CN113987447A

CN113987447A - Identity authentication method, device and equipment based on privacy protection

Info

Publication number: CN113987447A
Application number: CN202111263640.8A
Authority: CN
Inventors: 曹佳炯; 丁菁汀
Original assignee: Alipay Hangzhou Information Technology Co Ltd
Current assignee: Alipay Hangzhou Information Technology Co Ltd
Priority date: 2021-10-28
Filing date: 2021-10-28
Publication date: 2022-01-28

Abstract

The embodiment of the specification provides an identity authentication method, an identity authentication device and identity authentication equipment based on privacy protection, wherein the method comprises the following steps: according to a predetermined privacy protection strategy matched with a user to be authenticated, carrying out biological feature acquisition processing on the user to be authenticated to obtain a target biological feature image; performing identity authentication processing on a user to be authenticated based on the target biological characteristic image; determining first security information of a user to be authenticated based on target biological characteristics by using a security evaluation model obtained by model training in advance; and if the preset privacy protection strategy adjusting condition is determined to be met according to the first security information, adjusting the privacy protection strategy matched with the user to be authenticated.

Description

Identity authentication method, device and equipment based on privacy protection

Technical Field

The present document relates to the field of identity authentication technologies, and in particular, to an identity authentication method, apparatus, and device based on privacy protection.

Background

In recent years, biometric identification technology has been rapidly developed and widely applied, for example, in payment, travel and other scenes, a face recognition system, a fingerprint recognition system and the like are widely adopted to perform identity authentication on a user. For a user, in the process of identity authentication based on biological characteristics, the most concerned problem is the security problem, and once the biological characteristics are revealed, troubles and even economic losses are brought to the user. Therefore, how to effectively protect the biological characteristics of the user in the identity authentication process based on the biological characteristic identification is a technical problem which needs to be solved urgently so as to improve the safety of the user.

Disclosure of Invention

One or more embodiments of the present specification provide an identity authentication method based on privacy protection. The method comprises the steps of carrying out biological feature acquisition processing on a user to be authenticated according to a predetermined privacy protection strategy matched with the user to be authenticated to obtain a target biological feature image. And performing identity authentication processing on the user to be authenticated based on the target biological characteristic image. And determining first security information of the user to be authenticated based on the target biological characteristics by using a security evaluation model obtained by model training in advance. And if the preset privacy protection strategy adjusting condition is determined to be met according to the first security information, adjusting the privacy protection strategy matched with the user to be authenticated.

One or more embodiments of the present specification provide an identity authentication method based on privacy protection. The method comprises the steps of carrying out biological feature acquisition processing on a user to be authenticated according to a predetermined privacy protection strategy matched with the user to be authenticated to obtain a target biological feature image. And performing identity authentication processing on the user to be authenticated based on the target biological characteristic image, and storing an identity authentication record generated according to an identity authentication result into the block chain system. And determining first security information of the user to be authenticated according to the target biological characteristics based on the intelligent contract in the block chain system and a security evaluation model obtained by model training in advance. And if the preset privacy protection policy adjustment condition is determined to be met according to the first security information based on the intelligent contract, adjusting the privacy protection policy matched with the user to be authenticated.

One or more embodiments of the present specification provide an identity authentication apparatus based on privacy protection. The device comprises an acquisition module, and biological characteristics of a user to be authenticated are acquired and processed according to a predetermined privacy protection strategy matched with the user to be authenticated to obtain a target biological characteristic image. The device also comprises an authentication module which is used for carrying out identity authentication processing on the user to be authenticated based on the target biological characteristic image. The device further comprises a determining module, wherein a security evaluation model obtained by model training in advance is adopted, and the first security information of the user to be authenticated is determined based on the target biological characteristics. The device further comprises an adjusting module, and if the preset privacy protection strategy adjusting condition is determined to be met according to the first security information, the privacy protection strategy matched with the user to be authenticated is adjusted.

One or more embodiments of the present specification provide an identity authentication apparatus based on privacy protection. The device comprises an acquisition module, and biological characteristics of a user to be authenticated are acquired and processed according to a predetermined privacy protection strategy matched with the user to be authenticated to obtain a target biological characteristic image. The device also comprises an authentication module which is used for carrying out identity authentication processing on the user to be authenticated based on the target biological characteristic image. The device also comprises a storage module for storing the identity authentication record generated according to the identity authentication result into the block chain system. The device further comprises a determining module, and the determining module is used for determining first security information of the user to be authenticated according to the target biological characteristics based on the intelligent contract in the block chain system and a security evaluation model obtained by model training in advance. The device further comprises an adjusting module, and if the preset privacy protection policy adjusting condition is determined to be met according to the first security information based on the intelligent contract, the privacy protection policy matched with the user to be authenticated is adjusted.

One or more embodiments of the present specification provide an identity authentication device based on privacy protection. The apparatus includes a processor. The apparatus also comprises a memory arranged to store computer executable instructions. When the computer executable instruction is executed, the processor carries out biological feature acquisition processing on the user to be authenticated according to a predetermined privacy protection strategy matched with the user to be authenticated, and a target biological feature image is obtained. And performing identity authentication processing on the user to be authenticated based on the target biological characteristic image. And determining first security information of the user to be authenticated based on the target biological characteristics by using a security evaluation model obtained by model training in advance. And if the preset privacy protection strategy adjusting condition is determined to be met according to the first security information, adjusting the privacy protection strategy matched with the user to be authenticated.

One or more embodiments of the present specification provide an identity authentication device based on privacy protection. The apparatus includes a processor. The apparatus also comprises a memory arranged to store computer executable instructions. When the computer executable instruction is executed, the processor carries out biological feature acquisition processing on the user to be authenticated according to a predetermined privacy protection strategy matched with the user to be authenticated, and a target biological feature image is obtained. And performing identity authentication processing on the user to be authenticated based on the target biological characteristic image, and storing an identity authentication record generated according to an identity authentication result into the block chain system. And determining first security information of the user to be authenticated according to the target biological characteristics based on the intelligent contract in the block chain system and a security evaluation model obtained by model training in advance. And if the preset privacy protection policy adjustment condition is determined to be met according to the first security information based on the intelligent contract, adjusting the privacy protection policy matched with the user to be authenticated.

One or more embodiments of the present specification provide a storage medium. The storage medium is used to store computer-executable instructions. And when being executed by the processor, the computer executable instruction carries out biological feature acquisition processing on the user to be authenticated according to a predetermined privacy protection strategy matched with the user to be authenticated, so as to obtain a target biological feature image. And performing identity authentication processing on the user to be authenticated based on the target biological characteristic image. And determining first security information of the user to be authenticated based on the target biological characteristics by using a security evaluation model obtained by model training in advance. And if the preset privacy protection strategy adjusting condition is determined to be met according to the first security information, adjusting the privacy protection strategy matched with the user to be authenticated.

One or more embodiments of the present specification provide a storage medium. The storage medium is used to store computer-executable instructions. And when being executed by the processor, the computer executable instruction carries out biological feature acquisition processing on the user to be authenticated according to a predetermined privacy protection strategy matched with the user to be authenticated, so as to obtain a target biological feature image. And performing identity authentication processing on the user to be authenticated based on the target biological characteristic image, and storing an identity authentication record generated according to an identity authentication result into the block chain system. And determining first security information of the user to be authenticated according to the target biological characteristics based on the intelligent contract in the block chain system and a security evaluation model obtained by model training in advance. And if the preset privacy protection policy adjustment condition is determined to be met according to the first security information based on the intelligent contract, adjusting the privacy protection policy matched with the user to be authenticated.

Drawings

In order to more clearly illustrate one or more embodiments or prior art solutions of the present specification, the drawings that are needed in the description of the embodiments or prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments described in the present specification, and that other drawings can be obtained by those skilled in the art without inventive exercise.

Fig. 1 is a first flowchart of an identity authentication method based on privacy protection according to one or more embodiments of the present disclosure;

fig. 2 is a second flowchart of an identity authentication method based on privacy protection according to one or more embodiments of the present disclosure;

fig. 3 is a schematic flow chart of a method for authenticating an identity based on privacy protection according to one or more embodiments of the present disclosure;

fig. 4 is a fourth flowchart illustrating an identity authentication method based on privacy protection according to one or more embodiments of the present disclosure;

fig. 5 is a schematic flow chart of a method for authenticating an identity based on privacy protection according to one or more embodiments of the present disclosure;

fig. 6 is a sixth flowchart of an identity authentication method based on privacy protection according to one or more embodiments of the present specification;

fig. 7 is a schematic diagram illustrating a first module of an identity authentication apparatus based on privacy protection according to one or more embodiments of the present disclosure;

fig. 8 is a schematic block diagram illustrating a second module of an identity authentication apparatus based on privacy protection according to one or more embodiments of the present disclosure;

fig. 9 is a schematic structural diagram of an identity authentication device based on privacy protection according to one or more embodiments of the present specification.

Detailed Description

In order to make those skilled in the art better understand the technical solutions in one or more embodiments of the present disclosure, the technical solutions in one or more embodiments of the present disclosure will be clearly and completely described below with reference to the drawings in one or more embodiments of the present disclosure, and it is obvious that the described embodiments are only a part of the embodiments of the present disclosure, and not all embodiments. All other embodiments that can be derived by a person skilled in the art from one or more of the embodiments described herein without making any inventive step shall fall within the scope of protection of this document.

Fig. 1 is a flowchart illustrating a method for privacy-based identity authentication according to one or more embodiments of the present disclosure, where the method in fig. 1 can be performed by a privacy-based identity authentication apparatus (hereinafter, simply referred to as an identity authentication apparatus). The identity authentication device can be arranged in the terminal equipment and can also be arranged at the server side. The terminal equipment can be a mobile phone, a tablet personal computer, a desktop computer, a portable notebook, intelligent wearable equipment and the like; the server side can be an independent server or a server cluster consisting of a plurality of servers. As shown in fig. 1, the method comprises the steps of:

step S102, according to a predetermined privacy protection strategy matched with a user to be authenticated, carrying out biological feature acquisition processing on the user to be authenticated to obtain a target biological feature image;

the identity authentication method based on privacy protection provided by the embodiment of the specification can be applied to scenes needing identity authentication of users such as payment, vehicle travel, access control authentication, business handling and the like. Considering that in practical application, different users often have different security perception degrees in a biological feature acquisition process, based on this, in the embodiment of the present specification, a plurality of privacy protection policies are generated in advance, a privacy protection policy matched with each user is determined according to a preset manner, and policy information of the determined privacy protection policy is stored in association with user information of the user; and when the identity of the user to be authenticated is authenticated, acquiring a privacy protection strategy matched with the user to be authenticated according to the determined user information of the user to be authenticated, and acquiring and processing the biological characteristics of the user to be authenticated according to the determined privacy protection strategy to obtain a target biological characteristic image. The biometric features may be one or more of a human face, an iris, a fingerprint, etc. Hereinafter, the target biometric feature is a human face as an example, and the related processing of other biometric features is the same as that of the target biometric feature, and may be referred to each other.

For convenience of understanding, a face brushing payment scene and a travel scene are taken as examples in the present specification for explanation. In a feasible implementation manner, the user performs face-brushing payment through a payment application in the terminal device of the user, the identity authentication device is arranged in a payment server corresponding to the payment application, and the policy information of the privacy protection policy matched with each user and the account information of the payment application of each user are stored in the payment server in an associated manner. When the user to be authenticated operates the payment application in the terminal equipment to submit payment information, the payment application sends a payment request to the payment server according to the obtained payment information and the stored account information of the payment application. And the identity authentication device arranged in the payment server acquires the associated policy information according to the account information in the payment request, and sends the privacy protection policy corresponding to the policy information to the payment application. The payment application collects a face image of a user to be authenticated through the terminal equipment according to a received privacy protection strategy, sends the face image, the determined information of the terminal equipment, the determined collection duration of the face image, the obtained position information of the terminal equipment and the like to the payment server, the identity authentication device conducts identity authentication processing on the user to be authenticated according to the received face image, conducts payment processing according to the payment information when the identity authentication is passed, determines all received information to be identity authentication data of the user to be authenticated and stores the identity authentication data, and executes subsequent processing of determining first security information of the user to be authenticated and the like. Or, the identity authentication device may include an acquisition module and an authentication module, wherein the acquisition module is disposed in the payment application, the authentication module is disposed in the payment server, and the privacy protection policy matched with the user to be authenticated is stored in the acquisition module in advance; when a user to be authenticated operates a payment application in terminal equipment of the user to be authenticated to submit payment information, an acquisition module acquires a face image of the user to be authenticated according to a stored privacy protection strategy matched with the user to be authenticated, and sends a payment request to a payment server according to the acquired face image, the payment information submitted by the user, the determined information of the terminal equipment, the determined acquisition duration of the face image, the acquired position information of the terminal equipment and the like. And an authentication module in the payment server performs identity authentication processing on the user to be authenticated according to the face image in the payment request, performs payment processing according to the payment information after the identity authentication is passed, determines and stores the received information as identity authentication data of the user to be authenticated, and executes subsequent processing of determining first security information of the user to be authenticated and the like.

In another possible implementation manner, the user performs identity authentication based on face recognition to take an airplane, and policy information of the privacy protection policy matched with the user and identity document information of the user can be stored in an authentication server in advance in an associated manner, where the identity authentication device is disposed. When a user to be authenticated takes an airplane, the identity document is placed on the entrance guard equipment arranged at an airport, and the entrance guard equipment firstly collects the identity document information and sends the identity document information to the authentication server. And the identity authentication device in the authentication server acquires the policy information stored in association according to the received identity document information, and sends the privacy protection policy corresponding to the policy information to the access control equipment. The access control equipment collects the face image of the user to be authenticated according to the received privacy protection strategy, and sends the face image, the collection duration of the determined face image, the equipment information of the access control equipment, the position information of the access control equipment and the like to the authentication server side. And the identity authentication device in the authentication server performs identity authentication processing on the user to be authenticated according to the received face image, sends an identity authentication result to the access control equipment, determines and stores the received information as identity authentication data of the user to be authenticated, and executes subsequent processing. And when the access control equipment determines that the identity authentication passes according to the received identity authentication result, the access control equipment performs release processing on the user to be authenticated.

It should be understood that the above embodiments are merely exemplary embodiments, and the identity authentication method based on privacy protection provided in this specification is not limited to the above embodiments, and may be set in an actual application as needed.

Step S104, performing identity authentication processing on the user to be authenticated based on the target biological characteristic image;

the specific identity authentication process can be set in practical application as required, and is not limited in this specification. In a possible implementation manner, according to a pre-trained identity authentication model, based on a target biological feature image and a biological feature image in an authoritative biological feature library, identity authentication processing is performed on a user to be authenticated.

Step S106, determining first security information of a user to be authenticated based on target biological characteristics by adopting a security evaluation model obtained by model training in advance;

in view of the fact that the security perception of the user is not constant, in order to enable the user to better feel that the privacy information of the user is in a protected state during identity authentication, in the embodiment of the present specification, a security evaluation model is trained in advance, and first security information of the user to be authenticated is determined based on the security evaluation model, so that adjustment processing of a privacy protection policy is performed based on the first security information. Specifically, the user characteristics and the auxiliary characteristics of the user to be authenticated are determined according to the identity authentication data of the user, and the determined user characteristics and the auxiliary characteristics are input into the security evaluation model to obtain first security information of the user to be authenticated.

The first security information may be a security score or a security level. User features and assist features may vary from application scenario to application scenario; for example, for a face-brushing payment scenario, the user characteristics may include identity characteristics (e.g., characteristics of key points such as eyes, nose, etc.) and emotional characteristics (e.g., happy, nervous, etc.) of the user; the auxiliary features may include position information of a position where a user is located when the face is collected, information of a terminal device that collects the face image (such as a device identifier, a version of a payment application installed in the device, and the like), a collection duration of the face image, a quantity of transaction resources, image attack information (used for representing whether the face image in the terminal device such as a mobile phone is used for image attack), and the like. For another example, for a fingerprint-collected traffic travel scene, the user characteristics may include an identity characteristic (e.g., fingerprint characteristic) of the user; the auxiliary features may include location information of a location where the user is located when the fingerprint is collected (i.e., location information of the fingerprint collection device), information of the fingerprint collection device, a collection duration of the fingerprint, and the like. The specific determination of the identity and emotional characteristics can be found in the following description.

And step S108, if the preset privacy protection strategy adjusting condition is determined to be met according to the first security information, adjusting the privacy protection strategy matched with the user to be authenticated.

In one or more embodiments of the present specification, according to a predetermined privacy protection policy matched with a user to be authenticated, a biometric feature of the user to be authenticated is acquired, and a target biometric feature image is obtained; performing identity authentication processing on a user to be authenticated based on the target biological characteristic image; determining first security information of a user to be authenticated based on target biological characteristics by using a security evaluation model obtained by model training in advance; and if the preset privacy protection strategy adjusting condition is determined to be met according to the first security information, adjusting the privacy protection strategy matched with the user to be authenticated. Therefore, the target biological characteristic image of the user to be authenticated is collected according to the privacy protection strategy matched with the user to be authenticated, the target biological characteristic image can be effectively protected on the premise of meeting the security feeling of the user to be authenticated, and the privacy disclosure of the user is avoided. By determining the first security information of the user to be authenticated and adjusting the privacy protection strategy matched with the user to be authenticated according to the first security information, the privacy protection strategy can be changed along with the change of the user security, and meanwhile, the user can really feel that the biological characteristics of the user are in a protected state, so that the identity authentication experience of the user is improved.

In order to realize privacy protection of a user and improve the security of the user, a privacy protection strategy matched with the user to be authenticated is determined firstly. Considering that some users may be authenticated for the first time, the determination cannot be made based on a pre-trained security assessment model when determining a privacy protection policy matching the user. Based on the method, when the privacy protection strategy matched with the user to be authenticated is determined for the first time, different determination modes are adopted for different users to be authenticated. Specifically, as shown in fig. 2, step S102 may further include the following step S100-2 to step S100-8 before:

step S100-2, determining whether historical identity authentication data of a user to be authenticated is acquired, if so, executing step S100-4, otherwise, executing step S100-8;

specifically, determining user information of a user to be authenticated, and determining whether historical identity authentication data stored in a correlated manner is inquired from a specified database according to the user information of the user to be authenticated; if yes, executing step S100-4; if not, step S100-8 is executed. The process of determining the user information of the user to be authenticated can be different according to different scenes, for example, in a face-brushing payment scene, the user information can be determined according to the registration information of the user about the payment application; in the traffic trip, user information and the like in the identity document can be extracted. In this regard, the present specification is not particularly limited.

S100-4, determining second security information of the user to be authenticated based on the acquired historical identity authentication data by adopting a security evaluation model obtained by model training in advance; determining a fourth security level of the user to be authenticated according to the second security information;

specifically, when the second safety sensation information is a second safety sensation score, determining a target score interval to which the second safety sensation score belongs in a plurality of preset score intervals; according to the target score interval, acquiring a corresponding security level from a corresponding relation between a preset score interval and the security level; and determining the obtained security level as a first security level of the user to be authenticated. And when the security sense level is the second security sense information, determining the security sense level obtained by adopting the security sense evaluation model as a fourth security sense level of the user to be authenticated.

S100-6, acquiring a corresponding privacy protection strategy from the corresponding relation between the preset security level and the privacy protection strategy according to the fourth security level; determining the obtained privacy protection strategy as a privacy protection strategy matched with a user to be authenticated;

and S100-8, determining the default privacy protection strategy as the privacy protection strategy matched with the user to be authenticated.

The default privacy protection policy can be set in practical application according to needs. In one embodiment, the level of security perception includes high, medium and low; the privacy protection policy corresponding to the middle level may be determined as a default privacy protection policy.

In order to enable a user to better feel that the biometric features of the user are in a protected state during identity authentication, in one or more embodiments of the present specification, different biometric feature collection methods are adopted for different privacy protection policies. Specifically, step S102 may include:

if the predetermined privacy protection strategy matched with the user to be authenticated is the first privacy protection strategy, acquiring a target biological characteristic image of the user to be authenticated based on a biological characteristic acquisition mode without user interaction and privacy protection prompt;

if the predetermined privacy protection strategy matched with the user to be authenticated is a second privacy protection strategy, acquiring a target biological characteristic image of the user to be authenticated based on a biological characteristic acquisition mode of privacy protection prompt;

and if the predetermined privacy protection strategy matched with the user to be authenticated is the third privacy protection strategy, acquiring a target biological characteristic image of the user to be authenticated based on a biological characteristic acquisition mode combining user interaction and privacy protection prompt.

In one embodiment, the security level may include three levels, i.e., a high level, a medium level, and a low level, and the privacy protection policy may include a first privacy protection policy, a second privacy protection policy, and a third privacy protection policy, respectively. When the determined security level of the user to be authenticated is high, determining a first privacy protection strategy as a privacy protection strategy matched with the user to be authenticated; when the security level of the user to be authenticated is a middle level, determining the second privacy protection strategy as a privacy protection strategy matched with the user to be authenticated; and when the security level of the user to be authenticated is low, determining the third privacy protection policy as the privacy protection policy matched with the user to be authenticated. And the first privacy protection strategy adopts a biological characteristic collection mode without user interaction and privacy protection prompt, the second privacy protection strategy adopts a biological characteristic collection mode without privacy protection prompt, and the third privacy protection strategy adopts a biological characteristic collection mode combining user interaction and privacy protection prompt. The privacy protection prompt can be that text, patterns and the like related to privacy protection are displayed in a collecting screen so as to prompt a user to be in a privacy protection state; for example, a highlighted font is used to prompt that "you are protecting your private data using the privacy protection method, please use it with confidence" and a green shield pattern is displayed, etc. The privacy protection prompt may also be a voice playing mode, which prompts that the user to be authenticated is in a privacy protection state, for example, voice playing "use privacy protection method to protect your privacy data, please use for ease", and the like ". The user interaction can be prompting of the user to be authenticated to cooperatively perform actions of blinking, shaking head, mouth opening, head pointing and the like, so that the user to be authenticated feels that the privacy data is in a protected state, and the safety of the user is enhanced.

It should be noted that the above-mentioned dividing manner of the security level is only an exemplary dividing manner, and the dividing manner of the security level is not limited to this, and may be set by itself in practical applications according to needs, for example, a middle-high level, a middle-low level, or a first level, a second level, a third level, a fourth level, a fifth level, or even a higher level may be set in sequence.

Therefore, for users to be authenticated with different security levels, the privacy protection strategies based on different biological characteristic acquisition modes are adopted to acquire the target biological characteristic images, so that each user to be authenticated can feel that the biological characteristic image of the user to be authenticated is in a protected state, and the security of the user to be authenticated is improved.

In one or more embodiments of the present specification, as shown in fig. 3, step S108 may include the following steps S108-2 and S108-4, in order to allow the privacy protection policy matched with the user to be authenticated to change with the change of the security of the user to be authenticated, considering that the security of the user may change with the change of the environment or time:

step S108-2, determining whether a preset safety inspection condition is met;

specifically, whether the time length between the current time and the previous safety inspection time reaches a preset time length or not is determined, and if yes, the preset safety inspection condition is determined to be met; if not, determining that the preset safety inspection condition is not met. Or, if the user to be authenticated is determined to replace the biological characteristic acquisition equipment according to the information of the biological characteristic acquisition equipment acquired by the current identity authentication processing, the preset security inspection condition is determined to be met. The inspection condition for the safety sense can be set automatically in practical application according to the requirement, and the specification is not limited specifically.

Step S108-4, if the preset privacy protection policy adjustment condition is determined to be met according to the first security information, adjusting a privacy protection policy matched with the user to be authenticated:

specifically, as shown in fig. 4, step S108-4 may include the following steps S108-42 to S108-48:

step S108-42, if yes, determining a first security level of the user to be authenticated according to the first security information, and determining a second security level corresponding to a predetermined privacy protection policy matched with the user to be authenticated;

in one or more embodiments of the present description, the first security information may include a first security level, and accordingly, determining the first security level of the user to be authenticated according to the first security information may include: and determining a first security level in the first security information as a first security level of the user to be authenticated.

In one or more embodiments of the present description, the first security information may include a first security score, and the first security level of the user to be authenticated is determined according to the first security score. Namely, determining a first security level of the user to be authenticated according to the first security information may include: determining a target score interval to which a first safety sensation score belongs in a plurality of preset score intervals; according to the target score interval, acquiring a corresponding security level from a corresponding relation between a preset score interval and the security level; and determining the obtained security level as a first security level of the user to be authenticated.

In one or more embodiments of the present specification, the first security information may include a first security score, and the first security level of the user to be authenticated is determined according to the first security score and a historical security score of the user to be authenticated. Namely, determining a first security level of the user to be authenticated according to the first security information may include: if the historical security score of the user to be authenticated is obtained, calculating the average security score of the user to be authenticated according to the historical security score and the first security score; determining a target score interval to which the average safety feeling score belongs in a plurality of preset score intervals; according to the determined target score interval, acquiring a corresponding security level from the corresponding relation between a preset score interval and the security level; and determining the obtained security level as a first security level of the user to be authenticated. Correspondingly, the method further comprises the following steps: and saving the determined first security feeling score.

Step S108-44, if the first security level is not matched with the second security level, the first security level is lower than the second security level, and the second security level is not the highest level, determining that the preset privacy protection strategy adjustment condition is met;

specifically, when the first security level is matched with the second security level, the security level representing the user to be authenticated is not changed, and it is determined that the preset privacy protection policy adjustment condition is not met. When the first security level is not matched with the second security level and the first security level is higher than the second security level, the security level representing the user to be authenticated is improved, the predetermined privacy protection strategy matched with the user to be authenticated can meet the security of the user to be authenticated, and therefore the predetermined privacy protection strategy adjustment condition is determined not to be met. When the first security level is not matched with the second security level, the first security level is lower than the second security level, and the second security level is the highest level, the security level representing the user to be authenticated is lowered, but because the second security level corresponding to the privacy protection policy which is predetermined to be matched with the user to be authenticated is the highest level, no room for adjustment exists, and therefore the preset privacy protection policy adjustment condition is determined not to be met.

S108-46, determining a third security level which is adjacent to the second security level and higher than the second security level, and determining a privacy protection strategy corresponding to the third security level as a target privacy protection strategy matched with the user to be authenticated;

for example, if the second security level is a middle level, the privacy protection policy corresponding to the middle level is determined as the target privacy protection policy matching the user to be authenticated.

And S108-48, adjusting the predetermined privacy protection strategy matched with the user to be authenticated into a target privacy protection strategy.

Therefore, when the preset security inspection condition is met, the privacy protection strategy is adjusted, the privacy protection strategy can be changed along with the change of the security of the user to be authenticated, the privacy security of the user can be protected, the user can feel that the biological characteristics of the user are protected, and the identity authentication experience of the user to be authenticated can be improved.

Further, considering that in practical application, the security senses of some users are variable, in order to update the privacy protection policy matched with the user to be authenticated in time, in one or more embodiments of the present specification, after the user to be authenticated is subjected to the identity authentication process each time, the first security sense information of the user to be authenticated is determined based on the target biometric image corresponding to the current identity authentication process, and when it is determined that the preset privacy protection policy adjustment condition is met according to the first security sense information, the privacy protection policy matched with the user to be authenticated is adjusted. The process of adjusting the privacy protection policy matched with the user to be authenticated when the preset privacy protection policy adjustment condition is determined to be met according to the first security information may refer to the foregoing related description, and repeated details are not repeated here.

Further, in order to facilitate tracing the identity authentication process of the user to be authenticated subsequently, in one or more embodiments of the present specification, the method may further include:

determining a corresponding target encryption mode according to a predetermined privacy protection strategy matched with a user to be authenticated; and encrypting the target biological characteristic image according to the target encryption mode to obtain a ciphertext image, and storing the ciphertext image. The ciphertext image can be associated with the determined acquisition duration of the target biological characteristic image, information of the acquisition equipment of the target biological characteristic image and the like and recorded as identity authentication data of the user to be authenticated, and the identity authentication data is stored.

The encryption modes corresponding to different privacy protection strategies can be set in practical application according to needs. For example, when the security level includes a high level, a middle level, and a low level, the privacy protection policy corresponding to the high level and the middle level may be encrypted by using a basic encryption method, such as an encryption algorithm such as RSA, MD5, etc.; the lower-level corresponding privacy protection policy may be encrypted by using an encryption method with a better security level, for example, using a pre-trained privacy protection model.

In order to implement effective adjustment of the privacy protection policy, as shown in fig. 5, in one or more embodiments of the present specification, before step S102, the following steps S100-10 to S100-16 may further be included:

step S100-10, sending a security questionnaire to a plurality of determined target users, and acquiring the reply information of each target user to the security questionnaire;

specifically, a security survey questionnaire is generated in advance, and a plurality of target users are determined; and sending a security questionnaire to the determined target users, and acquiring response information of each target user to the security questionnaire. The security questionnaire can comprise a plurality of security questions and a plurality of privacy questions, and each question can have a plurality of scores for the user to select; the reply information includes a score selected by the user, and the like. The specific contents of the safety sense problems and the privacy problems can be set in practical application according to the needs. For example, a sense of security issue may include: in the existing biological identification scheme, whether the user thinks it is safe or not is scored according to 1-10 points in terms of safety; in public places, you do not use biometrics because of security concerns, the probability is from 1-10 points, please score, etc. Privacy-type issues may include: in the existing biological identification scheme, a user thinks whether a privacy problem exists, and the user is asked to score 1-10 points in terms of privacy security (the higher the score is, the more the privacy is safe); in public places, you think how many scores are for privacy protection of biometric schemes, please score 1-10 points, etc.

Further, the manner of determining the target user may be different according to different application scenarios, for example, in a face-brushing payment scenario, each user registered with the payment application may be determined as the target user; or determining a user with a payment frequency higher than a preset frequency in the users registered with the payment application as a target user; or, a target user is randomly selected from among users registered with the payment application, and the like. For another example, in a vehicle travel scene, the travel frequency of each user traveling within a preset time period may be counted, and a user whose travel frequency is higher than the preset frequency may be determined as a target user. The determination method of the target user is not specifically limited in this specification.

Further, sending the security questionnaire to the target user may be sending the security questionnaire to an application program related to the user (for example, sending the security questionnaire to a payment application), sending the security questionnaire to a mailbox of the user, and the like; the present specification is not particularly limited, and may be set as needed in practical applications.

S100-12, determining corresponding safety information of the target user according to the reply information;

specifically, the total score of the scores of the questions selected by the user is counted according to the response information, the total score is determined as the safety feeling score of the corresponding target user, and the counted safety feeling score is determined as the safety feeling information of the corresponding target user; or determining the security level of the corresponding target user according to the counted security score, the preset score interval and the corresponding relation between the score interval and the security level, and determining the security level as the security information of the corresponding target user. For example, a rating of 1.0-4.0 corresponds to a low level of security; 4.0-7.0 points of corresponding safety feeling grade as middle grade; the corresponding safety feeling grade of 7.0-1.0 is high grade, etc.

S100-14, acquiring historical identity authentication data of a target user;

specifically, historical authentication data of the target user is acquired according to the determined user information (for example, account information of the payment application, identity document information, and the like) of the target user. The historical identity authentication data may be different according to different application scenarios, for example, for a face-brushing payment scenario, the historical identity authentication data may include a face image, position information of a position where a user is located when the face image is collected, information of a collecting device of the face image, collecting duration information of the face image, amount information of transaction resources, and the like. For the trip based on the face recognition, the historical identity authentication data may include a face image, position information of a position where the user is located when the face image is collected, information of a collecting device of the face image, collecting duration information of the face image, and the like. The transaction resource may be an entity resource, such as a fund, or a virtual resource, such as points, electronic money, or the like.

And S100-16, performing model training processing according to the security information and the historical identity authentication data to obtain a security evaluation model.

Specifically, according to each historical identity authentication data, determining corresponding user characteristics and auxiliary characteristics; generating sample data according to the user characteristics, the auxiliary characteristics and the security information to obtain a sample set; and training based on the sample set and a preset loss function to obtain a security evaluation model. Wherein the user characteristics include one or more of: identity characteristics, emotional characteristics, etc.; the assist features include one or more of: the method comprises the steps of collecting position information of a user when biological characteristics are collected, information of biological characteristic collecting equipment, biological characteristic collecting duration information, transaction resource quantity information, image attack information and the like. The identity characteristics can be characteristics of key points such as eyes, noses and the like, and can also be characteristics of fingerprints, irises and the like; the emotional characteristics represent expressions of the user when the user collects the biological characteristic images, such as happiness, difficulty, tension and the like; the image attack information is used for representing whether a user adopts images in terminal equipment such as a mobile phone to carry out image attack, namely whether the user is living body authentication.

More specifically, the image analysis model may be trained in advance, and the biometric image in the historical identity authentication data may be input into the image analysis model to obtain an image analysis result. And determining the user characteristics and the auxiliary characteristics of the corresponding users according to the image analysis result and the historical identity authentication data, correlating the user characteristics, the auxiliary characteristics and the security feeling scores of the same target user and determining the user characteristics, the auxiliary characteristics and the security feeling scores as sample data to obtain a sample data set. Dividing a sample data set into a training set and a test set; and inputting the sample data in the training set into a training network of the security evaluation model for training until a preset loss function is converged to obtain an initial security evaluation model. Testing the initial security perception evaluation model by adopting a test set, and determining the corresponding initial security perception evaluation model as a final security perception evaluation model when a test result meets a preset condition; and when the test result does not meet the preset condition, carrying out training again based on the training set until a final security evaluation model is obtained.

It is understood that the image analysis results may be different for different types of biometric features. For example, when the biometric feature is a human face, the image analysis result may include an identity feature, an emotional feature, image attack information representing whether the image attack is performed, and the like of the user. When the biometric image is a fingerprint, the image analysis result may include an identity feature, image attack information representing whether the image attack is performed, and the like.

Therefore, the corresponding user characteristics and auxiliary characteristics are determined based on the historical identity authentication data of the target user, and the self performance of the user and the conditions of the surrounding environment can be comprehensively described in the identity authentication process of the user. Therefore, model training is carried out based on the user characteristics, the auxiliary characteristics and the security score, and the security evaluation model obtained through training can effectively evaluate the security perception of the user under different conditions.

Corresponding to the above-described identity authentication method based on privacy protection, based on the same technical concept, one or more embodiments of the present specification further provide another identity authentication method based on privacy protection, fig. 6 is a schematic flow diagram of another identity authentication method based on privacy protection provided by one or more embodiments of the present specification, and the method in fig. 6 can be executed by a block chain system; as shown in fig. 6, the method comprises the steps of:

step S202, according to a predetermined privacy protection strategy matched with a user to be authenticated, carrying out biological feature acquisition processing on the user to be authenticated to obtain a target biological feature image;

step S204, performing identity authentication processing on the user to be authenticated based on the target biological characteristic image, and storing an identity authentication record generated according to an identity authentication result into the block chain system;

specifically, identity authentication processing is carried out on a user to be authenticated based on the target biological characteristic image to obtain an identity authentication result; determining a corresponding target encryption mode according to a predetermined privacy protection strategy matched with a user to be authenticated; encrypting the target biological characteristic image according to a target encryption mode to obtain a ciphertext image; determining query information of an identity authentication result; generating identity authentication record information according to the identity authentication result, the ciphertext image and the query information; and storing the identity authentication record information into the block chain system.

Step S206, determining first security information of a user to be authenticated according to target biological characteristics based on an intelligent contract in a block chain system and a security evaluation model obtained by model training in advance;

and S208, if the preset privacy protection policy adjusting condition is determined to be met based on the intelligent contract according to the first security information, adjusting the privacy protection policy matched with the user to be authenticated.

In consideration of the characteristics that an intelligent contract has automatic execution and cannot be intervened, in order to improve the accuracy of privacy protection policy adjustment, in the specification, the intelligent contract in a block chain system is called, a security evaluation model obtained by model training in advance is based on the intelligent contract, and first security information of a user to be authenticated is determined according to target biological characteristics; and if the preset privacy protection policy adjusting condition is determined to be met based on the intelligent contract according to the first security information, adjusting the privacy protection policy matched with the user to be authenticated.

Considering that there is a query requirement for the identity authentication result in practical application, in one or more embodiments of the present specification, the method may further include:

receiving an inquiry request sent by an inquirer; inquiring related identity authentication result information from the block chain system according to the inquiry information included in the inquiry request; and sending the inquired identity authentication result information to the inquiring party. The inquiring party may be the user to be authenticated, a related service provider (for example, a financial institution in a payment scenario), or a third party authority for performing service supervision. After determining the query information, the blockchain system can send the query information to the user to be authenticated and the service provider; the third party authority may obtain the query information from the user to be authenticated or the service provider.

It should be noted that, for a specific implementation manner of each operation in the above step S202 to step S208, reference may be made to the foregoing related description, and repeated details are not described herein again.

In one or more embodiments of the present specification, according to a predetermined privacy protection policy matched with a user to be authenticated, a biometric feature of the user to be authenticated is acquired, and a target biometric feature image is obtained; performing identity authentication processing on a user to be authenticated based on the target biological characteristic image, and storing an identity authentication record generated according to an identity authentication result into the block chain system; determining first security information of a user to be authenticated according to target biological characteristics based on an intelligent contract in the block chain system and a security evaluation model obtained by model training in advance; and if the preset privacy protection strategy adjusting condition is determined to be met according to the first security information based on the intelligent contract, adjusting the privacy protection strategy matched with the user to be authenticated. Therefore, the target biological characteristic image of the user to be authenticated is collected according to the privacy protection strategy matched with the user to be authenticated, the target biological characteristic image can be effectively protected on the premise of meeting the security feeling of the user to be authenticated, and the privacy disclosure of the user is avoided. The first security information of the user to be authenticated is determined based on the intelligent contract and the security evaluation model, the privacy protection strategy matched with the user to be authenticated is adjusted according to the first security information, the adjustment accuracy of the privacy protection strategy can be guaranteed, the privacy protection strategy is changed along with the change of the security of the user, the user can really feel that the biological characteristics of the user are in a protected state, and the identity authentication experience of the user is improved. Moreover, the identity authentication record is stored in the block chain system, so that the authenticity and the validity of the identity authentication record can be ensured based on the characteristics of the block chain, and an effective basis is provided for subsequent related processing.

On the basis of the same technical concept, the identity authentication method based on privacy protection described in correspondence with fig. 1 to 5 above also provides an identity authentication device based on privacy protection according to one or more embodiments of the present specification. Fig. 7 is a schematic block diagram illustrating an identity authentication apparatus based on privacy protection according to one or more embodiments of the present specification, where, as shown in fig. 7, the apparatus includes:

the acquisition module 301 is configured to perform biometric acquisition processing on a user to be authenticated according to a predetermined privacy protection policy matched with the user to be authenticated, so as to obtain a target biometric image;

the authentication module 302 is used for performing identity authentication processing on the user to be authenticated based on the target biological characteristic image;

the determining module 303 is configured to determine, based on the target biological feature, first security information of the user to be authenticated, by using a security evaluation model obtained by performing model training in advance;

and the adjusting module 304 is configured to adjust the privacy protection policy matched with the user to be authenticated if it is determined that the preset privacy protection policy adjusting condition is met according to the first security information.

Optionally, the acquiring module 301 acquires a target biometric image of the user to be authenticated based on a biometric acquisition manner without user interaction and privacy protection prompt if the predetermined privacy protection policy matched with the user to be authenticated is a first privacy protection policy; and the number of the first and second groups,

if the predetermined privacy protection strategy matched with the user to be authenticated is a second privacy protection strategy, acquiring a target biological characteristic image of the user to be authenticated based on a biological characteristic acquisition mode of the privacy protection prompt;

and if the predetermined privacy protection strategy matched with the user to be authenticated is a third privacy protection strategy, acquiring a target biological characteristic image of the user to be authenticated based on a biological characteristic acquisition mode combining the user interaction and the privacy protection prompt.

Optionally, the adjusting module 304 determines whether a preset safety inspection condition is met;

and if the preset privacy protection strategy adjustment condition is met according to the first security information, adjusting the privacy protection strategy matched with the user to be authenticated.

Optionally, the apparatus further comprises: a processing module and a training module;

the processing module is used for sending a security questionnaire to a plurality of determined target users and acquiring the reply information of each target user to the security questionnaire; determining the safety information of the corresponding target user according to the reply information; acquiring historical identity authentication data of the target user;

and the training module is used for carrying out model training processing according to the security information and the historical identity authentication data to obtain the security evaluation model.

According to the identity authentication device based on privacy protection provided by one or more embodiments of the present specification, according to a predetermined privacy protection policy matched with a user to be authenticated, a biometric feature of the user to be authenticated is acquired, and a target biometric image is obtained; performing identity authentication processing on a user to be authenticated based on the target biological characteristic image; determining first security information of a user to be authenticated based on target biological characteristics by using a security evaluation model obtained by model training in advance; and if the preset privacy protection strategy adjusting condition is determined to be met according to the first security information, adjusting the privacy protection strategy matched with the user to be authenticated. Therefore, the target biological characteristic image of the user to be authenticated is collected according to the privacy protection strategy matched with the user to be authenticated, the target biological characteristic image can be effectively protected on the premise of meeting the security feeling of the user to be authenticated, and the privacy disclosure of the user is avoided. By determining the first security information of the user to be authenticated and adjusting the privacy protection strategy matched with the user to be authenticated according to the first security information, the privacy protection strategy can be changed along with the change of the user security, and meanwhile, the user can really feel that the biological characteristics of the user are in a protected state, so that the identity authentication experience of the user is improved.

It should be noted that, the embodiment of the identity authentication apparatus based on privacy protection in this specification and the embodiment of the identity authentication method based on privacy protection in this specification are based on the same inventive concept, and therefore, for specific implementation of this embodiment, reference may be made to implementation of the corresponding identity authentication method based on privacy protection, and repeated details are not repeated.

Further, based on the same technical concept, the identity authentication method based on privacy protection described in correspondence to fig. 6 above, one or more embodiments of the present specification further provide another identity authentication apparatus based on privacy protection. Fig. 8 is a schematic block diagram of another identity authentication apparatus based on privacy protection according to one or more embodiments of the present disclosure, as shown in fig. 8, the apparatus includes:

the acquisition module 401 is configured to perform biometric acquisition processing on a user to be authenticated according to a predetermined privacy protection policy matched with the user to be authenticated, so as to obtain a target biometric image;

an authentication module 402, configured to perform identity authentication processing on the user to be authenticated based on the target biometric image;

the saving module 403 is configured to save the identity authentication record generated according to the identity authentication result into the blockchain system;

a determining module 404, configured to determine, based on the intelligent contract in the blockchain system and a security evaluation model obtained by performing model training in advance, first security information of the user to be authenticated according to the target biometric feature;

and an adjusting module 405, configured to adjust the privacy protection policy matched with the user to be authenticated if it is determined that a preset privacy protection policy adjustment condition is met based on the intelligent contract according to the first security information.

Optionally, the saving module 403 determines a corresponding target encryption manner according to a predetermined privacy protection policy matched with the user to be authenticated; and the number of the first and second groups,

encrypting the target biological characteristic image according to the target encryption mode to obtain a ciphertext image;

determining query information of the identity authentication result;

generating identity authentication record information according to the identity authentication result, the ciphertext image and the query information;

and storing the identity authentication record information into a block chain system.

Optionally, the apparatus further comprises: a query module;

the query module receives a query request sent by a query party; and the number of the first and second groups,

inquiring related identity authentication result information from the block chain system according to the inquiry information included in the inquiry request;

and sending the inquired identity authentication result information to the inquirer.

According to the identity authentication device based on privacy protection provided by one or more embodiments of the present specification, according to a predetermined privacy protection policy matched with a user to be authenticated, a biometric feature of the user to be authenticated is acquired, and a target biometric image is obtained; performing identity authentication processing on a user to be authenticated based on the target biological characteristic image, and storing an identity authentication record generated according to an identity authentication result into the block chain system; determining first security information of a user to be authenticated according to target biological characteristics based on an intelligent contract in the block chain system and a security evaluation model obtained by model training in advance; and if the preset privacy protection strategy adjusting condition is determined to be met according to the first security information based on the intelligent contract, adjusting the privacy protection strategy matched with the user to be authenticated. Therefore, the target biological characteristic image of the user to be authenticated is collected according to the privacy protection strategy matched with the user to be authenticated, the target biological characteristic image can be effectively protected on the premise of meeting the security feeling of the user to be authenticated, and the privacy disclosure of the user is avoided. The first security information of the user to be authenticated is determined based on the intelligent contract and the security evaluation model, the privacy protection strategy matched with the user to be authenticated is adjusted according to the first security information, the adjustment accuracy of the privacy protection strategy can be guaranteed, the privacy protection strategy is changed along with the change of the security of the user, the user can really feel that the biological characteristics of the user are in a protected state, and the identity authentication experience of the user is improved. Moreover, the identity authentication record is stored in the block chain system, so that the authenticity and the validity of the identity authentication record can be ensured based on the characteristics of the block chain, and an effective basis is provided for subsequent related processing.

Further, corresponding to the above-described identity authentication method based on privacy protection, based on the same technical concept, one or more embodiments of the present specification further provide an identity authentication device based on privacy protection, where the device is configured to perform the above-described identity authentication method based on privacy protection, and fig. 9 is a schematic structural diagram of the identity authentication device based on privacy protection provided by one or more embodiments of the present specification.

As shown in fig. 9, the privacy-based identity authentication device may have a relatively large difference due to different configurations or performances, and may include one or more processors 501 and a memory 502, where the memory 502 may store one or more stored applications or data. Memory 502 may be, among other things, transient or persistent storage. The application program stored in memory 502 may include one or more modules (not shown), each of which may include a series of computer-executable instructions in a privacy-based identity authentication device. Still further, the processor 501 may be configured to communicate with the memory 502 to execute a series of computer-executable instructions in the memory 502 on a privacy-based authentication device. The privacy-preserving based identity authentication apparatus may also include one or more power supplies 503, one or more wired or wireless network interfaces 504, one or more input-output interfaces 505, one or more keyboards 506, and the like.

In a particular embodiment, a privacy-based authentication apparatus includes a memory, and one or more programs, wherein the one or more programs are stored in the memory, and the one or more programs may include one or more modules, and each module may include a series of computer-executable instructions for the privacy-based authentication apparatus, and execution of the one or more programs by one or more processors includes computer-executable instructions for:

according to a predetermined privacy protection strategy matched with a user to be authenticated, carrying out biological feature acquisition processing on the user to be authenticated to obtain a target biological feature image;

performing identity authentication processing on the user to be authenticated based on the target biological characteristic image;

determining first security information of the user to be authenticated based on the target biological characteristics by using a security evaluation model obtained by model training in advance;

and if the preset privacy protection strategy adjusting condition is determined to be met according to the first security information, adjusting the privacy protection strategy matched with the user to be authenticated.

Optionally, when executed, the computer-executable instructions perform biometric acquisition processing on the user to be authenticated, and obtaining the target biometric image includes:

Optionally, when executed, before performing the biometric acquisition processing on the user to be authenticated according to the predetermined privacy protection policy matched with the user to be authenticated, the computer-executable instructions further include:

sending a security questionnaire to a plurality of determined target users, and acquiring reply information of each target user to the security questionnaire;

determining corresponding safety information of the target user according to the reply information;

acquiring historical identity authentication data of the target user;

and performing model training processing according to the security information and the historical identity authentication data to obtain the security evaluation model.

According to the identity authentication device based on privacy protection provided by one or more embodiments of the present specification, according to a predetermined privacy protection policy matched with a user to be authenticated, a biometric feature of the user to be authenticated is acquired, so as to obtain a target biometric image; performing identity authentication processing on a user to be authenticated based on the target biological characteristic image; determining first security information of a user to be authenticated based on target biological characteristics by using a security evaluation model obtained by model training in advance; and if the preset privacy protection strategy adjusting condition is determined to be met according to the first security information, adjusting the privacy protection strategy matched with the user to be authenticated. Therefore, the target biological characteristic image of the user to be authenticated is collected according to the privacy protection strategy matched with the user to be authenticated, the target biological characteristic image can be effectively protected on the premise of meeting the security feeling of the user to be authenticated, and the privacy disclosure of the user is avoided. By determining the first security information of the user to be authenticated and adjusting the privacy protection strategy matched with the user to be authenticated according to the first security information, the privacy protection strategy can be changed along with the change of the user security, and meanwhile, the user can really feel that the biological characteristics of the user are in a protected state, so that the identity authentication experience of the user is improved.

In another particular embodiment, a privacy-based authentication apparatus includes a memory, and one or more programs, wherein the one or more programs are stored in the memory, and the one or more programs may include one or more modules, and each module may include a series of computer-executable instructions for the privacy-based authentication apparatus, and execution of the one or more programs by one or more processors includes computer-executable instructions for:

performing identity authentication processing on the user to be authenticated based on the target biological characteristic image, and storing an identity authentication record generated according to an identity authentication result into a block chain system;

determining first security information of the user to be authenticated according to the target biological characteristics based on an intelligent contract in the block chain system and a security evaluation model obtained by model training in advance;

and if the preset privacy protection policy adjustment condition is determined to be met according to the first security information based on the intelligent contract, adjusting the privacy protection policy matched with the user to be authenticated.

Optionally, when executed, the computer executable instructions store the identity authentication record generated according to the identity authentication result in the blockchain system, including:

determining a corresponding target encryption mode according to a predetermined privacy protection strategy matched with a user to be authenticated;

determining query information of the identity authentication result;

Optionally, the computer executable instructions, when executed, further comprise:

receiving an inquiry request sent by an inquirer;

According to the identity authentication device based on privacy protection provided by one or more embodiments of the present specification, according to a predetermined privacy protection policy matched with a user to be authenticated, a biometric feature of the user to be authenticated is acquired, so as to obtain a target biometric image; performing identity authentication processing on a user to be authenticated based on the target biological characteristic image, and storing an identity authentication record generated according to an identity authentication result into the block chain system; determining first security information of a user to be authenticated according to target biological characteristics based on an intelligent contract in the block chain system and a security evaluation model obtained by model training in advance; and if the preset privacy protection strategy adjusting condition is determined to be met according to the first security information based on the intelligent contract, adjusting the privacy protection strategy matched with the user to be authenticated. Therefore, the target biological characteristic image of the user to be authenticated is collected according to the privacy protection strategy matched with the user to be authenticated, the target biological characteristic image can be effectively protected on the premise of meeting the security feeling of the user to be authenticated, and the privacy disclosure of the user is avoided. The first security information of the user to be authenticated is determined based on the intelligent contract and the security evaluation model, the privacy protection strategy matched with the user to be authenticated is adjusted according to the first security information, the adjustment accuracy of the privacy protection strategy can be guaranteed, the privacy protection strategy is changed along with the change of the security of the user, the user can really feel that the biological characteristics of the user are in a protected state, and the identity authentication experience of the user is improved. Moreover, the identity authentication record is stored in the block chain system, so that the authenticity and the validity of the identity authentication record can be ensured based on the characteristics of the block chain, and an effective basis is provided for subsequent related processing.

It should be noted that, the embodiment of the identity authentication device based on privacy protection in this specification and the embodiment of the identity authentication method based on privacy protection in this specification are based on the same inventive concept, and therefore, for specific implementation of this embodiment, reference may be made to implementation of the corresponding identity authentication method based on privacy protection, and repeated details are not described again.

Further, corresponding to the above-described method for identity authentication based on privacy protection, based on the same technical concept, one or more embodiments of the present specification further provide a storage medium for storing computer-executable instructions, where in a specific embodiment, the storage medium may be a usb disk, an optical disk, a hard disk, and the like, and when the storage medium stores computer-executable instructions, the following process is implemented:

Optionally, when executed by a processor, the computer-executable instructions stored in the storage medium perform, according to a predetermined privacy protection policy matched with a user to be authenticated, a biometric feature acquisition process on the user to be authenticated to obtain a target biometric image, where the biometric feature acquisition process includes:

Optionally, when executed by a processor, the computer-executable instructions stored in the storage medium further include, before performing a biometric acquisition process on the user to be authenticated according to a predetermined privacy protection policy matched with the user to be authenticated, a:

acquiring historical identity authentication data of the target user;

When executed by a processor, a computer-executable instruction stored in a storage medium provided in one or more embodiments of the present specification performs a biometric feature acquisition process on a user to be authenticated according to a predetermined privacy protection policy matched with the user to be authenticated, so as to obtain a target biometric feature image; performing identity authentication processing on a user to be authenticated based on the target biological characteristic image; determining first security information of a user to be authenticated based on target biological characteristics by using a security evaluation model obtained by model training in advance; and if the preset privacy protection strategy adjusting condition is determined to be met according to the first security information, adjusting the privacy protection strategy matched with the user to be authenticated. Therefore, the target biological characteristic image of the user to be authenticated is collected according to the privacy protection strategy matched with the user to be authenticated, the target biological characteristic image can be effectively protected on the premise of meeting the security feeling of the user to be authenticated, and the privacy disclosure of the user is avoided. By determining the first security information of the user to be authenticated and adjusting the privacy protection strategy matched with the user to be authenticated according to the first security information, the privacy protection strategy can be changed along with the change of the user security, and meanwhile, the user can really feel that the biological characteristics of the user are in a protected state, so that the identity authentication experience of the user is improved.

In a specific embodiment, the storage medium may be a usb disk, an optical disk, a hard disk, or the like, and when executed by the processor, the storage medium stores computer-executable instructions for implementing the following processes:

Optionally, the computer-executable instructions stored in the storage medium, when executed by the processor, store the identity authentication record generated according to the identity authentication result in the blockchain system, including:

determining query information of the identity authentication result;

Optionally, the storage medium stores computer-executable instructions that, when executed by the processor, further comprise:

receiving an inquiry request sent by an inquirer;

When executed by a processor, a computer-executable instruction stored in a storage medium provided in one or more embodiments of the present specification performs a biometric feature acquisition process on a user to be authenticated according to a predetermined privacy protection policy matched with the user to be authenticated, so as to obtain a target biometric feature image; performing identity authentication processing on a user to be authenticated based on the target biological characteristic image, and storing an identity authentication record generated according to an identity authentication result into the block chain system; determining first security information of a user to be authenticated according to target biological characteristics based on an intelligent contract in the block chain system and a security evaluation model obtained by model training in advance; and if the preset privacy protection strategy adjusting condition is determined to be met according to the first security information based on the intelligent contract, adjusting the privacy protection strategy matched with the user to be authenticated. Therefore, the target biological characteristic image of the user to be authenticated is collected according to the privacy protection strategy matched with the user to be authenticated, the target biological characteristic image can be effectively protected on the premise of meeting the security feeling of the user to be authenticated, and the privacy disclosure of the user is avoided. The first security information of the user to be authenticated is determined based on the intelligent contract and the security evaluation model, the privacy protection strategy matched with the user to be authenticated is adjusted according to the first security information, the adjustment accuracy of the privacy protection strategy can be guaranteed, the privacy protection strategy is changed along with the change of the security of the user, the user can really feel that the biological characteristics of the user are in a protected state, and the identity authentication experience of the user is improved. Moreover, the identity authentication record is stored in the block chain system, so that the authenticity and the validity of the identity authentication record can be ensured based on the characteristics of the block chain, and an effective basis is provided for subsequent related processing.

It should be noted that, the embodiment of the storage medium in this specification and the embodiment of the identity authentication method based on privacy protection in this specification are based on the same inventive concept, and therefore, for specific implementation of this embodiment, reference may be made to implementation of the corresponding identity authentication method based on privacy protection, and repeated details are not repeated.

The foregoing description has been directed to specific embodiments of this disclosure. Other embodiments are within the scope of the following claims. In some cases, the actions or steps recited in the claims may be performed in a different order than in the embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing may also be possible or may be advantageous.

In the 90 s of the 20 th century, improvements in a technology could clearly distinguish between improvements in hardware (e.g., improvements in circuit structures such as diodes, transistors, switches, etc.) and improvements in software (improvements in process flow). However, as technology advances, many of today's process flow improvements have been seen as direct improvements in hardware circuit architecture. Designers almost always obtain the corresponding hardware circuit structure by programming an improved method flow into the hardware circuit. Thus, it cannot be said that an improvement in the process flow cannot be realized by hardware physical modules. For example, a Programmable Logic Device (PLD), such as a Field Programmable Gate Array (FPGA), is an integrated circuit whose Logic functions are determined by programming the Device by a user. A digital system is "integrated" on a PLD by the designer's own programming without requiring the chip manufacturer to design and fabricate application-specific integrated circuit chips. Furthermore, nowadays, instead of manually making an Integrated Circuit chip, such Programming is often implemented by "logic compiler" software, which is similar to a software compiler used in program development and writing, but the original code before compiling is also written by a specific Programming Language, which is called Hardware Description Language (HDL), and HDL is not only one but many, such as abel (advanced Boolean Expression Language), ahdl (alternate Hardware Description Language), traffic, pl (core universal Programming Language), HDCal (jhdware Description Language), lang, Lola, HDL, laspam, hardward Description Language (vhr Description Language), vhal (Hardware Description Language), and vhigh-Language, which are currently used in most common. It will also be apparent to those skilled in the art that hardware circuitry that implements the logical method flows can be readily obtained by merely slightly programming the method flows into an integrated circuit using the hardware description languages described above.

The controller may be implemented in any suitable manner, for example, the controller may take the form of, for example, a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro) processor, logic gates, switches, an Application Specific Integrated Circuit (ASIC), a programmable logic controller, and an embedded microcontroller, examples of which include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320, the memory controller may also be implemented as part of the control logic for the memory. Those skilled in the art will also appreciate that, in addition to implementing the controller as pure computer readable program code, the same functionality can be implemented by logically programming method steps such that the controller is in the form of logic gates, switches, application specific integrated circuits, programmable logic controllers, embedded microcontrollers and the like. Such a controller may thus be considered a hardware component, and the means included therein for performing the various functions may also be considered as a structure within the hardware component. Or even means for performing the functions may be regarded as being both a software module for performing the method and a structure within a hardware component.

The systems, devices, modules or units illustrated in the above embodiments may be implemented by a computer chip or an entity, or by a product with certain functions. One typical implementation device is a computer. In particular, the computer may be, for example, a personal computer, a laptop computer, a cellular telephone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

For convenience of description, the above devices are described as being divided into various units by function, and are described separately. Of course, the functions of the units may be implemented in the same software and/or hardware or in multiple software and/or hardware when implementing the embodiments of the present description.

One skilled in the art will recognize that one or more embodiments of the present description may be provided as a method, system, or computer program product. Accordingly, one or more embodiments of the present description may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the description may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.

The description has been presented with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the description. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

The memory may include forms of volatile memory in a computer readable medium, Random Access Memory (RAM) and/or non-volatile memory, such as Read Only Memory (ROM) or flash memory (flash RAM). Memory is an example of a computer-readable medium.

Computer-readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), Read Only Memory (ROM), Electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), Digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined herein, a computer readable medium does not include a transitory computer readable medium such as a modulated data signal and a carrier wave.

It should also be noted that the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.

One or more embodiments of the present description may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. One or more embodiments of the specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.

The embodiments in the present specification are described in a progressive manner, and the same and similar parts among the embodiments are referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for the system embodiment, since it is substantially similar to the method embodiment, the description is simple, and for the relevant points, reference may be made to the partial description of the method embodiment.

The above description is only an example of this document and is not intended to limit this document. Various modifications and changes may occur to those skilled in the art from this document. Any modifications, equivalents, improvements, etc. which come within the spirit and principle of the disclosure are intended to be included within the scope of the claims of this document.

Claims

1. An identity authentication method based on privacy protection comprises the following steps:

2. The method according to claim 1, wherein the acquiring, according to a predetermined privacy protection policy matched with a user to be authenticated, a biometric feature of the user to be authenticated to obtain a target biometric image comprises:

3. The method according to claim 1, wherein if it is determined according to the first security information that a preset privacy protection policy adjustment condition is satisfied, adjusting a privacy protection policy that matches the user to be authenticated includes:

determining whether a preset safety inspection condition is met;

4. The method according to claim 1 or 3, wherein the determining that a preset privacy protection policy adjustment condition is met according to the first security information comprises:

determining a first security level of the user to be authenticated according to the first security information;

determining a second security level corresponding to the predetermined privacy protection strategy matched with the user to be authenticated;

and if the first security level is not matched with the second security level, the first security level is lower than the second security level, and the second security level is not the highest level, determining that a preset privacy protection strategy adjustment condition is met.

5. The method of claim 4, the first sense of security information comprising a first sense of security score, the determining a first sense of security level for the user to be authenticated from the first sense of security information comprising:

determining a target score interval to which the first safety sensation score belongs in a plurality of preset score intervals;

according to the target score interval, acquiring a corresponding security level from a corresponding relation between a preset score interval and the security level;

and determining the obtained security level as a first security level of the user to be authenticated.

6. The method of claim 4, the first sense of security information comprising a first sense of security score, the determining a first sense of security level for the user to be authenticated from the first sense of security information comprising:

if the historical security score of the user to be authenticated is obtained, calculating the average security score of the user to be authenticated according to the historical security score and the first security score;

determining a target score interval to which the average safety feeling score belongs in a plurality of preset score intervals;

determining the obtained security level as a first security level of the user to be authenticated;

the method further comprises the following steps:

and saving the first security feeling score.

7. The method of claim 4, the adjusting the privacy protection policy that matches the user to be authenticated comprising:

determining a third security sensation level adjacent to the second security sensation level and higher than the second security sensation level;

determining the privacy protection strategy corresponding to the third security level as a target privacy protection strategy matched with the user to be authenticated;

and adjusting the predetermined privacy protection strategy matched with the user to be authenticated into the target privacy protection strategy.

8. The method according to claim 1, before performing the biometric acquisition processing on the user to be authenticated according to the predetermined privacy protection policy matching the user to be authenticated, further comprising:

determining whether historical identity authentication data of the user to be authenticated is acquired;

if so, determining second security information of the user to be authenticated based on the historical identity authentication data by adopting the security evaluation model; determining a fourth security level of the user to be authenticated according to the second security information; according to the fourth security level, acquiring a corresponding privacy protection strategy from a corresponding relation between a preset security level and the privacy protection strategy; determining the obtained privacy protection strategy as a privacy protection strategy matched with the user to be authenticated;

if not, determining the default privacy protection strategy as the privacy protection strategy matched with the user to be authenticated.

9. The method according to claim 1, before performing the biometric acquisition processing on the user to be authenticated according to the predetermined privacy protection policy matching the user to be authenticated, further comprising:

acquiring historical identity authentication data of the target user;

10. The method of claim 9, wherein performing model training processing according to the security information and the historical identity authentication data to obtain the security evaluation model comprises:

determining corresponding user characteristics and auxiliary characteristics according to each historical identity authentication data;

generating sample data according to the user characteristics, the auxiliary characteristics and the safety information to obtain a sample set;

and training based on the sample set and a preset loss function to obtain the security evaluation model.

11. The method of claim 1, further comprising:

and saving the ciphertext image.

12. An identity authentication method based on privacy protection comprises the following steps:

13. The method of claim 12, wherein saving the identity authentication record generated according to the identity authentication result to the blockchain system comprises:

determining query information of the identity authentication result;

14. The method of claim 13, further comprising:

receiving an inquiry request sent by an inquirer;

15. An identity authentication device based on privacy protection, comprising:

the acquisition module is used for acquiring and processing the biological characteristics of the user to be authenticated according to a predetermined privacy protection strategy matched with the user to be authenticated to obtain a target biological characteristic image;

the authentication module is used for carrying out identity authentication processing on the user to be authenticated based on the target biological characteristic image;

the determining module is used for determining first security information of the user to be authenticated based on the target biological characteristics by adopting a security evaluation model obtained by model training in advance;

and the adjusting module is used for adjusting the privacy protection strategy matched with the user to be authenticated if the preset privacy protection strategy adjusting condition is determined to be met according to the first security information.

16. An identity authentication device based on privacy protection, comprising:

the storage module is used for storing the identity authentication record generated according to the identity authentication result into the block chain system;

the determining module is used for determining first security information of the user to be authenticated according to the target biological characteristics based on an intelligent contract in the block chain system and a security evaluation model obtained by model training in advance;

and the adjusting module is used for adjusting the privacy protection strategy matched with the user to be authenticated if the preset privacy protection strategy adjusting condition is determined to be met based on the intelligent contract according to the first security information.

17. An identity authentication device based on privacy protection, comprising:

a processor; and the number of the first and second groups,

a memory arranged to store computer executable instructions that, when executed, cause the processor to:

18. An identity authentication device based on privacy protection, comprising:

a processor; and the number of the first and second groups,

19. A storage medium storing computer-executable instructions that when executed by a processor implement the following:

20. A storage medium storing computer-executable instructions that when executed by a processor implement the following: