WO2017041715A1 - 远程身份认证方法和系统以及远程开户方法和系统 - Google Patents

远程身份认证方法和系统以及远程开户方法和系统 Download PDF

Info

Publication number
WO2017041715A1
WO2017041715A1 PCT/CN2016/098330 CN2016098330W WO2017041715A1 WO 2017041715 A1 WO2017041715 A1 WO 2017041715A1 CN 2016098330 W CN2016098330 W CN 2016098330W WO 2017041715 A1 WO2017041715 A1 WO 2017041715A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
user
background server
verified
cryptographic device
Prior art date
Application number
PCT/CN2016/098330
Other languages
English (en)
French (fr)
Inventor
李东声
Original Assignee
天地融科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 天地融科技股份有限公司 filed Critical 天地融科技股份有限公司
Priority to CA2997638A priority Critical patent/CA2997638C/en
Publication of WO2017041715A1 publication Critical patent/WO2017041715A1/zh
Priority to US15/909,017 priority patent/US10606997B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/36—User authentication by graphic or iconic representation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/32—User authentication using biometric data, e.g. fingerprints, iris scans or voiceprints
    • G—PHYSICS
    • G09—EDUCATION; CRYPTOGRAPHY; DISPLAY; ADVERTISING; SEALS
    • G09C—CIPHERING OR DECIPHERING APPARATUS FOR CRYPTOGRAPHIC OR OTHER PURPOSES INVOLVING THE NEED FOR SECRECY
    • G09C5/00—Ciphering apparatus or methods not provided for in the preceding groups, e.g. involving the concealment or deformation of graphic data such as designs, written or printed messages
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3228—One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3231—Biological data, e.g. fingerprint, voice or retina

Definitions

  • the present application relates to the field of electronic technologies, and in particular, to a remote identity authentication method and system, and a remote account opening method and system.
  • VTM Virtual Teller Machine
  • the remote mechanism using the VTM machine is to set up a VTM remote video teller machine at night to allow users to communicate face-to-face with bank staff. The user relies on the video and, under the guidance of the bank staff, independently completes a variety of counter business operations such as bank account opening, online banking processing, and investment and wealth management.
  • the VTM machine is placed in the bank, which is still inconvenient for some users.
  • the method of remote account opening enables the user to open an account anytime and anywhere.
  • it is necessary to realize the "one person and one card", that is, to realize the remote identity authentication to the user is a technical problem to be solved urgently in the process of remote account opening.
  • This application is intended to address the remote authentication problem of the above users.
  • the main purpose of this application is to provide a remote authentication method.
  • Another object of the present application is to provide a remote account opening method.
  • Another object of the present application is to provide a remote identity authentication system.
  • Another object of the present application is to provide a remote account opening system.
  • the present application provides a remote identity authentication method, including: in an remote account opening process, an electronic cryptographic device obtains information to be verified, wherein the information to be verified includes: single authentication information; and the electronic cryptographic device generates information according to the information to be verified. And displaying a graphic identification code; the terminal acquires a graphic image including a facial image of the user and an electronic password device The avatar picture is sent to the background server; the background server receives the picture and verifies the graphic identification code recorded on the picture and the user's face image.
  • the sending, by the terminal, the image to the background server includes: the terminal carrying the image in the identity authentication request and sending the message to the background server, where the identity authentication request further carries the user information.
  • the method further includes: the terminal sending an identity authentication request to the background server, where the identity authentication request carries the user information.
  • the method further includes: the ID card reading module reads the ID card information stored in the resident ID card of the user; and the ID card information read by the electronic password device on the ID card reading module Encrypting, sending the ciphertext of the encrypted ID card information to the terminal; the user information includes: ciphertext of the ID card information; after the terminal sends the identity authentication request to the background server, the method further includes: the background server receiving the identity authentication request The user's identity is verified according to the ciphertext of the ID card information.
  • the method further includes: the terminal obtains signature data of the ciphertext of the identity card information from the electronic cryptographic device; the user information further includes: signature data of the ciphertext of the identity card information; Before the ciphertext of the ID card information is verified by the user, the background server also checks the signature data of the ciphertext of the ID card information.
  • the background server verifies the identity of the user according to the ciphertext of the ID card information, including: the background server decrypts the ciphertext of the ID card information, and obtains the ID card information; the background server obtains the pre-stored identity corresponding to the electronic password device.
  • the information of the card is compared with the decrypted ID card information. If the two match, the identity verification of the user who requested the account opening is confirmed. If the two do not match, the current status is confirmed. The authentication of the user requesting the account to open failed.
  • the electronic cryptographic device obtains the information to be verified, including: the electronic cryptographic device generates the information to be verified based on the parameter synchronized with the background server.
  • the electronic cryptographic device generates a graphic identification code according to the information to be verified, including: the electronic cryptographic device converts the information to be verified into a graphic identification code; or the electronic cryptographic device calculates the information to be verified according to a preset algorithm, and generates a correspondence corresponding to the calculated result.
  • Graphic identification code including: the electronic cryptographic device converts the information to be verified into a graphic identification code; or the electronic cryptographic device calculates the information to be verified according to a preset algorithm, and generates a correspondence corresponding to the calculated result.
  • the electronic cryptographic device calculates the authentication information according to a preset algorithm, including one of the following: the electronic cryptographic device uses the private key stored by itself to sign the authentication information; and the electronic cryptographic device performs the message authentication code MAC calculation on the authentication information.
  • the terminal acquires a picture including the facial image of the user and the graphic identification code displayed by the electronic cryptographic device, including one of the following: the terminal captures the graphic identifier including the face of the user and the electronic cryptographic device displayed by the camera disposed on the terminal. Image, obtaining a picture; the terminal receives an image of the user's face and an electronic password sent by the external device The graphic identification code displayed by the device.
  • the background server verifies the facial image of the user recorded on the picture, the background server acquires pre-stored identity information of the user corresponding to the electronic cryptographic device, wherein the identity information includes a facial image of the user;
  • the recorded facial image of the user is compared with the facial image of the user included in the acquired identity information, and if the two match, the verification is determined to pass, otherwise, the verification is determined not to pass.
  • the background server further includes: the background server sends a retransmission instruction to the terminal, instructing the terminal to re-upload the picture until the verification passes or the verification reaches the predetermined time. frequency.
  • Another aspect of the present application provides a remote account opening method, including the above remote identity authentication method and remote account opening after the remote identity authentication is passed.
  • the other aspect of the present application provides a remote identity authentication system, including: an electronic cryptographic device, a terminal, and a background server; wherein the electronic cryptographic device is configured to acquire information to be verified, and generate and display a graphic according to the to-be-verified information.
  • the identifier code, wherein the information to be verified includes: single-time authentication data; the terminal is configured to acquire a picture including a facial image of the user and a graphic identification code displayed by the electronic cryptographic device, and send the image to a background server; The picture sent by the terminal is received, and the graphic identification code recorded on the picture and the facial image of the user are verified.
  • the terminal sends the image to the server in the following manner: the image is carried in the identity authentication request and sent to the background server, where the identity authentication request further carries the user information.
  • the terminal is further configured to send an identity authentication request to the background server before the electronic cryptographic device obtains the information to be verified, where the identity authentication request carries the user information.
  • the system further includes an ID card reading module; the ID card reading module is configured to read the ID card information stored in the user's resident ID card, and send the ID card information to the electronic password device; the electronic password device is also used to identify the identity
  • the ID card information read by the card reading module is encrypted, and the ciphertext of the encrypted ID card information is sent to the terminal;
  • the user information includes: the ciphertext of the user's ID card information;
  • the background server is also used to receive the identity authentication request, The identity of the user is verified according to the ciphertext of the identity card information.
  • the terminal is further configured to obtain signature data of the ciphertext of the ID card information from the electronic cryptographic device; the user information further includes: signature data of the ciphertext of the ID card information; and the background server is further configured to sign the ciphertext of the ID card information. The data is checked.
  • the background server verifies the identity of the user by decrypting the ciphertext of the ID card information to obtain the ID card information, obtaining the pre-stored ID card information corresponding to the electronic cipher device, and obtaining the ID card information and The ID information obtained by the decryption is compared, and if the two match, it is confirmed that the identity verification of the user currently requesting the account opening is successful, and if the two do not match, it is confirmed that the identity verification of the user currently requesting the account opening fails.
  • the electronic cryptographic device obtains information to be verified by: generating information to be verified based on parameters synchronized with the background server.
  • the electronic cryptographic device generates a graphic identification code according to one of the following methods: converting the information to be verified into a graphic identification code; performing calculation on the verification information according to a preset algorithm, and generating a graphic identification code corresponding to the calculation result.
  • the electronic cryptographic device calculates the authentication information by using one of the following methods: using the private key stored by itself to sign the authentication information; and performing the message authentication code MAC calculation on the authentication information.
  • the terminal acquires a picture including a facial image of the user and a graphic identification code displayed by the electronic cryptographic device in one of the following manners: capturing a graphic identification code including a face of the user and an electronic cryptographic device display by a photographing device disposed on the terminal The image is obtained by receiving an image sent by the external device including the facial image of the user and the graphic identification code displayed by the electronic cryptographic device.
  • the background server verifies the facial image of the user recorded on the picture by acquiring the pre-stored identity information of the user corresponding to the electronic cryptographic device, wherein the identity information includes a facial image of the user; The facial image is compared with the facial image of the user included in the acquired identity information. If the two match, the verification is determined to pass, and if the two do not match, it is determined that the verification fails.
  • the background server is further configured to send a retransmission instruction to the terminal, instructing the terminal to re-upload the picture until the verification passes or the verification reaches the predetermined time. frequency.
  • Another aspect of the present application provides a remote account opening system, including the remote identity authentication system described above, and the backend server is further configured to perform remote account opening after the identity authentication is passed.
  • the user can send an identity authentication request to the background server through the terminal, generate a graphic identification code through the electronic cryptographic device, and then include the user through the terminal.
  • the image of the facial image and the graphic identification code is sent to the background server, and the background server verifies the graphic identification code recorded on the image and the facial image of the user, thereby completing remote authentication of the user.
  • the ID card information in the user information is read by the ID card reading module from the resident ID card, and since the ID card reading module can only read the legal resident ID card, therefore, using the above implementation manner, The legality of the resident ID card used by the user during the account opening process can be guaranteed.
  • the user information includes the signature data of the ciphertext of the ID card information, which ensures the non-repudiation of the ciphertext of the ID card information sent by the terminal to the background server and is not falsified.
  • the background server compares the ID card information read by the ID card reading module with the pre-stored ID card information during the account opening process to verify the identity of the user, and can determine the legal holder of the electronic password device. Whether the user using the current ID card belongs to the same person. Thereby avoiding the user's ID card or electronic password setting After being lost, it is used by others to open an account.
  • the graphic identification code is generated and displayed according to the information to be verified, so that the background server can conveniently identify the information to be verified.
  • the background server can determine the identity of the electronic cryptographic device user by identifying the graphic identification code in the image; the background server uploads the terminal The user's facial image is compared with the pre-stored user's facial image. If the comparison is passed, the background server can confirm whether the electronic password device is the real account holder, and prevent the ID card and the electronic password device from being lost. Illegal elements pretend to open an account.
  • the user can remotely open an account anytime and anywhere, and facilitate the user and improve the user experience.
  • FIG. 1 is a schematic structural diagram of a remote identity authentication system provided by Embodiment 1 and Embodiment 2 of the present application;
  • FIG. 2 is a flowchart of a remote identity authentication method according to Embodiment 4 of the present application.
  • FIG. 3 is a flowchart of another remote identity authentication method according to Embodiment 5 of the present application.
  • connection In the description of the present application, it should be noted that the terms “installation”, “connected”, and “connected” are to be understood broadly, and may be fixed or detachable, for example, unless otherwise specifically defined and defined. Connected, or integrally connected; can be mechanical or electrical; can be directly connected, or indirectly connected through an intermediate medium, can be the internal communication of the two components.
  • Connected, or integrally connected can be mechanical or electrical; can be directly connected, or indirectly connected through an intermediate medium, can be the internal communication of the two components.
  • the specific meanings of the above terms in the present application can be understood in the specific circumstances for those skilled in the art.
  • the user can obtain the information to be verified through the electronic cryptographic device, and generate and display the graphic identification code according to the information to be verified, and then can pass the shooting device (can be set on the terminal or outside the terminal)
  • the user's face and the graphic identification code displayed by the electronic cryptographic device are photographed, and the terminal acquires a picture including the facial image of the user and the graphic identification code displayed by the electronic cryptographic device, and sends the image to the background server, and the background server pairs the image.
  • the graphic identification code and the user's face image are verified.
  • the information to be verified may be calculated by the electronic cryptographic device and the background server according to the same algorithm.
  • the electronic cryptographic device and the background server may adopt a dynamic password generated in an OTP-like manner.
  • it may be a single authentication data sent by the background server to the electronic cryptographic device, for example, a random number or the like.
  • it may be a single authentication data sent by the background server to another terminal of the electronic cryptographic device holder (for example, the user's mobile phone, etc.), for example, a random number, etc., and then the user inputs the single authentication data to the electronic password. device.
  • the graphic identification code may be generated directly according to the information to be verified, or may be generated after the calculation of the information to be verified (for example, a MAC calculation or a signature, etc.), for example, a graphic identification code is generated, which is not used in the embodiment of the present application. limited.
  • the graphic identification code may be a two-dimensional code, or may be a barcode, etc., as long as the graphic identification code can carry information related to the information to be verified, and the specific form is not limited in this embodiment.
  • the electronic cryptographic device may be a dynamic port token, or may be an electronic signature tool, or may be an electronic signature tool with a dynamic port token function, or may be other devices, as long as the device can complete the embodiment.
  • the function of the electronic cryptographic device can be.
  • the electronic cryptographic device may acquire and display the graphic identification code before the terminal sends the identity authentication request to the background server, and the terminal sends the image to the background server when sending the identity authentication request, or may first The background server sends an identity authentication request, and then the terminal instructs the electronic password device to generate and display the graphic identification code, and then the terminal sends the above picture to the background server.
  • the following examples will describe these two cases.
  • FIG. 1 is a schematic structural diagram of a remote identity authentication system according to an embodiment of the present invention. As shown in FIG. 1 , the system mainly includes: Electronic cryptographic device 10, terminal 20 and background server 30.
  • the terminal 20 first sends an identity authentication request to the background server 30, and then the electronic cryptographic device 10 obtains the to-be-verified information, and generates and displays a graphic identification code according to the to-be-verified information, and the user takes the electronic password device 10 to take a photo.
  • the terminal 20 Acquire a picture including the face image of the user and the graphic identification code displayed by the electronic cryptographic device 10, and send the picture to the background server 30 for verification.
  • the terminal 20 is configured to send an identity authentication request to the background server 30, where the identity authentication request carries user information, where the user information may be the user's identity card information, for example, the user's ID card number, etc.
  • the electronic cryptographic device 10 is configured to obtain information to be verified, and generate and display a graphic identification code according to the information to be verified.
  • the electronic cryptographic device 10 can obtain the information to be verified under the trigger of the terminal 20. For example, after transmitting the identity authentication request to the background server 30, the terminal 20 can send an indication to the electronic cryptographic device 10 to trigger the electronic cryptographic device 10 to acquire the information.
  • the terminal 20 may also send an indication to the electronic cryptographic device 10 after receiving the identity authentication request response returned by the background server 30, and trigger the electronic cryptographic device 10 to acquire the information to be verified.
  • the electronic cryptographic device 10 may also acquire the information to be verified under the trigger of an instruction input by the user, for example, the user presses a specific function key of the electronic cryptographic device 10.
  • the terminal 20 is further configured to acquire a picture including a face image of the user and a graphic identification code displayed by the electronic cryptographic device 10, and send the picture to the background server 30.
  • the background server 30 is configured to receive the picture sent by the terminal 20, and The graphic identification code recorded above and the face image of the user are verified.
  • the user can send an identity authentication request to the background server 30 through the terminal 20, generate a graphic identification code through the electronic cryptographic device 10, and then include the facial image and the graphic identification code of the user through the terminal 20.
  • the picture is sent to the background server 30, and the background server 30 verifies the graphic identification code recorded on the picture and the face image of the user, thereby completing remote identity authentication for the user.
  • the user information carried by the terminal 20 to the identity authentication request sent by the backend server 30 may be the identity card information of the user, for example, the ID number of the user, or the user information may also be the identity of the user.
  • the ciphertext of the information the terminal 20 obtains the ciphertext of the user's ID card information, and carries the ciphertext of the user's ID card information as the user information in the identity authentication request and sends it to the background server 30; the background server 30 is also used to receive the identity.
  • the authentication request is performed, and the identity of the user is verified according to the ciphertext of the identity card information carried in the identity authentication request.
  • the ciphertext of the user's ID card information may be an ID card reading module (which may be set in the terminal 20, or may be set in the electronic cryptographic device 10 or a separate ID card reader) from the user's It is read in the resident ID card and obtained by encrypting it through the electronic password device 10.
  • an ID card reading module which may be set in the terminal 20, or may be set in the electronic cryptographic device 10 or a separate ID card reader
  • the ID card reading module may be a card reader with a resident ID card verification security control module, and the ID card reader sends the read ID card information to the electronic password device 10 for encryption, and then sends the card ID to the terminal 20.
  • the ID card reading module can also be an ID card that does not have a resident ID card verification security control module and only has a card reading module.
  • Card device in this case, the resident ID card verification security control module is set at the far end, the ID card reading device communicates with the resident ID card verification security control module through the network, and forwards the resident ID card verification security control module and the resident ID card.
  • the interaction information between the last resident ID card verification security control module sends the read ID information to the terminal 20, and the terminal 20 sends the ID information to the electronic cryptographic device 10. After the electronic cryptographic device 10 encrypts, the confidentiality is encrypted. The text is returned to the terminal 20.
  • the ID card information is read by the ID card reading module from the resident ID card, and since the ID card reading module can only read the legal resident ID card, the above implementation manner can be used. Ensure the legality of the resident ID card used in the user identity authentication process.
  • the background server 30 After receiving the identity authentication request sent by the terminal 20, the background server 30 verifies the identity of the user according to the ciphertext of the identity card information carried in the identity authentication request.
  • the background server 30 may store the correspondence between the electronic cryptographic device 10 and the ID card information of the user who receives the electronic cryptographic device 10, and in the alternative embodiment, the background server After receiving the identity authentication request, the ciphertext of the ID card information carried in the identity authentication request may be decrypted by using the decryption key corresponding to the encryption key to obtain the identity card information.
  • the background server 30 In the corresponding relationship between the stored electronic cryptographic device and the ID card information, the ID card information corresponding to the electronic cryptographic device 10 is searched, and the background server 30 compares the obtained ID card information with the decrypted ID card information, in both In the case of matching, it is confirmed that the identity authentication of the user currently requesting identity authentication is successful, and if the two do not match, it is confirmed that the identity authentication of the user currently requesting identity authentication fails.
  • the background server 30 when the background server 30 stores the correspondence between the electronic cryptographic device and the ID card information, the background information of the electronic cryptographic device 10 may be stored and stored in association with the ID card information of the user using the electronic cryptographic device 10, and the identification information is stored.
  • the digital certificate can be used by the electronic cryptographic device 10, and the electronic cryptographic device 10 can send the digital certificate to the terminal 20, and the terminal 20 carries the digital certificate in the identity authentication request and sends it to the background server 30, and the background server 30 can The identifier information of the electronic cryptographic device 10 is obtained in the certificate.
  • the background server 30 may send an instruction to the electronic cryptographic device 10 to obtain the identification information through the terminal 20 after receiving the identity authentication request.
  • the background server 30 may also determine the decryption key of the ciphertext for decrypting the ID card information according to the identification information of the electronic cryptographic device 10, or the background server 30 and the electronic cryptographic device 10 may also negotiate the transmission key first (including The encryption key and the decryption key are established, that is, the secure transmission channel is established, and then the electronic cryptographic device 10 transmits the ciphertext of the identity card information to the background server 30 through the terminal 20.
  • the identification information is not limited to the digital certificate, and may be the serial number of the electronic cryptographic device 10.
  • the specific content of the identification information of the electronic cryptographic device 10 is not limited in this embodiment, as long as the identification information can be It is only necessary to determine an electronic cryptographic device 10.
  • the above-mentioned encryption key and decryption key used by the electronic cryptographic device 10 and the background server 30 may be asymmetric keys.
  • the encryption key may be the private key of the electronic cryptographic device 10, and the background server 30
  • the decryption key used is the public key of the electronic cryptographic device 10; or it may be a symmetric key, which is not limited in this embodiment.
  • the background server 30 compares the ID card information read by the ID card reading module with the pre-stored ID card information to verify the identity of the user, and can determine the legal holder of the electronic cryptographic device 10 and Whether the user using the current ID card belongs to the same person. Therefore, it is possible to prevent the user's ID card or electronic password device from being used by another person for identity authentication after being lost.
  • the user information sent by the terminal 20 may also include an identity.
  • the signature data of the ciphertext of the certificate information is, in the optional implementation, the electronic cryptographic device 10 is further configured to sign the ciphertext of the ID card information, that is, the electronic cryptographic device 10 is further configured to use the stored private key to perform signature calculation on the ciphertext of the ID card information.
  • the ciphertext of the signature data and the ID card information calculated by the signature is sent to the terminal 20, and the terminal 20 is configured to carry the ciphertext of the user's ID card information and the ciphertext signature data of the ID card information as user information in the identity authentication.
  • the request is sent to the background server 30.
  • the background server 30 is further configured to check the signature data of the ciphertext of the ID card information.
  • the background server 30 may first check the signature data of the ciphertext of the ID card information, and then verify the identity of the user according to the ciphertext of the ID card information, if the verification is performed. If it fails, the user's identity is no longer verified according to the ciphertext of the ID card information, and the user's identity authentication request is directly rejected.
  • the electronic cryptographic device 10 calculates summary information of the ciphertext of the identity card information, and the electronic cryptographic device 10 encrypts the summary information by using the private key stored by itself, and the The digest information of the private key encryption is used as the signature data of the ciphertext of the ID card information, and the electronic cipher device 10 transmits the ciphertext of the ID card information to the terminal 20 together with the signature data of the ciphertext of the ID card information.
  • the terminal 20 carries the ciphertext of the user's ID card information and the cipher text of the ID card information as user information in the identity authentication request and sends it to the background server 30.
  • the background server 30 After receiving the identity authentication request, the background server 30 first needs to identify the identity.
  • the signature data of the ciphertext of the information is checked, and the experience signing process is: the background server 30 decrypts the received encrypted summary information by using the public key of the electronic cryptographic device 10 to obtain the ciphertext summary information of the identity card information; Then, the background server 30 calculates the summary information of the ciphertext of the received identity card information, and compares it with the decrypted summary information. If the same, it indicates that the ciphertext of the identity card information has not been modified, and the identity card information can be guaranteed. complete.
  • the illegal molecule uses the lost ID card of the user and the illegal electronic device's own electronic cryptographic device 10 for identity authentication, and the private key pair of the electronic cryptographic device 10 is utilized.
  • the ciphertext of the ID card information is signed to obtain the signature data of the ciphertext of the ID card information, and the background server 30 checks the signature data of the ciphertext of the ID card information, and on the other hand, the ciphertext of the ID card information can be confirmed by the signature data.
  • the identity information sent by the signer on the other hand, by comparing the summary information obtained by calculating the ciphertext of the identity card information with the background server 30 and the decrypted summary information, can prevent the illegal molecule from modifying the identity card information.
  • the information to be verified acquired by the electronic cryptographic device 10 includes but is not limited to four ways.
  • Manner 1 The information to be verified is generated by the background server 30 and sent to the electronic cryptographic device through the terminal 20.
  • the background server 30 is further configured to: after receiving the identity authentication request sent by the terminal 20, generate the to-be-verified information, and send the to-be-verified information carrying identity authentication request response to the terminal 20.
  • the background server 30 may further encrypt the information to be sent to the terminal 20, for example, the background server 30 may use the private key of the background server 30 to encrypt the authentication information, or may also utilize The transport key negotiated with the electronic cryptographic device 10 is encrypted.
  • the terminal 20 is further configured to receive an identity authentication request response of the plaintext or ciphertext carrying the information to be verified returned by the backend server 30, and send the plaintext or ciphertext of the to-be-verified information to the electronic cryptographic device 10.
  • the background server 30 may verify the identity of the user according to the user information carried in the identity authentication request. After the verification is passed, the background server 30 generates the to-be-verified information, for example, The background server 30 may calculate the to-be-verified information according to the user information of the user, the serial number of the electronic cryptographic device, the current time, or other information, or may use the random number randomly generated by the background server 30 as the information to be verified. This embodiment does not limit the manner in which the background server 30 generates the information to be verified. To avoid the replay attack, the information to be verified is a single authentication data, that is, the information to be verified is invalid after being used once.
  • the information to be verified may be a string of numbers, letters or symbols, or any combination of numbers, letters or symbols. This embodiment does not limit the specific presentation of the information to be verified.
  • the background server 30 can also encrypt the plaintext of the authentication information, and generate the ciphertext of the information to be verified to ensure the security of the information to be verified.
  • the encryption operation can be symmetric encryption or asymmetric encryption.
  • the electronic cryptographic device 10 is further configured to receive the information to be verified sent by the terminal 20. If the received information to be verified is a ciphertext, the electronic cryptographic device 10 further decrypts the ciphertext of the authentication information.
  • Manner 2 The information to be verified is generated by the electronic cryptographic device 10;
  • the electronic cryptographic device 10 generates the information to be verified based on the parameters synchronized with the background server 10, for example, the information to be verified is generated in the manner of the current OTP.
  • the parameter that the electronic cryptographic device 10 synchronizes with the background server 10 may be a time parameter, or may be a usage time parameter or other synchronization parameter.
  • the information to be verified calculated by the electronic cryptographic device 10 using the parameters synchronized with the background server 30 does not need to be transmitted from the background server 30 to the terminal 20, and the information to be verified can be secured, and the information to be verified is prevented from being intercepted during the transmission.
  • Manner 3 The information to be verified is the user information obtained by the terminal 20.
  • the electronic cryptographic device 10 receives the user information transmitted by the terminal 20 and uses the user information as the information to be verified.
  • the information to be verified is the user information acquired by the terminal 20 (for example, the user's name, ID card number, etc.), the terminal 20 transmits the user information to the electronic cryptographic device 10, and the electronic cryptographic device 10 receives the user information sent by the terminal 20, and directly The user information is used as information to be verified.
  • the electronic cryptographic device 10 utilizes the user information acquired by the terminal 20. As the information to be verified, it has the advantage of being simple and quick.
  • Method 4 The information to be verified is input by the user to the electronic cryptographic device 10.
  • the background server 30 may generate the information to be verified and send it to the terminal 20 or other external device according to the foregoing manner, but the terminal 20 or other device does not send the information to be verified to the electronic cryptographic device 10, but Displayed on the terminal 20 or other device, and then the user inputs the information to be verified through the input device (for example, a keyboard) of the electronic cryptographic device 10, such that the device that obtains the information to be verified is separated from the electronic cryptographic device 10, and the electronic cryptographic device of the user In the case of 10 lost, the illegal molecule cannot obtain the information to be verified, and it is possible to prevent the illegal molecule from using the electronic cryptographic device 10 for identity authentication in the event that the electronic cryptographic device 10 is lost.
  • the user may input the user information into the electronic cryptographic device 10 instead of being transmitted by the terminal 20, so that the hacker can remotely operate the user's terminal and modify the user information sent by the terminal 20 to the electronic cryptographic device 10.
  • the electronic cryptographic device 10 After acquiring the information to be verified, the electronic cryptographic device 10 generates and displays a graphic identification code according to the information to be verified. Therefore, the background server 30 can be conveniently identified to subsequently identify the information to be verified.
  • the manner in which the electronic cryptographic device 10 generates the graphic identification code includes, but is not limited to, the following manners 1 and 2.
  • Method 1 The electronic cryptographic device 10 directly converts the information to be verified into a graphic identification code
  • the information to be verified is directly converted into a graphic identification code by using a graphic identification code algorithm.
  • the graphic identification code algorithm is an algorithm for generating a graphic identification code for the information to be verified.
  • the graphic identification code is a two-dimensional code
  • the graphic identification code algorithm is an algorithm for generating a two-dimensional code to be verified, that is, a two-dimensional code. Generate an algorithm.
  • Manner 2 The electronic cryptographic device 10 performs the calculation of the verification information according to a preset algorithm, and generates a graphic identification code corresponding to the calculation result.
  • the electronic cryptographic device 10 obtains the information to be verified
  • the information to be verified is not directly converted into a graphic identification code by using a graphic identification code algorithm, but is calculated according to a preset algorithm, and then The graphic identification code algorithm generates a graphic identification code corresponding to the calculation result. In this way, the amount of calculation for generating the graphic identification code can be reduced, and the flow can be saved.
  • the electronic cryptographic device 10 performs calculations on the verification information including but not limited to:
  • the electronic cryptographic device 10 signs the authentication information using the private key stored by itself.
  • the electronic cryptographic device 10 may first calculate the summary information of the information to be verified, and encrypt the summary information by using the private key stored by itself to form signature data of the information to be verified. After obtaining the signature data of the information to be verified, the background server 30 uses the public key corresponding to the private key of the electronic cryptographic device to perform the verification, which may prevent the hacker from tampering with the verification information on the one hand, and ensure that the information to be verified is determined by the specific The electronic cryptographic device 10 sends it.
  • the electronic cryptographic device 10 performs message authentication code (MAC) calculation on the authentication information.
  • MAC message authentication code
  • the message authentication code (MAC) algorithm is an encryption algorithm, and the electronic cryptographic device 10 performs encryption calculation on the verification information, and is not limited to an encryption algorithm of the MAC algorithm, as long as the encryption algorithm is in the protection scope of the present application.
  • the encryption algorithms that can be used in this embodiment are listed below:
  • Symmetric MAC algorithm DES-CBC, 3DES-CBC, AES-CBC;
  • HMAC algorithm HMAC-MD5, HMAC-SHA1.
  • the terminal 20 is further configured to acquire a picture including a face image of the user and a graphic identification code displayed by the electronic cryptographic device 10, and send the picture to the background server 30;
  • the image including the facial image of the user and the graphic identification code displayed by the electronic cryptographic device 10 may be a photographing of the face containing the user and the electronic cryptographic device by the photographing device provided on the terminal 20.
  • Obtaining an image of the displayed graphic identification code may also be an image acquisition by the external device including the face of the user and the graphic identification code displayed by the electronic cryptographic device 10, and then transmitting the captured image to the terminal 20, in this case.
  • the hardware requirement for the terminal 20 can be reduced, and the camera 20 is not required to be provided on the terminal 20.
  • the terminal 20 obtains a picture including the facial image of the user and the graphic identification code displayed by the electronic cryptographic device 10, and sends the picture to the background server 30.
  • the background server 30 After receiving the picture including the user's face image and the graphic identification code, the background server 30 first records the picture.
  • the graphical identification code is identified to determine the identity of the user of the electronic cryptographic device 10, i.e., the background server 30 can verify whether the information carried on the graphical identification code is predetermined information. For example, if the information to be verified is generated by the background server 30 and transmitted to the electronic cryptographic device 10 through the terminal 20, (1) if the electronic cryptographic device 10 directly generates the graphic identification code for the information to be verified, the background server 30 identifies the graphic identifier.
  • the background server 30 determining whether the information carried by the graphic identification code is the same as the information to be verified generated by the background server 30; (2) if the electronic cryptographic device 10 signs the data to be verified and generates a graphic identification code for the signature data, the background server 30 identifies The graphic identification code acquires information carried by the graphic identification code, and then decrypts the information by using the public key of the electronic cryptographic device 10. On the other hand, the background server 30 performs hash calculation on the information to be verified generated by the background server, and the calculation is performed.
  • the obtained result is compared with the result obtained by decrypting the above information to determine whether the two are the same; (3) if the electronic cryptographic device 10 performs MAC calculation on the information to be verified and generates a graphic identification code by the calculation result, the background server 30 recognizes The graphic identification code acquires information carried by the graphic identification code, on the other hand, Server 30 performs its authentication information to be generated MAC calculation, the results obtained with the calculated pattern information carried by the identification code comparison, determines whether or not both the same.
  • the verification of the graphic identification code by the background server 30 is similar to the case where the information to be verified is generated by the background server 30, except that in this case, the background server The information to be verified is generated by the background server 30 in the same manner as the electronic cryptographic device 10, and details are not described herein. If the information to be verified is the user information acquired by the terminal 20, the verification of the graphic identification code by the background server 30 is similar to the case where the information to be verified is generated by the background server 30, except that in this case, the background server The information to be verified that is used for the authentication is the user information obtained by the background server 30 from the identity authentication request, and details are not described herein.
  • the manner in which the background server 30 verifies the graphic identification code is as described above.
  • the information to be verified is the same as that generated by the background server 30 and sent to the electronic cryptographic device 10 through the terminal 20. If the information to be verified input by the user is user information, the manner in which the background server 30 verifies the graphic identification code and the information to be verified is The manners of the user information acquired by the terminal 20 are the same, and details are not described herein.
  • the background server 30 may optionally store the identity information including the facial image of the user in advance, and when verifying the facial image of the user included in the image, the background server 30 may upload the facial image of the user uploaded by the terminal 20 with the pre-stored user. The facial images are compared. If they match, the verification passes, and if they do not match, the verification fails.
  • the background server 30 may store the correspondence between the identification information of the user and the identity information of the user, where the identification information of the user may be the ID number of the user, or the ID number of the user + the name of the user. It may be the serial number of the electronic cryptographic device 10 used by the user, or may be the certificate used by the electronic cryptographic device 10 used by the user.
  • the backend server 30 stores the electronic cryptographic device 10 (which can be identified by the serial number of the electronic cryptographic device 10, the used certificate, etc.) used by the user and the identity information of the user. Corresponding relationship, specifically when the user goes to the electronic password device 10, uploads the user's electronic password device 10 and the user's identity information to the backend server 30 through the counter. Alternatively, it may be a face image of the user displayed by the identity information system called by the background server 30 based on the information of the electronic cryptographic device 10.
  • the background server 30 After receiving the facial image of the user uploaded by the terminal 20, the background server 30 verifies the facial image of the user by acquiring the pre-stored identity information of the user corresponding to the electronic cryptographic device 10, wherein the identity The information includes a facial image of the user; comparing the facial image of the user recorded on the image with the facial image of the user included in the acquired identity information, and if the two match, determining that the verification passes, otherwise , make sure the verification does not pass.
  • the comparison method may be a face recognition technology or a background worker for identification.
  • the background server 30 can confirm whether the electronic cryptographic device is the person who actually requests the identity authentication.
  • the background server 30 when the background server 30 fails to pass the graphic identification code recorded on the picture and the facial image verification of the user, the background server 30 sends a retransmission instruction to the terminal 20, indicating The terminal 20 re-uploads the picture until the verification passes or the verification reaches a predetermined number of times.
  • FIG. 1 is a schematic structural diagram of a remote identity authentication system according to the present application.
  • the system embodiment shown in FIG. 1 includes an electronic cryptographic device 10, a terminal 20, and a background server 30.
  • the electronic cryptographic device 10 obtains the information to be verified, and generates and displays a graphic identification code according to the information to be verified, the user takes the electronic password device 10 to take a photo, and the terminal 20 acquires the facial image including the user and the electronic cryptographic device 10 displays The picture of the graphic identification code is carried in the identity authentication request and sent to the background server 30 for verification.
  • the electronic cryptographic device 10 before the terminal 20 sends an identity authentication request to the background server 30, the electronic cryptographic device 10 generates and displays a graphic identification code, and the terminal 20 acquires a user facial image and a graphic identifier. The picture of the code, the terminal 20 transmits the above picture to the background server 30 when transmitting the identity authentication request.
  • the manner in which the electronic cryptographic device 10 obtains the information to be verified includes, but is not limited to, the following manners:
  • Method 1 The information to be verified is generated by the electronic cryptographic device 10;
  • the electronic cryptographic device 10 generates the information to be verified based on the parameters synchronized with the background server 10, for example, the information to be verified is generated in the manner of the current OTP.
  • the parameter that the electronic cryptographic device 10 synchronizes with the background server 10 may be a time parameter, or may be a usage time parameter or other synchronization parameter.
  • the information to be verified calculated by the electronic cryptographic device 10 using the parameters synchronized with the background server 30 does not need to be transmitted from the background server 30 to the terminal 20, and the information to be verified can be secured, and the information to be verified is prevented from being intercepted during the transmission.
  • the information to be verified is the user information acquired by the terminal 20;
  • the electronic cryptographic device 10 receives the user information transmitted by the terminal 20 and uses the user information as the information to be verified.
  • the information to be verified is the user information acquired by the terminal 20 (for example, the user's name, ID card number, etc.), the terminal 20 transmits the user information to the electronic cryptographic device 10, and the electronic cryptographic device 10 receives the user information sent by the terminal 20, and directly The user information is used as information to be verified.
  • the electronic cryptographic device 10 utilizes the user information acquired by the terminal 20 as the information to be verified, and has the advantage of being simple and quick.
  • Manner 3 The information to be verified is input by the user to the electronic cryptographic device 10.
  • the user inputs the user information into the electronic cryptographic device 10 instead of being transmitted by the terminal 20, thereby preventing the hacker from remotely operating the user's terminal and modifying the user information sent by the terminal 20 to the electronic cryptographic device 10.
  • the electronic cryptographic device 10 After acquiring the information to be verified, the electronic cryptographic device 10 generates and displays a graphic identification code according to the information to be verified. Therefore, it is convenient for the station server 30 to subsequently identify the information to be verified.
  • the manner in which the electronic cryptographic device 10 generates the graphic identification code according to the information to be verified in this embodiment is the same as that in the first embodiment of the present application, that is, the electronic cryptographic device 10 directly sends the to-be-verified signal.
  • the information is converted into a graphic identification code or the electronic cryptographic device 10 calculates the authentication information according to a preset algorithm, and generates a graphic identification code corresponding to the calculation result.
  • the specific implementation is the same as that in Embodiment 1, and details are not described herein again.
  • the calculation of the authentication information by the electronic cryptographic device 10 is also the same as that in Embodiment 1, and details are not described herein again.
  • the manner in which the terminal 20 obtains a picture of the user's facial image and the graphic identification code displayed by the electronic cryptographic device 10 is the same as that in the first embodiment of the present application, and details are not described herein again.
  • the terminal 20 After acquiring the above picture, the terminal 20 carries the picture in the identity authentication request and sends it to the background server 30.
  • the user information carried in the identity authentication request is the same as that in the first embodiment of the present application, that is, the ciphertext of the user's ID card information, or the signature data of the cipher text of the ID card information, which is not described in detail. .
  • the manner in which the ID card reading module reads the ID card information is the same as that in the embodiment 1 of the present application, and details are not described herein again.
  • the background server 30 After the background server 30 receives the identity authentication request, the background server 30 verifies the identity of the user according to the ciphertext of the ID card information in the same manner as in the first embodiment of the present application, and details are not described herein again.
  • the background server 30 receives the picture sent by the terminal, the manner in which the background server 30 verifies the graphic identification code and the facial image of the user on the image is the same as that in the first embodiment of the present application, and details are not described herein again.
  • the background server 30 transmits a retransmission instruction to the terminal 20 to instruct the terminal 20 to re-upload the picture until the verification passes or the verification reaches the predetermined time. frequency.
  • the embodiment provides a remote account opening system, which uses the remote identity authentication system in the first embodiment or the second embodiment to authenticate the identity of the user. After the user's identity authentication is passed, the background server 30 performs remote account opening. It enables users to open accounts remotely anytime, anywhere, to facilitate users and improve user experience.
  • the background server 30 may automatically perform remote account opening, or the staff control background server 30 may perform remote account opening.
  • FIG. 2 is a schematic flowchart diagram of an embodiment of a remote identity authentication method provided by the present application. The method embodiment shown in Figure 2 includes the following steps:
  • Step 201 The terminal sends an identity authentication request to the background server, where the identity authentication request carries user information.
  • Step 202 The electronic cryptographic device obtains information to be verified.
  • Step 203 The electronic cryptographic device generates and displays a graphic identification code according to the information to be verified.
  • Step 204 The terminal acquires a picture including a facial image of the user and the graphic identification code displayed by the electronic cryptographic device, and sends the image to a background server.
  • Step 205 The background server receives the picture, and verifies the graphic identification code and the facial image of the user recorded on the picture.
  • the terminal sends an identity authentication request to the background server, where the identity authentication request carries user information, where the user information may be the user's identity card information, for example, the user's ID number.
  • the electronic cryptographic device obtains the information to be verified, and generates and displays a graphic identification code according to the information to be verified.
  • the electronic cryptographic device can obtain the information to be verified under the trigger of the terminal. For example, after sending the identity authentication request to the background server, the terminal may send an indication to the electronic cryptographic device to trigger the electronic cryptographic device to obtain the information to be verified, or the terminal. After receiving the identity authentication request response returned by the background server, the device may send an indication to the electronic cryptographic device to trigger the electronic cryptographic device to obtain the information to be verified.
  • the electronic cryptographic device may also acquire the information to be verified under the trigger of the instruction input by the user, for example, the specific function key of the user pressing the electronic cryptographic device.
  • the terminal acquires a picture including the facial image of the user and the graphic identification code displayed by the electronic cryptographic device, and sends the picture to the background server; the background server receives the picture sent by the terminal, and performs the graphic identification code recorded on the picture and the facial image of the user. verification.
  • the user may send an identity authentication request to the background server through the terminal, generate a graphic identification code through the electronic cryptographic device, and then send the image including the facial image and the graphic identification code of the user to the background through the terminal.
  • the server and the background server verify the graphic identification code recorded on the picture and the facial image of the user, thereby completing remote authentication of the user.
  • Step 201 The terminal sends an identity authentication request to the background server, where the identity authentication request carries user information.
  • the terminal Before the electronic cryptographic device obtains the information to be verified, the terminal sends an identity authentication request to the background server, where the identity authentication request carries the user information.
  • the user information carried by the terminal to the identity authentication request sent by the terminal server may be the identity card information of the user, for example, the ID number of the user, or the user information may also be The ciphertext of the user's ID card information, the terminal obtains the ciphertext of the user's ID card information, and the ciphertext of the user's ID card information is carried as the user information in the identity authentication request and sent to the background server; the background server receives the identity authentication request, And verifying the identity of the user according to the ciphertext of the ID card information carried in the identity authentication request.
  • the ciphertext of the user's ID card information may be an ID card reading module (which may be set at the terminal, or may be set in an electronic cryptographic device or a separate ID card reader) from the user's resident identity.
  • the card is read and encrypted by an electronic cryptographic device.
  • the ID card reading module may be a card reader with a resident ID card verification security control module, and the ID card reader sends the read ID card information to the electronic password device for encryption, and then sends the card to the terminal.
  • the ID card reading module may also be an ID card reading device that does not have a resident ID card verification security control module and only has a card reading module.
  • the resident ID card verification security control module is set at the remote end, and the ID card
  • the card reading device communicates with the resident ID card verification security control module through the network, and forwards the interaction information between the resident ID card verification security control module and the resident ID card, and finally the resident ID card verification security control module will read the identity card information to be sent.
  • the terminal sends the ID information to the electronic cryptographic device, and after the electronic cryptographic device encrypts, the ciphertext is returned to the terminal.
  • the ID card information is read by the ID card reading module from the resident ID card, and since the ID card reading module can only read the legal resident ID card, the above implementation manner can be used. Ensure the legality of the resident ID card used by the user during the account opening process.
  • the background server After receiving the identity authentication request sent by the terminal, the background server verifies the identity of the user according to the ciphertext of the identity card information carried in the identity authentication request.
  • the background server may store the correspondence between the electronic cryptographic device and the identity card information of the user who obtains the electronic cryptographic device.
  • the background server receives the After the identity authentication request, on the one hand, the decryption key corresponding to the encryption key may be used to decrypt the ciphertext of the identity card information carried in the identity authentication request to obtain the identity card information, and on the other hand, the background server stores the electronic password.
  • the ID card information corresponding to the electronic password device is searched, and the background server compares the obtained ID card information with the decrypted ID card information, and if the two match, confirm the current The authentication of the user requesting to open the account is successful. If the two do not match, the identity verification of the user who requested the account opening fails.
  • the background server when the background server stores the correspondence between the electronic password device and the ID card information, the identifier information of the electronic password device may be stored and stored in association with the ID card information of the user using the electronic password device, and the identifier information may be electronic.
  • the digital certificate used by the cryptographic device, the electronic cryptographic device can send the digital certificate to the terminal, and the terminal carries the digital certificate in the identity authentication request and sends the digital certificate to the background server, and the background server can obtain the identification information of the electronic cryptographic device from the digital certificate.
  • the background server may also send an instruction to the electronic cryptographic device to obtain the identification information after receiving the identity authentication request.
  • the background server may also determine the decryption key of the ciphertext for decrypting the ID card information according to the identification information of the electronic cryptographic device, or the background server and the electronic cryptographic device may also negotiate the transmission key (including the encryption key and The decryption key) establishes a secure transmission channel, and then the electronic cryptographic device transmits the ciphertext of the identity card information to the background server through the terminal.
  • the identification information is not limited to the digital certificate, and may be the serial number of the electronic cryptographic device.
  • the specific content of the identification information of the electronic cryptographic device is not limited in this embodiment, and may be uniquely determined according to the identification information. Identify an electronic password device.
  • the above-mentioned encryption key and decryption key used by the electronic cryptographic device and the background server may be asymmetric keys, for example, the encryption key may be a private key of the electronic cryptographic device, and a decryption key used by the background server.
  • the background server compares the ID card information read by the ID card reading module with the pre-stored ID card information during the account opening process, to verify the identity of the user, and can determine the legal holding of the electronic password device. Whether the user who uses the current ID card belongs to the same person. Therefore, it is possible to prevent the user's ID card or electronic password device from being used by others to open an account after being lost.
  • the user information sent by the terminal may further include the ID card information.
  • the signature data of the ciphertext that is, in the optional implementation, the electronic cryptographic device is further configured to sign the ciphertext of the ID card information, that is, the electronic cryptographic device uses the stored private key to perform signature calculation on the ciphertext of the ID card information, and calculates the signature.
  • the cipher text of the signature data and the ID card information is sent to the terminal, and the terminal carries the ciphertext of the user's ID card information and the cipher text of the ID card information as user information in the identity authentication request and sends the message to the background server.
  • the background server checks the signature data of the ciphertext of the ID card information.
  • the background server may first check the signature data of the ciphertext of the ID card information, and then verify the identity of the user according to the ciphertext of the ID card information after the verification is passed, if the verification is not After passing, the user's identity is no longer verified according to the ciphertext of the ID card information, and the user's identity authentication request is directly rejected.
  • the electronic cryptographic device calculates summary information of the ciphertext of the identity card information, and the electronic cryptographic device encrypts the summary information by using the private key stored by the electronic cryptographic device, and encrypts the private key.
  • the encrypted summary information is used as the signature data of the ciphertext of the ID card information, and the electronic cryptographic device transmits the ciphertext of the ID card information together with the signature data of the ciphertext of the ID card information to the terminal.
  • the terminal carries the ciphertext of the user's ID card information and the cipher text of the ID card information as user information in the identity authentication request and sends the message to the background server.
  • the background server After receiving the identity authentication request, the background server first needs the identity card information.
  • the signature data of the ciphertext is checked, and the experience signing process is: the background server decrypts the received encrypted summary information by using the public key of the electronic cryptographic device to obtain the ciphertext summary information of the identity card information; and then the background server calculates and receives The summary information of the ciphertext of the ID card information is compared with the decrypted summary information. If they are the same, the ciphertext of the ID card information has not been modified, and the identity information of the ID card can be guaranteed.
  • the illegal molecule uses the lost identity card of the user and the illegal electronic identity device of the illegal molecule to perform remote identity authentication, and the private key of the electronic cryptographic device is used to identify the identity.
  • the ciphertext of the certificate information is signed to obtain the signature data of the ciphertext of the ID card information, and the background server performs the verification of the signature data of the ciphertext of the ID card information.
  • the ciphertext of the ID card information can be confirmed by the signature data.
  • a summary letter obtained by comparing the ciphertext of the ID card information with the background server Whether the information is consistent with the summary information obtained by decryption can prevent illegal elements from modifying the identity card information.
  • Step 202 The electronic cryptographic device obtains information to be verified.
  • the information to be verified acquired by the electronic cryptographic device includes but is not limited to four ways.
  • Method 1 The information to be verified is generated by the background server and sent to the electronic password device through the terminal.
  • the background server after receiving the identity authentication request sent by the terminal, the background server generates the to-be-verified information, and sends the to-be-verified information carrying identity authentication request response to the terminal.
  • the background server may further encrypt the information to be sent to the terminal, for example, the background server may use the private key of the background server to encrypt the verification information, or may use the electronic password device.
  • the negotiated transport key is encrypted.
  • the terminal receives the identity authentication request response of the plaintext or the ciphertext that is to be verified by the backend server, and sends the plaintext or ciphertext of the information to be verified to the electronic cryptographic device.
  • the background server may verify the identity of the user according to the user information carried in the identity authentication request. After the verification is passed, the background server generates the to-be-verified information.
  • the background server may The information to be verified is calculated according to the user information of the user, the serial number of the electronic cryptographic device, the current time, or other information, and the random number randomly generated by the background server may also be used as the information to be verified. This embodiment does not limit the manner in which the background server generates the information to be verified.
  • the information to be verified is a single authentication data, that is, the information to be verified is invalid after being used once.
  • the information to be verified may be a string of numbers, letters or symbols, or any combination of numbers, letters or symbols.
  • This embodiment does not limit the specific presentation of the information to be verified.
  • the background server can also encrypt the plaintext of the verification information to generate the ciphertext of the information to be verified, so as to ensure the security of the information to be verified, and the encryption operation can be symmetric encryption or asymmetric encryption.
  • the electronic cryptographic device receives the information to be verified sent by the terminal, and if the received information to be verified is ciphertext, the electronic cryptographic device is further used to decrypt the ciphertext of the authentication information.
  • Method 2 The information to be verified is generated by an electronic cryptographic device
  • the electronic cryptographic device generates the information to be verified based on the parameters synchronized with the background server, for example, the information to be verified is generated in the manner of the current OTP.
  • the parameter that the electronic cryptographic device synchronizes with the background server may be a time parameter, or may be a usage time parameter or other synchronization parameter.
  • the information to be verified calculated by the electronic cryptographic device using the parameters synchronized with the background server does not need to be transmitted from the background server to the terminal, and the information to be verified can be secured, and the information to be verified is prevented from being intercepted during the transmission.
  • Manner 3 The information to be verified is the user information obtained by the terminal.
  • the electronic cryptographic device receives the user information sent by the terminal, and uses the user information as the information to be verified.
  • the information to be verified is the user information obtained by the terminal (for example, the user's name, ID number, etc.), and the terminal will use
  • the user information is sent to the electronic cryptographic device, and the electronic cryptographic device receives the user information sent by the terminal, and directly uses the user information as the information to be verified.
  • the electronic cryptographic device utilizes the user information acquired by the terminal as the information to be verified, and has the advantages of being simple and quick.
  • Method 4 The information to be verified is input by the user to the electronic password device.
  • the background server may generate the information to be verified and send the information to the terminal or other external device in the foregoing manner, but the terminal or other device does not send the information to be verified to the electronic password device, but displays the terminal or On other devices, the user then inputs the information to be verified through the input device (such as a keyboard) of the electronic cryptographic device, so that the device that obtains the information to be verified is separated from the electronic cryptographic device, and the electronic cryptographic device of the user is lost, the illegal molecule The information to be verified cannot be obtained, and the illegal molecule can be prevented from using the electronic password device to open an account in the event that the electronic password device is lost.
  • the user may input the user information into the electronic cryptographic device instead of being sent by the terminal, so that the hacker can remotely operate the user's terminal and modify the user information sent by the terminal to the electronic cryptographic device.
  • Step 203 The electronic cryptographic device generates and displays a graphic identification code according to the information to be verified.
  • the electronic cryptographic device After obtaining the information to be verified, the electronic cryptographic device generates and displays a graphic identification code according to the information to be verified. Therefore, the background server can be conveniently identified by the background server.
  • the manner in which the electronic cryptographic device generates the graphic identification code includes, but is not limited to, the following manners 1 and 2.
  • Method 1 The electronic cryptographic device directly converts the information to be verified into a graphic identification code
  • the information to be verified is directly converted into a graphic identification code by using a graphic identification code algorithm.
  • the graphic identification code algorithm is an algorithm for generating a graphic identification code for the information to be verified.
  • the graphic identification code is a two-dimensional code
  • the graphic identification code algorithm is an algorithm for generating a two-dimensional code to be verified, that is, a two-dimensional code. Generate an algorithm.
  • Manner 2 The electronic cryptographic device calculates the verification information according to a preset algorithm, and generates a graphic identification code corresponding to the calculation result.
  • the information to be verified is not directly converted into the graphic identification code by the graphic identification code algorithm, but is calculated according to the preset algorithm, and then the graphic is processed.
  • the identification code algorithm generates a graphic identification code corresponding to the calculation result. In this way, the amount of calculation for generating the graphic identification code can be reduced, and the flow can be saved.
  • the electronic cryptographic device performs calculations on the verification information including but not limited to:
  • the electronic cryptographic device uses the private key stored by itself to sign the authentication information.
  • the electronic cryptographic device may first calculate the summary information of the information to be verified, and encrypt the summary information by using the private key stored by itself to form signature data of the information to be verified.
  • the background server obtains signature data of the information to be verified.
  • the hacker can be prevented from tampering with the verification information, and on the other hand, the information to be verified can be sent by the specific electronic cryptographic device.
  • the electronic cryptographic device performs message authentication code (MAC) calculation on the authentication information.
  • MAC message authentication code
  • the message authentication code (MAC) algorithm is an encryption algorithm, and the electronic cryptographic device performs encryption calculation on the verification information, and is not limited to an encryption algorithm of the MAC algorithm.
  • the encryption algorithms that can be used in this embodiment are listed below:
  • Symmetric MAC algorithm DES-CBC, 3DES-CBC, AES-CBC;
  • HMAC algorithm HMAC-MD5, HMAC-SHA1.
  • Step 204 The terminal acquires a picture including a facial image of the user and the graphic identification code displayed by the electronic cryptographic device, and sends the image to a background server.
  • the image including the facial image of the user and the graphic identification code displayed by the electronic cryptographic device may be displayed by the camera set on the terminal, including the face of the user and the electronic cryptographic device.
  • the image of the graphic identification code is obtained.
  • the image acquisition including the user's face and the graphic identification code displayed by the electronic cryptographic device may be taken by the external device, and then the captured image is sent to the terminal.
  • the hardware requirement for the terminal can be reduced, and the terminal is not needed.
  • a shooting device is provided on the top.
  • Step 205 The background server receives the picture, and verifies the graphic identification code and the facial image of the user recorded on the picture.
  • the terminal acquires a picture including the face image of the user and the graphic identification code displayed by the electronic cryptographic device, and sends the picture to the background server.
  • the background server After receiving the picture including the user's face image and the graphic identification code, the background server first performs the graphic identification code recorded on the picture.
  • the identification is performed to determine the identity of the user of the electronic cryptographic device, that is, the background server can verify whether the information carried on the graphic identification code is predetermined information. For example, if the information to be verified is generated by the background server and sent to the electronic cryptographic device through the terminal, (1) if the electronic cryptographic device directly generates the graphic identification code for the information to be verified, the background server identifies the graphic identification code and determines the graphic.
  • the background server Whether the information carried by the identification code is the same as the information to be verified generated by the background server; (2) if the electronic cryptographic device signs the authentication information and generates a graphic identification code for the signature data, the background server identifies the graphic identification code and obtains the graphic Identifying the information carried by the code, and then decrypting the information by using the public key of the electronic cryptographic device. On the other hand, the background server performs hash calculation on the information to be verified generated by the background server, and decrypts the calculated result and the obtained information.
  • the results are compared to determine whether the two are the same; (3) if the electronic cryptographic device performs MAC calculation on the information to be verified, the calculation result generates a graphic identification code, The background server identifies the graphic identification code to obtain the information carried by the graphic identification code. On the other hand, the background server performs MAC calculation on the information to be verified generated by the background server, and compares the calculated result with the information carried by the graphic identification code. , to determine whether the two are the same. If the information to be verified is generated by the electronic password device, the verification of the graphic identification code by the background server is similar to the case where the information to be verified is generated by the background server, except that in this case, the background server is used for verification.
  • the information to be verified is generated by the background server in the same manner as the electronic cryptographic device, and details are not described herein. If the information to be verified is the user information acquired by the terminal, the verification of the graphic identification code by the background server is similar to the case where the information to be verified is generated by the background server, except that in this case, the background server is used for verification.
  • the information to be verified is the user information obtained by the background server from the identity authentication request, and details are not described herein.
  • the manner in which the background server verifies the graphic identification code and the above-mentioned pending verification The information is generated by the background server and sent to the electronic cryptographic device through the terminal. If the information to be verified by the user is the user information, the manner in which the background server verifies the graphic identification code and the manner in which the information to be verified is the user information acquired by the terminal is The same, no longer detailed.
  • the background server may optionally store the identity information including the facial image of the user, and when verifying the facial image of the user included in the image, the background server may upload the facial image of the user uploaded by the terminal and the pre-stored facial image of the user. For comparison, if it matches, the verification passes, and if it does not match, the verification fails.
  • the background server may store a correspondence between the user's identification information and the user's identity information, where the user's identification information may be the user's ID number, or the user's ID number + user name, or It is the serial number of the electronic password device used by the user, or it can be the certificate used by the user's electronic password device.
  • the background server stores a corresponding relationship between the electronic cryptographic device used by the user (which can be identified by the serial number of the electronic cryptographic device, the used certificate, etc.) and the identity information of the user.
  • the electronic cryptographic device used by the user which can be identified by the serial number of the electronic cryptographic device, the used certificate, etc.
  • the user's electronic password device and the user's identity information are uploaded to the background server for storage through the counter.
  • it may be a facial image of the user displayed by the identity information system called by the background server according to the information of the electronic cryptographic device.
  • the background server verifies the facial image of the user by acquiring the pre-stored identity information of the user corresponding to the electronic cryptographic device, wherein the identity information includes the user.
  • the comparison method may be a face recognition technology or a background worker for identification.
  • the background server can confirm whether the electronic password device is the real account holder, and prevent the illegal elements from pretending to open the account in case the ID card and the electronic password device are lost.
  • the background server records the graphic identifier on the picture. If the code and the user's facial image verification fail, the background server sends a retransmission instruction to the terminal to instruct the terminal to re-upload the picture until the verification passes or the verification reaches a predetermined number of times.
  • the electronic cryptographic device generates a graphic identification code for the information to be verified, and the terminal acquires a picture including the user's facial image and the graphic identification code and sends the image to the background server, and the background server can determine the electronic by identifying the graphic identification code in the image.
  • the identity of the user of the cryptographic device the background server compares the facial image of the user uploaded by the terminal with the pre-stored facial image of the user. If the comparison is passed, the background server can confirm whether the electronic cryptographic device is the real account holder. In the case of preventing the loss of identity cards and electronic password devices, illegal elements pretend to open accounts.
  • FIG. 3 is a schematic flowchart diagram of another remote identity authentication method according to an embodiment of the present application. The method embodiment shown in Figure 3 includes the following steps:
  • Step 301 The electronic cryptographic device obtains information to be verified.
  • Step 302 The electronic cryptographic device generates and displays a graphic identification code according to the information to be verified.
  • Step 303 The terminal acquires a picture including a facial image of the user and the graphic identification code displayed by the electronic cryptographic device.
  • Step 304 The terminal carries the picture to the background server in the identity authentication request, where the user does not request the user information;
  • Step 305 The background server receives the picture, and verifies the graphic identification code and the facial image of the user recorded on the picture.
  • the electronic cryptographic device before the terminal sends the identity authentication request to the background server, the electronic cryptographic device generates and displays the graphic identification code, and the terminal acquires the image of the user's face image and the graphic identification code, and the terminal acquires the image of the user's face image and the graphic identification code.
  • the above picture is sent to the background server when the identity authentication request is sent.
  • the background server can perform remote authentication of the user by verifying the graphic identification code on the picture and the facial image of the user.
  • Step 301 The electronic cryptographic device obtains information to be verified.
  • the manner in which the electronic cryptographic device obtains the information to be verified includes, but is not limited to, the following three modes:
  • Method 1 The information to be verified is generated by the electronic cryptographic device
  • the electronic cryptographic device generates the information to be verified based on the parameters synchronized with the background server, for example, the information to be verified is generated in the manner of the current OTP.
  • the parameter that the electronic cryptographic device synchronizes with the background server may be a time parameter, or may be a usage time parameter or other synchronization parameter.
  • the information to be verified calculated by the electronic cryptographic device using the parameters synchronized with the background server does not need to be transmitted from the background server to the terminal, and the information to be verified can be secured, and the information to be verified is prevented from being intercepted during the transmission.
  • the information to be verified is the user information obtained by the terminal;
  • the electronic cryptographic device receives the user information sent by the terminal, and uses the user information as the information to be verified.
  • the information to be verified is the user information acquired by the terminal (for example, the user's name, ID card number, etc.), the terminal sends the user information to the electronic password device, and the electronic password device receives the user information sent by the terminal, and directly uses the user information as the user information.
  • Information to be verified is the user information acquired by the terminal (for example, the user's name, ID card number, etc.), the terminal sends the user information to the electronic password device, and the electronic password device receives the user information sent by the terminal, and directly uses the user information as the user information.
  • Information to be verified The electronic cryptographic device utilizes the user information acquired by the terminal as the information to be verified, and has the advantages of being simple and quick.
  • Mode 3 The information to be verified is input by the user to the electronic password device.
  • the user inputs the user information into the electronic cryptographic device instead of being sent by the terminal, so that the hacker can remotely operate the user's terminal and modify the user information sent by the terminal to the electronic cryptographic device.
  • Step 302 The electronic cryptographic device generates and displays a graphic identification code according to the information to be verified.
  • the electronic cryptographic device After obtaining the information to be verified, the electronic cryptographic device generates and displays a graphic identification code according to the information to be verified. Therefore, it is convenient for the server to subsequently identify the information to be verified.
  • the method for generating the graphic identification code according to the information to be verified in the embodiment is the same as that in the fourth embodiment of the present application, that is, the electronic cryptographic device directly converts the information to be verified into a graphic identification code or the electronic cryptographic device treats according to a preset algorithm.
  • the verification information is calculated and a graphic identification code corresponding to the calculation result is generated.
  • the specific implementation is the same as that in Embodiment 4, and details are not described herein again.
  • the calculation of the verification information by the electronic cryptographic device is the same as that in the embodiment 4, and details are not described herein again.
  • Step 303 The terminal acquires a picture including a facial image of the user and the graphic identification code displayed by the electronic cryptographic device.
  • the manner in which the terminal obtains the picture of the user's facial image and the graphic identification code displayed by the electronic cryptographic device is the same as that in the embodiment 4 of the present application, and details are not described herein again.
  • the terminal After acquiring the above picture, the terminal carries the picture and sends it to the background server in the identity authentication request.
  • the user information carried in the identity authentication request is the same as that in the fourth embodiment of the present application, that is, the ciphertext of the user's ID card information, or the signature data of the ciphertext of the ID card information, which is not described in detail. .
  • the manner in which the ID card reading module reads the ID card information is the same as that in the embodiment 4 of the present application, and details are not described herein again.
  • Step 304 The terminal carries the picture in an identity authentication request and sends it to the background server, where the identity authentication request further carries user information.
  • the terminal After the terminal obtains the above picture, it is sent to the background server together with the identity authentication request, where the identity authentication request is sent.
  • the user information in the user information may be the user's ID card information, the cipher text of the user ID card information, or the signature data of the user ID card information, which is the same as the content in the foregoing embodiment 4, and details are not described herein again.
  • the background server After the background server receives the identity authentication request, the method for verifying the user ID information is the same as that in the embodiment 4, and details are not described herein again.
  • Step 305 The background server receives the picture, and verifies the graphic identification code and the facial image of the user recorded on the picture.
  • the background server receives the picture, and verifies the graphic identification code recorded on the picture and the facial image of the user.
  • the background server After the background server receives the identity authentication request, the background server verifies the identity of the user according to the ciphertext of the ID card information in the same manner as in the fourth embodiment of the present application, and details are not described herein again.
  • the background server After the background server receives the above-mentioned picture carried in the identity authentication request sent by the terminal, the manner in which the background server verifies the graphic identification code and the facial image of the user on the image is the same as that in the fourth embodiment of the present application. Narration.
  • the background server sends a retransmission instruction to the terminal, instructing the terminal to re-upload the picture until the verification passes or the verification reaches a predetermined number of times.
  • This embodiment provides a remote account opening method, which uses the identity authentication method in the above embodiment 4 or embodiment 5 to authenticate the identity of the user, and after the identity authentication is passed, the user can be remotely opened, enabling the user to open the account remotely anytime and anywhere, facilitating the user. To improve the user experience.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Health & Medical Sciences (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Biodiversity & Conservation Biology (AREA)
  • Biomedical Technology (AREA)
  • General Health & Medical Sciences (AREA)
  • Collating Specific Patterns (AREA)
  • Storage Device Security (AREA)

Abstract

本申请提供了远程身份认证方法和系统以及远程开户方法和系统，远程身份认证方法包括：电子密码设备获取待验证信息，并根据待验证信息生成并显示图形标识码，终端获取包含用户的面部图像和电子密码设备显示的图形标识码的图片，并将图片发送至后台服务器，后台服务器接收图片，并对图片上记载的图形标识码以及用户的面部图像进行验证。

Description

远程身份认证方法和系统以及远程开户方法和系统
相关申请的交叉引用
本申请基于申请号为201510564864.0、申请日为2015/9/7的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本申请作为参考。
技术领域
本申请涉及电子技术领域，尤其涉及一种远程身份认证方法和系统以及一种远程开户方法和系统。
背景技术
目前，客户开立新银行账户、股票账户等一般需要客户到物理网点进行办理，但是银行或证券公司等可以办理开户业务的时间，客户一般也在上班，很难有时间到物理网点进行办理业务。为方便客户办理开户业务，远程开户的方法被提上日程。目前，有基于VTM(虚拟柜员机)的一种远程开户方法，采用该VTM机进行远程的机制是在夜间通过设立在银行VTM远程视频柜员机，让用户与银行工作人员面对面视频交流。用户依靠视频，在银行工作人员的指导下，自主完成银行开户、网银办理、投资理财等多种柜面业务办理。然而该VTM机是放在银行的，对一些用户来说仍是不方便的，目前通过远程开户的方法实现用户可随时随地的进行开户。为保证远程开户的账户的真实性，需要实现“人证合一”，即实现对用户的远程身份认证是远程开户过程中亟待解决的技术问题。
发明内容
本申请旨在解决上述用户的远程身份认证问题。
本申请的主要目的在于提供远程身份认证方法。
本申请的另一目的在于提供一种远程开户方法。
本申请的另一目的在于提供远程身份认证系统。
本申请的另一目的在于提供一种远程开户系统。
为达到上述目的，本申请的技术方案具体是这样实现的：
本申请一方面提供了一种远程身份认证方法，包括：在远程开户过程中，电子密码设备获取待验证信息，其中，待验证信息包括：单次认证信息；电子密码设备根据待验证信息，生成并显示图形标识码；终端获取包含用户的面部图像和电子密码设备显示的图形标 识码的图片，并将图片发送至后台服务器；后台服务器接收图片，并对图片上记载的图形标识码以及用户的面部图像进行验证。
此外，终端将图片发送至后台服务器包括：终端将图片携带在身份认证请求中发送给后台服务器，其中，身份认证请求中还携带有用户信息。
此外，电子密码设备获取待验证信息之前，还包括：终端向后台服务器发送身份认证请求，其中，身份认证请求中携带有用户信息。
此外，在终端向后台服务器发送身份认证请求之前，还包括：身份证读卡模块读取用户的居民身份证中存储的身份证信息；电子密码设备对身份证读卡模块读取的身份证信息进行加密，将加密得到的身份证信息的密文发送给所述终端；用户信息包括：身份证信息的密文；在终端向后台服务器发送身份认证请求之后，还包括：后台服务器接收身份认证请求，根据身份证信息的密文对用户的身份进行验证。
此外，在终端向后台服务器发送身份认证请求之前，还包括：终端从电子密码设备获取身份证信息的密文的签名数据；用户信息还包括：身份证信息的密文的签名数据；后台服务器根据身份证信息的密文对用户的身份进行验证之前，还包括：后台服务器对身份证信息的密文的签名数据进行验签。
此外，后台服务器根据身份证信息的密文对用户的身份进行验证，包括：后台服务器对身份证信息的密文进行解密，得到身份证信息；后台服务器获取预先存储的与电子密码设备对应的身份证信息；后台服务器将获取的身份证信息与解密得到的身份证信息进行比较，在两者匹配的情况下，确认当前请求开户的用户的身份验证成功，在两者不匹配的情况，确认当前请求开户的用户的身份验证失败。
此外，电子密码设备获取待验证信息，包括：电子密码设备基于与后台服务器同步的参数，生成待验证信息。
此外，电子密码设备根据待验证信息，生成图形标识码，包括：电子密码设备将待验证信息转换为图形标识码；或者电子密码设备按照预设算法对待验证信息进行计算，生成与计算结果对应的图形标识码。
此外，电子密码设备按照预设算法对待验证信息进行计算，包括以下之一：电子密码设备利用自身存储的私钥，对待验证信息进行签名；电子密码设备对待验证信息进行消息认证码MAC计算。
此外，终端获取包含用户的面部图像和电子密码设备显示的图形标识码的图片，包括以下之一：终端通过设置在终端上的拍摄装置拍摄包含用户的面部和电子密码设备显示的图形标识码的图像，获取图片；终端接收外部设备发送的包含用户的面部图像和电子密码 设备显示的图形标识码。
此外，后台服务器对图片上记载的所述用户的面部图像验证包括：后台服务器获取预先存储的与电子密码设备对应的用户的身份信息，其中，身份信息包括用户的面部图像；后台服务器将图片上记载的用户的面部图像与获取所述身份信息中包括的用户的面部图像进行比对，在两者匹配的情况下，确定验证通过，否则，确定验证不通过。
此外，在后台服务器对图片上记载的图形标识码以及用户的面部图像验证没有通过的情况下，还包括：后台服务器向终端发送重传指令，指示终端重新上传图片，直到验证通过或验证达到预定次数。
本申请另一方面提供了一种远程开户方法，包括上述远程身份认证方法以及在远程身份认证通过之后进行远程开户。
本申请另一方面提供了一种远程身份认证系统，包括：电子密码设备、终端和后台服务器；其中，电子密码设备，用于获取待验证信息，并根据所述待验证信息，生成并显示图形标识码，其中，待验证信息包括：单次认证数据；终端，用于获取包含用户的面部图像和电子密码设备显示的图形标识码的图片，并将图片发送至后台服务器；后台服务器，用于接收终端发送的图片，并对图片上记载的图形标识码以及用户的面部图像进行验证。
此外，终端通过以下方式将图片发送给服务器：将图片携带在身份认证请求中发送给后台服务器，其中，身份认证请求中还携带有用户信息。
此外，终端还用于在电子密码设备获取待验证信息之前向后台服务器发送身份认证请求，其中，身份认证请求中携带有用户信息。
此外，系统还包括身份证读卡模块；身份证读卡模块用于读取用户的居民身份证中存储的身份证信息，将身份证信息发送给电子密码设备；电子密码设备还用于对身份证读卡模块读取的身份证信息进行加密，将加密得到的身份证信息的密文发送给终端；用户信息包括：用户的身份证信息的密文；后台服务器还用于接收身份认证请求，根据身份证信息的密文对用户的身份进行验证。
此外，终端还用于从电子密码设备获取身份证信息的密文的签名数据；用户信息还包括：身份证信息的密文的签名数据；后台服务器还用于对身份证信息的密文的签名数据进行验签。
此外，后台服务器通过以下方式对用户的身份进行验证：对身份证信息的密文进行解密，得到身份证信息；获取预先存储的与电子密码设备对应的身份证信息；将获取的身份证信息与解密得到的身份证信息进行比较，在两者匹配的情况下，确认当前请求开户的用户的身份验证成功，在两者不匹配的情况，确认当前请求开户的用户的身份验证失败。
此外，电子密码设备通过以下方式获取待验证信息：基于与后台服务器同步的参数，生成待验证信息。
此外，电子密码设备根据以下方式之一生成图形标识码：将待验证信息转换为图形标识码；按照预设算法对待验证信息进行计算，生成与计算结果对应的图形标识码。
此外，电子密码设备通过以下方式之一对待验证信息进行计算：利用自身存储的私钥，对待验证信息进行签名；对待验证信息进行消息认证码MAC计算。
此外，终端通过以下方式之一获取包含用户的面部图像和所述电子密码设备显示的图形标识码的图片：通过设置在终端上的拍摄装置拍摄包含用户的面部和电子密码设备显示的图形标识码的图像，获取图片；接收外部设备发送的包含用户的面部图像和电子密码设备显示的图形标识码的图片。
此外，后台服务器通过以下方式对图片上记载的用户的面部图像进行验证：获取预先存储的与电子密码设备对应的用户的身份信息，其中，身份信息包括用户的面部图像；将图片上记载的用户的面部图像与获取身份信息中包括的用户的面部图像进行比对，在两者匹配的情况下，确定验证通过，在两者不匹配的情况下，确定验证不通过。
此外，在后台服务器对图片上记载的图形标识码以及用户的面部图像验证没有通过的情况下，后台服务器还用于向终端发送重传指令，指示终端重新上传图片，直到验证通过或验证达到预定次数。
本申请的另一方面提供了一种远程开户系统，包括上述的远程身份认证系统，后台服务器还用于在身份认证通过之后进行远程开户。
由上述本申请提供的技术方案可以看出，通过本申请提供的一种身份认证方法，用户可以通过终端向后台服务器发送身份认证请求，通过电子密码设备生成图形标识码，然后通过终端将包含用户的面部图像和图形标识码的图片发送给后台服务器，后台服务器对图片上记载的图形标识码以及用户的面部图像进行验证，从而完成对用户的远程身份认证。
进一步的，用户信息中的身份证信息是身份证读卡模块从居民身份证中读取的，由于身份证读卡模块只能对合法的居民身份证进行读取，因此，采用上述实施方式，可以保证用户开户过程中使用的居民身份证的合法性。
进一步的，用户信息中包括身份证信息的密文的签名数据，保证了终端发送给后台服务器的身份证信息的密文的不可抵赖性及不会被篡改。
进一步的，后台服务器将开户过程中，身份证读卡模块读取的身份证信息与预先存储的身份证信息进行比较，以对用户的身份进行验证，可以判断电子密码设备的合法持有者与使用当前身份证的用户是否属于同一个人的。从而可以避免用户的身份证或电子密码设 备丢失后被其他人冒用开户的情况。
进一步的，电子密码设备获取待验证信息后，根据待验证信息生成并显示图形标识码，从而可以方便后台服务器后续识别待验证信息。
进一步的，对图片上记载的用户的面部图像与获取身份证信息中包括的用户的面部图像对比，后台服务器通过识别图片中的图形标识码可以确定电子密码设备用户的身份；后台服务器将终端上传的用户的面部图像与预先存储的用户的面部图像进行比对，比对通过的情况下，后台服务器可以确认电子密码设备是否是该真实开户人的，防止身份证和电子密码设备丢失的情况下，非法分子冒充开户。
通过本申请提供的远程开户方法，能够实现用户随时随地进行远程开户，方便用户，提高用户体验。
附图说明
为了更清楚地说明本申请实施例的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域的普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他附图。
图1是本申请实施例1和实施例2提供的远程身份认证系统的架构示意图；
图2是本申请实施例4提供的一种远程身份认证方法流程图；
图3是本申请实施例5提供的另一种远程身份认证方法流程图。
具体实施方式
下面结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请的保护范围。
在本申请的描述中，需要理解的是，术语“中心”、“纵向”、“横向”、“上”、“下”、“前”、“后”、“左”、“右”、“竖直”、“水平”、“顶”、“底”、“内”、“外”等指示的方位或位置关系为基于附图所示的方位或位置关系，仅是为了便于描述本申请和简化描述，而不是指示或暗示所指的装置或元件必须具有特定的方位、以特定的方位构造和操作，因此不能理解为对本申请的限制。此外，术语“第一”、“第二”仅用于描述目的，而不能理解为指示或暗示相对重要性或数量或位置。
在本申请的描述中，需要说明的是，除非另有明确的规定和限定，术语“安装”、“相连”、“连接”应做广义理解，例如，可以是固定连接，也可以是可拆卸连接，或一体地连接；可以是机械连接，也可以是电连接；可以是直接相连，也可以通过中间媒介间接相连，可以是两个元件内部的连通。对于本领域的普通技术人员而言，可以具体情况理解上述术语在本申请中的具体含义。
下面将结合附图和实施例对本申请进行详细描述。
在本申请实施例中，用户可以通过电子密码设备获取待验证信息，并根据该待验证信息生成并显示图形标识码，然后可以通过拍摄装置(可以设置在终端上，也可以设置在终端外)将用户的面部及电子密码设备显示的图形标识码进行拍照，终端获取到包含用户的面部图像和电子密码设备显示的图形标识码的图片，将该图片发送给后台服务器，后台服务器对图片上的图形标识码和用户的面部图像进行验证。
在本申请实施例中，待验证信息可以是电子密码设备与后台服务器按照相同的算法计算得到的，例如，电子密码设备和后台服务器可以采用类似OTP的方式生成的动态口令。或者，也可以是后台服务器发送给电子密码设备的单次认证数据，例如，随机数等。或者，还可以是后台服务器发送给电子密码设备持有者另一终端(例如用户的手机等)的单次认证数据，例如，随机数等，再由用户将该单次认证数据输入至电子密码设备。
图形标识码可以是根据待验证信息直接生成的，也可以是对待验证信息进行计算(例如，MAC计算或签名等)后生成的，例如，将计算结果生成图形标识码，具体本申请实施例不作限定。
其中，图形标识码可以是二维码，也可以是条形码等，只要该图形标识码中可以携带与待验证信息相关的信息即可，具体形式本实施例不作限定。
另外，在本实施例中，电子密码设备可以是动态口令牌，也可以电子签名工具，还可以是具有动态口令牌功能的电子签名工具，也可以为其他设备，只要该设备能够完成本实施例中电子密码设备的功能即可。
另外，在本申请实施例中，电子密码设备可以在终端向后台服务器发送身份认证请求之前，获取并显示图形标识码，终端在发送身份认证请求的时候向后台服务器发送上述图片，也可以先向后台服务器发送身份认证请求，然后，终端指示电子密码设备生成并显示图形标识码，然后终端在将上述图片发送给后台服务器。下面实施例将分这两种情况进行描述。
实施例1
图1为本实施例提供远程身份认证系统的架构示意图，如图1所示，该系统主要包括： 电子密码设备10、终端20和后台服务器30。
在本实施例中，终端20先向后台服务器30发送身份认证请求，然后电子密码设备10获取待验证信息，并根据待验证信息生成并显示图形标识码，用户持电子密码设备10进行拍照，终端20获取包含用户的面部图像及电子密码设备10显示的图形标识码的图片，将该图片发送给后台服务器30进行验证。
因此，在本实施例中，终端20，用于向后台服务器30发送身份认证请求，其中，身份认证请求中携带有用户信息，其中，该用户信息可以是用户的身份证信息，例如，用户的身份证号码等。电子密码设备10，用于获取待验证信息，并根据待验证信息，生成并显示图形标识码。其中，电子密码设备10可以在终端20的触发下获取待验证信息，例如，终端20可以在向后台服务器30发送身份认证请求之后，即向电子密码设备10发送指示，触发电子密码设备10获取待验证信息，或者，终端20也可以在接收后台服务器30返回的身份认证请求响应后，向电子密码设备10发送指示，触发电子密码设备10获取待验证信息。另外，电子密码设备10也可以是在用户输入的指令的触发下获取待验证信息，例如，用户按下电子密码设备10的特定功能键。终端20，还用于获取包含用户的面部图像和电子密码设备10显示的图形标识码的图片，并将图片发送至后台服务器30；后台服务器30，用于接收终端20发送的图片，并对图片上记载的图形标识码以及用户的面部图像进行验证。
通过本实施例提供的上述身份认证系统，用户可以通过终端20向后台服务器30发送身份认证请求，通过电子密码设备10生成图形标识码，然后通过终端20将包含用户的面部图像和图形标识码的图片发送给后台服务器30，后台服务器30对图片上记载的图形标识码以及用户的面部图像进行验证，从而完成对用户的远程身份认证。
在可选实施方式中，终端20向后台服务器30发送的身份认证请求携带的用户信息可以是用户的身份证信息，例如，用户的身份证号码等，或者，该用户信息还可以是用户的身份证信息的密文，终端20获取用户的身份证信息的密文，将用户的身份证信息的密文作为用户信息携带在身份认证请求中发送给后台服务器30；后台服务器30还用于接收身份认证请求，并根据身份认证请求中携带的身份证信息的密文对用户的身份进行验证。
在具体应用中，用户的身份证信息的密文可以是身份证读卡模块(可以设置在终端20，也可以设置在电子密码设备10，也可以是单独的身份证读卡器)从用户的居民身份证中读取，并通过电子密码设备10进行加密后得到的。
身份证读卡模块可以是具有居民身份证验证安全控制模块身份证读卡器，身份证读卡器将读取到的身份证信息发送给电子密码设备10进行加密，然后再发送给终端20。或者，身份证读卡模块也可以是不具备居民身份证验证安全控制模块只具备读卡模块的身份证读 卡装置，这种情况下，居民身份证验证安全控制模块设置在远端，身份证读卡装置通过网络与居民身份证验证安全控制模块进行通信，转发居民身份证验证安全控制模块与居民身份证之间的交互信息，最后居民身份证验证安全控制模块将读取到身份证信息发送给终端20，终端20将该身份证信息发送给电子密码设备10，电子密码设备10进行加密后，将密文返回给终端20。
在上述实施方式中，身份证信息是身份证读卡模块从居民身份证中读取的，由于身份证读卡模块只能对合法的居民身份证进行读取，因此，采用上述实施方式，可以保证用户身份认证过程中使用的居民身份证的合法性。
后台服务器30在接收到终端20发送的身份认证请求后，根据身份认证请求中携带的身份证信息的密文对用户的身份进行验证。在本申请实施例的一个可选实施方案中，后台服务器30可以存储电子密码设备10与领取该电子密码设备10的用户的身份证信息的对应关系，则在该可选实施方式中，后台服务器30在接收到身份认证请求后，一方面可以利用与加密密钥对应的解密密钥对身份认证请求中携带的身份证信息的密文进行解密，得到身份证信息，另一方面，后台服务器30从存储的电子密码设备与身份证信息的对应关系中，查找与电子密码设备10对应的身份证信息，后台服务器30将查找得到的身份证信息与解密得到的身份证信息进行比较，在两者匹配的情况下，确认当前请求身份认证的用户的身份认证成功，在两者不匹配的情况，确认当前请求身份认证的用户的身份认证失败。
在具体应用中，后台服务器30在存储电子密码设备与身份证信息的对应关系时，可以存储电子密码设备10的标识信息与使用该电子密码设备10的用户的身份证信息关联存储，该标识信息可以为电子密码设备10使用的数字证书，电子密码设备10可以将数字证书发送给终端20，终端20将该数字证书携带在身份认证请求中并发送至后台服务器30，后台服务器30即可从数字证书中获取电子密码设备10的标识信息，或者，后台服务器30也可以在接收到身份认证请求后，通过终端20向电子密码设备10发送请求获取标识信息的指示。另外，后台服务器30也可以根据电子密码设备10的标识信息来确定解密身份证信息的密文的解密密钥，或者，后台服务器30与电子密码设备10之间也可以先协商传输密钥(包括加密密钥和解密密钥)，即建立安全传输通道，然后电子密码设备10再通过终端20向后台服务器30发送身份证信息的密文。
当然，该标识信息并不局限于数字证书中，也可以是电子密码设备10的序列号等，本实施例对电子密码设备10的标识信息的具体内容并不做限定，只要根据该标识信息可以唯一地确定一个电子密码设备10即可。
另外，在具体应用中，电子密码设备10和后台服务器30使用的上述加密密钥和解密密钥可以是非对称密钥，例如，加密密钥可以为电子密码设备10的私钥，后台服务器30 使用的解密密钥为电子密码设备10的公钥；或者，也可以为对称密钥，具体本实施例不作限定。
通过上述实施方式，后台服务器30将身份证读卡模块读取的身份证信息与预先存储的身份证信息进行比较，以对用户的身份进行验证，可以判断电子密码设备10的合法持有者与使用当前身份证的用户是否属于同一个人的。从而可以避免用户的身份证或电子密码设备丢失后被其他人冒用进行身份认证的情况。
在本申请实施例的一个可选实施方案中，为了保证终端20发送给后台服务器30的身份证信息的密文的不可抵赖性及不会被篡改，终端20发送的用户信息中还可以包括身份证信息的密文的签名数据。即在该可选实施方式中，电子密码设备10还用于对身份证信息的密文进行签名，即电子密码设备10还用于利用其存储的私钥对身份证信息的密文进行签名计算，将签名计算得到的签名数据及身份证信息的密文发送给终端20，终端20用于将用户的身份证信息的密文与身份证信息的密文的签名数据作为用户信息携带在身份认证请求中发送至后台服务器30。后台服务器30还用于对身份证信息的密文的签名数据进行验签。在具体应用中，为了节约流程，后台服务器30可以先对身份证信息的密文的签名数据进行验签，验签通过之后再根据身份证信息的密文对用户的身份进行验证，如果验签不通过，则不再根据身份证信息的密文对用户的身份进行验证，直接拒绝用户的身份认证请求。
具体应用时，在上述实施方式中，在签名计算时，电子密码设备10计算身份证信息的密文的摘要信息，电子密码设备10利用自身存储的私钥对该摘要信息进行加密，并将该私钥加密的摘要信息作为身份证信息的密文的签名数据，电子密码设备10将身份证信息的密文与身份证信息的密文的签名数据一起发送至终端20。终端20将用户的身份证信息的密文与身份证信息的密文的签名数据作为用户信息携带在身份认证请求中发送至后台服务器30，后台服务器30接收到身份认证请求后，首先要对身份证信息的密文的签名数据进行验签，具体验签过程为：后台服务器30利用电子密码设备10的公钥对接收到的加密的摘要信息进行解密得到身份证信息的密文的摘要信息；然后后台服务器30计算接收到的身份证信息的密文的摘要信息，并与解密得到的摘要信息进行对比，如果相同，则说明身份证信息的密文没有被修改过，能够保证身份证信息的完整。
通过上述可选实施方式，不仅可以防止用户身份证丢失的情况下，非法分子利用用户丢失的身份证和非法分子自己的电子密码设备10进行身份认证，而且，利用电子密码设备10的私钥对身份证信息的密文进行签名得到身份证信息的密文的签名数据，后台服务器30对身份证信息的密文的签名数据进行验签，一方面可以通过签名数据确认身份证信息的密文是由签名者发送的，另一方面，通过比对后台服务器30计算身份证信息的密文得到的摘要信息与解密得到的摘要信息是否一致，可以防止非法分子修改身份证信息。
在本申请实施例的一个可选实施方案中，电子密码设备10获取的待验证信息包括但不限于四种方式。
方式一：待验证信息由后台服务器30生成，通过终端20发送给电子密码设备
在该实施方式中，后台服务器30还用于在接收到终端20发送的身份认证请求之后，生成待验证信息，将待验证信息携带身份认证请求响应中发送给终端20。可选地，为了保证传输安全，后台服务器30还可以待验证信息进行加密后再发送给终端20，例如，后台服务器30可以使用后台服务器30的私钥对待验证信息进行加密，或者，也可以利用与电子密码设备10协商的传输密钥进行加密。
终端20还用于接收后台服务器30返回的携带有待验证信息的明文或密文的身份认证请求响应，并将待验证信息的明文或密文发送给电子密码设备10。
可选地，后台服务器30可以在接收到终端20发送的身份认证请求后，根据身份认证请求中携带的用户信息对用户的身份验证，在验证通过后，后台服务器30生成待验证信息，例如，后台服务器30可以根据用户的用户信息、电子密码设备的序列号、当前时间或其它信息计算生成待验证信息，也可以将后台服务器30随机生成的随机数作为待验证信息。本实施例并不限定后台服务器30生成待验证信息的方式。为避免重放攻击，可选地，待验证信息为单次认证数据，即该待验证信息使用一次后就失效。待验证信息可以是一串数字、字母或符号，也可以是数字、字母或符号的任意组合，本实施例也不限定待验证信息的具体呈现形式。当然，后台服务器30也可对待验证信息的明文进行加密，生成待验证信息的密文，以保证待验证信息传输的安全性，另外，加密运算可以为对称加密或者非对称加密。
电子密码设备10还用于接收终端20发送的待验证信息，如果接收到的待验证信息为密文，则电子密码设备10还用于对待验证信息的密文进行解密。
方式二：待验证信息由电子密码设备10生成；
在该实施方式中，电子密码设备10基于与后台服务器10同步的参数生成待验证信息，例如，按照现在OTP的方式生成待验证信息。其中，电子密码设备10与后台服务器10同步的参数可以是时间参数，也可以是使用次数参数或者其它同步参数等。电子密码设备10利用与后台服务器30同步的参数计算出来的待验证信息，不需要从后台服务器30传输到终端20，可以保证待验证信息的安全，防止待验证信息在传输过程中被截获。
方式三：待验证信息为终端20获取的用户信息
在该实施方式中，电子密码设备10接收终端20发送的用户信息，将用户信息作为待验证信息。待验证信息即是终端20获取的用户信息(例如，用户的姓名、身份证号码等)，终端20将用户信息发送给电子密码设备10，电子密码设备10接收终端20发送的用户信息，并直接将该用户信息作为待验证信息。电子密码设备10利用终端20获取的用户信息 作为待验证信息，具有简单快捷的优点。
方式四：待验证信息由用户输入到电子密码设备10。
在该实施方式中，可以是后台服务器30通过上述方式一生成待验证信息后发送给终端20或其它外部设备，但是终端20或其它设备并不将待验证信息发送至电子密码设备10，而是显示在终端20或其它设备上，然后用户通过电子密码设备10的输入设备(例如键盘)输入待验证信息，这样，获得待验证信息的设备与电子密码设备10是分离的，用户的电子密码设备10丢失的情况下，非法分子无法获得待验证信息，可以防止在电子密码设备10丢失的情况下，非法分子利用该电子密码设备10进行身份认证。或者，也可以是用户将用户信息输入到电子密码设备10中，而不是由终端20发送，从而可以避免黑客远程操作用户的终端，修改终端20发送给电子密码设备10的用户信息。
电子密码设备10在获取待验证信息后，根据该待验证信息生成并显示图形标识码。从而可以方便后台服务器30后续识别待验证信息。在本申请实施例的一个可选实施方案中，电子密码设备10生成图形标识码的方式包括但不限于下面的方式一和方式二。
方式一：电子密码设备10直接将待验证信息转换为图形标识码；
即，电子密码设备10获取待验证信息后，通过图形标识码算法直接将待验证信息转化为图形标识码。需要说明的是，图形标识码算法为将待验证信息生成图形标识码的算法，例如图形标识码是二维码，则图形标识码算法是待验证信息生成二维码的算法，即二维码生成算法。通过将待验证信息转换为图形标识码，可以方便后台服务器30后续识别待验证信息。
方式二：电子密码设备10按照预设算法对待验证信息进行计算，并生成与计算结果对应的图形标识码。
与上述方式一不同的是：电子密码设备10获取待验证信息后，并不直接通过图形标识码算法将待验证信息转化为图形标识码，而是按照预设算法对待验证信息计算后，再通过图形标识码算法生成与计算结果对应的图形标识码。通过该方式，可以减少生成图形标识码的运算量，节约流程。
可选地，电子密码设备10对待验证信息进行计算包括但不限于：
(1)电子密码设备10利用自身存储的私钥，对待验证信息进行签名。
具体的，电子密码设备10可以先计算待验证信息的摘要信息，并利用自身存储的私钥对摘要信息进行加密，形成待验证信息的签名数据。后台服务器30获取待验证信息的签名数据后利用电子密码设备的私钥对应的公钥进行验签，可以一方面可以防止黑客篡改待验证信息，另一方面，可以确保待验证信息是由特定的电子密码设备10发送的。
(2)电子密码设备10对待验证信息进行消息认证码(MAC)计算。
需要说明的是，消息认证码(MAC)算法是一种加密算法，电子密码设备10对待验证信息进行加密计算并不局限于MAC算法一种加密算法，只要是加密算法都在本申请的保护范围，在本实施例中可以采用的加密算法列举如下：
1)对称加密算法：DES、3DES或AES；
2)MAC算法：
对称MAC算法：DES-CBC、3DES-CBC、AES-CBC；
HMAC算法：HMAC-MD5、HMAC-SHA1。
通过对待验证信息进行加密，可以防止非法分子截获待验证信息后利用截获的待验证信息进行身份认证。
另外，终端20还用于获取包含用户的面部图像和所述电子密码设备10显示的图形标识码的图片，并将所述图片发送至所述后台服务器30；
在本申请实施例的一个可选实施方案中，包含用户的面部图像和电子密码设备10显示的图形标识码的图片可以是通过设置在终端20上的拍摄装置拍摄包含用户的面部和电子密码设备10显示的图形标识码的图像获取的，也可以是由外部设备拍摄包含用户的面部和电子密码设备10显示的图形标识码的图像获取，然后将拍摄到的图片发送给终端20，这种情况下，可以降低对终端20的硬件要求，不需要终端20上设置有拍摄装置。
终端20获取包含用户的面部图像和电子密码设备10显示的图形标识码的图片后发送至后台服务器30，后台服务器30接收到包含用户面部图像和图形标识码的图片后，首先对图片上记载的图形标识码进行识别，以确定电子密码设备10用户的身份，即后台服务器30可以验证图形标识码上携带的信息是否为预定的信息。例如，如果待验证信息为后台服务器30生成并通过终端20发送给电子密码设备10的，(1)如果电子密码设备10直接将该待验证信息生成图形标识码，则后台服务器30识别该图形标识码，判断该图形标识码携带的信息与后台服务器30生成的待验证信息是否相同；(2)如果电子密码设备10是对待验证信息进行签名后将签名数据生成图形标识码，则后台服务器30识别该图形标识码，获取该图形识别码携带的信息，然后利用电子密码设备10的公钥对该信息进行解密，另一方面，后台服务器30对其生成的待验证信息进行哈希计算，将计算得到的结果与对上述信息进行解密得到的结果进行对比，判断两者是否相同；(3)如果电子密码设备10是对待验证信息进行MAC计算后将计算结果生成图形标识码，则后台服务器30识别该图形标识码，获取该图形识别码携带的信息，另一方面，后台服务器30对其生成的待验证信息进行MAC计算，将计算得到的结果与对图形识别码携带的信息进行对比，判断两者是否相同。如果待验证信息为电子密码设备10生成的，则后台服务器30对图形标识码的验证与上述待验证信息为后台服务器30生成的情况类似，不同之处只在于，在这种情况下，后台服务器 30用来验证的待验证信息为后台服务器30采用与电子密码设备10相同的方式生成待验证信息，具体不再赘述。如果待验证信息为终端20获取的用户信息，则后台服务器30对图形标识码的验证与上述待验证信息为后台服务器30生成的情况类似，不同之处只在于，在这种情况下，后台服务器30用来验证的待验证信息为后台服务器30从身份认证请求中获取的用户信息，具体不再赘述。如果待验证信息是由用户输入到电子密码设备的，如果用户输入的待验证信息由后台服务器30生成并发送给终端20或其它外部设备显示的，则后台服务器30验证图形识别码的方式与上述的待验证信息为后台服务器30生成并通过终端20发送给电子密码设备10的方式相同，如果用户输入的待验证信息为用户信息，则后台服务器30验证图形识别码的方式与上述待验证信息为终端20获取的用户信息的方式相同，具体不再赘述。
另外，后台服务器30可选预先存储包括用户的面部图像的身份信息，在对图片中包含的用户的面部图像进行验证时，后台服务器30可以将终端20上传的用户的面部图像与预先存储的用户的面部图像进行比对，如果匹配，则验证通过，如果不匹配，则验证失败。在具体应用中，后台服务器30可以存储用户的标识信息与用户的身份信息的对应关系，其中，用户的标识信息可以是用户的身份证号码、也可以是用户的身份证号码+用户姓名，还可以是用户使用的电子密码设备10的序列号，也可以是用户的使用的电子密码设备10使用的证书。在本申请实施例的一个可选实施方案中，后台服务器30存储的为用户使用的电子密码设备10(可以通过电子密码设备10的序列号、使用的证书等来标识)与用户的身份信息的对应的关系，具体可以在用户去办理电子密码设备10时，通过柜台将用户的电子密码设备10与用户的身份信息上传到后台服务器30关联存储。或者，也可以是后台服务器30根据电子密码设备10的信息调用的身份信息系统显示的用户的面部图像。后台服务器30在接收到终端20上传的用户的面部图像之后，通过以下方式对用户的面部图像进行验证：获取预先存储的与所述电子密码设备10对应的用户的身份信息，其中，所述身份信息包括用户的面部图像；将所述图片上记载的所述用户的面部图像与获取所述身份信息中包括的用户的面部图像进行比对，在两者匹配的情况下，确定验证通过，否则，确定验证不通过。在具体应用中，比对方法可以是采用人脸识别技术，也可以是后台工作人员进行识别。比对通过的情况下，后台服务器30可以确认电子密码设备是否是该真实请求身份认证的人的。
另外，在本申请实施例的一个可选实施方案中，后台服务器30对图片上记载的图形标识码以及用户的面部图像验证没有通过的情况下，后台服务器30向终端20发送重传指令，指示终端20重新上传图片，直到验证通过或验证达到预定次数。通过允许用户进行多次上传图片，可以防止图片识别过程中出现的误判问题。限制图片上传次数可以防止验证不通 过的情况下，用户无限制上传图片的问题。
实施例2
图1为本申请提供一种远程身份认证系统的结构示意图，图1所示系统实施例包括：电子密码设备10、终端20和后台服务器30。
在本实施例中，电子密码设备10获取待验证信息，并根据待验证信息生成并显示图形标识码，用户持电子密码设备10进行拍照，终端20获取包含用户的面部图像及电子密码设备10显示的图形标识码的图片，将该图片携带在身份认证请求中发送给后台服务器30进行验证。
与实施例1不同的是，本实施例中，电子密码设备10在终端20向后台服务器30发送身份认证请求之前，电子密码设备10生成并显示图形标识码，终端20获取用户面部图像和图形标识码的图片，终端20在发送身份认证请求的时候向后台服务器30发送上述图片。
在发明实施例的一个可选实施方式中，电子密码设备10获取待验证信息的方式包括但不限于以下几种方式：
方式一：待验证信息由电子密码设备10生成；
在该实施方式中，电子密码设备10基于与后台服务器10同步的参数生成待验证信息，例如，按照现在OTP的方式生成待验证信息。其中，电子密码设备10与后台服务器10同步的参数可以是时间参数，也可以是使用次数参数或者其它同步参数等。电子密码设备10利用与后台服务器30同步的参数计算出来的待验证信息，不需要从后台服务器30传输到终端20，可以保证待验证信息的安全，防止待验证信息在传输过程中被截获。
方式二：待验证信息为终端20获取的用户信息；
在该实施方式中，电子密码设备10接收终端20发送的用户信息，将用户信息作为待验证信息。待验证信息即是终端20获取的用户信息(例如，用户的姓名、身份证号码等)，终端20将用户信息发送给电子密码设备10，电子密码设备10接收终端20发送的用户信息，并直接将该用户信息作为待验证信息。电子密码设备10利用终端20获取的用户信息作为待验证信息，具有简单快捷的优点。
方式三：待验证信息由用户输入到电子密码设备10。
在该实施方式中，用户将用户信息输入到电子密码设备10中，而不是由终端20发送，从而可以避免黑客远程操作用户的终端，修改终端20发送给电子密码设备10的用户信息。
电子密码设备10在获取待验证信息后，根据该待验证信息生成并显示图形标识码。从而可以方便台服务器30后续识别待验证信息。本实施例中电子密码设备10根据待验证信息生成图形标识码的方式与本申请实施例1中的相同，即电子密码设备10直接将待验证信 息转换为图形标识码或者电子密码设备10按照预设算法对待验证信息进行计算，并生成与计算结果对应的图形标识码。具体实施方式与实施例1中的相同，在此不再赘述。另外，电子密码设备10对待验证信息进行计算也与实施例1中的相同，在此不再赘述。
另外，终端20获取包含用户的面部图像的和电子密码设备10显示的图形标识码的图片的方式与本申请实施例1中的相同，在此不再赘述。
另外，终端20获取上述图片后，将所述图片携带在身份认证请求中发送至后台服务器30。其中，身份认证请求中携带的用户信息与本申请实施例1中的相同，即可以是用户的身份证信息的密文，也可以是身份证信息的密文的签名数据，具体的不再赘述。身份证读卡模块读取身份证信息的方式也与本申请实施例1中的相同，在此不再赘述。
另外，后台服务器30接收身份认证请求后，后台服务器30根据身份证信息的密文对用户的身份进行验证的方式与本申请实施例1中的相同，在此不再赘述。
另外，后台服务器30接收到终端发送的图片后，后台服务器30对图片上记载的图形标识码以及用户的面部图像进行验证的方式与本申请实施例1中的相同，在此不再赘述。
另外，台服务器30对图片上记载的图形标识码以及用户的面部图像验证没有通过的情况下，后台服务器30向终端20发送重传指令，指示终端20重新上传图片，直到验证通过或验证达到预定次数。通过允许用户进行多次上传图片，可以防止图片识别过程中出现的误判问题。限制图片上传次数可以防止验证不通过的情况下，用户无限制上传图片的问题。
实施例3
本实施例提供一种远程开户系统，采用上述实施例1或实施例2中的远程身份认证系统对用户的身份进行认证，对用户的身份认证通过之后，后台服务器30进行远程开户。能够实现用户随时随地进行远程开户，方便用户，提高用户体验。
需要说明的是，身份认证通过之后，可以是后台服务器30自动进行远程开户，也可以是工作人员控制后台服务器30进行远程开户。
实施例4
本实施例提供一种远程身份认证方法，是基于实施例1中的系统实现的身份认证的方法。图2为本申请提供的一种远程身份认证方法实施例的流程示意图。图2所示方法实施例包括如下步骤：
步骤201：终端向后台服务器发送身份认证请求，其中身份认证请求中携带有用户信息；
步骤202：电子密码设备获取待验证信息；
步骤203：所述电子密码设备根据所述待验证信息，生成并显示图形标识码；
步骤204：所述终端获取包含用户的面部图像和所述电子密码设备显示的所述图形标识码的图片，并将所述图片发送至后台服务器；
步骤205：所述后台服务器接收所述图片，并对所述图片上记载的所述图形标识码以及所述用户的面部图像进行验证。
在本实施例中，终端向后台服务器发送身份认证请求，其中，身份认证请求中携带有用户信息，其中，该用户信息可以是用户的身份证信息，例如，用户的身份证号码等。电子密码设备获取待验证信息，并根据待验证信息，生成并显示图形标识码。其中，电子密码设备可以在终端的触发下获取待验证信息，例如，终端可以在向后台服务器发送身份认证请求之后，即向电子密码设备发送指示，触发电子密码设备获取待验证信息，或者，终端也可以在接收后台服务器返回的身份认证请求响应后，向电子密码设备发送指示，触发电子密码设备获取待验证信息。另外，电子密码设备也可以是在用户输入的指令的触发下获取待验证信息，例如，用户按下电子密码设备的特定功能键。终端获取包含用户的面部图像和电子密码设备显示的图形标识码的图片，并将图片发送至后台服务器；后台服务器接收终端发送的图片，并对图片上记载的图形标识码以及用户的面部图像进行验证。
通过本实施例提供的上述身份认证方法，用户可以通过终端向后台服务器发送身份认证请求，通过电子密码设备生成图形标识码，然后通过终端将包含用户的面部图像和图形标识码的图片发送给后台服务器，后台服务器对图片上记载的图形标识码以及用户的面部图像进行验证，从而完成对用户的远程身份认证。
其中，
步骤201：终端向后台服务器发送身份认证请求，其中身份认证请求中携带有用户信息；
电子密码设备获取待验证信息之前，终端向所述后台服务器发送身份认证请求，其中，所述身份认证请求中携带有用户信息。
作为本申请实施例的一个可选实施方式，终端向后台服务器发送的身份认证请求携带的用户信息可以是用户的身份证信息，例如，用户的身份证号码等，或者，该用户信息还可以是用户的身份证信息的密文，终端获取用户的身份证信息的密文，将用户的身份证信息的密文作为用户信息携带在身份认证请求中发送给后台服务器；后台服务器接收身份认证请求，并根据身份认证请求中携带的身份证信息的密文对用户的身份进行验证。
在具体应用中，用户的身份证信息的密文可以是身份证读卡模块(可以设置在终端，也可以设置在电子密码设备，也可以是单独的身份证读卡器)从用户的居民身份证中读取，并通过电子密码设备进行加密后得到的。
身份证读卡模块可以是具有居民身份证验证安全控制模块身份证读卡器，身份证读卡器将读取到的身份证信息发送给电子密码设备进行加密，然后再发送给终端。或者，身份证读卡模块也可以是不具备居民身份证验证安全控制模块只具备读卡模块的身份证读卡装置，这种情况下，居民身份证验证安全控制模块设置在远端，身份证读卡装置通过网络与居民身份证验证安全控制模块进行通信，转发居民身份证验证安全控制模块与居民身份证之间的交互信息，最后居民身份证验证安全控制模块将读取到身份证信息发送给终端，终端将该身份证信息发送给电子密码设备，电子密码设备进行加密后，将密文返回给终端。
在上述实施方式中，身份证信息是身份证读卡模块从居民身份证中读取的，由于身份证读卡模块只能对合法的居民身份证进行读取，因此，采用上述实施方式，可以保证用户开户过程中使用的居民身份证的合法性。
后台服务器在接收到终端发送的身份认证请求后，根据身份认证请求中携带的身份证信息的密文对用户的身份进行验证。
在本申请实施例的一个可选实施方案中，后台服务器可以存储电子密码设备与领取该电子密码设备的用户的身份证信息的对应关系，则在该可选实施方式中，后台服务器在接收到身份认证请求后，一方面可以利用与加密密钥对应的解密密钥对身份认证请求中携带的身份证信息的密文进行解密，得到身份证信息，另一方面，后台服务器从存储的电子密码设备与身份证信息的对应关系中，查找与电子密码设备对应的身份证信息，后台服务器将查找得到的身份证信息与解密得到的身份证信息进行比较，在两者匹配的情况下，确认当前请求开户的用户的身份验证成功，在两者不匹配的情况，确认当前请求开户的用户的身份验证失败。
在具体应用中，后台服务器在存储电子密码设备与身份证信息的对应关系时，可以存储电子密码设备的标识信息与使用该电子密码设备的用户的身份证信息关联存储，该标识信息可以为电子密码设备使用的数字证书，电子密码设备可以将数字证书发送给终端，终端将该数字证书携带在身份认证请求中并发送至后台服务器，后台服务器即可从数字证书中获取电子密码设备的标识信息，或者，后台服务器也可以在接收到身份认证请求后，通过终端向电子密码设备发送请求获取标识信息的指示。另外，后台服务器也可以根据电子密码设备的标识信息来确定解密身份证信息的密文的解密密钥，或者，后台服务器与电子密码设备之间也可以先协商传输密钥(包括加密密钥和解密密钥)，即建立安全传输通道，然后电子密码设备再通过终端向后台服务器发送身份证信息的密文。
当然，该标识信息并不局限于数字证书中，也可以是电子密码设备的序列号等，本实施例对电子密码设备的标识信息的具体内容并不做限定，只要根据该标识信息可以唯一地确定一个电子密码设备即可。
另外，在具体应用中，电子密码设备和后台服务器使用的上述加密密钥和解密密钥可以是非对称密钥，例如，加密密钥可以为电子密码设备的私钥，后台服务器使用的解密密钥为电子密码设备的公钥；或者，也可以为对称密钥，具体本实施例不作限定。
通过上述实施方式，后台服务器将开户过程中，身份证读卡模块读取的身份证信息与预先存储的身份证信息进行比较，以对用户的身份进行验证，可以判断电子密码设备的合法持有者与使用当前身份证的用户是否属于同一个人的。从而可以避免用户的身份证或电子密码设备丢失后被其他人冒用开户的情况。
在本申请实施例的一个可选实施方案中，为了保证终端发送给后台服务器的身份证信息的密文的不可抵赖性及不会被篡改，终端发送的用户信息中还可以包括身份证信息的密文的签名数据。即在该可选实施方式中，电子密码设备还用于对身份证信息的密文进行签名，即电子密码设备利用其存储的私钥对身份证信息的密文进行签名计算，将签名计算得到的签名数据及身份证信息的密文发送给终端，终端将用户的身份证信息的密文与身份证信息的密文的签名数据作为用户信息携带在身份认证请求中发送至后台服务器。后台服务器对身份证信息的密文的签名数据进行验签。在具体应用中，为了节约流程，后台服务器可以先对身份证信息的密文的签名数据进行验签，验签通过之后再根据身份证信息的密文对用户的身份进行验证，如果验签不通过，则不再根据身份证信息的密文对用户的身份进行验证，直接拒绝用户的身份认证请求。
具体应用时，在上述实施方式中，在签名计算时，电子密码设备计算身份证信息的密文的摘要信息，电子密码设备利用自身存储的私钥对该摘要信息进行加密，并将该私钥加密的摘要信息作为身份证信息的密文的签名数据，电子密码设备将身份证信息的密文与身份证信息的密文的签名数据一起发送至终端。终端将用户的身份证信息的密文与身份证信息的密文的签名数据作为用户信息携带在身份认证请求中发送至后台服务器，后台服务器接收到身份认证请求后，首先要对身份证信息的密文的签名数据进行验签，具体验签过程为：后台服务器利用电子密码设备的公钥对接收到的加密的摘要信息进行解密得到身份证信息的密文的摘要信息；然后后台服务器计算接收到的身份证信息的密文的摘要信息，并与解密得到的摘要信息进行对比，如果相同，则说明身份证信息的密文没有被修改过，能够保证身份证信息的完整。
通过上述可选实施方式，不仅可以防止用户身份证丢失的情况下，非法分子利用用户丢失的身份证和非法分子自己的电子密码设备进行远程身份认证，而且，利用电子密码设备的私钥对身份证信息的密文进行签名得到身份证信息的密文的签名数据，后台服务器对身份证信息的密文的签名数据进行验签，一方面可以通过签名数据确认身份证信息的密文是由签名者发送的，另一方面，通过比对后台服务器计算身份证信息的密文得到的摘要信 息与解密得到的摘要信息是否一致，可以防止非法分子修改身份证信息。
步骤202：电子密码设备获取待验证信息；
在本申请实施例的一个可选实施方案中，电子密码设备获取的待验证信息包括但不限于四种方式。
方式一：待验证信息由后台服务器生成，通过终端发送给电子密码设备
在该实施方式中，后台服务器在接收到终端发送的身份认证请求之后，生成待验证信息，将待验证信息携带身份认证请求响应中发送给终端。可选地，为了保证传输安全，后台服务器还可以待验证信息进行加密后再发送给终端，例如，后台服务器可以使用后台服务器的私钥对待验证信息进行加密，或者，也可以利用与电子密码设备协商的传输密钥进行加密。
终端接收后台服务器返回的携带有待验证信息的明文或密文的身份认证请求响应，并将待验证信息的明文或密文发送给电子密码设备。
可选地，后台服务器可以在接收到终端发送的身份认证请求后，根据身份认证请求中携带的用户信息对用户的身份验证，在验证通过后，后台服务器生成待验证信息，例如，后台服务器可以根据用户的用户信息、电子密码设备的序列号、当前时间或其它信息计算生成待验证信息，也可以将后台服务器随机生成的随机数作为待验证信息。本实施例并不限定后台服务器生成待验证信息的方式。为避免重放攻击，可选地，待验证信息为单次认证数据，即该待验证信息使用一次后就失效。待验证信息可以是一串数字、字母或符号，也可以是数字、字母或符号的任意组合，本实施例也不限定待验证信息的具体呈现形式。当然，后台服务器也可对待验证信息的明文进行加密，生成待验证信息的密文，以保证待验证信息传输的安全性，另外，加密运算可以为对称加密或者非对称加密。
电子密码设备接收终端发送的待验证信息，如果接收到的待验证信息为密文，则电子密码设备还用于对待验证信息的密文进行解密。
方式二：待验证信息由电子密码设备生成；
在该实施方式中，电子密码设备基于与后台服务器同步的参数生成待验证信息，例如，按照现在OTP的方式生成待验证信息。其中，电子密码设备与后台服务器同步的参数可以是时间参数，也可以是使用次数参数或者其它同步参数等。电子密码设备利用与后台服务器同步的参数计算出来的待验证信息，不需要从后台服务器传输到终端，可以保证待验证信息的安全，防止待验证信息在传输过程中被截获。
方式三：待验证信息为终端获取的用户信息
在该实施方式中，电子密码设备接收终端发送的用户信息，将用户信息作为待验证信息。待验证信息即是终端获取的用户信息(例如，用户的姓名、身份证号码等)，终端将用 户信息发送给电子密码设备，电子密码设备接收终端发送的用户信息，并直接将该用户信息作为待验证信息。电子密码设备利用终端获取的用户信息作为待验证信息，具有简单快捷的优点。
方式四：待验证信息由用户输入到电子密码设备。
在该实施方式中，可以是后台服务器通过上述方式一生成待验证信息后发送给终端或其它外部设备，但是终端或其它设备并不将待验证信息发送至电子密码设备，而是显示在终端或其它设备上，然后用户通过电子密码设备的输入设备(例如键盘)输入待验证信息，这样，获得待验证信息的设备与电子密码设备是分离的，用户的电子密码设备丢失的情况下，非法分子无法获得待验证信息，可以防止在电子密码设备丢失的情况下，非法分子利用该电子密码设备进行开户。或者，也可以是用户将用户信息输入到电子密码设备中，而不是由终端发送，从而可以避免黑客远程操作用户的终端，修改终端发送给电子密码设备的用户信息。
步骤203：所述电子密码设备根据所述待验证信息，生成并显示图形标识码；
电子密码设备在获取待验证信息后，根据该待验证信息生成并显示图形标识码。从而可以方便后台服务器后续识别待验证信息。
在本申请实施例的一个可选实施方案中，电子密码设备生成图形标识码的方式包括但不限于下面的方式一和方式二。
方式一：电子密码设备直接将待验证信息转换为图形标识码；
即，电子密码设备获取待验证信息后，通过图形标识码算法直接将待验证信息转化为图形标识码。需要说明的是，图形标识码算法为将待验证信息生成图形标识码的算法，例如图形标识码是二维码，则图形标识码算法是待验证信息生成二维码的算法，即二维码生成算法。通过将待验证信息转换为图形标识码，可以方便后台服务器后续识别待验证信息。
方式二：电子密码设备按照预设算法对待验证信息进行计算，并生成与计算结果对应的图形标识码。
与上述方式一不同的是：电子密码设备获取待验证信息后，并不直接通过图形标识码算法将待验证信息转化为图形标识码，而是按照预设算法对待验证信息计算后，再通过图形标识码算法生成与计算结果对应的图形标识码。通过该方式，可以减少生成图形标识码的运算量，节约流程。
可选地，电子密码设备对待验证信息进行计算包括但不限于：
(1)电子密码设备利用自身存储的私钥，对待验证信息进行签名。
具体的，电子密码设备可以先计算待验证信息的摘要信息，并利用自身存储的私钥对摘要信息进行加密，形成待验证信息的签名数据。后台服务器获取待验证信息的签名数据 后利用电子密码设备的私钥对应的公钥进行验签，可以一方面可以防止黑客篡改待验证信息，另一方面，可以确保待验证信息是由特定的电子密码设备发送的。
(2)电子密码设备对待验证信息进行消息认证码(MAC)计算。
需要说明的是，消息认证码(MAC)算法是一种加密算法，电子密码设备对待验证信息进行加密计算并不局限于MAC算法一种加密算法，只要是加密算法都在本申请的保护范围，在本实施例中可以采用的加密算法列举如下：
1)对称加密算法：DES、3DES或AES；
2)MAC算法：
对称MAC算法：DES-CBC、3DES-CBC、AES-CBC；
HMAC算法：HMAC-MD5、HMAC-SHA1。
通过对待验证信息进行加密，可以防止非法分子截获待验证信息后利用截获的待验证信息进行开户。
步骤204：所述终端获取包含用户的面部图像和所述电子密码设备显示的所述图形标识码的图片，并将所述图片发送至后台服务器；
在本申请实施例的一个可选实施方式中，包含用户的面部图像和电子密码设备显示的图形标识码的图片可以是通过设置在终端上的拍摄装置拍摄包含用户的面部和电子密码设备显示的图形标识码的图像获取的。也可以是由外部设备拍摄包含用户的面部和电子密码设备显示的图形标识码的图像获取，然后将拍摄到的图片发送给终端，这种情况下，可以降低对终端的硬件要求，不需要终端上设置有拍摄装置。
步骤205：所述后台服务器接收所述图片，并对所述图片上记载的所述图形标识码以及所述用户的面部图像进行验证。
终端获取包含用户的面部图像和电子密码设备显示的图形标识码的图片后发送至后台服务器，后台服务器接收到包含用户面部图像和图形标识码的图片后，首先对图片上记载的图形标识码进行识别，以确定电子密码设备用户的身份，即后台服务器可以验证图形标识码上携带的信息是否为预定的信息。例如，如果待验证信息为后台服务器生成并通过终端发送给电子密码设备的，(1)如果电子密码设备直接将该待验证信息生成图形标识码，则后台服务器识别该图形标识码，判断该图形标识码携带的信息与后台服务器生成的待验证信息是否相同；(2)如果电子密码设备是对待验证信息进行签名后将签名数据生成图形标识码，则后台服务器识别该图形标识码，获取该图形识别码携带的信息，然后利用电子密码设备的公钥对该信息进行解密，另一方面，后台服务器对其生成的待验证信息进行哈希计算，将计算得到的结果与对上述信息进行解密得到的结果进行对比，判断两者是否相同；(3)如果电子密码设备是对待验证信息进行MAC计算后将计算结果生成图形标识码， 则后台服务器识别该图形标识码，获取该图形识别码携带的信息，另一方面，后台服务器对其生成的待验证信息进行MAC计算，将计算得到的结果与对图形识别码携带的信息进行对比，判断两者是否相同。如果待验证信息为电子密码设备生成的，则后台服务器对图形标识码的验证与上述待验证信息为后台服务器生成的情况类似，不同之处只在于，在这种情况下，后台服务器用来验证的待验证信息为后台服务器采用与电子密码设备相同的方式生成待验证信息，具体不再赘述。如果待验证信息为终端获取的用户信息，则后台服务器对图形标识码的验证与上述待验证信息为后台服务器生成的情况类似，不同之处只在于，在这种情况下，后台服务器用来验证的待验证信息为后台服务器从身份认证请求中获取的用户信息，具体不再赘述。如果待验证信息是由用户输入到电子密码设备的，如果用户输入的待验证信息由后台服务器生成并发送给终端或其它外部设备显示的，则后台服务器验证图形识别码的方式与上述的待验证信息为后台服务器生成并通过终端发送给电子密码设备的方式相同，如果用户输入的待验证信息为用户信息，则后台服务器验证图形识别码的方式与上述待验证信息为终端获取的用户信息的方式相同，具体不再赘述。
另外，后台服务器可选预先存储包括用户的面部图像的身份信息，在对图片中包含的用户的面部图像进行验证时，后台服务器可以将终端上传的用户的面部图像与预先存储的用户的面部图像进行比对，如果匹配，则验证通过，如果不匹配，则验证失败。在具体应用中，后台服务器可以存储用户的标识信息与用户的身份信息的对应关系，其中，用户的标识信息可以是用户的身份证号码、也可以是用户的身份证号码+用户姓名，还可以是用户使用的电子密码设备的序列号，也可以是用户的使用的电子密码设备使用的证书。在本申请实施例的一个可选实施方案中，后台服务器存储的为用户使用的电子密码设备(可以通过电子密码设备的序列号、使用的证书等来标识)与用户的身份信息的对应的关系，具体可以在用户去办理电子密码设备时，通过柜台将用户的电子密码设备与用户的身份信息上传到后台服务器关联存储。或者，也可以是后台服务器根据电子密码设备的信息调用的身份信息系统显示的用户的面部图像。后台服务器在接收到终端上传的用户的面部图像之后，通过以下方式对用户的面部图像进行验证：获取预先存储的与所述电子密码设备对应的用户的身份信息，其中，所述身份信息包括用户的面部图像；将所述图片上记载的所述用户的面部图像与获取所述身份信息中包括的用户的面部图像进行比对，在两者匹配的情况下，确定验证通过，否则，确定验证不通过。在具体应用中，比对方法可以是采用人脸识别技术，也可以是后台工作人员进行识别。比对通过的情况下，后台服务器可以确认电子密码设备是否是该真实开户人的，防止身份证和电子密码设备丢失的情况下，非法分子冒充开户。
另外，在本申请实施例的一个可选实施方案中，后台服务器对图片上记载的图形标识 码以及用户的面部图像验证没有通过的情况下，后台服务器向终端发送重传指令，指示终端重新上传图片，直到验证通过或验证达到预定次数。通过允许用户进行多次上传图片，可以防止图片识别过程中出现的误判问题。限制图片上传次数可以防止验证不通过的情况下，用户无限制上传图片的问题。
通过上述远程身份认证方法，电子密码设备将待验证信息生成图形标识码，终端获取包含用户面部图像和图形标识码的图片并发送给后台服务器，后台服务器通过识别图片中的图形标识码可以确定电子密码设备用户的身份；后台服务器将终端上传的用户的面部图像与预先存储的用户的面部图像进行比对，比对通过的情况下，后台服务器可以确认电子密码设备是否是该真实开户人的，防止身份证和电子密码设备丢失的情况下，非法分子冒充开户。
实施例5
本实施例提供另一种远程身份认证方法，是基于实施例2中的系统实现的身份认证的方法。图3为本申请提供的另一种远程身份认证方法实施例的流程示意图。图3所示方法实施例包括如下步骤：
步骤301：电子密码设备获取待验证信息；
步骤302：所述电子密码设备根据所述待验证信息，生成并显示图形标识码；
步骤303：终端获取包含用户的面部图像和所述电子密码设备显示的所述图形标识码的图片；
步骤304：所述终端将所述图片携带在身份认证请求中发送给后台服务器，其中，所述开不请求中还携带有用户信息；
步骤305：所述后台服务器接收所述图片，并对所述图片上记载的所述图形标识码以及所述用户的面部图像进行验证。
与实施例4不同的是，本实施例中，电子密码设备在终端向后台服务器发送身份认证请求之前，电子密码设备生成并显示图形标识码，终端获取用户面部图像和图形标识码的图片，终端在发送身份认证请求的时候向后台服务器发送上述图片。后台服务器通过对图片上的图形标识码和用户的面部图像进行验证，可完成对用户的远程身份认证。
其中，
步骤301：电子密码设备获取待验证信息；
在发明实施例的一个可选实施方式中，电子密码设备获取待验证信息的方式包括但不限于以下三种方式：
方式一：待验证信息由电子密码设备生成；
在该实施方式中，电子密码设备基于与后台服务器同步的参数生成待验证信息，例如，按照现在OTP的方式生成待验证信息。其中，电子密码设备与后台服务器同步的参数可以是时间参数，也可以是使用次数参数或者其它同步参数等。电子密码设备利用与后台服务器同步的参数计算出来的待验证信息，不需要从后台服务器传输到终端，可以保证待验证信息的安全，防止待验证信息在传输过程中被截获。
方式二：待验证信息为终端获取的用户信息；
在该实施方式中，电子密码设备接收终端发送的用户信息，将用户信息作为待验证信息。待验证信息即是终端获取的用户信息(例如，用户的姓名、身份证号码等)，终端将用户信息发送给电子密码设备，电子密码设备接收终端发送的用户信息，并直接将该用户信息作为待验证信息。电子密码设备利用终端获取的用户信息作为待验证信息，具有简单快捷的优点。
方式三：待验证信息由用户输入到电子密码设备。
在该实施方式中，用户将用户信息输入到电子密码设备中，而不是由终端发送，从而可以避免黑客远程操作用户的终端，修改终端发送给电子密码设备的用户信息。
步骤302：所述电子密码设备根据所述待验证信息，生成并显示图形标识码；
电子密码设备在获取待验证信息后，根据该待验证信息生成并显示图形标识码。从而可以方便台服务器后续识别待验证信息。本实施例中电子密码设备根据待验证信息生成图形标识码的方式与本申请实施例4中的相同，即电子密码设备直接将待验证信息转换为图形标识码或者电子密码设备按照预设算法对待验证信息进行计算，并生成与计算结果对应的图形标识码。具体实施方式与实施例4中的相同，在此不再赘述。另外，电子密码设备对待验证信息进行计算也与实施例4中的相同，在此不再赘述。
步骤303：终端获取包含用户的面部图像和所述电子密码设备显示的所述图形标识码的图片；
终端获取包含用户的面部图像的和电子密码设备显示的图形标识码的图片的方式与本申请实施例4中的相同，在此不再赘述。
终端获取上述图片后，将所述图片携带在身份认证请求中发送至后台服务器。其中，身份认证请求中携带的用户信息与本申请实施例4中的相同，即可以是用户的身份证信息的密文，也可以是身份证信息的密文的签名数据，具体的不再赘述。其中，身份证读卡模块读取身份证信息的方式也与本申请实施例4中的相同，在此不再赘述。
步骤304：所述终端将所述图片携带在身份认证请求中发送给后台服务器，其中，所述身份认证请求中还携带有用户信息；
终端获取上述图片后才和身份认证请求一起发送至后台服务器，其中，身份认证请求 中的用户信息可以是用户的身份证信息、用户身份证信息的密文或用户身份证信息的签名数据，具体与上述实施例4中的内容相同，在此不再赘述。后台服务器接收到身份认证请求后，对用户身份证信息进行验证的方式与实施例4中的内容相同，在此不再赘述。
步骤305：所述后台服务器接收所述图片，并对所述图片上记载的所述图形标识码以及所述用户的面部图像进行验证。
所述后台服务器接收所述图片，并对所述图片上记载的所述图形标识码以及所述用户的面部图像进行验证。
后台服务器接收身份认证请求后，后台服务器根据身份证信息的密文对用户的身份进行验证的方式与本申请实施例4中的相同，在此不再赘述。
后台服务器接收到终端发送的身份认证请求中携带的上述图片后，后台服务器对图片上记载的图形标识码以及用户的面部图像进行验证的方式与本申请实施例4中的相同，在此不再赘述。
另外，台服务器对图片上记载的图形标识码以及用户的面部图像验证没有通过的情况下，后台服务器向终端发送重传指令，指示终端重新上传图片，直到验证通过或验证达到预定次数。通过允许用户进行多次上传图片，可以防止图片识别过程中出现的误判问题。限制图片上传次数可以防止验证不通过的情况下，用户无限制上传图片的问题。
实施例6
本实施例提供一种远程开户方法，采用上述实施例4或实施例5中的身份认证方法对用户的身份进行认证，身份认证通过之后进行远程开户，能够实现用户随时随地进行远程开户，方便用户，提高用户体验。
流程图中或在此以其他方式描述的任何过程或方法描述可以被理解为，表示包括一个或更多个用于实现特定逻辑功能或过程的步骤的可执行指令的代码的模块、片段或部分，并且本申请的优选实施方式的范围包括另外的实现，其中可以不按所示出或讨论的顺序，包括根据所涉及的功能按基本同时的方式或按相反的顺序，来执行功能，这应被本申请的实施例所属技术领域的技术人员所理解。
本技术领域的普通技术人员可以理解实现上述实施例方法携带的全部或部分步骤是可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，该程序在执行时，包括方法实施例的步骤之一或其组合。
在本说明书的描述中，参考术语“一个实施例”、“一些实施例”、“示例”、“具体示例”、或“一些示例”等的描述意指结合该实施例或示例描述的具体特征、结构、材料或者特点包 含于本申请的至少一个实施例或示例中。在本说明书中，对上述术语的示意性表述不一定指的是相同的实施例或示例。而且，描述的具体特征、结构、材料或者特点可以在任何的一个或多个实施例或示例中以合适的方式结合。
尽管上面已经示出和描述了本申请的实施例，可以理解的是，上述实施例是示例性的，不能理解为对本申请的限制，本领域的普通技术人员在不脱离本申请的原理和宗旨的情况下在本申请的范围内可以对上述实施例进行变化、修改、替换和变型。本申请的范围由所附权利要求及其等同限定。

Claims (26)

  1. 一种远程身份认证方法，其特征在于，包括：
    电子密码设备获取待验证信息，其中，所述待验证信息包括：单次认证信息；
    所述电子密码设备根据所述待验证信息，生成并显示图形标识码；
    所述终端获取包含用户的面部图像和所述电子密码设备显示的所述图形标识码的图片，并将所述图片发送至后台服务器；
    所述后台服务器接收所述图片，并对所述图片上记载的所述图形标识码以及所述用户的面部图像进行验证。
  2. 根据权利要求1所述的方法，其特征在于，所述终端将所述图片发送至所述后台服务器包括：
    所述终端将所述图片携带在身份认证请求中发送给所述后台服务器，其中，所述身份认证请求中还携带有用户信息。
  3. 根据权利要求1所述的方法，其特征在于，电子密码设备获取待验证信息之前，所述方法还包括：所述终端向所述后台服务器发送身份认证请求，其中，所述身份认证请求中携带有用户信息。
  4. 根据权利要求2或3所述的方法，其特征在于，
    在所述终端向后台服务器发送身份认证请求之前，所述方法还包括：身份证读卡模块读取用户的居民身份证中存储的身份证信息；所述电子密码设备对所述身份证读卡模块读取的所述身份证信息进行加密，将加密得到的身份证信息的密文发送给所述终端；
    所述用户信息包括：所述身份证信息的密文；
    在所述终端向后台服务器发送身份认证请求之后，所述方法还包括：所述后台服务器接收所述身份认证请求，根据所述身份证信息的密文对用户的身份进行验证。
  5. 根据权利要求4所述的方法，其特征在于，
    在所述终端向后台服务器发送身份认证请求之前，所述方法还包括：所述终端从所述电子密码设备获取所述身份证信息的密文的签名数据；
    所述用户信息还包括：所述身份证信息的密文的签名数据；
    所述后台服务器根据身份证信息的密文对用户的身份进行验证之前，所述方法还包括：所述后台服务器对所述身份证信息的密文的签名数据进行验签。
  6. 根据权利要求4或5所述的方法，其特征在于，所述后台服务器根据所述身份证信息的密文对用户的身份进行验证，包括：
    所述后台服务器对所述身份证信息的密文进行解密，得到所述身份证信息；
    所述后台服务器获取预先存储的与所述电子密码设备对应的身份证信息；
    所述后台服务器将获取的所述身份证信息与解密得到的所述身份证信息进行比较，在两者匹配的情况下，确认当前请求开户的用户的身份验证成功，在两者不匹配的情况，确认当前请求开户的用户的身份验证失败。
  7. 根据权利要求1至6任一项所述的方法，其特征在于，所述电子密码设备获取待验证信息，包括：
    所述电子密码设备基于与所述后台服务器同步的参数，生成所述待验证信息。
  8. 根据权利要求1至7任一项所述的方法，其特征在于，所述电子密码设备根据所述待验证信息，生成图形标识码，包括：
    所述电子密码设备将所述待验证信息转换为所述图形标识码；或者
    所述电子密码设备按照预设算法对所述待验证信息进行计算，生成与计算结果对应的图形标识码。
  9. 根据权利要求8所述的方法，其特征在于，所述电子密码设备按照预设算法对所述待验证信息进行计算，包括以下之一：
    所述电子密码设备利用自身存储的私钥，对所述待验证信息进行签名；
    所述电子密码设备对所述待验证信息进行消息认证码MAC计算。
  10. 根据权利要求1至9任一项所述的方法，其特征在于，所述终端获取包含用户的面部图像和所述电子密码设备显示的所述图形标识码的图片，包括以下之一：
    所述终端通过设置在所述终端上的拍摄装置拍摄包含用户的面部和所述电子密码设备显示的所述图形标识码的图像，获取所述图片；
    所述终端接收外部设备发送的包含用户的面部图像和所述电子密码设备显示的所述图形标识码。
  11. 根据权利要求1至10任一项所述的方法，其特征在于，所述后台服务器对所述图片上记载的所述用户的面部图像验证包括：
    所述后台服务器获取预先存储的与所述电子密码设备对应的用户的身份信息，其中，所述身份信息包括用户的面部图像；
    所述后台服务器将所述图片上记载的所述用户的面部图像与获取所述身份信息中包括的用户的面部图像进行比对，在两者匹配的情况下，确定验证通过，否则，确定验证不通过。
  12. 根据权利要求1至10任一项所述的方法，其特征在于，在所述后台服务器对所述图片上记载的所述图形标识码以及所述用户的面部图像验证没有通过的情况下，所述方法还包括：
    所述后台服务器向所述终端发送重传指令，指示所述终端重新上传所述图片，直到验证通过或验证达到预定次数。
  13. 一种远程开户方法，其特征在于，包括权利要求1至12任一项所述的远程身份认证方法以及在身份认证通过之后进行远程开户。
  14. 一种远程身份认证系统，其特征在于，所述系统包括：电子密码设备、终端和后台服务器；其中，
    所述电子密码设备，用于获取待验证信息，并根据所述待验证信息，生成并显示图形标识码，其中，所述待验证信息包括：单次认证数据；
    所述终端，用于获取包含用户的面部图像和所述电子密码设备显示的图形标识码的图片，并将所述图片发送至所述后台服务器；
    所述后台服务器，用于接收所述终端发送的所述图片，并对所述图片上记载的所述图形标识码以及所述用户的面部图像进行验证。
  15. 根据权利要求14所述的系统，其特征在于，所述终端通过以下方式将所述图片发送给所述服务器：
    将所述图片携带在身份认证请求中发送给所述后台服务器，其中，所述身份认证请求中还携带有用户信息。
  16. 根据权利要求14所述的系统，其特征在于，
    所述终端还用于在电子密码设备获取待验证信息之前向所述后台服务器发送身份认证请求，其中，所述身份认证请求中携带有用户信息。
  17. 根据权利要求15或16所述的系统，其特征在于，所述系统还包括身份证读卡模块；
    所述身份证读卡模块用于读取用户的居民身份证中存储的身份证信息，将所述身份证信息发送给所述电子密码设备；
    所述电子密码设备还用于对所述身份证读卡模块读取的所述身份证信息进行加密，将加密得到的身份证信息的密文发送给所述终端；
    所述用户信息包括：用户的身份证信息的密文；
    所述后台服务器还用于接收所述身份认证请求，根据所述身份证信息的密文对用户的身份进行验证。
  18. 根据权利要求17所述的系统，其特征在于，
    所述终端还用于从所述电子密码设备获取所述身份证信息的密文的签名数据；
    所述用户信息还包括：所述身份证信息的密文的签名数据；
    所述后台服务器还用于对所述身份证信息的密文的签名数据进行验签。
  19. 根据权利要求17或18所述的系统，其特征在于，所述后台服务器通过以下方式对用户的身份进行验证：
    对所述身份证信息的密文进行解密，得到所述身份证信息；
    获取预先存储的与所述电子密码设备对应的身份证信息；
    将获取的所述身份证信息与解密得到的所述身份证信息进行比较，在两者匹配的情况下，确认当前请求开户的用户的身份验证成功，在两者不匹配的情况，确认当前请求开户的用户的身份验证失败。
  20. 根据权利要求14至19任一项所述的系统，其特征在于，所述电子密码设备通过以下方式获取所述待验证信息：
    基于与所述后台服务器同步的参数，生成所述待验证信息。
  21. 根据权利要求14至20任一项所述的系统，其特征在于，所述电子密码设备根据以下方式之一生成图形标识码：
    将所述待验证信息转换为所述图形标识码；
    按照预设算法对所述待验证信息进行计算，生成与计算结果对应的图形标识码。
  22. 根据权利要求21所述的系统，其特征在于，所述电子密码设备通过以下方式之一对所述待验证信息进行计算：
    利用自身存储的私钥，对所述待验证信息进行签名；
    对所述待验证信息进行消息认证码MAC计算。
  23. 根据权利要求14至22任一项所述的系统，其特征在于，所述终端通过以下方式之一获取包含用户的面部图像和所述电子密码设备显示的所述图形标识码的图片：
    通过设置在所述终端上的拍摄装置拍摄包含用户的面部和所述电子密码设备显示的所述图形标识码的图像，获取所述图片；
    接收外部设备发送的包含用户的面部图像和所述电子密码设备显示的所述图形标识码的图片。
  24. 根据权利要求14至23任一项所述的系统，其特征在于，所述后台服务器通过以下方式对所述图片上记载的所述用户的面部图像进行验证：
    获取预先存储的与所述电子密码设备对应的用户的身份信息，其中，所述身份信息包括用户的面部图像；
    将所述图片上记载的所述用户的面部图像与获取所述身份信息中包括的用户的面部图像进行比对，在两者匹配的情况下，确定验证通过，在两者不匹配的情况下，确定验证不通过。
  25. 根据权利要求14至23任一项所述的系统，其特征在于，在所述后台服务器对所 述图片上记载的所述图形标识码以及所述用户的面部图像验证没有通过的情况下，所述后台服务器还用于向所述终端发送重传指令，指示所述终端重新上传所述图片，直到验证通过或验证达到预定次数。
  26. 一种远程开户系统，其特征在于，包括权利要求14至25任一项所述的远程身份认证系统，所述后台服务器还用于在身份认证通过之后进行远程开户。
PCT/CN2016/098330 2015-09-07 2016-09-07 远程身份认证方法和系统以及远程开户方法和系统 WO2017041715A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CA2997638A CA2997638C (en) 2015-09-07 2016-09-07 Remote identity authentication method and system and remote account opening method and system
US15/909,017 US10606997B2 (en) 2015-09-07 2018-03-01 Remote identity authentication method and system and remote account opening method and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510564864.0A CN105245341B (zh) 2015-09-07 2015-09-07 远程身份认证方法和系统以及远程开户方法和系统
CN201510564864.0 2015-09-07

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/909,017 Continuation US10606997B2 (en) 2015-09-07 2018-03-01 Remote identity authentication method and system and remote account opening method and system

Publications (1)

Publication Number Publication Date
WO2017041715A1 true WO2017041715A1 (zh) 2017-03-16

Family

ID=55042853

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/098330 WO2017041715A1 (zh) 2015-09-07 2016-09-07 远程身份认证方法和系统以及远程开户方法和系统

Country Status (4)

Country Link
US (1) US10606997B2 (zh)
CN (1) CN105245341B (zh)
CA (1) CA2997638C (zh)
WO (1) WO2017041715A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
IT201800006758A1 (it) * 2018-06-28 2019-12-28 Sistema e metodo di verifica in linea dell’identità di un soggetto
EP3646247B1 (en) 2017-06-30 2023-09-13 Cryptomathic Ltd User authentication based on rfid-enabled identity document and gesture challenge-response protocol

Families Citing this family (24)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105245341B (zh) 2015-09-07 2018-11-30 天地融科技股份有限公司 远程身份认证方法和系统以及远程开户方法和系统
CN105141615A (zh) * 2015-09-07 2015-12-09 天地融科技股份有限公司 一种远程开户方法和系统及其身份验证方法和系统
CN106027461B (zh) * 2016-01-21 2019-02-15 李明 一种身份证认证系统中云认证平台使用密钥的方法
CN106027464B (zh) * 2016-01-21 2019-10-01 李明 一种安全信息控制方法及身份证读卡终端
CN105719131A (zh) * 2016-01-27 2016-06-29 努比亚技术有限公司 服务器、客户端及电子支付的代付方法
CN105938526A (zh) * 2016-03-07 2016-09-14 李明 一种身份认证方法及系统
CN105939195A (zh) * 2016-03-07 2016-09-14 李明 一种交易方法及系统
JP2019512786A (ja) * 2016-03-07 2019-05-16 天地融科技股▲ふん▼有限公司 権限付与認証方法、権限付与装置及び権限付与システム
CN105939197B (zh) * 2016-03-17 2019-02-12 天地融科技股份有限公司 一种身份认证方法和系统
US10346605B2 (en) * 2016-06-28 2019-07-09 Paypal, Inc. Visual data processing of response images for authentication
CN107360126B (zh) * 2016-08-22 2020-03-24 天地融科技股份有限公司 一种利用图形标识码登录客户端的方法、系统和终端
IT201700036968A1 (it) * 2017-04-04 2018-10-04 Inventia S R L Metodo e sistema di verifica online dell’identità di un soggetto
CN107483430A (zh) * 2017-08-09 2017-12-15 北京中软信科技有限公司 一种基于身份证云识别的人证合一认证方法和装置
CN107944872A (zh) * 2017-11-15 2018-04-20 成都航空职业技术学院 一种基于身份证认证的租车费用结算系统及方法
CN110198289B (zh) * 2018-02-27 2023-03-24 国民技术股份有限公司 终端、云服务器、验证设备、身份验证方法及系统
CN110730063B (zh) * 2018-07-16 2022-11-11 中国电信股份有限公司 安全验证方法、系统、物联网平台、终端和可读存储介质
CN109214163B (zh) * 2018-09-14 2021-08-20 北卡科技有限公司 一种身份认证的方法和装置
CN111224926B (zh) * 2018-11-27 2022-05-13 天地融科技股份有限公司 一种云身份证的实现方法及系统
CN111310512B (zh) * 2018-12-11 2023-08-22 杭州海康威视数字技术股份有限公司 用户身份鉴权方法及装置
CN110380864B (zh) * 2019-07-05 2021-10-01 创新先进技术有限公司 人脸数据采集、验证的方法、设备及系统
US11317288B2 (en) * 2019-10-21 2022-04-26 Jpmorgan Chase Bank, N.A. Systems and methods for securing communication between a native application and an embedded hybrid component on an electronic device
CN114095211B (zh) * 2021-10-29 2023-08-22 新大陆（福建）公共服务有限公司 一种可信数字身份人员核验方法与系统
CN115801885A (zh) * 2022-11-14 2023-03-14 中国工商银行股份有限公司 业务操作的处理方法及装置、处理器和电子设备
CN117692259B (zh) * 2024-02-02 2024-05-31 杭州天谷信息科技有限公司 一种基于验证网络的注册方法和验证方法

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104200580A (zh) * 2014-08-29 2014-12-10 中国农业银行股份有限公司 一种智能柜台
CN104361274A (zh) * 2014-10-30 2015-02-18 深圳市富途网络科技有限公司 一种基于视频识别的身份认证方法及其系统
CN104767616A (zh) * 2015-03-06 2015-07-08 北京石盾科技有限公司 一种信息处理方法、系统及相关设备
CN105141615A (zh) * 2015-09-07 2015-12-09 天地融科技股份有限公司 一种远程开户方法和系统及其身份验证方法和系统
CN105245341A (zh) * 2015-09-07 2016-01-13 天地融科技股份有限公司 远程身份认证方法和系统以及远程开户方法和系统
CN105245340A (zh) * 2015-09-07 2016-01-13 天地融科技股份有限公司 一种基于远程开户的身份认证方法和系统

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101075868B (zh) * 2006-05-19 2010-05-12 华为技术有限公司 一种远程身份认证的系统、终端、服务器和方法
US8689287B2 (en) * 2006-08-17 2014-04-01 Northrop Grumman Systems Corporation Federated credentialing system and method
US9129340B1 (en) * 2010-06-08 2015-09-08 United Services Automobile Association (Usaa) Apparatuses, methods and systems for remote deposit capture with enhanced image detection
US8819445B2 (en) * 2012-04-09 2014-08-26 Mcafee, Inc. Wireless token authentication
CN104639542A (zh) * 2015-01-27 2015-05-20 李明 身份证信息获取方法及系统
US9491160B2 (en) * 2015-03-09 2016-11-08 Michigan Health Information Network-Mihin Method and apparatus for remote identity proofing service issuing trusted identities
US10262191B2 (en) * 2017-03-08 2019-04-16 Morphotrust Usa, Llc System and method for manufacturing and inspecting identification documents

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104200580A (zh) * 2014-08-29 2014-12-10 中国农业银行股份有限公司 一种智能柜台
CN104361274A (zh) * 2014-10-30 2015-02-18 深圳市富途网络科技有限公司 一种基于视频识别的身份认证方法及其系统
CN104767616A (zh) * 2015-03-06 2015-07-08 北京石盾科技有限公司 一种信息处理方法、系统及相关设备
CN105141615A (zh) * 2015-09-07 2015-12-09 天地融科技股份有限公司 一种远程开户方法和系统及其身份验证方法和系统
CN105245341A (zh) * 2015-09-07 2016-01-13 天地融科技股份有限公司 远程身份认证方法和系统以及远程开户方法和系统
CN105245340A (zh) * 2015-09-07 2016-01-13 天地融科技股份有限公司 一种基于远程开户的身份认证方法和系统

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3646247B1 (en) 2017-06-30 2023-09-13 Cryptomathic Ltd User authentication based on rfid-enabled identity document and gesture challenge-response protocol
IT201800006758A1 (it) * 2018-06-28 2019-12-28 Sistema e metodo di verifica in linea dell’identità di un soggetto
WO2020003186A1 (en) * 2018-06-28 2020-01-02 Inventia S.R.L. System and method for online verification of the identity of a subject

Also Published As

Publication number Publication date
CA2997638C (en) 2022-03-22
CN105245341A (zh) 2016-01-13
CN105245341B (zh) 2018-11-30
US20180189476A1 (en) 2018-07-05
US10606997B2 (en) 2020-03-31
CA2997638A1 (en) 2017-03-16

Similar Documents

Publication Publication Date Title
WO2017041715A1 (zh) 远程身份认证方法和系统以及远程开户方法和系统
KR102328725B1 (ko) 하나의 장치를 이용하여 다른 장치를 언로크하는 방법
CN105245340B (zh) 一种基于远程开户的身份认证方法和系统
EP3343831B1 (en) Identity authentication method and apparatus
CN105050081B (zh) 网络接入设备接入无线网络接入点的方法、装置和系统
US7552322B2 (en) Using a portable security token to facilitate public key certification for devices in a network
CN103714639B (zh) 一种实现对pos终端安全操作的方法及系统
CN105871857B (zh) 认证方法、装置、系统及治疗设备
CN107896147B (zh) 一种基于国密算法协商临时会话密钥的方法及其系统
US20160269393A1 (en) Protecting passwords and biometrics against back-end security breaches
CN109379387B (zh) 一种物联网设备间的安全认证和数据通信系统
US20180219688A1 (en) Information Transmission Method and Mobile Device
CN105939196B (zh) 身份认证方法和系统
US10044684B2 (en) Server for authenticating smart chip and method thereof
US20150113283A1 (en) Protecting credentials against physical capture of a computing device
CN104639516A (zh) 身份认证方法、设备及系统
WO2012072001A1 (zh) 一种安全发卡方法、发卡设备和系统
KR101113446B1 (ko) 휴대기기에 공인인증서를 전송하는 시스템 및 방법 그리고 다차원 코드를 이용하여 데이터를 전송 및 인증하는 시스템 및 방법
CN106022081A (zh) 一种身份证读卡终端的读卡方法、身份证读卡终端和系统
CN106131008B (zh) 视音频监控设备及其安全认证方法、视音频展示设备
CN110300287A (zh) 一种公共安全视频监控联网摄像头接入认证方法
KR102375287B1 (ko) 제 3자 검증에 사용되는 신분 등록 및 액세스 제어 방법
CN109960916A (zh) 一种身份认证的方法和系统
CN112184952A (zh) 智能锁控制系统、方法以及存储介质
WO2019165571A1 (zh) 一种传输数据的方法及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16843653

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2997638

Country of ref document: CA

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16843653

Country of ref document: EP

Kind code of ref document: A1