first user ID from the detection device.

Thereafter, the process proceeds to step 302.

In step 302, the server matches the received first device ID, first terminal ID, and first user ID with the second device ID, second terminal ID, and second user ID, respectively.

If the matching is successful, the process proceeds to step 303; otherwise, the process ends.

In step 303, authorization information is sent, and the authorization information is used to authorize the corresponding operation requested by the user on the device to be authorized.

The first biometric feature is collected at the place to be authorized and sent to the mobile terminal by the detection device, the first device ID is sent to the mobile terminal by the detection device, and the mobile terminal stores and stores the first biometric feature in the mobile terminal. When the second biometric feature of the user matches, the second device ID, the second terminal ID, and the second user ID are sent to the server, and the first terminal ID and the first user ID are sent to the detection device.

After that, the process ends.

A fourth embodiment of the present invention relates to a remote authorization method. FIG. 4 is a schematic flowchart of the method.

Specifically, as shown in FIG. 4, the method includes the following steps:

In step 401, the detection device acquires and sends to the mobile terminal a first biometric characteristic of the user collected at the device to be authorized and a second device ID identifying the device to be authorized.

After that, it proceeds to step 402.

In step 402, the mobile terminal matches the received first biometric feature with the second biometric feature of the user stored in the mobile terminal.

If the matching is successful, step 403 is entered; otherwise, the process ends.

In step 403, the mobile terminal sends a first terminal ID identifying the mobile terminal and a first user ID identifying a user of the mobile terminal to the detection device, and sends a second device ID and a second terminal identifying the mobile terminal to the server. An ID and a second user ID identifying a user of the mobile terminal.

After that, it proceeds to step 404.

In step 404, the detection device sends a first device ID identifying the device to be authorized, and the received first terminal ID and first user ID to the server.

Thereafter, the process proceeds to step 405.

In step 405, the server matches the received first device ID, first terminal ID, and first user ID with the second device ID, second terminal ID, and second user ID, respectively.

If the match is successful, step 406 is entered; otherwise, the process ends.

In step 406, the server sends authorization information, and the authorization information is used to authorize the corresponding operation requested by the user on the device to be authorized.

After that, the process ends.

The method embodiments of the present invention can be implemented in software, hardware, firmware, and the like. Regardless of whether the present invention is implemented in software, hardware, or firmware, the instruction code can be stored in any type of computer-accessible memory (such as permanent or modifiable, volatile or nonvolatile, solid state Or non-solid, fixed or replaceable media, etc.). Similarly, the memory may be, for example, Programmable Array Logic (PAL), Random Access Memory (RAM), Programmable Read Only Memory (PROM) "), Read-Only Memory (" ROM "), Electrically Erasable Programmable ROM (" EEPROM "), magnetic disks, optical disks, digital Versatile Discs , "DVD" for short) and so on.

A fifth embodiment of the present invention relates to a remote authorization device. FIG. 5 is a schematic structural diagram of the remote authorization device.

Specifically, as shown in FIG. 5, the remote authorization device includes:

In addition, in an exemplary embodiment, the device further includes:

A deleting unit, configured to delete the first biometric feature.

The first or fourth embodiment is a method embodiment corresponding to this embodiment, and this embodiment can be implemented in cooperation with the first or fourth embodiment. Relevant technical details mentioned in the first or fourth embodiment are still valid in this embodiment, and in order to reduce repetition, details are not repeated here. Accordingly, the related technical details mentioned in this embodiment can also be applied in the first or fourth embodiment.

A sixth embodiment of the present invention relates to a mobile terminal. FIG. 6 is a schematic structural diagram of the mobile terminal.

Specifically, as shown in FIG. 6, the mobile terminal includes:

The second or fourth embodiment is a method embodiment corresponding to this embodiment, and this embodiment can be implemented in cooperation with the second or fourth embodiment. The related technical details mentioned in the second or fourth embodiment are still valid in this embodiment, and in order to reduce repetition, details are not repeated here. Accordingly, the related technical details mentioned in this embodiment can also be applied in the second or fourth embodiment.

A seventh embodiment of the present invention relates to a server. FIG. 7 is a schematic diagram of the server.

Specifically, as shown in FIG. 7, the server includes:

The third or fourth embodiment is a method implementation corresponding to this embodiment, and this embodiment can be implemented in cooperation with the third or fourth embodiment. Relevant technical details mentioned in the third or fourth embodiment are still valid in this embodiment, and in order to reduce repetition, details are not repeated here. Accordingly, the related technical details mentioned in this embodiment can also be applied in the third or fourth embodiment.

An eighth embodiment of the present invention relates to a device. Specifically, the device includes a memory and a processor storing computer-executable instructions, and the processor is configured to execute the remote authorization method of any one of the first to fourth embodiments when the computer-executable instructions are executed.

A ninth embodiment of the present invention relates to a non-volatile computer storage medium encoded using a computer program, wherein the computer program includes instructions, and when the instructions are executed by more than one computer, the instructions cause more than one computer to execute the first The remote authorization method according to any one of the fourth embodiment.

At present, the existing electronic physical identity authentication mainly relies on the security of the mobile terminal to ensure the reliability and security of its authentication process. Therefore, the core security process of the security system is left to an external uncontrollable link, thereby seriously weakening the security of the entire system. That is, the entire system is prone to single point failure. The centralized storage of user information will lead to a huge risk of information leakage. The invention solves the single dependence of the existing electronic physical authentication on the security of the mobile terminal, thereby avoiding the failure of the authentication mechanism of the entire security system due to the failure of the mobile terminal, and there is no centralized storage user in the system constructed according to the invention The problem of biological information does not easily lead to large-scale user information leakage events.

Referring now to FIG. 8, a block diagram of a system 800 according to one embodiment of the present application is shown. The system 800 may be an implementation manner of a server, a detection device, a remote authorization device, or a device mentioned in this application. However, it can be understood that the server, detection device, remote authorization device, or device of the present application may also have other implementation manners, and is not limited to the system 800. The system 800 may include one or more processors 801 coupled to a controller hub 803. In one embodiment, the controller hub 803 includes, but is not limited to, a graphics memory controller hub (GMCH) (not shown) and an input / output hub (IOH) (which may be on separate chips) (not shown) Out), where the GMCH includes a memory and a graphics controller and is coupled to the IOH. The system 800 may also include a coprocessor 802 and a memory 804 coupled to a controller hub 803. Alternatively, one or both of the memory and the GMCH may be integrated in the processor (as described in this application), the memory 804 and the coprocessor 802 are directly coupled to the processor 801 and the controller hub 803, the controller hub 803 and IOH are in a single chip.

The optional nature of the additional processor 802 is indicated in FIG. 7 by dashed lines.

The memory 804 may be, for example, a dynamic random access memory (DRAM), a phase change memory (PCM), or a combination of the two. For at least one embodiment, the controller hub 803 communicates with the processor 801 via a multi-drop bus such as a front-side bus (FSB), a point-to-point interface such as a fast-path interconnect (QPI), or the like.

In one embodiment, the coprocessor 802 is a dedicated processor, such as, for example, a high-throughput MIC processor, a network or communication processor, a compression engine, a graphics processor, a GPGPU, or an embedded processor, and so on. In one embodiment, the controller hub 803 may include an integrated graphics accelerator. The instruction execution method proposed in this application may be executed by the coprocessor 802.

In one embodiment, the processor 801 executes instructions that control data processing operations of a general type. Coprocessor instructions can be embedded in these instructions. The processor 801 recognizes these coprocessor instructions as the type that should be executed by the attached coprocessor 802. Therefore, the processor 801 issues these coprocessor instructions (or control signals representing the coprocessor instructions) to the coprocessor 802 on a coprocessor bus or other interconnect. The coprocessor 802 accepts and executes the received coprocessor instructions.

Referring now to FIG. 9, a block diagram of a SoC (System on Chip) 900 according to an embodiment of the present application is shown. The SoC may be an implementation manner of a mobile terminal, a detection device, a remote authorization device, or a device mentioned in this application. However, it can be understood that the mobile terminal, detection device, remote authorization device, or device of the present application may also have other implementation manners, and is not limited to the SoC 900. In FIG. 9, similar components have the same reference numerals. In addition, dashed boxes are optional features for more advanced SoCs. In FIG. 9, the interconnect unit 950 is coupled to an application processor 910, which includes, but is not limited to, one or more core sets and shared cache units and registers; a system proxy unit 980; a bus controller Unit 990; integrated memory controller unit 940; one or more coprocessors 920, which may include integrated graphics logic, image processor, audio processor, and video processor; static random access memory (SRAM) unit 930; Direct Memory Access (DMA) unit 960. In one embodiment, the coprocessor 920 includes a dedicated processor, such as, for example, a network or communications processor, a compression engine, a GPGPU, a high-throughput MIC processor, or an embedded processor, and the like.

Embodiments of the mechanisms disclosed herein may be implemented in hardware, software, firmware, or a combination of these implementation methods. Embodiments of the present application may be implemented as a computer program or program code executed on a programmable system, the programmable system including at least one processor, a storage system (including volatile and nonvolatile memory and / or storage elements) , At least one input device, and at least one output device.

Program code can be applied to input instructions to perform the functions described in this application and generate output information. The output information can be applied to one or more output devices in a known manner. For the purposes of this application, a processing system includes any system having a processor such as, for example, a digital signal processor (DSP), a microcontroller, an application specific integrated circuit (ASIC), or a microprocessor.

The program code can be implemented in a high-level programming language or an object-oriented programming language to communicate with the processing system. When required, program code can also be implemented in assembly or machine language. In fact, the mechanisms described in this application are not limited to the scope of any particular programming language. In either case, the language can be a compiled or interpreted language.

It should be noted that each unit mentioned in the embodiments of each device of the present invention is a logical unit. Physically, a logical unit may be a physical unit, or a part of a physical unit, or multiple physical units. The combined implementation of units, the physical implementation of these logical units themselves is not the most important, and the combination of the functions implemented by these logical units is the key to solving the technical problem proposed by the present invention. In addition, in order to highlight the innovative part of the present invention, the above-mentioned device embodiments of the present invention do not introduce units that are not closely related to solving the technical problems proposed by the present invention, which does not mean that there are no other existing device embodiments unit.

It should be noted that in the claims and description of this patent, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or Imply any such actual relationship or order between these entities or operations. Moreover, the terms "including", "comprising", or any other variation thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or device that includes a series of elements includes not only those elements but also those that are not explicitly listed Or other elements inherent to such a process, method, article, or device. Without more restrictions, an element limited by the sentence "including one" does not exclude that there are other identical elements in the process, method, article, or device including the element.

Although the present invention has been illustrated and described with reference to certain preferred embodiments of the present invention, those skilled in the art should understand that various changes can be made in form and detail without departing from the present invention. The spirit and scope of the invention.

Claims

A remote authorization method, comprising:

Acquiring a first biometric feature of a user collected at a device to be authorized;

Sending the first biometric feature to a mobile terminal, where the first biometric feature is used to match a second biometric feature of a user stored in the mobile terminal;

If a first terminal ID identifying the mobile terminal and a first user ID of a user of the mobile terminal sent by the mobile terminal are received, sending to the server a first device ID identifying the device to be authorized, the first A terminal ID and a first user ID, and the first device ID, the first terminal ID, and the first user ID are used to communicate with the second device ID, the second terminal ID, and the second device that the server receives from the mobile terminal; User IDs are matched separately;

The first terminal ID and the first user ID are sent by the mobile terminal after the first biometric feature matches the second biometric feature.
The remote authorization method according to claim 1, after sending the first device ID, the first terminal ID, and the first user ID identifying the device to be authorized to the server, further comprising:

If authorization information is received from the server, the corresponding operation requested by the user is authorized on the device to be authorized.
The remote authorization method according to claim 1 or 2, further comprising: after sending the first biometric feature to a mobile terminal:

Deleting the first biometric feature.
The remote authorization method according to claim 3, wherein the first biometric feature and the second biometric feature are fingerprints.
A remote authorization method, comprising:

The mobile terminal receives the first biometric feature of the user collected at the device to be authorized;

Matching, by the mobile terminal, the received first biometric feature with a stored second biometric feature of a user of the mobile terminal;

If the matching is successful, the mobile terminal sends a first terminal ID identifying the mobile terminal and a first user ID of a user of the mobile terminal to the detection device that sends the first biometric feature, and

Sending to the server a second terminal ID identifying the mobile terminal and a second user ID of a user of the mobile terminal and the received second device ID identifying the device to be authorized;

The second device ID, the second terminal ID, and the second user ID are used to match the first device ID, the first terminal ID, and the first user ID received by the server from the detection device, respectively.
A remote authorization method, comprising:

The server receives the second device ID, the second terminal ID, and the second user ID from the mobile terminal, and receives the first device ID, the first terminal ID, and the first user ID from the detection device;

The server matches the received first device ID, first terminal ID, and first user ID with the second device ID, second terminal ID, and second user ID, respectively;

If the match is successful, the authorization information is sent;

The first biometric feature is collected at a place to be authorized and sent to the mobile terminal by a detection device, the first device ID is sent to the mobile terminal by the detection device, and

Sending, by the mobile terminal, the second device ID, the second terminal ID, and the second user ID to the server when the first biometric feature matches a second biometric feature of a user stored in the mobile terminal, Sending a first terminal ID and a first user ID to the detection device, and

The authorization information is used to authorize a corresponding operation requested by the user on the device to be authorized.
A remote authorization device, comprising:

An obtaining unit, configured to obtain a first biometric feature of a user collected at a device to be authorized;

A first sending unit, configured to send the first biometric feature to a mobile terminal, where the first biometric feature is used to match a second biometric feature of a user stored in the mobile terminal;

A second sending unit, configured to send a first identifier identifying the device to be authorized to the server when the first terminal ID identifying the mobile terminal and the first user ID of a user of the mobile terminal are received and sent by the mobile terminal; A device ID, the first terminal ID, and a first user ID, the first device ID, the first terminal ID, and the first user ID are used for a second device ID received by the server from the mobile terminal, Matching the second terminal ID and the second user ID, respectively;

The first terminal ID and the first user ID are sent by the mobile terminal after the first biometric feature matches the second biometric feature.
The remote authorization device according to claim 1, further comprising:

A deleting unit, configured to delete the first biometric feature.
A mobile terminal, comprising:

A first receiving unit, configured to receive a first biometric feature of a user collected at a device to be authorized;

A first matching unit, configured to match the received first biometric feature with a stored second biometric feature of a user of the mobile terminal;

A third sending unit, configured to send a first terminal ID identifying the mobile terminal and a first user of the user of the mobile terminal to a detection device that sends the first biometric feature after the first matching unit is successfully matched ID, and

Sending to the server a second terminal ID identifying the mobile terminal and a second user ID of a user of the mobile terminal and the received second device ID identifying the device to be authorized;

The second device ID, the second terminal ID, and the second user ID are used to match the first device ID, the first terminal ID, and the first user ID received by the server from the detection device, respectively.
A server is characterized in that it includes:

A second receiving unit, configured to receive the second device ID, the second terminal ID, and the second user ID from the mobile terminal, and receive the first device ID, the first terminal ID, and the first user ID from the detection device;

A second matching unit, configured to match the received first device ID, first terminal ID, and first user ID with the second device ID, second terminal ID, and second user ID, respectively;

A fourth sending unit, configured to send authorization information after the second matching unit is successfully matched;

The first biometric feature is collected at a place to be authorized and sent to the mobile terminal by a detection device, the first device ID is sent to the mobile terminal by the detection device, and

Sending, by the mobile terminal, the second device ID, the second terminal ID, and the second user ID to the server when the first biometric feature matches a second biometric feature of a user stored in the mobile terminal, Sending a first terminal ID and a first user ID to the detection device, and

The authorization information is used to authorize a corresponding operation requested by the user on the device to be authorized.
An apparatus, comprising a memory and a processor storing computer-executable instructions, and the processor is configured to, when executing the computer-executable instructions, execute the device according to any one of claims 1 to 6. The remote authorization method described above.
A non-volatile computer storage medium encoded using a computer program, characterized in that the computer program includes instructions, and when the instructions are executed by more than one computer, the instructions cause the more than one computer to execute such instructions as The remote authorization method according to any one of claims 1 to 6.