WO2016078429A1

WO2016078429A1 - Identity recognition method and apparatus

Info

Publication number: WO2016078429A1
Application number: PCT/CN2015/083458
Authority: WO
Inventors: 沙爽
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-11-19
Filing date: 2015-07-07
Publication date: 2016-05-26
Also published as: CN105678137A

Abstract

An identity recognition method and apparatus. The method is applicable to a terminal device, comprising: when a pre-determined condition is met, scanning, by a terminal device, eyeprints of a current user; comparing, by the terminal device, eyeprint characteristic data obtained through scanning with eyeprint characteristic data pre-stored in the terminal device; and when a comparison result is representative of consistency, executing, by the terminal device, a subsequent operation. The technical solution can ensure that valid users are effectively recognized.

Description

Method and device for identification

Technical field

This paper relates to the field of data security, and in particular to a method and apparatus for identity recognition.

Background technique

There are more and more applications on terminal devices such as smart phones. Many applications need to access user data on the terminal device. For example, social applications need to access the address book, navigation applications need to access the location of the terminal device, and authentication software needs to access the terminal device identifier. However, users often don't realize that the data of the terminal device is read by the application, and it is often the case that some applications access data that is not related to itself, which provides an opportunity for data leakage.

In addition, on the terminal device, some data machine owners only want to be accessed by themselves, including personal phone book, private files, social applications and other aspects of the data, if it can be viewed by any user, then it is easy to socialize the owner himself Work, money and threats.

At present, the identification technology is mainly used in the industry to protect user data on terminal devices. Currently, identity recognition mainly uses fingerprint mode:

A. Fingerprint collection method: mainly through the external sliding or pressing type fingerprint acquisition device for fingerprint collection;

B. Protection of data access: Generally, the private mode switch is provided in the setting menu. After the fingerprint verification, the private mode can be started, and then any other module is no longer subjected to fingerprint identification and verification.

Disadvantages or problems with related technologies:

First of all, fingerprint recognition has great reproducibility. For example, the fingerprint that the user keeps on the screen can be copied into the silicone finger sleeve, which lacks concealment. Therefore, there is a certain risk of misjudgment in the identification of the identity;

Secondly, the related technical solution confirms the identity of the owner by identifying the fingerprint in the setting menu, thereby adopting the development processing method for all subsequent operations of the module, and does not implement the data. When the identity verification protection; in fact, it is entirely possible that the owner is not operating at this time, causing the non-owner himself to enter the highly sensitive module.

Finally, the related art data access identity management, there is no whitelist mechanism, once the software is released, subsequent upgrades require a large version of the update, that is, the consumption of traffic is also a waste of time.

Summary of the invention

The present invention provides a method and apparatus for user identification to solve the technical problem of how to effectively identify legitimate users.

In order to solve the above problem, the embodiment of the present invention provides a method for identity identification, which is applicable to a terminal device, and includes:

The terminal device scans an eyelet of the current user when the predetermined condition is met;

The terminal device compares the scanned eye pattern characteristic data with the pre-stored eye pattern characteristic data in the terminal device;

When the comparison result is consistent, the terminal device performs subsequent operations.

Optionally, the predetermined condition includes:

Receiving a predetermined operational request; and/or,

In the case where the predetermined application is turned on, the predetermined application arrives at the authentication period.

Optionally, the method further includes:

Configuring the predetermined operation request or a predetermined application by a white list,

When the terminal device receives the operation request or launches the application, the operation request or the application is matched with the whitelist; when the matching succeeds, the pre-stored eyeprint feature data in the terminal device is allowed to be read.

Optionally, the predetermined condition and the pre-stored eye pattern feature data each include a plurality of, respectively, corresponding to different security levels;

The comparing, by the terminal device, the scanned eye pattern characteristic data and the pre-stored eye pattern characteristic data in the terminal device, includes:

The terminal device searches for a security level corresponding to the predetermined condition that is met, and obtains the security level. Corresponding pre-existing eye pattern characteristic data; comparing the scanned eye pattern characteristic data with the acquired eye pattern characteristic data.

The embodiment of the present invention further provides an apparatus for identifying an identity, which is disposed in the terminal device, and includes:

a scanning module configured to scan an eyelet of a current user when a predetermined condition is met;

The comparison module is configured to compare the scanned eye pattern characteristic data with the pre-stored eye pattern characteristic data in the terminal device;

Execution module, set to perform subsequent operations when the comparison results are consistent.

Optionally, the predetermined condition includes:

Receiving, by the terminal device, a predetermined operation request; and/or

In the case where the predetermined application is turned on on the terminal device, the predetermined application arrives at the authentication period.

Optionally, the device further includes:

a configuration module, configured to configure the predetermined operation request or a predetermined application by using a whitelist; when the terminal device receives an operation request or starts an application, matching the operation request or the application with the whitelist; The comparison module is allowed to read pre-stored eye pattern characteristic data in the terminal device.

The comparison module is configured to compare the scanned eye pattern characteristic data with the pre-stored eye pattern characteristic data in the terminal device by:

Finding a security level corresponding to the predetermined condition that is met, acquiring pre-stored eye pattern characteristic data corresponding to the security level; and comparing the scanned eye pattern characteristic data with the acquired eye pattern characteristic data.

The embodiment of the invention further provides a computer storage medium, wherein the computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute the above method.

The embodiment of the invention designs a set of user identification mechanism based on the eye pattern, not only identifies the owner identity from the unlocking aspect, but also scans and verifies the eye pattern at any time in all other modules that wish to perform real-time user identification. Ensure that legitimate users access the specified data.

In addition, the embodiments of the present invention can also perform whitelist management on protected applications and data, and the availability and flexibility of the embodiments of the present invention are greatly improved, and the possibility of key data being stolen is effectively reduced.

BRIEF abstract

FIG. 1 is a schematic flowchart diagram of a method for identity recognition according to an embodiment of the present invention;

2 is a schematic flow chart of one of predetermined condition conditions in an embodiment of the present invention;

3 is a schematic flowchart of a second predetermined condition in an embodiment of the present invention;

4 is a schematic flowchart of whitelist matching and comparison in an embodiment of the present invention;

FIG. 5 is a schematic diagram of a specific implementation manner of an embodiment of the present invention; FIG.

6 is a schematic flow chart of the specific implementation shown in FIG. 5;

FIG. 7 is a schematic diagram of an apparatus for identity recognition according to an embodiment of the present invention.

Preferred embodiment of the invention

The technical solution of the present invention will be described in more detail below with reference to the accompanying drawings and embodiments.

It should be noted that, if not conflicting, the embodiments of the present invention and the various features of the embodiments may be combined with each other, and are all within the protection scope of the present invention. Additionally, although logical sequences are shown in the flowcharts, in some cases the steps shown or described may be performed in a different order than the ones described herein.

A method for identifying an identity, as set in the terminal device, as shown in FIG. 1, includes:

Eye pattern recognition is a technique for collecting and recognizing venous blood vessels of the human eye. The blood vessels of the human body are the best biometric method because the blood vessel data collection is hidden in the human body and cannot be forgotten and cannot be copied. The pre-stored eye pattern feature data may include only the owner of the owner, or may include one or more legitimate users other than the owner himself.

The predetermined condition may include two types:

One is to receive a predetermined operational request. The predetermined operation request may be accessing predetermined data (such as a short message, an address book, a call record, a library, and data specified in some applications), starting a predetermined application (such as social software, a file manager), and performing a predetermined operation (such as Unlocking the mobile phone, online banking payment, transfer, etc., the predetermined operation request specifically includes which can be set by the user. Scan the current user's eye pattern when a predetermined operation request is received. If it is not the owner or other legitimate user, the operation is not allowed; if it is the owner or other legitimate user, the subsequent operation is performed, that is, according to the user's operation request. The corresponding operation.

A specific example is shown in FIG. 2. In this example, the predetermined operation request is to start an application that needs to verify the identity of the user, and the application is in the mobile phone, and the legitimate user only includes the owner; the example includes:

201. Start an application that needs to verify the identity of the user;

202, starting the front camera to scan the current user's eye pattern to obtain eye pattern characteristic data;

203. Read the eye pattern characteristic data of the owner of the mobile phone pre-recorded;

204. Compare whether the two sets of eye pattern characteristic data are consistent;

205. If the current user is identified as the owner, the application may be opened.

206. If the inconsistency is, the current user is identified as a non-owner, and the application cannot be opened.

When the predetermined operation request is to access the data specified in some applications, the application is not recognized when the application is launched, and any user can be allowed to open the application, but the illegal user can be prevented from accessing the pre-selected sensitive data. , concealment is better.

The other is to arrive at the authentication cycle with the scheduled application turned on.

This is a real-time identification of the user identity mode. Once enabled, the current user's eye pattern is scanned periodically during the application process. If the illegal user is identified, the current application is exited; if it is the owner or other legitimate user, the subsequent execution is performed. Operation, that is, continue to run the application, and perform the operation request made by the user in the application until the next authentication cycle arrives.

A specific example is shown in Figure 3. The example is applied to a mobile phone. The legal user only includes the owner. The authentication period is 3 minutes. The example includes:

301, the application starts to start;

302. Determine whether to enable real-time detection; if it is enabled, perform 303, if not, perform 308, and use normally;

303. Every 3 minutes, the front camera is started to scan the current user's eye pattern to obtain eye pattern characteristic data;

304, reading the eyeprint characteristic data of the owner of the mobile phone pre-recorded;

305. Compare whether the two sets of eye pattern characteristic data are consistent;

306. If they are consistent, identify the current user as the owner and use normally;

307. If it is inconsistent, identify the current user as a non-owner, prompt and exit the current application.

The type of the predetermined application and the length of the authentication period may be set by the user.

The two predetermined conditions can be used independently or together.

In order to verify the identity of the current user in real time, the technical solution can perform real-time user identity verification when the application is started and during use, so that only legitimate users can perform certain operations, such as accessing data that needs to be kept confidential, and performing online banking. Payment, etc. This protects important data, prevents illegal operations, and ensures the security of the terminal device.

Through this scheme, the right to access data can also be associated with the identity of a specific person; the identity element can be combined with the algorithm of data encryption and storage, and only the authenticated user can access the specified data to decrypt the data. The identity of an unauthenticated user cannot access the data, and the plaintext of the data is even less visible.

The terminal device searches for a security level corresponding to the predetermined condition that is met, and obtains pre-stored eye pattern data corresponding to the security level; and scans the obtained eye pattern characteristic data and the acquired eye pattern The data is compared for comparison.

In this way, the application and user data in the mobile phone system can be hierarchically managed according to different user access identities, and different access identities are mapped to different security levels.

The scheme can also use the eyeprint recognition technology to verify the identity of the user. When the user unlocks the mobile phone, the user needs to collect the eyeprint feature of the user, and if it is the same as the owner's eyeprint feature previously recorded in the mobile phone, it is recognized as the owner; If they are not the same, they are identified as non-owners, ie visitors.

For non-owner users, the phone can pre-set a set of visible applications and data for such users, which can be publicly available to other owners and stored in plain text;

For the owner, most of the applications and data in the phone are visible, and the data is only visible to the owner.

The solution is based on ARM TrustZone technology, and TrustZone(TM) technology appears in ARMv6KZ and later application core architecture. It provides a low-cost solution for adding a dedicated security core to a system-on-a-chip (SoC), and two virtual processors supported by hardware-built access control. This approach allows the application core to switch between two states (usually referred to as worlds to avoid confusion with names in other functional areas), which prevents information from leaking from more trusted core areas. Less secure areas. This kind of switching between kernel domains is usually completely unrelated to other functions of the processor, so each domain can operate independently but still use the same kernel.

Optionally, the foregoing method further includes:

The predetermined operation request or predetermined application is configured by a white list.

If you need to delete or increase the protected operation request/application, you can update the whitelist to achieve the effect, which is convenient and flexible.

The whitelist may be first encrypted by aes_cbc_128, and then signed by the RSA private key. The RSA public key is stored in the hardware register of the terminal device, and the signed data is built in the software system of the terminal device.

When the terminal device receives the predetermined operation request or starts the predetermined application, the operation request or the application is matched with the whitelist; when the matching is successful, the pre-stored eyeprint feature data in the terminal device is allowed to be read.

An example of whitelist checksum matching is shown in Figure 4, in which the predetermined condition is to initiate a predetermined application;

Step 1: Start the application;

Step 2: Determine whether the whitelist needs to be checked; if not, perform step 3 to directly open the application; if necessary, perform step 4 to perform matching in the whitelist (list of eyeprint protection applications);

403. Determine whether the application to be started belongs to the protected application, and if yes, enter the process of FIG. 3; if not, open the application normally.

The whitelist in step four is obtained through the following process:

a, read the RSA public key from the register;

b. Verify the whitelist data with the RSA public key and decrypt it with aes_cbc_128;

c. Get the original whitelist.

In the whitelist checksum matching process, the related public key can also be saved in the normal Flash storage space, but the access in this area is shared by all applications, and there is a risk of being accessed by other applications.

For protected operations and application categories, management through whitelists can increase the scalability of the protected object list and ensure the effectiveness of management.

The specific implementation of the foregoing solution may be as shown in FIG. 5, in which a security module is embedded in the application client, and the security module uses the unique key of each application to sign in advance, and after the application is started, the access eye feature is involved. When the data is used, the security module invokes the interface encapsulated by the terminal device to access the protected eye pattern data;

When the client access interface is applied, the terminal device verifies the identity of the application. The main process is shown in Figure 6, including:

601. Start an application that needs to be identified;

602. Specify a different ID for each application; read a hardware key from the register;

603. Generate a unique identification key for the application.

604. When applying the main eye pattern characteristic data of the reader, determine whether it is a legitimate application;

605. If yes, the eye pattern characteristic data can be accessed;

606. If not, it is not accessible.

Since it is very important to verify the identity of the user, the scheme saves the eyeprint feature data in a special area, and the access rights of the area are verified by the key stored in the register. The storage area of the identity is physically isolated from normal data, greatly reducing the possibility of being stolen and tampered by Trojans and malicious viruses, and adding authentication measures from the access mechanism to ensure that only legitimate applications can run and access, identity The correctness of the logo and the protection of data security are very meaningful.

As shown in FIG. 7, an embodiment of the present invention provides an apparatus for identifying an identity, which is installed in a terminal device, and includes:

Optionally, the predetermined condition includes:

Receiving, by the terminal device, a predetermined operation request; and/or

In the case where the predetermined application is turned on on the terminal device, the authentication period is reached.

Optionally, the device further includes:

Comparing the scanned eye pattern characteristic data with the pre-stored eye pattern characteristic data in the terminal device by the comparing module means:

The comparison module searches for a security level corresponding to the predetermined condition that is met, and obtains the security level. Corresponding pre-existing eye pattern characteristic data; comparing the scanned eye pattern characteristic data with the acquired eye pattern characteristic data.

The invention may, of course, be embodied in a variety of other embodiments without departing from the spirit and scope of the invention. Changes and modifications are intended to fall within the scope of the appended claims.

One of ordinary skill in the art will appreciate that all or a portion of the steps of the above-described embodiments can be implemented using a computer program flow, which can be stored in a computer readable storage medium, such as on a corresponding hardware platform (eg, The system, device, device, device, etc. are executed, and when executed, include one or a combination of the steps of the method embodiments.

Alternatively, all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve.

The devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.

When each device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium. The above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.

Industrial applicability

The above technical solution not only identifies the owner identity from the unlocking aspect, but also can scan and verify the eyeprint at any time in all other modules that wish to perform real-time user identification, thereby ensuring that the legitimate user accesses the specified data. In addition, the above technical solution whitelists protected applications and data, improves usability and flexibility, and effectively reduces the possibility of key data being stolen.

Claims

A method of identification, comprising:

The terminal device scans an eyelet of the current user when the predetermined condition is met;

The terminal device compares the scanned eye pattern characteristic data with the pre-stored eye pattern characteristic data in the terminal device;

When the comparison result is consistent, the terminal device performs subsequent operations.
The method of claim 1 wherein said predetermined condition comprises:

Receiving a predetermined operational request; and/or

In the case where the predetermined application is turned on, the predetermined application arrives at the authentication period.
The method of claim 2 further comprising:

Configuring the predetermined operation request or the predetermined application by the whitelist, and when the terminal device receives the operation request or starts the application, matching the operation request or the application with the whitelist; when the matching succeeds, the reading is allowed The eye pattern characteristic data pre-stored in the terminal device.
The method according to any one of claims 1 to 3, wherein

The predetermined condition and the pre-stored eye pattern characteristic data each include a plurality of, respectively, corresponding to different security levels;

The comparing, by the terminal device, the scanned eye pattern characteristic data and the pre-stored eye pattern characteristic data in the terminal device, includes:

The terminal device searches for a security level corresponding to the predetermined condition, and obtains pre-stored eye pattern data corresponding to the security level; and compares the scanned eye pattern data with the acquired eye pattern data.
An apparatus for identifying an identity set in a terminal device, comprising:

a scanning module configured to scan an eyelet of a current user when a predetermined condition is met;

The comparison module is configured to compare the scanned eye pattern characteristic data with the pre-stored eye pattern characteristic data in the terminal device;

Execution module, set to perform subsequent operations when the comparison results are consistent.
The apparatus of claim 5 wherein said predetermined condition comprises:

Receiving, by the terminal device, a predetermined operation request; and/or

In the case where the predetermined application is turned on on the terminal device, the predetermined application arrives at the authentication period.
The apparatus of claim 6 further comprising:

a configuration module, configured to configure the predetermined operation request or a predetermined application by using a whitelist; when the terminal device receives an operation request or starts an application, matching the operation request or the application with the whitelist; The comparison module is allowed to read pre-stored eye pattern characteristic data in the terminal device.
The apparatus according to any one of claims 5 to 7, wherein:

The predetermined condition and the pre-stored eye pattern characteristic data each include a plurality of, respectively, corresponding to different security levels;

The comparison module is configured to compare the scanned eye pattern characteristic data with the pre-stored eye pattern characteristic data in the terminal device by:

Finding a security level corresponding to the predetermined condition that is met, acquiring pre-stored eye pattern characteristic data corresponding to the security level; and comparing the scanned eye pattern characteristic data with the acquired eye pattern characteristic data.
A computer storage medium having stored therein computer executable instructions for performing the method of any one of claims 1 to 4.