WO2017041716A1 - 远程开户方法和系统及其身份验证方法和系统 - Google Patents

远程开户方法和系统及其身份验证方法和系统 Download PDF

Info

Publication number
WO2017041716A1
WO2017041716A1 PCT/CN2016/098331 CN2016098331W WO2017041716A1 WO 2017041716 A1 WO2017041716 A1 WO 2017041716A1 CN 2016098331 W CN2016098331 W CN 2016098331W WO 2017041716 A1 WO2017041716 A1 WO 2017041716A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
identity
user
background server
verification
Prior art date
Application number
PCT/CN2016/098331
Other languages
English (en)
French (fr)
Inventor
李东声
Original Assignee
天地融科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 天地融科技股份有限公司 filed Critical 天地融科技股份有限公司
Publication of WO2017041716A1 publication Critical patent/WO2017041716A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0861—Network architectures or network communication protocols for network security for authentication of entities using biometrical features, e.g. fingerprint, retina-scan
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures

Definitions

  • the present application relates to the field of electronic technologies, and in particular, to a remote account opening method and system and an authentication method and system thereof.
  • the user first initiates an account opening request through a remote video teller machine (VTM), and the background server prompts the user to upload the identity document information, and after verifying that the identity document is legal, the background server establishes a video with the bank client. Connect, capture the user's face photo in real time through the camera, and then check the photo with the ID card to check whether it is the user.
  • VTM remote video teller machine
  • this remote account opening method can reduce the waiting time of the user, the user still needs to go to the bank outlet, and does not really realize that the user can open the account at any time when sitting at home or anywhere, so although the remote account opening is reduced. The user waited for time, but did not bring great convenience to the user.
  • the present application aims to solve at least one of the above problems, and enables a user to open an account remotely at any time while sitting at home or anywhere, and to ensure the security of remote account opening.
  • the main purpose of the present application is to provide an authentication method.
  • Another object of the present application is to provide a remote account opening method.
  • Another object of the present application is to provide an identity verification system.
  • the present invention provides an identity verification method, which is characterized in that: the method includes: the electronic key device acquires the prompt information, and prompts the prompt information to the user; the terminal obtains the information to be verified, and sends the information to the background server, and the information to be verified At least the signature information and the video data of the user reading the prompt information; the background server receives the information to be verified, and the signature information in the verification information is checked, and after the verification is passed, the identity information to be verified in the video data is extracted, and the The identity information to be verified extracted in the video data is compared with the verification identity information obtained by the background server, and if the comparison is consistent, the identity verification is completed.
  • the electronic key device acquires the prompt information, including at least one of the following: the electronic key device acquires the prompt information sent by the background server; and the electronic key device is based on being synchronized with the background server.
  • the data calculation obtains the prompt information; the electronic key device receives the to-be-calculated information sent by the background server, and calculates the prompt information; the electronic key device receives the to-be-calculated information input by the input device, and calculates the prompt information.
  • the terminal acquires video data including the user reading the prompt information, and includes at least one of the following ways: the terminal records a video including the user reading prompt information; and the electronic key device recording includes the user read The video of the prompt information is taken and sent to the terminal; the terminal other than the terminal and the electronic key device records a video containing the user's read prompt information, and sends the video to the terminal.
  • the signature information is information obtained by signing one or more of the following: ID card information plaintext, ID card information ciphertext, video data, and single authentication data.
  • the identity information to be verified includes user information to be verified and/or the prompt information
  • the verification identity information includes verification user information and/or verification prompt information
  • Comparing the to-be-checked identity information extracted in the video data with the verification identity information obtained by the background server including: comparing the to-be-verified user information extracted from the video data with the verification user information obtained by the background server; And/or, the prompt information extracted from the video data is compared with the verification prompt information acquired by the background server.
  • the user information to be verified includes: a photo of the user to be verified and/or user voiceprint information to be verified, and verifying the user information includes: verifying the user photo and/or verifying the user voice. Aligning information; comparing the user information to be verified extracted from the video data with the verification user information obtained by the background server, including: the photo of the user to be verified extracted from the video data and the school acquired by the background server The user photos are compared for comparison; and/or, the user voiceprint information to be verified extracted from the video data is compared with the verified user voiceprint information acquired by the background server.
  • the to-be-verified information further includes: user identity information; the identity information to be verified extracted from the video data is compared with the verification identity information obtained by the background server database, including: a background server The verification identity information corresponding to the user identity information is found in the obtained verification identity information, and the identity information to be verified extracted from the video data is compared with the verification identity information corresponding to the user identity information.
  • the information to be verified further includes: user identity information, user identity information to The method includes: the background information is clear: after the background server receives the information to be verified, when the identity information to be verified extracted from the video data is compared with the verification identity information obtained by the background server, the method further includes: The server obtains the pre-stored identity information, and finds the ID information matching the electronic key device in the obtained ID information, and compares the clear information of the ID information with the ID information matched by the electronic key device. The identity verification is completed if the identity information to be verified is consistent with the verification identity information and the identity information of the identity card information and the electronic key device are matched.
  • finding the identity card information that matches the electronic key device includes at least one of: finding identity card information that matches the electronic key device according to the serial number of the electronic key device; The digital certificate sent by the key device finds the identity card information that matches the electronic key device.
  • the present application provides a remote account opening method, which is characterized in that, before the background server receives the information to be verified, the method further includes: the terminal sending an account opening request to the background server; the account opening request carries at least User identity information; after the background server completes the authentication, the method further includes: the background server opens an account that matches the user identity information according to the account opening request.
  • an identity verification system including: an electronic key device, a terminal, and a background server; an electronic key device, configured to obtain prompt information, prompting prompt information to the user; and the terminal is configured to obtain information to be verified.
  • the information to be verified at least includes the signature information and the video data of the user reading the prompt information;
  • the background server is configured to receive the information to be verified, and the signature information in the verification information is checked, after the verification is passed,
  • the identity information to be verified in the video data is extracted, and the identity information to be verified extracted from the video data is compared with the verification identity information obtained by the background server, and the identity verification is completed after the comparison is consistent.
  • the electronic key device acquires the prompt information by at least one of the following: the electronic key device acquires the prompt information sent by the background server; and the electronic key device calculates the data based on the synchronization with the background server.
  • the prompt information the electronic key device receives the to-be-calculated information sent by the background server, and calculates the prompt information
  • the electronic key device receives the to-be-calculated information input by the input device, and calculates the prompt information.
  • the terminal acquires video data including user read prompt information by at least one of: the terminal recording a video including the user reading prompt information; and the electronic key device recording including the user reading prompt information
  • the video is sent to the terminal; other terminals than the terminal and the electronic key device record a video containing the user's read prompt information and send it to the terminal.
  • the signature information is information obtained by signing one or more of the following: ID card information plaintext, ID card information ciphertext, video data, and single authentication data.
  • the identity information to be verified includes: user information to be verified and/or the prompt information
  • the verification identity information includes: verifying user information and/or verifying prompt information
  • For the video from The user information to be verified extracted from the data is compared with the verification identity information obtained by the background server, and the background server compares the information to be verified extracted from the video data with the verification user information obtained by the background server. And/or, the background server compares the prompt information extracted from the video data with the verification prompt information acquired by the background server.
  • the user information to be verified includes: a photo of the user to be verified and/or user voiceprint information to be verified, and verifying the user information includes: verifying the user photo and/or verifying the user voice.
  • the background information is used to compare the user information to be verified extracted from the video data with the verification user information obtained by the background server, including: the photo of the user to be verified extracted from the video data by the background server The verification user photo obtained by the background server is compared; and/or, the background server compares the user voiceprint information to be verified extracted from the video data with the verification user voiceprint information acquired by the background server.
  • the information to be verified further includes: user identity information; and a background server, configured to compare the identity information to be verified extracted from the video data with the verification identity information acquired by the background server,
  • the method includes: a background server, configured to find verification identity information corresponding to the user identity information in the obtained verification identity information, and perform verification identity information corresponding to the identity information to be verified extracted from the video data and the user identity information. Comparison.
  • the information to be verified further includes: user identity information
  • the user identity information includes at least the plaintext information
  • the background server is further configured to: after receiving the to-be-verified information, extract the video data from the video data.
  • the identity information to be verified is compared with the verification identity information obtained by the background server, the pre-stored identity information is obtained, and the identity card information matching the electronic key device is found in the obtained identity card information, and The clear text of the ID card information is compared with the found ID card information matching the electronic key device, and the identity information of the identity information to be verified and the verification identity information are consistent, and the ID card information matching the ID card information and the electronic key device is matched. In the case of a consistent match, the authentication is completed.
  • the background server finds the identity card information that matches the electronic key device by at least one of: finding the identity card information that matches the electronic key device according to the serial number of the electronic key device; And identifying the ID card information matching the electronic key device according to the certificate sent by the electronic key device; and finding the ID card information matching the electronic key device according to the signature information sent by the electronic key device.
  • a further aspect of the present application provides a remote account opening system for applying the above-mentioned identity verification system, wherein the terminal is further configured to send an account opening request to the background server; the account opening request carries at least user identity information; and the background server is further used. After the identity verification is completed, an account matching the user identity information is opened according to the account opening request.
  • the present application provides a remote account opening method and system, and an authentication method and system thereof, which use an electronic key device to prompt prompt information, and the background server records a user reading prompt through a remote terminal.
  • the video data of the information realizes multiple verification of the user's identity, ensuring the identity of the user in the remote account opening. Legitimacy, and then open the account for the user according to the received account opening request after the verification is passed, realizing the remote account opening anytime and anywhere, greatly improving the user experience of the remote account opening.
  • FIG. 1 is a schematic structural diagram of an identity verification system according to Embodiment 1 of the present application.
  • FIG. 3 is a flowchart of a remote account opening method according to Embodiment 4 of the present application.
  • FIG. 4 is a flowchart of another remote account opening method according to Embodiment 4 of the present application.
  • connection In the description of the present application, it should be noted that the terms “installation”, “connected”, and “connected” are to be understood broadly, and may be fixed or detachable, for example, unless otherwise specifically defined and defined. Connected, or integrally connected; can be mechanical or electrical; can be directly connected, or indirectly connected through an intermediate medium, can be the internal communication of the two components.
  • Connected, or integrally connected can be mechanical or electrical; can be directly connected, or indirectly connected through an intermediate medium, can be the internal communication of the two components.
  • the specific meanings of the above terms in the present application can be understood in the specific circumstances for those skilled in the art.
  • This embodiment provides an identity verification system.
  • the system includes: an electronic key device 10, a terminal 20, and a background server 30.
  • the electronic key device 10 is configured to obtain the prompt information, and prompt the user with the prompt information.
  • the terminal 20 is configured to obtain the information to be verified, and send the information to the background server 30, where the information to be verified at least includes the video that the user reads the prompt information.
  • the background server 30 is configured to receive the to-be-verified information, and extract the to-be-checked identity information in the video, and compare the to-be-checked identity information extracted from the video with the verification identity information obtained by the background server 30. Complete authentication.
  • the identity verification system provided in this embodiment, the user can remotely open an account at any time while sitting at home or anywhere, and ensure the security of remote account opening.
  • the electronic key device 10 may be a device with a signature function, including a KEY with a signature function, a smart card, or a KEY card, for example, an ICBC U-Shield, an Agricultural Bank K-Bao, a BOC e-Law, and the like.
  • the prompt information may be a number or a character string. After the electronic key device 10 obtains the prompt information, the electronic key device 10 may display the prompt information to the user through the display screen of the electronic key device 10, or may broadcast the voice message to the user. The user plays a prompt message.
  • the electronic key device 10 may obtain prompt information by using at least one of the following manners:
  • the first method of the electronic key device 10 is used to obtain the prompt information sent by the background server 30.
  • the background server 30 generates prompt information, which may be a random number or a random string.
  • the background server 30 transmits the prompt information to the terminal 20, and the terminal 20 forwards the prompt information to the electronic key device 10.
  • the background server 30 may encrypt and/or sign the prompt information before transmitting the prompt information.
  • the electronic key device 10 decrypts the ciphertext of the prompt information to obtain the plaintext of the prompt information.
  • the electronic key device 10 receives the signature verification of the signature, and obtains the plaintext of the prompt information after the verification is passed.
  • the background server 30 transmits the ciphertext of the prompt information and the signature information of the plaintext of the prompt information
  • the electronic key device 10 first decrypts the ciphertext of the prompt information to obtain the plaintext of the prompt information, and according to the plaintext of the prompt information obtained by the decryption, the prompt information is The signature information of the plaintext is checked, and after the verification is passed, it is determined that the ciphertext of the received prompt information has not been tampered with, and the plaintext of the decrypted information is also true and valid. .
  • the electronic key device 10 When the background server 30 sends the ciphertext of the prompt information and the signature information of the ciphertext of the prompt information, the electronic key device 10 first checks the signature information of the ciphertext of the prompt information, and obtains the ciphertext of the prompt information after the verification is passed. The ciphertext of the prompt information is decrypted to obtain the plaintext of the prompt information.
  • the electronic key device 10 and the terminal 20 may be connected by a wired connection (for example, a USB interface, a headphone interface, etc.), or may be connected by a wireless connection (for example, WIFI, Bluetooth, infrared, NFC, etc.).
  • the prompt information is obtained, and the electronic key device only needs to receive the prompt information, which simplifies the process of obtaining the prompt information by the electronic key device and reduces the cost of the electronic key device.
  • the electronic key device 10 calculates the prompt information based on the data synchronized with the background server 30, and the electronic key device 10 may be a device having an OTP function such as a BOC e-order.
  • the electronic key device 10 generates a dynamic password as the prompt information using a built-in algorithm based on the data synchronized with the background server 30.
  • the data synchronized with the background server 30 may be time, an event, or a combination of time and events.
  • the electronic key device 10 calculates the presentation information based on the time synchronized with the background server 30, the electronic key device 10 can change the presentation information every other fixed time interval, for example, changing the presentation information every 60 seconds.
  • the electronic key device 10 may also change the prompt information once for each authentication operation.
  • the prompt information calculated in this way can only be used once, which ensures the security of the prompt information.
  • the electronic key device 10 is configured to receive the information to be calculated sent by the background server 30, and calculate the prompt information.
  • the background server 30 may generate a random character string as the information to be calculated, and may also generate the information to be calculated according to the account information or other information of the user.
  • the background server 30 may encrypt and/or sign the calculation information before transmitting the information to be calculated.
  • the electronic key device 10 decrypts the ciphertext of the calculation information to obtain the plaintext of the information to be calculated.
  • the electronic key device 10 receives the signature verification of the signature, and obtains the plaintext of the information to be calculated after the verification is passed.
  • the electronic key device 10 first decrypts the ciphertext of the calculated information to obtain the plaintext of the information to be calculated, and obtains the plaintext of the information to be calculated according to the decryption.
  • the signature information of the plaintext of the calculation information is checked, and after the verification is passed, it is determined that the received ciphertext of the information to be calculated has not been tampered with, and the plaintext of the information to be calculated obtained by the decryption is also true and effective.
  • the background server 30 sends the ciphertext of the information to be calculated and the signature information of the ciphertext to be calculated
  • the electronic key device 10 first performs the verification of the signature information of the ciphertext of the calculation information, and obtains the information to be calculated after the verification is passed.
  • the ciphertext to be processed is decrypted to obtain the plaintext of the information to be calculated.
  • the electronic key device 10 calculates the presentation information using an algorithm built in the electronic key device 10 based on the plaintext of the information to be calculated.
  • the background server sends the information to be calculated, even if the information to be calculated leaks, the prompt information will not be leaked, and the prompt information is secured.
  • Method 4 The electronic key device 10 is configured to receive information to be calculated input by the input device, and calculate prompt information.
  • the background server 30 may generate a random character string as the information to be calculated, and may also generate the to-be-calculated information according to the account information or other information of the user, and send the to-be-calculated information to the terminal, for example, sending the message as a short message.
  • the information to be calculated is input through a button provided by the electronic key device 10; the information to be calculated may also be input through the input device of the terminal 20, and the terminal 20 transmits the information to be calculated to the electronic key device 10;
  • the other input devices connected to 10 input the information to be calculated, and the other input devices transmit the information to be calculated to the electronic key device 10.
  • the electronic key device 10 receives the information to be calculated input by the input device, and calculates the prompt information using an algorithm built in the electronic key device 10.
  • the background server sends the information to be calculated, even if the information to be calculated leaks, the prompt information will not be leaked, and the prompt information is secured.
  • the electronic key device 10 is further configured to obtain identity card information (including plaintext or ciphertext), and send the identity card information to the backend server 30 through the terminal 10 to utilize the identity.
  • the certificate information completes the identity verification.
  • the electronic key device 10 can obtain the identity card information by at least one of the following methods:
  • Method 1 The electronic key device 10 directly reads the identity card information.
  • the electronic key device 10 has an ID card reader function, and the ID card is placed close to the electronic key device 10, and the electronic key device 10 can read the plaintext of the ID card information of the identity document.
  • the electronic key device 10 may also use the symmetric key negotiated with the background server 30 to encrypt the identity information and generate the identity information ciphertext or use the private key of the electronic key device 10 to identify the identity card.
  • the information is signed in plain text to generate signature information of the clear text of the ID card information.
  • the electronic key device 10 can directly obtain the identity card information, and does not need to be transmitted to the electronic key device 10 through other devices. Therefore, the identity card information does not need to be transmitted in the network. To ensure the security of identity information.
  • Method 2 The ID card reader reads the ID card information and sends it to the electronic key device 10.
  • the ID card is placed close to the ID card reader, and the ID card reader can read the ID card information of the ID card and send it to the electronic key device 10.
  • the ID card information received by the electronic key device 10 is the clear text of the ID card information.
  • the electronic key device 10 may also use the symmetric key negotiated with the background server 30 to encrypt the identity information and generate the identity information ciphertext or use the private key of the electronic key device 10 to identify the identity card.
  • the information is signed in plain text to generate signature information of the clear text of the ID card information.
  • the electronic key device When the electronic key device acquires the identity card information in this manner, the electronic key device does not need to configure the card reader function, thereby reducing the cost of the electronic key device.
  • the electronic key device 10 is further configured to generate signature information and send the signature information to the terminal 20.
  • the signature information includes one or more of the following: signature information of the clear text of the ID card information, and identity card information. Signature information of ciphertext, signature information of video data, and signature information of single authentication data.
  • the electronic key device 10 may sign the combination of one or more of the identity card information plaintext, the identity card information ciphertext, the video data, and the single authentication data to obtain signature data.
  • the signature information may be signature data obtained by signing a single authentication data
  • the single authentication data may be sent by the server to the electronic key device 10, and may be a random number or a random event.
  • Single-authentication data can only be used once, thus preventing replay attacks.
  • the signature information may also be signature data obtained by signing the clear text of the ID card information and the single authentication data.
  • the background server 30 After receiving the signature information, the background server 30 first performs the verification, and then verifies the single authentication data after the verification is passed.
  • the clear text of the ID card information is used as the comparison of the index verification identity information of the verification identity information obtained by the background server 30, or the plaintext information of the ID card information and the ID card information pre-stored in the background are directly clarified.
  • the signature information may also be signature data obtained by signing the video data and the single authentication data, where the video data may be sent to the electronic key device 10 after being recorded by the terminal, or may be the electronic key device 10 itself. The recorded by the camera may also be transmitted to the electronic key device 10 through the terminal 20 after being recorded by the terminal other than the terminal 20 and the electronic key device 10.
  • the signature information may also be signature data obtained by signing the ciphertext of the ID card information.
  • the background server 30 After receiving the signature information of the ciphertext of the ID card information, the background server 30 first performs the verification, and after the verification is passed, the electronic key is utilized.
  • the symmetric key negotiated by the device decrypts the ID card information and obtains the clear text of the ID card information.
  • the signature information may be data obtained by signing a combination of various information, which is not limited in the embodiment of the present application. Therefore, the server side can verify the signature information, thereby ensuring whether the identity of the user holding the electronic key device is legal, thereby ensuring the security of remote account opening.
  • the terminal 20 is configured to obtain the information to be verified, and send the information to the background server 30, where the information to be verified includes at least the video of the user reading the prompt information;
  • the terminal 20 may be a PC supporting the electronic key device. Machines, PAD (tablet), smart phones and other equipment.
  • the electronic key device 10 and the terminal 20 may perform data transmission through a wired connection (for example, a USB interface, a headphone interface, etc.), or may perform data transmission through a wireless connection (for example, WIFI, Bluetooth, infrared, NFC, etc.).
  • the user after the electronic key device 10 presents the prompt information to the user, the user records the process of reading the prompt information by the user into a video by using the camera, and the terminal 20 acquires the information to be verified that includes at least the video of the user reading the prompt information. And sent to the background server 30.
  • the user reading the prompt information includes: the user reads the prompt information aloudly, or the user views the prompt information on the display screen of the electronic key device 10, and only needs to record the video that the user is reading the prompt information, the embodiment does not Make specific restrictions.
  • the video in which the user reads the prompt information can be compressed.
  • the video for which the user reads the prompt information may be encrypted, encrypted, and sent to the background server 30.
  • the terminal 20 is configured to obtain, by using at least one of the following manners, a video that includes the user reading prompt information:
  • the terminal 20 is configured to record a video that includes the user reading the prompt information.
  • the terminal 20 calls the self-contained camera to record the process of reading the prompt information by the user into a video.
  • Existing terminals eg, PCs, smart phones, tablets, etc.
  • cameras that use the camera provided by the terminal 20 to record video without additional cost.
  • the electronic key device 10 records a video including the user's read prompt information, and sends the video to the terminal 20.
  • the electronic key device 10 calls the camera that is provided by the electronic key device 10, records the process of the user reading the prompt information into a video, and sends the video to the terminal 20. Before the electronic key device 10 sends the video, the video can also be encrypted and signed to ensure the security of the video transmission.
  • Manner 3 The terminal other than the terminal 20 and the electronic key device 10 records a video containing the user's read prompt information and transmits it to the terminal 20.
  • the terminal 20 and other terminals with the camera other than the electronic key device 10 record video, and the recording is completed and sent to the terminal 20.
  • the other terminals with the camera and the terminal 20 may be connected by a wired connection (for example, a USB interface, a headphone jack, etc.), or may be connected by a wireless connection (for example, WIFI, Bluetooth, infrared, NFC, etc.).
  • the terminal and the terminal other than the electronic key device record video without separately setting a camera for the electronic key device, which reduces the cost of the electronic key device.
  • the background server 30 is configured to receive information to be verified, where the information to be verified includes at least video data of the user reading the prompt information, and extracting identity information to be verified in the video data, and the video data to be verified.
  • the extracted identity information to be checked is compared with the verification identity information obtained by the background server 30, and the comparison is consistent, and the identity verification is completed.
  • the verification identity information acquired by the background server 30 may be pre-stored in the background server 30, may be obtained from other databases, or may be temporarily generated (for example, an OTP password).
  • the background server 30 after the background server 30 receives the information to be verified, if the video data in the information to be verified is encrypted, the background server 30 decrypts the video data first; if the video data therein is After compression, the background server 30 decompresses the video data, and then extracts the identity information to be verified from the decrypted or decompressed video, performs subsequent comparison, and completes identity verification.
  • the information to be verified further includes signature information
  • the background server 30 is further configured to perform verification on the signature information, and trigger the extraction of the identity information to be verified in the video data after the verification is passed. operating.
  • the background server 30 receives the information to be verified sent by the terminal 20, and includes the original information corresponding to the signature information in addition to the signature information. After receiving the information to be verified sent by the terminal 20, the background server 30 first performs the verification of the signature information in the verification information.
  • the background server 30 generates a digest of the original information in the received signature information using the same hash function as the electronic key device 10, and decrypts the signature data in the signature information with the public key of the electronic key device 10 to obtain another digest. , compare whether the two digests are the same. If two abstract phases The same check is passed, and the operation of extracting the identity information to be verified in the video data is triggered after the check is passed.
  • the authentication operation is terminated, that is, the authentication fails. Therefore, the electronic key device used in the remote account opening can be ensured as the electronic key device of the legitimate user, which is a double verification of the identity of the user.
  • the background server can also verify whether the signature information has been tampered with, to ensure the security of the signature information transmission, thereby ensuring the security of remote account opening.
  • the signature information is information obtained by signing one or more of the following: identity card information plaintext, ID card information ciphertext, video data, and single authentication data; the background server 30 Used to check the signature information.
  • the signature information may be signature data obtained by signing a combination of one or more of the ID information plaintext, the ID card information ciphertext, the video data, and the single authentication data.
  • the signature information may be signature data obtained by signing a single authentication data
  • the single authentication data may be a random number or a random event.
  • Single-authentication data can only be used once, thus preventing replay attacks.
  • the background server 30 After receiving the signature information, the background server 30 first performs the verification check, and then verifies the single authentication data after the verification is passed, and compares whether the received single authentication data is consistent with the single authentication data in the background server, and if not, the terminal is terminated. Authentication operation. Replay attacks can be prevented by using signature information for a single authentication data.
  • the signature information may also be signature data obtained by signing the ID information plaintext and the single authentication data.
  • the signature information may also be signature data obtained by signing the video data and the single authentication data, where the video data may be sent to the electronic key device 10 after being recorded by the terminal, or may be the electronic key device 10 itself.
  • the recorded by the camera may also be transmitted to the electronic key device 10 through the terminal 20 after being recorded by the terminal other than the terminal 20 and the electronic key device 10.
  • the signature information may be data obtained by signing a combination of various information, which is not limited in the embodiment of the present application.
  • the identity information to be verified includes: user information to be verified and/or prompt information, where the user information to be verified is information extracted from the video data that can reflect the characteristics of the user, and is verified.
  • the identity information includes: verification user information and/or verification prompt information; the background server 30 is configured to compare the to-be-checked identity information extracted from the video data with the verification identity information obtained by the background server, including: The server 30 compares the to-be-verified user information extracted from the video data with the verification user information acquired by the background server 30; and/or, the background server 30 extracts the prompt information extracted from the video data with the background server. Check the prompt information for comparison.
  • the verification user information acquired by the background server 30 may be pre-stored in the background server 30, or may be obtained from other databases; the verification prompt information acquired by the background server 30 may be pre-stored in the background server 30. It can also be obtained from other databases, or it can be temporarily generated (for example, OTP password).
  • the background server 30 may select the corresponding device or software to extract the identity information to be verified according to the identity information to be verified that needs to be verified, and the background server 30 will extract the information to be learned from the video data.
  • the identity information is compared with the verification identity information obtained by the background server 30.
  • the audio extraction software may be used to extract the prompt information read by the user in the video data, and the background service
  • the server 30 compares the prompt information extracted from the video data with the verification prompt information acquired by the background server; or, after the background server 30 receives the information to be verified, the identity information and the prompt information to be verified are extracted, and the background server 30
  • the identity information to be verified extracted from the video data is compared with the verification identity information obtained by the background server, and the prompt information extracted from the video data is compared with the verification prompt information acquired by the background server, and is to be verified. After the identity information and the prompt information are aligned, the authentication is completed.
  • the background server 30 compares the identity information to be verified with the corresponding verification identity information obtained by the background server, and compares If the agreement is verified and the comparison is inconsistent, the authentication will not pass. If the to-be-checked identity information includes multiple to-be-checked identity information, for example, including prompt information and multiple to-be-checked user information, the background server 30 needs to check the plurality of to-be-checked identity information in the identity information to be verified. Comparing with the corresponding verification identity information acquired by the background server 30, only all the identity information to be verified is consistent, and the background server 30 passes the identity verification, as long as one of the to-be-checked identity information is inconsistent.
  • the authentication of the background server 30 fails. After the authentication is successful, the background server 30 may send an identity verification success message to the terminal 20; after the identity verification fails, the background server 30 may send an identity verification failure message to the terminal 20. Therefore, the validity of the identity of the user who opens the account remotely can be ensured, and the background server can complete the remote account opening for the user.
  • the identity verification system can flexibly select the type and number of identity information to be checked that need to be compared as needed.
  • the user uses the electronic key device and the video data to verify the identity of the user together with the electronic key device of the user, and solves the problem of identity verification in the remote account opening, and the user passes the PC at home.
  • Terminals such as computers and smart phones can be opened remotely.
  • the user information to be verified includes the photo of the user to be verified and/or the voiceprint information of the user to be verified, and the photo of the user to be verified may be multiple, and the photo of the user to be verified is
  • the voiceprint information of the user to be verified extracted from the video data is extracted from the video data; verifying the user information includes verifying the user's photo and/or verifying the user's voiceprint information, and verifying that the user's photo may be the user
  • the photo of the bank is reserved when the account is opened, and the user's voiceprint information may be reserved at the bank when the user opens the account; the background server 30 is used for the user information to be verified and the background server 30 extracted from the video data.
  • the obtained verification user information is compared, including: the background server 30 compares the photo of the user to be verified extracted from the video data with the verification user photo obtained by the background server; and/or, the background server 30 will video
  • the user voiceprint information to be verified extracted from the data is compared with the verified user voiceprint information obtained by the background server.
  • the verification user photo and/or the verification user voiceprint information acquired by the background server 30 may be pre-stored in the background server 30, or may be acquired from other databases.
  • the user information to be verified extracted by the background server 30 from the video data includes a photo of the user to be verified, and the background worker can manually compare the photo of the user to be verified extracted from the video data in the background server 30. Get the verified user photo.
  • the background server 30 may also use a face recognition technology to perform a comparison of the photos of the user to be verified. Specifically, first, the background server 30 restores the received video data to a video and transmits it to the face recognition system.
  • the face recognition system collects the face image in the video and uses face detection to accurately calibrate the position and size of the face in the image.
  • the face image is preprocessed (for example, ray compensation, gradation transformation, histogram equalization, normalization, geometric correction, filtering, sharpening, etc.) of the face image.
  • facial image features are extracted.
  • the extractable features include visual features, pixel statistical features, face image transform coefficient features, face image algebra features, and the like.
  • the feature data of the extracted face image is searched and matched with the face feature template of the verified user photo stored in the database.
  • the face recognition system determines the photo of the user to be verified and Verify that the user's photo match is the same.
  • the face recognition technology has the flexibility to discriminate, and others cannot deceive the face recognition system with inactive photos, puppets, etc., and the recognition accuracy is high. Face recognition technology improves the accuracy and security of the authentication method and saves labor costs.
  • the background server 30 can use the voiceprint recognition system to collect the user voiceprint information to be verified in the video due to the video recorded by the user reading the prompt information. Specifically, first, the background server 30 extracts the user's voice from the video and preprocesses the voice (eg, removes background noise). Secondly, the acoustic characteristics are extracted from the pre-processed speech, and the user's voiceprint is modeled to obtain the user's voiceprint model to be verified. Finally, the background server matches the voiceprint model of the user to be verified with the voiceprint information obtained by the background server, and determines whether the result is consistent and outputs the result.
  • the background server 30 matches the voiceprint model of the user to be verified with the voiceprint information obtained by the background server, and determines whether the result is consistent and outputs the result.
  • Voiceprint is a kind of user's biological characteristics. Because of the physiological difference of each person, the voiceprint of any two people is different, so the voiceprint is unique, and the security of using voiceprint information for authentication is high. Secondly, for each adult, the voiceprint does not change with age, so there is no need to repeat the collection, which saves costs. In addition, voiceprint recognition technology has the advantages of convenient acquisition and low cost compared with other biometric identification technologies.
  • the information to be verified further includes: user identity information; wherein the user identity information may be a bank card number, a serial number of the electronic key device 10, an explicit text of the ID card information, etc. may be used for unique
  • the information identifying the identity of the user the background server 30 is configured to find the identity card information matching the electronic key device in the obtained identity card information, and compare the plaintext information of the identity card with the identity card information matched by the electronic key device.
  • the ID information acquired by the background server 30 may be pre-stored in the background server 30, or may be obtained from other databases. Therefore, the background server can quickly find the ID card information matching the electronic key device, realize the identity verification by comparing the ID card information, ensure the security of the remote account opening, and improve the authentication efficiency.
  • the to-be-verified information further includes: user identity information, the user identity information may be an explicit text of the identity card information, and the background server 30 is configured to find the electronic key device in the acquired identity card information. Match the ID card information, compare the ID card information with the found ID card information matching the electronic key device, and if the comparison is consistent, the identity verification is completed.
  • the to-be-verified information further includes: user identity information, as an optional manner, the user identity information may be an identity card information ciphertext, and the background server 30 is configured to adopt an electronic secret.
  • the symmetric key negotiated by the key device 10 decrypts the ID card information and obtains the clear text of the ID card information, and uses the user identity information (such as an account number) as an index to find the ID card information acquired by the background server 30 and matched with the electronic key device.
  • the plaintext information of the ID card is compared with the found ID card information matching the electronic key device, and the matching is completed, and the identity verification is completed.
  • the background server 30 finds the identity card information that matches the electronic key device by at least one of the following manners:
  • the background server 30 finds the identity card information matching the electronic key device according to the serial number of the electronic key device.
  • the serial number of the electronic key device is a unique identifier assigned to the electronic key device during the production process of the electronic key device.
  • the serial number of the electronic key device is uniquely associated with the user ID information. .
  • the terminal 20 after acquiring the serial number of the electronic key device 10, the terminal 20 sends the serial number of the electronic key device 10 to the background server 30; the background server 30 receives the serial number of the electronic key device, and utilizes the electronic key device.
  • the serial number is used as an index to find the ID information that matches the electronic key device.
  • the background server 30 finds the identity card information matching the electronic key device according to the digital certificate sent by the electronic key device 10.
  • the digital certificate of the electronic key device is issued by a third-party authority certification authority (Certificate Authority (CA)), which can be used as the unique identifier of the electronic key device.
  • CA Certificate Authority
  • the digital certificate of the electronic key device is uniquely associated with the user ID information. .
  • the digital certificate when the electronic key device 10 sends the signature information to the background, the digital certificate will be sent to the background server together, and the terminal 20 sends the signature information together with the digital certificate of the electronic key device 10 to the background server 30; After receiving the digital certificate transmitted by the electronic key device 10, the background server 30 uses the digital certificate of the electronic key device 10 as an index to find the identity card information that matches the electronic key device 10.
  • the background server 30 can quickly find the ID card information matching the electronic key device, thereby completing the identity verification, and improving the efficiency of the system identity verification.
  • the user uses the electronic key device and the video data to jointly verify the identity of the user, and solves the problem of identity verification in the remote account opening.
  • Remotely open accounts through terminals such as PCs and smartphones.
  • This embodiment provides a remote account opening system.
  • the remote account opening system adopts the identity verification system in Embodiment 1.
  • the terminal 20 is further configured to send an account opening request to the background server 30, where the account opening request carries at least user identity information, and the user identity information may be a bank card number, The serial number of the electronic key device 10, the plaintext information of the ID card, and the like may be used to uniquely identify the identity of the user.
  • the user identity information has the same meaning as the user identity information in Embodiment 1, and the content included is the same; the background server 30, It is used to open an account that matches the user identity information according to the account opening request.
  • the terminal 20 is further configured to: after obtaining the information to be verified, send an account opening request to the background server 30, where the account opening request may carry the information to be verified in addition to the user identity information.
  • the information to be verified includes at least video data of the user reading the prompt information.
  • the user identity information may be carried in the account opening request, or may be carried in the account opening request and the to-be-verified information, and sent to the background server twice, which is not limited in this embodiment.
  • the background server is configured to verify the validity and legality of the user identity by using the identity verification system in Embodiment 1.
  • the background server terminates the account opening process, and if the verification passes, the background is The server opens an account that matches the user identity information according to the account opening request. After the account is opened, the background server is also used to send the account information to the terminal, and the user knows the newly opened account information through the terminal.
  • the terminal 20 is further configured to send an account opening request to the background server before acquiring the information to be verified, where the account opening request carries at least user identity information.
  • the terminal 20 sends an account opening request to the backend server 30, and the account opening request carries at least the user identity information, and the account opening request may further include the type of the account requested to be opened.
  • the terminal 20 is further configured to: after obtaining the to-be-verified information, send the to-be-verified information to the background server, where the remote account opening system uses the background server in the identity verification system in the first embodiment to verify the validity and legality of the user identity. The way.
  • the remote account opening system terminates the account opening process. If the verification is passed, the background server 30 opens an account matching the user identity information according to the account opening request. After the account opening is completed, the background server 30 can transmit the account information to the terminal 20, and the user can obtain the account information through the terminal 20.
  • the user can be remotely opened at any time while sitting at home or anywhere, and the security of remote account opening can be ensured.
  • This embodiment provides an identity verification method, and the identity verification method is applied to the identity verification system in Embodiment 1. System.
  • FIG. 2 is a flowchart of an identity verification method according to an embodiment, where the method mainly includes the following steps (S201-S203):
  • S201 The electronic key device acquires the prompt information, and prompts the prompt information to the user.
  • the device with a signature function issued by the bank to the user includes a device with a signature function of a KEY, a smart card or a KEY card, for example, ICBC U-Shield, Agricultural Bank of China K Bao, BOC e-order and other equipment.
  • the prompt information may be a number or a character string.
  • the electronic key device may obtain prompt information in different manners according to different working principles. After the electronic key device obtains the prompt information, the prompt information may be displayed to the user through the display screen of the electronic key device, or the prompt information may be played to the user through the voice broadcast.
  • the electronic key device may obtain the prompt information by using at least one of the following manners:
  • Method 1 The electronic key device acquires the prompt information sent by the background server.
  • the background server generates prompt information, and the prompt information may be a random number or a random string.
  • the background server sends the prompt information to the terminal, and the terminal forwards the prompt information to the electronic key device.
  • the background server may encrypt and/or sign the prompt information before sending the prompt information.
  • the electronic key device decrypts the ciphertext of the prompt information to obtain the plaintext of the prompt information.
  • the background server sends the signature of the prompt information
  • the electronic key device receives the signature verification, and obtains the plaintext of the prompt information after the verification is passed.
  • the electronic key device When the background server sends the ciphertext of the prompt information and the signature information of the plaintext of the prompt information, the electronic key device first decrypts the ciphertext of the prompt information to obtain the plaintext of the prompt information, and according to the plaintext of the prompt information obtained by the decryption, the plaintext of the prompt information The signature information is checked, and after the verification is passed, it is determined that the ciphertext of the received prompt information has not been tampered with, and the plaintext of the decrypted information is also true and valid.
  • the electronic key device When the background server sends the ciphertext of the prompt message and the signature information of the ciphertext of the prompt information, the electronic key device first checks the signature information of the ciphertext of the prompt information, and obtains the ciphertext of the prompt information after the verification is passed, and prompts the prompt The ciphertext of the information is decrypted to obtain the plaintext of the prompt information.
  • the electronic key device and the terminal can be connected by a wired connection (for example, a USB interface, a headphone interface, etc.), or can be connected by a wireless connection (for example, WIFI, Bluetooth, infrared, NFC, etc.).
  • the prompt information is obtained, and the electronic key device only needs to receive the prompt information, which simplifies the process of obtaining the prompt information by the electronic key device and reduces the cost of the electronic key device.
  • the electronic key device calculates the prompt information based on the data synchronized with the background server, and the electronic key device may be an OTP-enabled device such as the BOC e-order.
  • the electronic key device generates a dynamic using a built-in algorithm based on data synchronized with the background server.
  • the password is used as a prompt.
  • the data synchronized with the background server can be time, event, or a combination of time and events.
  • the electronic key device calculates the prompt information based on the time synchronized with the background server, the electronic key device can change the prompt information every other fixed time interval, for example, change the prompt information every 60 seconds.
  • the electronic key device may also change the prompt information once for each authentication operation.
  • the prompt information calculated in this way can only be used once, which ensures the security of the prompt information.
  • Manner 3 The electronic key device receives the to-be-calculated information sent by the background server, and calculates the prompt information.
  • the background server may generate a random string as the information to be calculated, and may also generate the to-be-calculated information according to the account information or other information of the user.
  • the background server may encrypt and/or sign the calculation information before transmitting the information to be calculated.
  • the electronic key device decrypts the ciphertext of the calculated information to obtain the plaintext of the information to be calculated.
  • the electronic key device receives the signature verification, and obtains the plaintext of the information to be calculated after the verification is passed.
  • the electronic key device first decrypts the ciphertext of the calculated information to obtain the plaintext of the information to be calculated, and calculates the plaintext according to the decrypted information to be calculated.
  • the signature information of the plaintext of the information is checked, and after the verification is passed, it is determined that the received ciphertext of the information to be calculated has not been tampered with, and the plaintext of the information to be calculated obtained by the decryption is also true and valid.
  • the electronic key device When the background server sends the ciphertext of the information to be calculated and the signature information of the ciphertext to be calculated, the electronic key device first checks the signature information of the ciphertext of the calculation information, and obtains the ciphertext of the information to be calculated after the verification is passed. The ciphertext to be processed is decrypted to obtain the plaintext of the information to be calculated. The electronic key device calculates the prompt information by using an algorithm built in the electronic key device according to the plaintext of the information to be calculated.
  • the background server sends the information to be calculated, even if the information to be calculated leaks, the prompt information will not be leaked, and the prompt information is secured.
  • Method 4 The electronic key device receives the information to be calculated input by the input device, and calculates the prompt information.
  • the background server may generate a random string as the information to be calculated, and may also generate the to-be-calculated information according to the account information or other information of the user, and send the to-be-calculated information to the terminal, for example, sending the message to the
  • the user reserves the phone number in the bank backend server.
  • the information to be calculated may be input through a button provided by the electronic key device; the information to be calculated may also be input through the input device of the terminal, and the terminal sends the information to be calculated to the electronic key device;
  • the other input devices connected to the electronic key device input the information to be calculated, and the other input devices transmit the information to be calculated to the electronic key device.
  • the electronic key device receives the information to be calculated input by the input device, and calculates the prompt information by using an algorithm built in the electronic key device.
  • the background server sends the information to be calculated, even if the information to be calculated leaks, the prompt information will not be leaked, and the prompt information is secured.
  • the electronic key device may also obtain identity card information (including plaintext or ciphertext), and send the identity card information to the background server through the terminal to complete the identity by using the identity card information. Verification, in the optional implementation, the electronic key device may obtain the identity card information by using at least one of the following manners:
  • Method 1 The electronic key device directly reads the identity card information.
  • the electronic key device has the function of an ID card reader, and the ID card is placed close to the electronic key device, and the electronic key device can read the plaintext information of the identity card of the identity document.
  • the electronic key device may also use the symmetric key negotiated with the background server to encrypt the clear text of the ID card information to generate the ID card information ciphertext or use the private key of the electronic key device to clear the ID card information. Signature is generated to generate signature information of the clear text of the ID card information.
  • the electronic key device When the electronic key device obtains the identity card information in this manner, the electronic key device can directly obtain the identity card information, and does not need to be transmitted to the electronic key device through other devices. Therefore, the identity card information does not need to be transmitted in the network, and the The security of identity information.
  • Method 2 The ID card reader reads the ID card information and sends it to the electronic key device.
  • the ID card is attached to the ID card reader, and the ID card reader can read the ID card information of the ID card and send it to the electronic key device.
  • the ID card information received by the electronic key device is the clear text of the ID card information.
  • the electronic key device may also use the symmetric key negotiated with the background server to encrypt the identity card information in plain text to generate the identity card information ciphertext or use the private key of the electronic key device 10 to clear the identity card information. Signature is generated to generate signature information of the clear text of the ID card information.
  • the electronic key device When the electronic key device acquires the identity card information in this manner, the electronic key device does not need to configure the card reader function, thereby reducing the cost of the electronic key device.
  • the electronic key device generates signature information and sends the signature information to the terminal, where the signature information includes one or more of the following: signature information of the clear text of the ID card information, signature information of the cipher text of the ID card information, Signature information of video data and signature information of single authentication data.
  • the electronic key device may sign the combination of one or more of the ID information plaintext, the ID card information ciphertext, the video data, and the single authentication data to obtain signature data.
  • the signature information may be signature data obtained by signing a single authentication data
  • the single authentication data may be sent by the server to the electronic key device 10, and may be a random number or a random event.
  • Single-authentication data can only be used once, thus preventing replay attacks.
  • the signature information may also be signature data obtained by signing the clear text of the ID card information and the single authentication data.
  • the background server After receiving the signature information, the background server first performs the verification, and then verifies the single authentication data after the verification is passed.
  • the clear text of the identity card information is used as an index for finding the verification identity information obtained by the background server, or the plaintext information of the identity card is directly compared with the plaintext information obtained by the background.
  • the signature information may also be signature data obtained by signing the video data and the single authentication data, where the video data may be sent to the electronic key device after the terminal is recorded, or may be recorded by the electronic key device itself. It may also be that the terminal other than the terminal and the electronic key device is transmitted to the electronic key device through the terminal after being recorded.
  • the signature information may also be signature data obtained by signing the ciphertext of the ID card information.
  • the background server After receiving the signature information of the ciphertext of the ID card information, the background server first performs the verification, and after the verification is passed, the electronic key device is utilized.
  • the negotiated symmetric key decrypts the ID card information and obtains the clear text of the ID card information, and uses the clear text of the ID card information as an index for finding the verification identity information obtained by the background server, or directly encrypts the ID card information and the pre-stored ID card.
  • the information is compared in plain text.
  • the signature information may be data obtained by signing a combination of various information, which is not limited in the embodiment of the present application. Therefore, the server side can verify the signature information, thereby ensuring whether the identity of the user holding the electronic key device is legal, thereby ensuring the security of remote account opening.
  • S202 The terminal acquires the to-be-verified information, and sends the information to the background server, where the information to be verified includes at least the video data that the user reads the prompt information.
  • the terminal in this embodiment may be a PC supporting a electronic key device, a PAD (tablet computer), a smart phone, or the like.
  • the electronic key device and the terminal can perform data transmission through a wired connection (for example, a USB interface, a headphone interface, etc.), or can perform data transmission through a wireless connection (for example, WIFI, Bluetooth, infrared, NFC, etc.).
  • the user after the electronic key device displays or broadcasts the prompt information to the user, the user records the process of reading the prompt information by the user into a video by using the camera, and the terminal acquires the video, encodes the video into video data, and at least The to-be-verified information containing the video data is sent to the background server.
  • the user reads the prompt information, including: the user reads the prompt information aloudly, or the user views the prompt information on the display screen of the electronic key device, and only needs to record the video that the user is reading the prompt information, and the embodiment does not do Specific restrictions.
  • the video data of the user reading the prompt information may be compressed.
  • the video of the user reading the prompt information may be encrypted, encrypted and sent to the background server.
  • the terminal may obtain a video that includes the user reading prompt information in at least one of the following manners:
  • Method 1 The terminal invokes the built-in camera to record the process of reading the prompt information by the user into a video.
  • the terminal calls the self-contained camera to record the process of reading the prompt information by the user into a video.
  • Existing terminals such as PCs, smart phones, and tablets, are equipped with cameras, and the use of the camera that comes with the terminal does not add extra cost.
  • Method 2 The electronic key device records a video containing the user reading prompt information, and sends the video to the terminal.
  • the electronic key device invokes a camera that is provided by the electronic key device, records the process of reading the prompt information by the user into a video, and sends the video to the terminal.
  • the video can be encrypted before the electronic key device sends the video. And signature to ensure video transmission security.
  • Method 3 The terminal other than the terminal and the electronic key device records a video containing the user's read prompt information, and sends the video to the terminal.
  • the terminal and the other terminal with the camera other than the electronic key device record the video, and after the recording is completed, the terminal sends the video to the terminal.
  • Other terminals and cameras with cameras can be connected by wired connection (such as USB interface, headphone interface, etc.), or by wireless connection (such as WIFI, Bluetooth, infrared, NFC, etc.).
  • the background server receives the to-be-verified information, where the to-be-verified information includes at least the video data that the user reads the prompt information, extracts the identity information to be verified in the video data, and the identity information to be verified that is to be extracted from the video data.
  • the verification identity information obtained by the background server is compared, and the comparison is completed to complete the identity verification.
  • the verification identity information obtained by the background server may be pre-stored in the background server, may be obtained from other databases, or may be temporarily generated (for example, an OTP password).
  • the background server after the background server receives the information to be verified, if the video data in the information to be verified is encrypted, the background server decrypts the video data first; if the video data in the information to be verified It is compressed. The background server decompresses the video data first, and then extracts the identity information to be verified from the decrypted or decompressed video, performs subsequent comparison, and completes the identity verification.
  • the information to be verified further includes signature information
  • the background server first performs verification on the signature information, and triggers the extraction of the video data after the verification is passed. The operation of the identity information to be verified.
  • the background server receives the information to be verified sent by the terminal, and includes the original information corresponding to the signature information in addition to the signature information.
  • the background server first checks the signature information in the verification information.
  • the background server generates a digest of the original information in the received signature information by using the same hash function as the electronic key device, and then decrypts the signature data in the signature information by using the public key of the electronic key device to obtain another digest, and compares the two. Whether the abstracts are the same. If the two digests are the same, the verification pass is passed, and after the verification is passed, the operation of extracting the identity information to be verified in the video data is triggered.
  • the authentication operation is terminated, that is, the authentication fails. Therefore, the electronic key device used in the remote account opening can be ensured as the electronic key device of the legitimate user, which is a double verification of the identity of the user.
  • the background server can also verify whether the signature information has been tampered with, to ensure the security of the signature information transmission, thereby ensuring the security of remote account opening.
  • the signature information is information obtained by signing one or more of the following: an ID card information plaintext, an ID card information ciphertext, video data, and a single authentication data.
  • the signature information may be signature data obtained by signing a combination of one or more of the ID information plaintext, the ID card information ciphertext, the video data, and the single authentication data.
  • the signature information may be signature data obtained by signing a single authentication data
  • the single authentication data may be a random number or a random event. Single-authentication data can only be used once, thus preventing replay attacks.
  • the background server After receiving the signature information, the background server first performs the verification check, and then verifies the single authentication data after the verification is passed, and compares whether the received single authentication data is consistent with the single authentication data in the background server, and if not, the identity is terminated. Verify the operation. Signature data obtained by signing a single authentication data can prevent replay attacks.
  • the signature information may also be signature data obtained by signing the ID information plaintext and the single authentication data.
  • the signature information may also be signature data obtained by signing the video data and the single authentication data, where the video data may be sent to the electronic key device after the terminal is recorded, or may be the camera of the electronic key device itself.
  • the recorded terminal may also be sent to the electronic key device through the terminal after being recorded by a terminal other than the terminal and the electronic key device.
  • the signature information may be data obtained by signing a combination of various information, which is not limited in the embodiment of the present application.
  • the identity information to be verified includes: user information to be verified and/or prompt information, where the user information to be verified is information extracted from the video data that can reflect the characteristics of the user, and is verified.
  • the identity information includes: verifying the user information and/or verifying the prompt information; the background server compares the to-be-checked identity information extracted from the video data with the verification identity information obtained by the background server, including: the background server will be the video
  • the user information to be verified extracted in the data is compared with the verification user information obtained by the background server; and/or, the prompt information extracted from the video data is compared with the verification prompt information acquired by the background server.
  • the verification user information obtained by the background server may be pre-stored in the background server, or may be obtained from other databases; the verification prompt information obtained by the background server may be pre-stored in the background server, or It is obtained from other databases, or it can be temporarily generated (for example, OTP password).
  • the background server compares the identity information to be verified with the corresponding verification identity information obtained by the background server, and the comparison is consistent. If the verification is inconsistent, the authentication will not pass. If the identity information to be verified includes multiple identity information to be verified, for example, including prompt information and multiple user information to be verified, the background server needs to separately identify multiple identity information to be verified in the identity information to be verified. Compared with the corresponding verification identity information obtained by the background server, only all the identity information to be verified is consistent, and the background server passes the identity verification. As long as one of the to-be-checked identity information is inconsistent, the background is The server's authentication failed.
  • the background server can send an authentication success message to the terminal; after the authentication fails, the background server can send an authentication failure message to the terminal. Therefore, the validity of the identity of the user who opens the account remotely can be ensured, and the background server can complete the remote account opening for the user.
  • the identity verification method can flexibly select the type and number of identity information to be checked that need to be compared according to needs. Head.
  • the user information to be verified includes the photo of the user to be verified and/or the voiceprint information of the user to be verified, and the photo of the user to be verified may be multiple, and the photo of the user to be verified is
  • the voiceprint information of the user to be verified extracted from the video data is extracted from the video data; verifying the user information includes verifying the user's photo and/or verifying the user's voiceprint information, and verifying that the user's photo may be the user
  • the photo of the bank is reserved when the account is opened, and the user's voiceprint information can be reserved at the bank when the user opens the account; the back-end server will extract the user information to be verified from the video data and the verification user obtained by the background server.
  • the information is compared, and the background server compares the photo of the user to be verified extracted from the video data with the photo of the verification user obtained by the background server; and/or, the background server is to be verified from the video data to be verified.
  • the user voiceprint information is compared with the verified user voiceprint information obtained by the background server.
  • the verification user photo and/or the verification user voiceprint information obtained by the background server may be pre-stored in the background server, or may be acquired from other databases.
  • the background server extracts the photo of the user to be verified from the video data, and the background worker can manually compare the photo of the user to be verified extracted from the video and the verified user photo obtained in the background server.
  • the background server may also use the face recognition technology to compare the photos of the users to be verified. Specifically, first, the background server restores the received video data to a video and sends it to the face recognition system.
  • the face recognition system collects the face image in the video and uses face detection to accurately calibrate the position and size of the face in the image.
  • the face image is preprocessed (for example, ray compensation, gradation transformation, histogram equalization, normalization, geometric correction, filtering, sharpening, etc.) of the face image.
  • facial image features are extracted.
  • the extractable features include visual features, pixel statistical features, face image transform coefficient features, face image algebra features, and the like.
  • the feature data of the extracted face image is searched and matched with the face feature template of the verified user photo stored in the database.
  • the face recognition system determines the photo of the user to be verified and Verify that the user's photo match is the same.
  • the face recognition technology has the flexibility to discriminate, and others cannot deceive the face recognition system with inactive photos, puppets, etc., and the recognition accuracy is high. Face recognition technology improves the accuracy and security of the authentication method and saves labor costs.
  • the background server may use the voiceprint recognition system to collect the user voiceprint information to be verified in the video by recording the video of the user's reading prompt information. Specifically, first, the background server extracts the user's voice from the video, and preprocesses the voice (eg, removes background noise). Secondly, the acoustic characteristics are extracted from the pre-processed speech, and the user's voiceprint is modeled to obtain the user's voiceprint model to be verified. Finally, the background server matches the voiceprint model of the user to be verified with the voiceprint information obtained by the background server, and determines whether the result is consistent and outputs the result.
  • the background server matches the voiceprint model of the user to be verified with the voiceprint information obtained by the background server, and determines whether the result is consistent and outputs the result.
  • Voiceprint is a kind of user's biological characteristics. Because of the physiological difference of each person, the voiceprint of any two people is different, so the voiceprint is unique, and the security of using voiceprint information for authentication is high. Second, for every adult, Voiceprints do not change with age, so there is no need to repeat collections, saving costs. In addition, voiceprint recognition technology has the advantages of convenient acquisition and low cost compared with other biometric identification technologies.
  • the to-be-verified information further includes: user identity information, where the user identity information may be a bank card number, a serial number of the electronic key device, an explicit text of the ID card information, or the like, which may be used for unique identification.
  • user identity information may be a bank card number, a serial number of the electronic key device, an explicit text of the ID card information, or the like, which may be used for unique identification.
  • the background server finds the identity card information matching the electronic key device in the obtained identity card information, and performs the identity card information matching the clear text information of the identity card with the electronic key device. If the comparison is the same, the electronic key device and the ID card are held by the same user and the identity verification is completed. If the comparison is inconsistent, the electronic key device and the ID card are not held by the same user. The card may have been stolen. At this time, the identity verification is terminated.
  • the ID information obtained by the background server may be pre-stored in the background server, or may be obtained from other databases. Therefore, the background server can quickly find the ID card information matching the electronic key device, realize the identity verification by comparing the ID card information, ensure the security of the remote account opening, and improve the authentication efficiency.
  • the to-be-verified information further includes: user identity information, as an optional manner, the user identity information may be an explicit text of the identity card information, and the background server finds and obtains in the obtained identity card information.
  • the ID card information matched by the electronic key device compares the ID card information with the found ID card information matching the electronic key device, and if the comparison is consistent, the identity verification is completed.
  • the to-be-verified information further includes: user identity information.
  • the user identity information may be an identity card information ciphertext
  • the background server adopts an agreement with the electronic key device 10.
  • the symmetric key decrypts the ID card information and obtains the clear text of the ID card information, and uses the user identity information (such as an account number) as an index to find the ID card information obtained by the background server 30 and matches the electronic key device, and the ID card information is obtained.
  • the plaintext is compared with the found ID card information matched with the electronic key device, and the comparison is completed, and the identity verification is completed.
  • the background server finds the identity card information that matches the electronic key device by using at least one of the following manners:
  • Method 1 The background server finds the identity card information that matches the electronic key device according to the serial number of the electronic key device.
  • the serial number of the electronic key device is a unique identifier assigned to the electronic key device during the production process of the electronic key device.
  • the serial number of the electronic key device is uniquely associated with the user ID information. .
  • the terminal after acquiring the serial number of the electronic key device, the terminal sends the serial number of the electronic key device to the background server; the background server receives the serial number of the electronic key device, and uses the serial number of the electronic key device as an index. , find the ID card information that matches the electronic key device.
  • Manner 2 The background server finds the identity card information that matches the electronic key device according to the digital certificate sent by the electronic key device.
  • the digital certificate of the electronic key device is issued by a third-party authority certification authority (Certificate Authority (CA)), which can be used as the unique identifier of the electronic key device.
  • CA Certificate Authority
  • the digital certificate of the electronic key device is uniquely associated with the user ID information. .
  • the digital certificate is sent to the background server together, and the terminal sends the signature information together with the digital certificate of the electronic key device to the background server; the background server receives the electronic After the digital certificate sent by the key device, the digital certificate of the electronic key device is used as an index to find the identity card information that matches the electronic key device.
  • the background server can quickly find the identity card information matching the electronic key device, thereby completing the identity verification, and improving the efficiency of the system identity verification.
  • the electronic key device and the video data are used to jointly verify the identity of the user under the premise that the user has the electronic key device, and the problem of identity verification in the remote account opening is solved, and the user passes the PC at home.
  • Terminals such as smart phones can be opened remotely.
  • This embodiment provides a remote account opening method, and the remote account opening method adopts the identity verification method in Embodiment 3.
  • the difference between this embodiment and the third embodiment is that, in this embodiment, before the background server receives the information to be verified, the terminal sends an account opening request to the background server; the account opening request carries at least user identity information, and the user identity information may be The bank card number, the serial number of the electronic key device 10, the plaintext information of the ID card, and the like may be used to uniquely identify the identity of the user.
  • the user identity information has the same meaning as the user identity information in Embodiment 3, and the content included is the same; After the background server completes the authentication, the background server opens an account matching the user identity information according to the account opening request.
  • FIG. 3 is a flowchart of an optional remote account opening method according to the embodiment, where the method mainly includes the following steps:
  • S301 The electronic key device acquires the prompt information, and prompts the prompt information to the user;
  • S302 The terminal acquires the information to be verified, and sends an account opening request carrying the information to be verified to the background server.
  • the account opening request carries the user identity information, such as the bank card number, the serial number of the electronic key device 10, the clear text of the ID card information, and the like, which can be used to uniquely identify the identity of the user.
  • the user identity information such as the bank card number, the serial number of the electronic key device 10, the clear text of the ID card information, and the like, which can be used to uniquely identify the identity of the user.
  • the background server receives the account opening request carrying the information to be verified, and extracts the to-be-checked identity information in the video data, and compares the to-be-checked identity information extracted from the video data with the verification identity information obtained by the background server, Consistent, complete authentication;
  • the terminal may further send the to-be-verified information and the account opening request to the background server after acquiring the to-be-verified information, and in step S303, the background server extracts the video data after receiving the to-be-verified information.
  • the identity information to be verified after receiving the account opening request, enters the verification process, and the identity to be verified extracted from the video
  • the information is compared with the verification identity information obtained by the background server, and the comparison is completed to complete the identity verification.
  • the verification identity information obtained by the background server may be pre-stored in the background server, may be obtained from other databases, or may be temporarily generated.
  • S304 The background server opens an account that matches the user identity information according to the account opening request.
  • the remote account opening method provided in this embodiment is different from the third embodiment in that, after the terminal obtains the information to be verified, the information to be verified and the account opening request may be sent to the background server, and the background.
  • the server receives the information to be verified and the account opening request, and may also send the account opening request carrying the information to be verified to the background server, the background server receives the account opening request carrying the information to be verified, and the remote account opening method applies the identity verification method in the third embodiment to the user identity. Validity and legitimacy are verified. If the user authentication fails, the remote account opening system terminates the account opening process (ie, stops executing step S304).
  • step S304 is performed, that is, the background server opens an account that matches the user identity information according to the account opening request. After the account is opened, the background server can send the account information to the terminal, and the user can obtain the newly opened account information through the terminal.
  • FIG. 4 is a flowchart of another optional remote account opening method according to the embodiment, where the method mainly includes the following steps:
  • the terminal sends an account opening request to the background server, where the account opening request carries at least user identity information.
  • the terminal when the user needs to open an account remotely, the terminal sends an account opening request to the background server through the terminal, and the account opening request carries at least the user identity information, such as the bank card number, the serial number of the electronic key device 10, and the clear text of the ID card information, etc.
  • the account opening request may also include the type of account requested to be opened, and the like.
  • the electronic key device acquires the prompt information, and prompts the prompt information to the user;
  • the prompt information may also be an account opening sent by the background server after receiving the terminal. After the request, the prompt information carried in the account opening request returned.
  • S403 The terminal acquires the to-be-verified information, and sends the to-be-verified information to the background server.
  • the background server receives the information to be verified, and extracts the identity information to be verified in the video data, and compares the identity information to be verified extracted from the video data with the verification identity information obtained by the background server, and the comparison is consistent. Authentication;
  • S405 The background server opens an account that matches the user identity information according to the account opening request.
  • the remote account opening method applies the identity verification method in Embodiment 3 to verify the validity and legality of the user identity. If the user authentication fails, the remote account opening system terminates the account opening process (ie, stops executing step S405). If the verification is passed, step S405 is performed, that is, the background server opens an account that matches the user identity information according to the account opening request. After the account is opened, the background server can send the account information to the terminal, and the user can obtain the newly opened account information through the terminal.
  • the user can be remotely opened at any time while sitting at home or anywhere, and the security of remote account opening can be ensured.
  • portions of the application can be implemented in hardware, software, firmware, or a combination thereof.
  • multiple steps or methods may be implemented in software or firmware stored in a memory and executed by a suitable instruction execution system.
  • a suitable instruction execution system For example, if implemented in hardware, as in another embodiment, it can be implemented by any one or combination of the following techniques well known in the art: having logic gates for implementing logic functions on data signals. Discrete logic circuits, application specific integrated circuits with suitable combinational logic gates, programmable gate arrays (PGAs), field programmable gate arrays (FPGAs), etc.
  • each functional unit in each embodiment of the present application may be integrated into one processing module, or each unit may exist physically separately, or two or more units may be integrated into one module.
  • the above integrated modules can be implemented in the form of hardware or in the form of software functional modules.
  • the integrated modules, if implemented in the form of software functional modules and sold or used as stand-alone products, may also be stored in a computer readable storage medium.
  • the above mentioned storage medium may be a read only memory, a magnetic disk or an optical disk or the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • Biomedical Technology (AREA)
  • General Health & Medical Sciences (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本申请提供了一种远程开户方法和系统及其身份验证方法和系统，其中，身份验证方法包括：电子密钥设备获取提示信息，向用户提示提示信息；终端获取待验证信息，并发送至后台服务器，待验证信息至少包含用户读取提示信息的视频数据；后台服务器接收待验证信息，提取视频数据中的待校验身份信息，将从视频数据中提取的待校验身份信息与后台服务器获取的校验身份信息进行比对，比对一致，则完成身份验证。远程开户方法包括：在完成身份验证后，利用用户个人信息为用户开设账户，由此可以实现用户坐在家里或身处任何地方都能随时远程开户，并且保证远程开户的安全性。

Description

远程开户方法和系统及其身份验证方法和系统
相关申请的交叉引用
本申请基于申请号为201510564019.3、申请日为2015/9/7的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本申请作为参考。
技术领域
本申请涉及一种电子技术领域，尤其涉及一种远程开户方法和系统及其身份验证方法和系统。
背景技术
传统开户方式中，为了防止不法分子假冒他人的身份证件开户，需要银行柜台人员人工比对用户本人与其持有的身份证件是否一致，只有判断一致才能准予开户。因此，用户只能在银行网点办理需要验证身份的业务，在业务繁忙时，需要等候的时间较长，给银行用户造成了极大的不便。
为解决上述问题，越来越多的银行尝试开放远程开户。在现有的远程开户方法中，用户首先通过远程视频柜员机(Video Teller Machine，简称VTM)发起开户请求，后台服务器提示用户上传身份证件信息，验证身份证件合法后，后台服务器与银行客户端建立视频连接，通过摄像头实时捕捉用户脸部照片，然后与身份证联网核查照片进行比对，判断是否为用户本人。这种远程开户方法虽然能够减少用户等候时间，但是用户仍然需要前往银行网点，并没有真正意义上实现用户坐在家里或身处任何地方就能随时远程开户，所以，虽然这种远程开户减少了用户等候时间，但并没有给用户带来极大的便利。
发明内容
本申请旨在解决至少上述问题之一，实现用户坐在家里或身处任何地方都能随时远程开户，并且保证远程开户的安全性。
本申请的主要目的在于提供一种身份验证方法。
本申请的另一目的在于提供一种远程开户方法。
本申请的另一目的在于提供一种身份验证系统。
本申请的又一目的在于提供一种远程开户系统。为达到上述目的，本申请的技术方案具体是这样实现的：
本申请一方面提供了一种身份验证方法，其特征在于，方法包括：电子密钥设备获取提示信息，向用户提示所述提示信息；终端获取待验证信息，并发送至后台服务器，待验证信息至少包含签名信息和用户读取提示信息的视频数据；后台服务器接收待验证信息，对待验证信息中的签名信息进行验签，验签通过后，提取视频数据中的待校验身份信息，将从所述视频数据中提取的待校验身份信息与后台服务器获取的校验身份信息进行比对，比对一致，则完成身份验证。
在本申请的至少一个实施例中，电子密钥设备获取提示信息，包括以下方式至少之一：电子密钥设备获取由后台服务器发送的所述提示信息；电子密钥设备基于与后台服务器同步的数据计算得到提示信息；电子密钥设备接收后台服务器发送的待计算信息，计算得到提示信息；电子密钥设备接收输入设备输入的待计算信息，计算得到提示信息。
在本申请的至少一个实施例中，终端获取包含用户读取所述提示信息的视频数据，包括以下方式至少之一：终端录制包含用户读取提示信息的视频；电子密钥设备录制包含用户读取提示信息的视频，并发送至终端；除终端和电子密钥设备之外的其他终端录制包含用户读取提示信息的视频，并发送至终端。
在本申请的至少一个实施例中，签名信息为通过对一个或多个进行签名获得的信息：身份证信息明文、身份证信息密文、视频数据和单次认证数据。
在本申请的至少一个实施例中，待校验身份信息包括待校验用户信息和/或所述提示信息，校验身份信息包括校验用户信息和/或校验提示信息；将从所述视频数据中提取的待校验身份信息与后台服务器获取的校验身份信息进行比对，包括：将从视频数据中提取的待校验用户信息与后台服务器获取的校验用户信息进行比对；和/或，将从视频数据中提取的提示信息与后台服务器获取的校验提示信息进行比对。
在本申请的至少一个实施例中，待校验用户信息包括：待校验用户照片和/或待校验用户声纹信息，校验用户信息包括：校验用户照片和/或校验用户声纹信息；将从所述视频数据中提取的待校验用户信息与后台服务器获取的校验用户信息进行比对，包括：将从视频数据中提取的待校验用户照片与后台服务器获取的校验用户照片进行比对；和/或，将从视频数据中提取的待校验用户声纹信息与后台服务器获取的校验用户声纹信息进行比对。
在本申请的至少一个实施例中，待验证信息还包括：用户身份信息；将从视频数据中提取的待校验身份信息与后台服务器数据库获取的校验身份信息进行比对，包括：后台服务器在获取的校验身份信息中找到与用户身份信息对应的校验身份信息，将从视频数据中提取的待校验身份信息与用户身份信息对应的校验身份信息进行比对。
在本申请的至少一个实施例中，待验证信息还包括：用户身份信息，用户身份信息至 少包括身份证信息明文；在后台服务器接收所述待验证信息后，在将从视频数据中提取的待校验身份信息与后台服务器获取的校验身份信息进行比对时，方法还包括：后台服务器获取预先存储的身份信证信息，并在获取的身份证信息中找到与电子密钥设备匹配的身份证信息，将身份证信息明文与电子密钥设备匹配的身份证信息进行比对，在待校验身份信息与校验身份信息比对一致以及身份证信息明文与电子密钥设备匹配的身份证信息比对一致的情况下，完成身份验证。
在本申请的至少一个实施例中，找到与电子密钥设备匹配的身份证信息包括以下方式至少之一：根据电子密钥设备的序列号找到与电子密钥设备匹配的身份证信息；根据电子密钥设备发送的数字证书找到与电子密钥设备匹配的身份证信息。
本申请另一方面提供了一种采用上述身份验证方法的远程开户方法，其特征在于，在后台服务器接收待验证信息之前，方法还包括：终端向后台服务器发送开户请求；开户请求中至少携带有用户身份信息；在后台服务器完成身份验证之后，方法还包括：后台服务器根据开户请求开设与用户身份信息匹配的账户。
本申请另一方面提供了一种身份验证系统，包括：电子密钥设备、终端以及后台服务器；电子密钥设备，用于获取提示信息，向用户提示提示信息；终端，用于获取待验证信息，并发送至后台服务器，待验证信息至少包含签名信息和用户读取提示信息的视频数据；后台服务器，用于接收待验证信息，对待验证信息中的签名信息进行验签，验签通过后，提取视频数据中的待校验身份信息，将从视频数据中提取的待校验身份信息与后台服务器获取的校验身份信息进行比对，比对一致后完成身份验证。
在本申请的至少一个实施例中，电子密钥设备通过以下方式至少之一获取提示信息：电子密钥设备获取由后台服务器发送的提示信息；电子密钥设备基于与后台服务器同步的数据计算得到提示信息；电子密钥设备接收后台服务器发送的待计算信息，计算得到提示信息；电子密钥设备接收输入设备输入的待计算信息，计算得到提示信息。
在本申请的至少一个实施例中，终端通过以下方式至少之一获取包含用户读取提示信息的视频数据：终端录制包含用户读取提示信息的视频；电子密钥设备录制包含用户读取提示信息的视频，并发送至终端；除终端和电子密钥设备之外的其他终端录制包含用户读取提示信息的视频，并发送至终端。
在本申请的至少一个实施例中，签名信息为通过对以下一个或多个进行签名获得的信息：身份证信息明文、身份证信息密文、视频数据和单次认证数据。
在本申请的至少一个实施例中，待校验身份信息包括：待校验用户信息和/或所述提示信息，校验身份信息包括：校验用户信息和/或校验提示信息；后台服务器，用于将从视频 数据中提取的待校验用户信息与后台服务器获取的校验身份信息进行比对，包括：后台服务器将从视频数据中提取的待校验用户信息与后台服务器获取的校验用户信息进行比对；和/或，后台服务器将从视频数据中提取的提示信息与后台服务器获取的校验提示信息进行比对。
在本申请的至少一个实施例中，待校验用户信息包括：待校验用户照片和/或待校验用户声纹信息，校验用户信息包括：校验用户照片和/或校验用户声纹信息；后台服务器，用于将从视频数据中提取的待校验用户信息与后台服务器获取的校验用户信息进行比对，包括：后台服务器将从视频数据中提取的待校验用户照片与后台服务器获取的校验用户照片进行比对；和/或，后台服务器将从视频数据中提取的待校验用户声纹信息与后台服务器获取的校验用户声纹信息进行比对。
在本申请的至少一个实施例中，待验证信息还包括：用户身份信息；后台服务器，用于将从视频数据中提取的待校验身份信息与后台服务器获取的校验身份信息进行比对，包括：后台服务器，用于在获取的校验身份信息中找到与用户身份信息对应的校验身份信息，将从视频数据中提取的待校验身份信息与用户身份信息对应的校验身份信息进行比对。
在本申请的至少一个实施例中，待验证信息还包括：用户身份信息，用户身份信息至少包括身份证信息明文；后台服务器，还用于在接收待验证信息后，在将从视频数据中提取的待校验身份信息与后台服务器获取的校验身份信息进行比对时，获取预先存储的身份信证信息，并在获取的身份证信息中找到与电子密钥设备匹配的身份证信息，将身份证信息明文与找到的与电子密钥设备匹配的身份证信息进行比对，在待校验身份信息与校验身份信息比对一致以及身份证信息明文与电子密钥设备匹配的身份证信息比对一致的情况下，完成身份验证。
在本申请的至少一个实施例中，后台服务器通过以下方式至少之一找到与电子密钥设备匹配的身份证信息：根据电子密钥设备的序列号找到与电子密钥设备匹配的身份证信息；根据电子密钥设备发送的证书找到与电子密钥设备匹配的身份证信息；根据电子密钥设备发送的签名信息找到与电子密钥设备匹配的身份证信息。
本申请又一方面提供了一种应用上述身份验证系统的远程开户系统，其特征在于，终端，还用于向后台服务器发送开户请求；开户请求中至少携带有用户身份信息；后台服务器，还用于在完成身份验证之后，根据开户请求开设与用户身份信息匹配的账户。
由上述本申请提供的技术方案可以看出，本申请提供了一种远程开户方法和系统及其身份验证方法和系统，利用电子密钥设备提示提示信息，后台服务器通过远程终端录制用户读取提示信息的视频数据，实现对用户身份的多重校验，保证了远程开户中用户身份的 合法性，进而在验证通过后根据接收的开户请求为该用户远程开户，实现了随时随地远程开户，大大提高了远程开户的用户体验。
附图说明
为了更清楚地说明本申请实施例的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域的普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他附图。
图1为本申请实施例1提供的身份验证系统的结构示意图；
图2为本申请实施例3提供的一种身份验证方法的流程图；
图3为本申请实施例4提供的一种远程开户方法的流程图；
图4为本申请实施例4提供的另一种远程开户方法的流程图。
具体实施方式
下面结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请的保护范围。
在本申请的描述中，需要理解的是，术语“中心”、“纵向”、“横向”、“上”、“下”、“前”、“后”、“左”、“右”、“竖直”、“水平”、“顶”、“底”、“内”、“外”等指示的方位或位置关系为基于附图所示的方位或位置关系，仅是为了便于描述本申请和简化描述，而不是指示或暗示所指的装置或元件必须具有特定的方位、以特定的方位构造和操作，因此不能理解为对本申请的限制。此外，术语“第一”、“第二”仅用于描述目的，而不能理解为指示或暗示相对重要性或数量或位置。
在本申请的描述中，需要说明的是，除非另有明确的规定和限定，术语“安装”、“相连”、“连接”应做广义理解，例如，可以是固定连接，也可以是可拆卸连接，或一体地连接；可以是机械连接，也可以是电连接；可以是直接相连，也可以通过中间媒介间接相连，可以是两个元件内部的连通。对于本领域的普通技术人员而言，可以具体情况理解上述术语在本申请中的具体含义。
下面将结合附图对本申请实施例作进一步地详细描述。
实施例1
本实施例提供了一种身份验证系统，如图1所示，该系统包括：电子密钥设备10、终端20以及后台服务器30。
在本实施例中，各个设备的工作原理描述如下。
电子密钥设备10，用于获取提示信息，向用户提示提示信息；终端20，用于获取待验证信息，并发送至后台服务器30，其中，待验证信息至少包含用户读取提示信息的视频；后台服务器30，用于接收待验证信息，提取视频中的待校验身份信息，将从视频中提取的待校验身份信息与后台服务器30获取的校验身份信息进行比对，比对一致后完成身份验证。通过本实施例提供的身份验证系统，能够实现用户坐在家里或身处任何地方都能随时远程开户，并且保证远程开户的安全性。
在本实施例中，电子密钥设备10可以为具有签名功能的设备，包括具有签名功能的KEY、智能卡或者KEY卡合一的设备，例如，工行U盾、农行K宝、中银e令等设备。在本实施例中，提示信息可以是数字、也可以是字符串，电子密钥设备10获取提示信息后，可以通过电子密钥设备10的显示屏向用户显示提示信息，也可以通过语音播报向用户播放提示信息。
作为本申请实施例的一个可选实施方式，电子密钥设备10可以通过以下方式至少之一获取提示信息：
方式一、电子密钥设备10，用于获取后台服务器30发送的提示信息。
在具体实施时，后台服务器30生成提示信息，提示信息可以为一个随机数字或者随机字符串。后台服务器30将提示信息发送至终端20，终端20接收提示信息后转发至电子密钥设备10。为了保证后台服务器30向电子密钥设备10发送的提示信息不被篡改，后台服务器30在发送提示信息之前可以对提示信息进行加密和/或签名。后台服务器30发送提示信息的密文时，则电子密钥设备10对提示信息的密文解密得到提示信息的明文。后台服务器30发送提示信息的签名时，电子密钥设备10接收先对签名进行验签，验签通过后得到提示信息的明文。后台服务器30发送提示信息的密文和提示信息的明文的签名信息时，电子密钥设备10先对提示信息的密文解密得到提示信息的明文，根据解密得到的提示信息的明文对提示信息的明文的签名信息进行验签，验签通过后确定接收的提示信息的密文没有被篡改，则解密得到的提示信息的明文也是真实有效的。。后台服务器30发送提示信息的密文和提示信息的密文的签名信息时，电子密钥设备10先对提示信息的密文的签名信息进行验签，验签通过后获取提示信息的密文，对提示信息的密文解密得到提示信息的明文。电子密钥设备10与终端20之间可以通过有线连接(例如USB接口、耳机接口等)进行连接，也可以通过无线连接(例如WIFI、蓝牙、红外、NFC等)进行连接。
采用这种方式获取提示信息，电子密钥设备只需接收提示信息，简化了电子密钥设备获取提示信息的过程，降低电子密钥设备的成本。
方式二、电子密钥设备10基于与后台服务器30同步的数据计算得到提示信息，该电子密钥设备10可以是中银e令等具有OTP功能的设备。
在具体实施时，电子密钥设备10基于与后台服务器30同步的数据，利用内置的算法生成动态口令作为提示信息。与后台服务器30同步的数据可以是时间、也可以是事件、也可以是时间和事件的结合。电子密钥设备10基于与后台服务器30同步的时间计算提示信息时，电子密钥设备10可以每隔一个固定时间间隔变换一次提示信息，例如每隔60秒变换一次提示信息。电子密钥设备10基于与后台服务器30同步的事件计算提示信息时，电子密钥设备10也可以每进行一次身份验证操作变换一次提示信息。
采用这种方式计算得到的提示信息只能使用一次，保证了提示信息的安全。
方式三、电子密钥设备10，用于接收后台服务器30发送的待计算信息，计算得到提示信息。
在具体实施时，后台服务器30可以产生一个随机字符串作为待计算信息，也可以根据用户的账户信息或其他信息计算产生待计算信息。另外，为了保证后台服务器30向电子密钥设备10发送的待计算信息不被篡改，后台服务器30在发送待计算信息之前可以对待计算信息进行加密和/或签名。后台服务器30发送待计算信息的密文时，则电子密钥设备10对待计算信息的密文解密得到待计算信息的明文。后台服务器30发送待计算信息的签名时，电子密钥设备10接收先对签名进行验签，验签通过后得到待计算信息的明文。后台服务器30发送待计算信息的密文和待计算信息的明文的签名信息时，电子密钥设备10先对待计算信息的密文解密得到待计算信息的明文，根据解密得到的待计算信息的明文对待计算信息的明文的签名信息进行验签，验签通过后确定接收的待计算信息的密文没有被篡改，则解密得到的待计算信息的明文也是真实有效的。后台服务器30发送待计算信息的密文和待计算信息的密文的签名信息时，电子密钥设备10先对待计算信息的密文的签名信息进行验签，验签通过后获取待计算信息的密文，对待计算信息的密文解密得到待计算信息的明文。电子密钥设备10根据待计算信息的明文，使用内置于电子密钥设备10中的算法，计算得到提示信息。采用这种方式计算提示信息时，后台服务器发送的是待计算信息，即使待计算信息泄露也不会导致提示信息泄露，保证提示信息的安全。
方式四、电子密钥设备10，用于接收输入设备输入的待计算信息，计算得到提示信息。
在具体实施时，后台服务器30可以产生一个随机字符串作为待计算信息，也可以根据用户的账户信息或其他信息计算产生待计算信息，并将待计算信息发送至终端，例如，以短信形式发送至用户预留在银行后台服务器30中的手机号。用户接收待计算信息后，可以 通过电子密钥设备10自带的按键输入待计算信息；也可以通过终端20的输入设备输入待计算信息，终端20将待计算信息发送至电子密钥设备10；还可以通过与电子密钥设备10连接的其他输入设备输入待计算信息，其他输入设备将待计算信息发送至电子密钥设备10。电子密钥设备10接收输入设备输入的待计算信息，使用内置于电子密钥设备10中的算法，计算得到提示信息。
采用这种方式计算提示信息时，后台服务器发送的是待计算信息，即使待计算信息泄露也不会导致提示信息泄露，保证提示信息的安全。
作为本申请实施例的一个可选实施方式，电子密钥设备10，还用于获取身份证信息(包括明文或密文)，并通过终端10将身份证信息发送至后台服务器30，以利用身份证信息完成身份验证，在该可选实施方式中，电子密钥设备10可以通过以下方式至少之一获取身份证信息：
方式一、电子密钥设备10直接读取身份证信息。
在具体实施时，电子密钥设备10具有身份证读卡器功能，将身份证贴近电子密钥设备10，电子密钥设备10可以读取身份证件的身份证信息的明文。为了进一步保证数据传输的安全，电子密钥设备10还可以采用与后台服务器30协商的对称密钥对身份证信息明文加密生成身份证信息密文或采用电子密钥设备10的私钥对身份证信息明文进行签名生成身份证信息明文的签名信息。
电子密钥设备采用这种方式获取身份证信息时，电子密钥设备10可以直接获取身份证信息，不需要通过其他设备传递给电子密钥设备10，因此，身份证信息不需要在网络中传输，保证身份信息的安全。
方式二、身份证读卡器读取身份证信息，并发送至电子密钥设备10。
在具体实施时，将身份证贴近身份证读卡器，身份证读卡器可以读取身份证件的身份证信息，并发送至电子密钥设备10。其中，电子密钥设备10接收到的身份证信息为身份证信息明文。当然，在身份证读卡器读取到身份证信息的明文后，也可以不通过终端20而是直接发送给电子密钥设备10。为了进一步保证数据传输的安全，电子密钥设备10还可以采用与后台服务器30协商的对称密钥对身份证信息明文加密生成身份证信息密文或采用电子密钥设备10的私钥对身份证信息明文进行签名生成身份证信息明文的签名信息。
电子密钥设备采用这种方式获取身份证信息时，电子密钥设备不需要配置读卡器功能，降低电子密钥设备的成本。
作为本申请实施例的一个可选实施方式，电子密钥设备10，还用于生成签名信息并发送至终端20，签名信息包括以下一个或多个：身份证信息明文的签名信息、身份证信息密文的签名信息、视频数据的签名信息和单次认证数据的签名信息。
在具体实施时，电子密钥设备10可以对身份证信息明文、身份证信息密文、视频数据和单次认证数据中的一个或多个的组合进行签名得到签名数据。例如，签名信息可以为对单次认证数据进行签名得到的签名数据，单次认证数据可以是由服务器发送至电子密钥设备10的，可以为随机数字，也可以是随机事件。单次认证数据只能使用一次，因此可以防止重放攻击。又例如，签名信息还可以是对身份证信息明文和单次认证数据进行签名得到的签名数据，后台服务器30接收该签名信息后，首先进行验签，验签通过后再验证单次认证数据，单次认证数据验证通过后再使用身份证信息明文作为寻找后台服务器30获取的校验身份信息的索引校验身份信息的比对，或者直接将该身份证信息明文与后台预存的身份证信息明文进行比对。又例如，签名信息还可以是对视频数据和单次认证数据进行签名得到的签名数据，其中，视频数据可以是终端录制后发送给电子密钥设备10的，也可以是电子密钥设备10自身的摄像头录制的，还可以是除终端20和电子密钥设备10之外的其他终端录制后通过终端20发送给电子密钥设备10的。又例如，签名信息也可以是对身份证信息密文进行签名得到的签名数据，后台服务器30接收身份证信息密文的签名信息后，首先进行验签，验签通过后，利用与电子密钥设备协商的对称密钥对身份证信息密文解密得到身份证信息明文。总之，签名信息可以是对各种信息的组合进行签名得到的数据，具体本申请实施例不作限定。由此，服务器侧可以通过验证签名信息，从而保证持有电子密钥设备的用户的身份是否合法，进而保证远程开户的安全性。
在本实施例中，终端20，用于获取待验证信息，并发送至后台服务器30，其中，待验证信息至少包含用户读取提示信息的视频；该终端20可以为支持电子密钥设备的PC机、PAD(平板电脑)、智能手机等设备。电子密钥设备10与终端20之间可以通过有线连接(例如USB接口、耳机接口等)进行数据传输，也可以通过无线连接(例如WIFI、蓝牙、红外、NFC等)进行数据传输。
在本实施例中，电子密钥设备10向用户提示提示信息之后，用户使用摄像头将用户读取提示信息的过程录制成视频，终端20获取至少包含用户读取提示信息的视频的待验证信息，并发送至后台服务器30。其中，用户读取提示信息包括：用户大声朗读出提示信息，或者，用户在电子密钥设备10的显示屏查看提示信息，只要录制到用户正在读取提示信息的视频即可，本实施例不做具体限制。
在本实施例中，为了减少终端20向后台服务器30发送的数据量，提高通信效率，可以对用户读取提示信息的视频进行压缩。另外，为了防止视频传输过程中被黑客截获，保证通信安全，还可以对用户读取提示信息的视频进行加密，加密后发送至后台服务器30。
作为本申请实施例的一个可选实施方式，终端20，用于通过以下方式至少之一获取包含用户读取提示信息的视频：
方式一、终端20，用于录制包含用户读取提示信息的视频。
在具体实施时，终端20调用自带摄像头将用户读取提示信息的过程录制成视频。
现有的终端(例如，PC、智能手机、平板电脑等)都配备有摄像头，使用终端20自带的摄像头录制视频，不会增加额外的成本。
方式二、电子密钥设备10录制包含用户读取提示信息的视频，并发送至终端20。
在具体实施时，电子密钥设备10调用电子密钥设备10自带的摄像头，将用户读取提示信息的过程录制成视频，并发送至终端20。电子密钥设备10发送视频之前，还可以对视频进行加密和签名，保证视频传输安全。
方式三、除终端20和电子密钥设备10之外的其他终端录制包含用户读取提示信息的视频，并发送至终端20。
在具体实施时，电子密钥设备10向用户显示或者播报提示信息后，终端20和电子密钥设备10之外的带有摄像头的其他终端录制视频，录制完成后发送至终端20。带有摄像头的其他终端与终端20之间可以通过有线连接(例如USB接口、耳机接口等)进行连接，也可以通过无线连接(例如WIFI、蓝牙、红外、NFC等)进行连接。
终端和电子密钥设备之外的终端录制视频，不需要为电子密钥设备单独设置一个摄像头，降低了电子密钥设备的成本。
在本实施例中，后台服务器30，用于接收待验证信息，待验证信息中至少包含用户读取所述提示信息的视频数据，提取视频数据中的待校验身份信息，将从视频数据中提取的待校验身份信息与后台服务器30获取的校验身份信息进行比对，比对一致，完成身份验证。其中，后台服务器30获取的校验身份信息可以是预先存储在后台服务器30中的，也可以是从其他数据库中获取的，也可以是临时产生的(例如，OTP口令)。
作为本申请实施例的一个可选实施方式，在后台服务器30接收待验证信息之后，如果待验证信息中的视频数据是加密的，后台服务器30先对视频数据进行解密；如果其中的视频数据是压缩的，后台服务器30先对视频数据进行解压，然后再从解密后或解压后的视频中提取待校验身份信息，进行后续的比对，完成身份验证。
作为本申请实施例的一个可选实施方式，待验证信息还包括签名信息，后台服务器30，还用于对签名信息进行验签，验签通过后触发提取视频数据中的待校验身份信息的操作。
在具体实施过程中，后台服务器30接收终端20发送的待验证信息中，除了签名信息以外，还包括签名信息对应的原始信息。后台服务器30接收终端20发送的待验证信息后，首先对待验证信息中的签名信息进行验签。后台服务器30使用与电子密钥设备10相同的hash函数对接收的签名信息中的原始信息生成一个摘要，再用电子密钥设备10的公钥对签名信息中的签名数据进行解密得到另一个摘要，比较两个摘要是否相同。如果两个摘要相 同则验签通过，验签通过后触发提取视频数据中的待校验身份信息的操作。如果摘要不相同，则终止此次身份验证操作，即此次身份验证不通过。由此，可以保证远程开户中使用的电子密钥设备为合法用户的电子密钥设备，是对用户身份的一重验证。此外，后台服务器还可以检验签名信息是否被篡改，保证签名信息传输安全，进而保证远程开户的安全性。
作为本申请实施例的一个可选实施方式，签名信息为通过对以下一个或多个进行签名获得的信息：身份证信息明文、身份证信息密文、视频数据和单次认证数据；后台服务器30，用于对签名信息验签。
在具体实施时，签名信息可以是对身份证信息明文、身份证信息密文、视频数据和单次认证数据中的一个或多个的组合进行签名得到的签名数据。例如，签名信息可以是对单次认证数据进行签名得到的签名数据，单次认证数据可以是随机数字，也可以是随机事件。单次认证数据只能使用一次，因此可以防止重放攻击。后台服务器30接收该签名信息后，首先进行验签，验签通过后再验证单次认证数据，比较接收的单次认证数据与后台服务器中的单次认证数据是否一致，如果不一致则终止此次身份验证操作。使用单次认证数据的签名信息可以防止重放攻击。又例如，签名信息还可以是对身份证信息明文和单次认证数据进行签名得到的签名数据。又例如，签名信息还可以是对视频数据和单次认证数据进行签名得到的签名数据，其中，视频数据可以是终端录制后发送给电子密钥设备10的，也可以是电子密钥设备10自身的摄像头录制的，还可以是除终端20和电子密钥设备10之外的其他终端录制后通过终端20发送给电子密钥设备10的。总之，签名信息可以是对各种信息的组合进行签名得到的数据，具体本申请实施例不作限定。
作为本申请实施例的一个可选实施方式，待校验身份信息包括：待校验用户信息和/或提示信息，待检验用户信息是从视频数据中提取的能够体现用户特征的信息，校验身份信息包括：校验用户信息和/或校验提示信息；后台服务器30，用于将从视频数据中提取的待校验身份信息与后台服务器获取的校验身份信息进行比对，包括：后台服务器30将从视频数据中提取的待校验用户信息与后台服务器30获取的校验用户信息进行比对；和/或，后台服务器30将从视频数据中提取的提示信息与后台服务器获取的校验提示信息进行比对。其中，后台服务器30获取的校验用户信息可以是预先存储在后台服务器30中的，也可以是从其他数据库中获取的；后台服务器30获取的校验提示信息可以是预先存储在后台服务器30中的，也可以是从其他数据库中获取的，也可以是临时产生的(例如，OTP口令)。
在本实施例中，后台服务器30接收待验证信息之后，可以根据需要提取的待校验身份信息选择相应的设备或者软件提取待校验身份信息，后台服务器30将从视频数据中提取的待校验身份信息与后台服务器30获取的校验身份信息进行比对。例如，后台服务器30接收待验证信息之后，可以使用音频提取软件提取视频数据中用户读取的提示信息，后台服 务器30将从视频数据中提取的提示信息与后台服务器获取的校验提示信息进行比对；或者，后台服务器30接收待验证信息之后，提取待校验身份信息和提示信息，后台服务器30将从视频数据中提取的待校验身份信息与后台服务器获取的校验身份信息进行比对，并且将从视频数据中提取的提示信息与后台服务器获取的校验提示信息进行比对，待校验身份信息和提示信息均比对一致后，完成身份验证。
在本实施例中，如果待检验身份信息中只包含一个待校验身份信息，则后台服务器30将这一个待校验身份信息与后台服务器获取的相应的校验身份信息进行比对，比对一致则通过验证，比对不一致，则此次身份验证不通过。如果待校验身份信息中包括多个待校验身份信息，例如，包括提示信息和多个待校验用户信息，则后台服务器30需要将待校验身份信息中的多个待校验身份信息分别与后台服务器30获取的对应的校验身份信息进行比对，只有全部的待校验身份信息都比对一致，后台服务器30才通过身份验证，只要其中的一个待校验身份信息比对不一致，则后台服务器30的身份验证失败。身份验证成功后，后台服务器30可以向终端20发送身份验证成功消息；身份验证失败后，后台服务器30可以向终端20发送身份验证失败消息。由此，可以保证远程开户的用户身份的合法性，进而后台服务器可以为用户完成远程开户。
由此，身份验证系统能够根据需要，灵活选择需要比对的待校验身份信息的类型和数目。
通过本实施例提供的身份验证系统，在用户已经有银行电子密钥设备的前提下，使用电子密钥设备和视频数据共同验证用户身份，解决远程开户中身份验证的问题，用户在家中通过PC机、智能手机等终端实现远程开户。
作为本申请实施例的一个可选实施方式，待校验用户信息包括待校验用户照片和/或待校验用户声纹信息，待校验用户照片可以是多张，待校验用户照片是从视频数据中提取得到的，待校验用户声纹信息是从视频数据中提取得到的；校验用户信息包括校验用户照片和/或校验用户声纹信息，校验用户照片可以是用户办理开户时预留在银行的照片，校验用户声纹信息可以是用户办理开户时预留在银行的；后台服务器30，用于将从视频数据中提取的待校验用户信息与后台服务器30获取的校验用户信息进行比对，包括：后台服务器30将从视频数据中提取的待校验用户照片与后台服务器获取的校验用户照片进行比对；和/或，后台服务器30将从视频数据中提取的待校验用户声纹信息与后台服务器获取的校验用户声纹信息进行比对。其中，后台服务器30获取的校验用户照片和/或校验用户声纹信息可以是预先存储在后台服务器30中的，也可以是从其他数据库中获取的。
在具体实施时，后台服务器30从视频数据中提取的待校验用户信息包括待校验用户照片，后台工作人员可以在后台服务器30中人工比对从视频数据中提取的待校验用户照片与 获取的校验用户照片。
在具体实施时，后台服务器30也可以采用人脸识别技术进行待校验用户照片比对。具体的，首先，后台服务器30将接收的视频数据还原为视频，并发送至人脸识别系统。人脸识别系统采集视频中的人脸图像，并使用人脸检测，在图像中准确标定出人脸的位置和大小。其次，基于人脸检测结果，对人脸图像预处理(例如，人脸图像的光线补偿、灰度变换、直方图均衡化、归一化、几何校正、滤波以及锐化等)。再次，基于图像预处理的结果，提取人脸图像特征，可提取的特征包括视觉特征、像素统计特征、人脸图像变换系数特征、人脸图像代数特征等。最后，将提取的人脸图像的特征数据与数据库中存储的校验用户照片的人脸特征模板进行搜索匹配，当相似度超过设定的阈值时，人脸识别系统判定待校验用户照片与校验用户照片比对一致。
人脸识别技术具有灵活判别能力，他人无法以非活动性的照片、木偶等欺骗人脸识别系统，识别准确率高。人脸识别技术提高了身份验证方法的准确率、安全性，节约了人工成本。
在本实施例中，由于录制了用户朗读提示信息的视频，后台服务器30可以采用声纹识别系统采集视频中的待校验用户声纹信息。具体的，首先，后台服务器30从视频中提取用户的语音，对语音进行预处理(例如，去除背景噪声)。其次，对预处理后的语音提取声学特征，对用户的声纹进行建模，得到待校验用户声纹模型。最后，后台服务器将待校验用户声纹模型与后台服务器获取的声纹信息进行模式匹配，判断是否一致后输出结果。
声纹是用户生物特征的一种，由于每个人的生理差异，任何两个人的声纹都有差异，因此声纹具有唯一性，利用声纹信息进行身份验证的安全性高。其次，对于每个成人而言，声纹不会随着年龄的增长而改变，因此不需要重复采集，节约了成本。此外，声纹识别技术相较于其他生物特征识别技术，具有获取方便、成本低廉等优点。
作为本申请实施例的一个可选实施方式，待验证信息还包括：用户身份信息；其中，用户身份信息可以是银行卡号、电子密钥设备10的序列号、身份证信息明文等可以用于唯一标识用户身份的信息，后台服务器30，用于在获取的身份证信息中找到与电子密钥设备匹配的身份证信息，将身份证信息明文与电子密钥设备匹配的身份证信息进行比对，比对一致，则表明电子密钥设备和身份证为当前同一用户所持有，完成身份验证；如果比对不一致，则表明电子密钥设备和身份证不是同一用户所持有，身份证有可能已经被盗，此时，终止此次身份验证。其中，后台服务器30获取的身份证信息可以是预先存储在后台服务器30中的，也可以是从其他数据库中获取的。由此，后台服务器可以快速找到与电子密钥设备匹配的身份证信息，通过比对身份证信息实现身份验证，确保远程开户的安全性，并提高身份验证效率。
作为本实施例的一个可选实施方式，待验证信息还包含：用户身份信息，用户身份信息可以为身份证信息明文，后台服务器30，用于在获取的身份证信息中找到与电子密钥设备匹配的身份证信息，将身份证信息与找到的与电子密钥设备匹配的身份证信息进行比对，比对一致，则完成身份验证。
作为本实施例的一个可选实施方式，待验证信息还包含：用户身份信息，作为一种可选的方式，用户身份信息可以为身份证信息密文，后台服务器30，用于采用与电子密钥设备10协商的对称密钥对身份证信息密文解密得到身份证信息明文，并使用用户身份信息(如账号)作为索引，查找后台服务器30获取的与电子密钥设备匹配的身份证信息，将身份证信息明文与找到的与电子密钥设备匹配的身份证信息进行比对，比对一致，则完成身份验证。
作为本实施例的一个可选实施方式，后台服务器30通过以下方式至少之一找到与电子密钥设备匹配的身份证信息：
方式一、后台服务器30根据电子密钥设备的序列号找到与电子密钥设备匹配的身份证信息。
电子密钥设备的序列号是在电子密钥设备生产过程中分配给电子密钥设备的唯一标识，在银行下发电子密钥设备时，电子密钥设备的序列号与用户身份证信息唯一关联。
在具体实施时，终端20获取电子密钥设备10的序列号后，将电子密钥设备10的序列号发送至后台服务器30；后台服务器30接收电子密钥设备的序列号，利用电子密钥设备的序列号作为索引，找到与电子密钥设备匹配的身份证信息。
方式二、后台服务器30根据电子密钥设备10发送的数字证书找到与电子密钥设备匹配的身份证信息。
电子密钥设备的数字证书由第三方权威认证机构-数字认证中心(Certificate Authority，简称CA)发行，可以作为电子密钥设备的唯一标识，电子密钥设备的数字证书与用户身份证信息唯一关联。
在具体实施时，电子密钥设备10向后台发送签名信息时，会将自身的数字证书一起发送至后台服务器，终端20将签名信息与电子密钥设备10的数字证书一起发送至后台服务器30；后台服务器30接收电子密钥设备10发送的数字证书后，利用电子密钥设备10的数字证书作为索引，找到与电子密钥设备10匹配的身份证信息。
通过上述2种方式，后台服务器30可以快速找到与电子密钥设备匹配的身份证信息，进而完成身份验证，提高了系统身份验证的效率。
通过本实施例提供的身份验证系统，在用户已经有电子密钥设备的前提下，使用电子密钥设备和视频数据共同验证用户身份，解决远程开户中身份验证的问题，用户在家中通 过PC机、智能手机等终端实现远程开户。
实施例2
本实施例提供了一种远程开户系统，如图1所示，该远程开户系统采用实施例1中的身份验证系统。本实施例与实施例1的区别在于，在本实施例中：终端20，还用于向后台服务器30发送开户请求，开户请求中至少携带有用户身份信息，该用户身份信息可以是银行卡号、电子密钥设备10的序列号、身份证信息明文等可以用于唯一标识用户身份的信息，该用户身份信息与实施例1中的用户身份信息含义相同，包含的内容也相同；后台服务器30，用于根据开户请求开设与用户身份信息匹配的账户。
作为本申请实施例的一个可选实施方式，终端20，还用于获取待验证信息后，向后台服务器30发送开户请求，其中，开户请求中除了携带用户身份信息之外还可以携带待验证信息，待验证信息至少包含用户读取提示信息的视频数据。在本实施例中，用户身份信息既可以在开户请求中携带，也可以分别携带在开户请求和待验证信息中，分两次发送给后台服务器，本实施例中不做限定。后台服务器，用于采用实施例1中的身份验证系统对用户身份的有效性、合法性进行验证，如果用户身份验证不通过，则所述后台服务器终止此次开户流程，如果验证通过，则后台服务器根据开户请求开设与用户身份信息匹配的账户。完成开户后，后台服务器，还用于将账户信息发送至终端，用户通过终端获知新开设的账户信息。
作为本申请实施例的一个可选实施方式，终端20，还用于在获取待验证信息之前，向后台服务器发送开户请求，开户请求中至少携带有用户身份信息。在具体实施时，例如，用户需要远程开户时，通过终端20向后台服务器30发送开户请求，开户请求中至少携带有用户身份信息，开户请求中还可以包括请求开设的账户类型等。然后，终端20，还用于在获取待验证信息之后，将待验证信息发送至后台服务器，远程开户系统采用实施例1中的身份验证系统中后台服务器对用户身份的有效性、合法性进行验证的方式。如果用户身份验证不通过，则远程开户系统终止此次开户流程，如果验证通过，后台服务器30根据开户请求开设与用户身份信息匹配的账户。完成开户后，后台服务器30可以将账户信息发送至终端20，用户通过终端20获知账户信息。
通过本实施例提供的远程开户系统，能够实现用户坐在家里、或者身处任何地方都能随时远程开户，并且保证远程开户的安全性。
实施例3
本实施例提供了一种身份验证方法，该身份验证方法应用于实施例1中的身份验证系 统。
图2为本实施例提供的身份验证方法的流程图，该方法主要包括以下步骤(S201～S203)：
S201：电子密钥设备获取提示信息，向用户提示提示信息。
本实施例中的电子密钥设备为用户开户时，银行向用户发放的具有签名功能的设备，包括具有签名功能的KEY、智能卡或者KEY卡合一的设备，，例如，工行U盾、农行K宝、中银e令等设备。在本实施例中，提示信息可以是数字，也可以是字符串。
在具体实施过程中，电子密钥设备可以根据工作原理的不同，使用不同的方式获取提示信息。电子密钥设备获取提示信息后，可以通过电子密钥设备的显示屏向用户显示提示信息，也可以通过语音播报向用户播放提示信息。
作为本申请实施例的一个可选实施方式，电子密钥设备可以通过以下方式至少之一获取提示信息：
方式一、电子密钥设备获取后台服务器发送的提示信息。
在具体实施时，后台服务器生成提示信息，提示信息可以为一个随机数字或者随机字符串。后台服务器将提示信息发送至终端，终端接收提示信息后转发至电子密钥设备。为了保证后台服务器向电子密钥设备发送的提示信息不被篡改，后台服务器在发送提示信息之前可以对提示信息进行加密和/或签名。后台服务器发送提示信息的密文时，则电子密钥设备对提示信息的密文解密得到提示信息的明文。后台服务器发送提示信息的签名时，电子密钥设备接收先对签名进行验签，验签通过后得到提示信息的明文。后台服务器发送提示信息的密文和提示信息的明文的签名信息时，电子密钥设备先对提示信息的密文解密得到提示信息的明文，根据解密得到的提示信息的明文对提示信息的明文的签名信息进行验签，验签通过后确定接收的提示信息的密文没有被篡改，则解密得到的提示信息的明文也是真实有效的。后台服务器发送提示信息的密文和提示信息的密文的签名信息时，电子密钥设备先对提示信息的密文的签名信息进行验签，验签通过后获取提示信息的密文，对提示信息的密文解密得到提示信息的明文。电子密钥设备与终端之间可以通过有线连接(例如USB接口、耳机接口等)进行连接，也可以通过无线连接(例如WIFI、蓝牙、红外、NFC等)进行连接。
采用这种方式获取提示信息，电子密钥设备只需接收提示信息，简化了电子密钥设备获取提示信息的过程，降低电子密钥设备的成本。
方式二、电子密钥设备基于与后台服务器同步的数据计算得到提示信息，该电子密钥设备可以是中银e令等具有OTP功能的设备。
在具体实施时，电子密钥设备基于与后台服务器同步的数据，利用内置的算法生成动 态口令作为提示信息。与后台服务器同步的数据可以是时间、也可以是事件、也可以是时间和事件的结合。电子密钥设备基于与后台服务器同步的时间计算提示信息时，电子密钥设备可以每隔一个固定时间间隔变换一次提示信息，例如每隔60秒变换一次提示信息。电子密钥设备基于与后台服务器同步的事件计算提示信息时，电子密钥设备也可以每进行一次身份验证操作变换一次提示信息。
采用这种方式计算得到的提示信息只能使用一次，保证了提示信息的安全。
方式三、电子密钥设备接收后台服务器发送的待计算信息，计算得到提示信息。
在具体实施时，后台服务器可以产生一个随机字符串作为待计算信息，也可以根据用户的账户信息或其他信息计算产生待计算信息。另外，为了保证后台服务器向电子密钥设备发送的待计算信息不被篡改，后台服务器在发送待计算信息之前可以对待计算信息进行加密和/或签名。后台服务器发送待计算信息的密文时，则电子密钥设备对待计算信息的密文解密得到待计算信息的明文。后台服务器发送待计算信息的签名时，电子密钥设备接收先对签名进行验签，验签通过后得到待计算信息的明文。后台服务器发送待计算信息的密文和待计算信息的明文的签名信息时，电子密钥设备先对待计算信息的密文解密得到待计算信息的明文，根据解密得到的待计算信息的明文对待计算信息的明文的签名信息进行验签，验签通过后确定接收的待计算信息的密文没有被篡改，则解密得到的待计算信息的明文也是真实有效的。后台服务器发送待计算信息的密文和待计算信息的密文的签名信息时，电子密钥设备先对待计算信息的密文的签名信息进行验签，验签通过后获取待计算信息的密文，对待计算信息的密文解密得到待计算信息的明文。电子密钥设备根据待计算信息的明文，使用内置于电子密钥设备中的算法，计算得到提示信息。
采用这种方式计算提示信息时，后台服务器发送的是待计算信息，即使待计算信息泄露也不会导致提示信息泄露，保证提示信息的安全。
方式四、电子密钥设备接收输入设备输入的待计算信息，计算得到提示信息。
在具体实施时，后台服务器可以产生一个随机字符串作为待计算信息，也可以根据用户的账户信息或其他信息计算产生待计算信息，并将待计算信息发送至终端，例如，以短信形式发送至用户预留在银行后台服务器中的手机号。用户接收待计算信息后，可以通过电子密钥设备自带的按键输入待计算信息；也可以通过终端的输入设备输入待计算信息，终端将待计算信息发送至电子密钥设备；还可以通过与电子密钥设备连接的其他输入设备输入待计算信息，其他输入设备将待计算信息发送至电子密钥设备。电子密钥设备接收输入设备输入的待计算信息，使用内置于电子密钥设备中的算法，计算得到提示信息。
采用这种方式计算提示信息时，后台服务器发送的是待计算信息，即使待计算信息泄露也不会导致提示信息泄露，保证提示信息的安全。
作为本申请实施例的一个可选实施方式，电子密钥设备，还可以获取身份证信息(包括明文或密文)，并通过终端将身份证信息发送至后台服务器，以利用身份证信息完成身份验证，在该可选实施方式中，电子密钥设备可以通过以下方式至少之一获取身份证信息：
方式一、电子密钥设备直接读取身份证信息。
在具体实施时，电子密钥设备具有身份证读卡器功能，将身份证贴近电子密钥设备，电子密钥设备可以读取身份证件的身份证信息的明文。为了进一步保证数据传输的安全，电子密钥设备还可以采用与后台服务器协商的对称密钥对身份证信息明文进行加密生成身份证信息密文或采用电子密钥设备的私钥对身份证信息明文进行签名生成身份证信息明文的签名信息。
电子密钥设备采用这种方式获取身份证信息时，电子密钥设备可以直接获取身份证信息，不需要通过其他设备传递给电子密钥设备，因此，身份证信息不需要在网络中传输，保证身份信息的安全。
方式二、身份证读卡器读取身份证信息，并发送至电子密钥设备。
在具体实施时，将身份证贴近身份证读卡器，身份证读卡器可以读取身份证件的身份证信息，并发送至电子密钥设备。其中，电子密钥设备接收到的身份证信息为身份证信息明文。当然，在身份证读卡器读取到身份证信息的明文后，也可以不通过终端而是直接发送给电子密钥设备。为了进一步保证数据传输的安全，电子密钥设备还可以采用与后台服务器协商的对称密钥对身份证信息明文加密生成身份证信息密文或采用电子密钥设备10的私钥对身份证信息明文进行签名生成身份证信息明文的签名信息。
电子密钥设备采用这种方式获取身份证信息时，电子密钥设备不需要配置读卡器功能，降低电子密钥设备的成本。
作为本申请实施例的一个可选实施方式，电子密钥设备生成签名信息并发送至终端，签名信息包括以下一个或多个：身份证信息明文的签名信息、身份证信息密文的签名信息、视频数据的签名信息和单次认证数据的签名信息。
在具体实施时，电子密钥设备可以对身份证信息明文、身份证信息密文、视频数据和单次认证数据中的一个或多个的组合进行签名得到签名数据。例如，签名信息可以为对单次认证数据进行签名得到的签名数据，单次认证数据可以是由服务器发送至电子密钥设备10的，可以为随机数字，也可以是随机事件。单次认证数据只能使用一次，因此可以防止重放攻击。又例如，签名信息还可以是对身份证信息明文和单次认证数据进行签名得到的签名数据，后台服务器接收该签名信息后，首先进行验签，验签通过后再验证单次认证数据，单次认证数据验证通过后再使用身份证信息明文作为寻找后台服务器获取的校验身份信息的索引，或者直接将该身份证信息明文与后台获取的身份证信息明文进行比对。又例 如，签名信息还可以是对视频数据和单次认证数据进行签名得到的签名数据，其中，视频数据可以是终端录制后发送给电子密钥设备的，也可以是电子密钥设备自身的摄像头录制的，还可以是除终端和电子密钥设备之外的其他终端录制后通过终端发送给电子密钥设备的。又例如，签名信息也可以是对身份证信息密文进行签名得到的签名数据，后台服务器接收身份证信息密文的签名信息后，首先进行验签，验签通过后，利用与电子密钥设备协商的对称密钥对身份证信息密文解密得到身份证信息明文，使用身份证信息明文作为寻找后台服务器获取的校验身份信息的索引，或者直接将该身份证信息明文与后台预存的身份证信息明文进行比对。总之，签名信息可以是对各种信息的组合进行签名得到的数据，具体本申请实施例不作限定。由此，服务器侧可以通过验证签名信息，从而保证持有电子密钥设备的用户的身份是否合法，进而保证远程开户的安全性。
S202：终端获取待验证信息，并发送至后台服务器，待验证信息至少包含用户读取提示信息的视频数据。
本实施例中的终端可以为支持电子密钥设备的PC机、PAD(平板电脑)、智能手机等设备。电子密钥设备与终端之间可以通过有线连接(例如USB接口、耳机接口等)进行数据传输，也可以通过无线连接(例如WIFI、蓝牙、红外、NFC等)进行数据传输。
在本实施例中，电子密钥设备向用户显示或者播报提示信息之后，用户使用摄像头将用户读取提示信息的过程录制成视频，终端获取该视频，将该视频编码为视频数据，并将至少包含该视频数据的待验证信息发送至后台服务器。其中，用户读取提示信息包括：用户大声朗读出提示信息，或者，用户在电子密钥设备的显示屏查看提示信息，只要录制到用户正在读取提示信息的视频即可，本实施例不做具体限制。
在具体实施过程中，为了减少终端向后台服务器发送的数据量，提高通信效率，可以对用户读取提示信息的视频数据进行压缩。另外，为了防止视频传输过程中被黑客截获，保证通信安全，还可以对用户读取提示信息的视频进行加密，加密后发送至后台服务器。
作为本申请实施例的一个可选实施方式，终端可以通过以下方式至少之一获取包含用户读取提示信息的视频：
方式一、终端调用自带的摄像头将用户读取提示信息的过程录制成视频。
在具体实施时，终端调用自带摄像头将用户读取提示信息的过程录制成视频。现有的终端，如PC机、智能手机、平板电脑等都配备有摄像头，使用终端自带的摄像头，不会增加额外的成本。
方式二、电子密钥设备录制包含用户读取提示信息的视频，并发送至终端。
在具体实施时，电子密钥设备调用电子密钥设备自带的摄像头，将用户读取提示信息的过程录制成视频，并发送至终端。电子密钥设备发送视频之前，还可以对视频进行加密 和签名，保证视频传输安全。
方式三、除终端和电子密钥设备之外的其他终端录制包含用户读取提示信息的视频，并发送至终端。
在具体实施时，电子密钥设备向用户显示或者播报提示信息后，终端和电子密钥设备之外的带有摄像头的其他终端录制视频，录制完成后发送至终端。带有摄像头的其他终端与终端之间可以通过有线连接(例如USB接口、耳机接口等)进行连接，也可以通过无线连接(例如WIFI、蓝牙、红外、NFC等)进行连接。
在本实施方式中不需要为电子密钥设备单独设置一个摄像头，降低了电子密钥设备的成本。
S203：后台服务器接收待验证信息，待验证信息中至少包含用户读取所述提示信息的视频数据，提取视频数据中的待校验身份信息，将从视频数据中提取的待校验身份信息与后台服务器获取的校验身份信息进行比对，比对一致，完成身份验证。其中，后台服务器获取的校验身份信息可以是预先存储在后台服务器中的，也可以是从其他数据库中获取的，也可以是临时产生的(例如，OTP口令)。
作为本申请实施例的一个可选实施方式，在后台服务器接收待验证信息之后，如果待验证信息中的视频数据是加密的，后台服务器先对视频数据进行解密；如果待验证信息中的视频数据是压缩的，后台服务器先对视频数据进行解压，然后再从解密后或解压后的视频中提取待校验身份信息，进行后续的比对，完成身份验证。
作为本申请实施例的一个可选实施方式，在步骤S203中，待验证信息还包括签名信息，后台服务器接收待验证信息后，首先对签名信息进行验签，验签通过后触发提取视频数据中的待校验身份信息的操作。
在具体实施过程中，后台服务器接收终端发送的待验证信息中，除了签名信息以外，还包括签名信息对应的原始信息。后台服务器接收终端发送的待验证信息后，首先对待验证信息中的签名信息进行验签。后台服务器使用与电子密钥设备相同的hash函数对接收的签名信息中的原始信息生成一个摘要，再用电子密钥设备的公钥对签名信息中的签名数据进行解密得到另一个摘要，比较两个摘要是否相同。如果两个摘要相同则验签通过，验签通过后触发提取视频数据中的待校验身份信息的操作。如果摘要不相同，则终止此次身份验证操作，即此次身份验证不通过。由此，可以保证远程开户中使用的电子密钥设备为合法用户的电子密钥设备，是对用户身份的一重验证。此外，后台服务器还可以检验签名信息是否被篡改，保证签名信息传输安全，进而保证远程开户的安全性。
作为本申请实施例的一个可选实施方式，签名信息为通过对以下一个或多个进行签名获得的信息：身份证信息明文、身份证信息密文、视频数据和单次认证数据。
在具体实施时，签名信息可以是对身份证信息明文、身份证信息密文、视频数据和单次认证数据中的一个或多个的组合进行签名得到的签名数据。例如，签名信息可以是对单次认证数据进行签名得到的签名数据，单次认证数据可以是随机数字，也可以是随机事件。单次认证数据只能使用一次，因此可以防止重放攻击。后台服务器接收该签名信息后，首先进行验签，验签通过后再验证单次认证数据，比较接收的单次认证数据与后台服务器中的单次认证数据是否一致，如果不一致则终止此次身份验证操作。使用对单次认证数据进行签名得到的签名数据可以防止重放攻击。又例如，签名信息还可以是对身份证信息明文和单次认证数据进行签名得到的签名数据。又例如，签名信息还可以是对视频数据和单次认证数据进行签名得到的签名数据，其中，视频数据可以是终端录制后发送给电子密钥设备的，也可以是电子密钥设备自身的摄像头录制的，还可以是除终端和电子密钥设备之外的其他终端录制后通过终端发送给电子密钥设备的。总之，签名信息可以是对各种信息的组合进行签名得到的数据，具体本申请实施例不作限定。
作为本申请实施例的一个可选实施方式，待校验身份信息包括：待校验用户信息和/或提示信息，待检验用户信息是从视频数据中提取的能够体现用户特征的信息，校验身份信息包括：校验用户信息和/或校验提示信息；后台服务器将从视频数据中提取的待校验身份信息与后台服务器获取的校验身份信息进行比对，包括：后台服务器将从视频数据中提取的待校验用户信息与后台服务器获取的校验用户信息进行比对；和/或，将从视频数据中提取的提示信息与后台服务器获取的校验提示信息进行比对。其中，后台服务器获取的校验用户信息可以是预先存储在后台服务器中的，也可以是从其他数据库中获取的；后台服务器获取的校验提示信息可以是预先存储在后台服务器中的，也可以是从其他数据库中获取的，也可以是临时产生的(例如，OTP口令)。
在本实施例中，如果待检验身份信息中只包含一个待校验身份信息，则后台服务器将这一个待校验身份信息与后台服务器获取的相应的校验身份信息进行比对，比对一致则通过验证，比对不一致，则此次身份验证不通过。如果待校验身份信息中包括多个待校验身份信息，例如，包括提示信息和多个待校验用户信息，则后台服务器需要将待校验身份信息中的多个待校验身份信息分别与后台服务器获取的对应的校验身份信息进行比对，只有全部的待校验身份信息都比对一致，后台服务器才通过身份验证，只要其中的一个待校验身份信息比对不一致，则后台服务器的身份验证失败。身份验证成功后，后台服务器可以向终端发送身份验证成功消息；身份验证失败后，后台服务器可以向终端发送身份验证失败消息。由此，可以保证远程开户的用户身份的合法性，进而后台服务器可以为用户完成远程开户。
由此，身份验证方法能够根据需要，灵活选择需要比对的待校验身份信息的类型和数 目。
作为本申请实施例的一个可选实施方式，待校验用户信息包括待校验用户照片和/或待校验用户声纹信息，待校验用户照片可以是多张，待校验用户照片是从视频数据中提取得到的，待校验用户声纹信息是从视频数据中提取得到的；校验用户信息包括校验用户照片和/或校验用户声纹信息，校验用户照片可以是用户办理开户时预留在银行的照片，校验用户声纹信息可以是用户办理开户时预留在银行的；后台服务器将从视频数据中提取的待校验用户信息与后台服务器获取的校验用户信息进行比对，包括：后台服务器将从视频数据中提取的待校验用户照片与后台服务器获取的校验用户照片进行比对；和/或，后台服务器将从视频数据中提取的待校验用户声纹信息与后台服务器获取的校验用户声纹信息进行比对。其中，后台服务器获取的校验用户照片和/或校验用户声纹信息可以是预先存储在后台服务器中的，也可以是从其他数据库中获取的。
在具体实施时，后台服务器从视频数据中提取待校验用户照片，后台工作人员可以在后台服务器中人工比对从视频中提取的待校验用户照片与获取的校验用户照片。
在具体实施时，后台服务器也可以采用人脸识别技术进行待校验用户照片比对。具体的，首先，后台服务器将接收的视频数据还原为视频，并发送至人脸识别系统。人脸识别系统采集视频中的人脸图像，并使用人脸检测，在图像中准确标定出人脸的位置和大小。其次，基于人脸检测结果，对人脸图像预处理(例如，人脸图像的光线补偿、灰度变换、直方图均衡化、归一化、几何校正、滤波以及锐化等)。再次，基于图像预处理的结果，提取人脸图像特征，可提取的特征包括视觉特征、像素统计特征、人脸图像变换系数特征、人脸图像代数特征等。最后，将提取的人脸图像的特征数据与数据库中存储的校验用户照片的人脸特征模板进行搜索匹配，当相似度超过设定的阈值时，人脸识别系统判定待校验用户照片与校验用户照片比对一致。
人脸识别技术具有灵活判别能力，他人无法以非活动性的照片、木偶等欺骗人脸识别系统，识别准确率高。人脸识别技术提高了身份验证方法的准确率、安全性，节约了人工成本。
在本实施例中，由于录制了用户朗读提示信息的视频，后台服务器可以采用声纹识别系统采集视频中的待校验用户声纹信息。具体的，首先，后台服务器从视频中提取用户的语音，对语音进行预处理(例如，去除背景噪声)。其次，对预处理后的语音提取声学特征，对用户的声纹进行建模，得到待校验用户声纹模型。最后，后台服务器将待校验用户声纹模型与后台服务器获取的声纹信息进行模式匹配，判断是否一致后输出结果。
声纹是用户生物特征的一种，由于每个人的生理差异，任何两个人的声纹都有差异，因此声纹具有唯一性，利用声纹信息进行身份验证的安全性高。其次，对于每个成人而言， 声纹不会随着年龄的增长而改变，因此不需要重复采集，节约了成本。此外，声纹识别技术相较于其他生物特征识别技术，具有获取方便、成本低廉等优点。
作为本申请实施例的一个可选实施方式，待验证信息还包括：用户身份信息；其中，用户身份信息可以是银行卡号、电子密钥设备的序列号、身份证信息明文等可以用于唯一标识用户身份的信息，作为一种可选的方式，后台服务器在获取的身份证信息中找到与电子密钥设备匹配的身份证信息，将身份证信息明文与电子密钥设备匹配的身份证信息进行比对，比对一致，则表明电子密钥设备和身份证为当前同一用户所持有，完成身份验证；如果比对不一致，则表明电子密钥设备和身份证不是同一用户所持有，身份证有可能已经被盗，此时，终止此次身份验证。其中，后台服务器获取的身份证信息可以是预先存储在后台服务器中的，也可以是从其他数据库中获取的。由此，后台服务器可以快速找到与电子密钥设备匹配的身份证信息，通过比对身份证信息实现身份验证，确保远程开户的安全性，并提高身份验证效率。
作为本实施例的一个可选实施方式，待验证信息还包含：用户身份信息，作为一种可选的方式，用户身份信息可以为身份证信息明文，后台服务器在获取的身份证信息中找到与电子密钥设备匹配的身份证信息，将身份证信息与找到的与电子密钥设备匹配的身份证信息进行比对，比对一致，则完成身份验证。
作为本实施例的一个可选实施方式，待验证信息还包含：用户身份信息，作为一种可选的方式，用户身份信息可以为身份证信息密文，后台服务器采用与电子密钥设备10协商的对称密钥对身份证信息密文解密得到身份证信息明文，并使用用户身份信息(如账号)作为索引，查找后台服务器30获取的与电子密钥设备匹配的身份证信息，将身份证信息明文与找到的与电子密钥设备匹配的身份证信息进行比对，比对一致，则完成身份验证。
作为本实施例的一个可选实施方式，后台服务器通过以下方式至少之一找到与电子密钥设备匹配的身份证信息：
方式一、后台服务器根据电子密钥设备的序列号找到与电子密钥设备匹配的身份证信息。
电子密钥设备的序列号是在电子密钥设备生产过程中分配给电子密钥设备的唯一标识，在银行下发电子密钥设备时，电子密钥设备的序列号与用户身份证信息唯一关联。
在具体实施时，终端获取电子密钥设备的序列号后，将电子密钥设备的序列号发送至后台服务器；后台服务器接收电子密钥设备的序列号，利用电子密钥设备的序列号作为索引，找到与电子密钥设备匹配的身份证信息。
方式二、后台服务器根据电子密钥设备发送的数字证书找到与电子密钥设备匹配的身份证信息。
电子密钥设备的数字证书由第三方权威认证机构-数字认证中心(Certificate Authority，简称CA)发行，可以作为电子密钥设备的唯一标识，电子密钥设备的数字证书与用户身份证信息唯一关联。
在具体实施时，电子密钥设备向后台发送签名信息时，会将自身的数字证书一起发送至后台服务器，终端将签名信息与电子密钥设备的数字证书一起发送至后台服务器；后台服务器接收电子密钥设备发送的数字证书后，利用电子密钥设备的数字证书作为索引，找到与电子密钥设备匹配的身份证信息。
通过上述2种方式，后台服务器可以快速找到与电子密钥设备匹配的身份证信息，进而完成身份验证，提高了系统身份验证的效率。
通过本实施例提供的身份验证方法，在用户已有电子密钥设备的前提下，使用电子密钥设备和视频数据共同验证用户身份，解决远程开户中身份验证的问题，用户在家中通过PC机、智能手机等终端实现远程开户。
实施例4
本实施例提供了一种远程开户方法，该远程开户方法采用实施例3中的身份验证方法。本实施例与实施例3的区别在于，在本实施例中：在后台服务器接收待验证信息之前，终端向后台服务器发送开户请求；开户请求中至少携带有用户身份信息，该用户身份信息可以是银行卡号、电子密钥设备10的序列号、身份证信息明文等可以用于唯一标识用户身份的信息，该用户身份信息与实施例3中的用户身份信息含义相同，包含的内容也相同；在后台服务器完成身份验证之后，后台服务器根据开户请求开设与所述用户身份信息匹配的账户。
图3为本实施例提供的一个可选的远程开户方法的流程图，该方法主要包括以下步骤：
S301：电子密钥设备获取提示信息，向用户提示提示信息；
S302：终端获取待验证信息，并向后台服务器发送携带有待验证信息的开户请求；
其中，开户请求除了携带有待验证信息之外，还携带有用户身份信息，如银行卡号、电子密钥设备10的序列号、身份证信息明文等可以用于唯一标识用户身份的信息。
S303：后台服务器接收携带有待验证信息的开户请求，提取视频数据中的待校验身份信息，将从视频数据中提取的待校验身份信息与后台服务器获取的校验身份信息进行比对，比对一致，完成身份验证；
可选地，在步骤S302中，终端还可以在获取待验证信息后，将待验证信息和开户请求分别发送至后台服务器，在步骤S303中，后台服务器在接收到待验证信息后提取视频数据中的待校验身份信息，接收到开户请求后，进入验证流程，将从视频中提取的待校验身份 信息与后台服务器获取的校验身份信息进行比对，比对一致，完成身份验证。其中，后台服务器获取的校验身份信息可以是预先存储在后台服务器中的，也可以是从其他数据库中获取的，也可以是临时产生的。
S304：后台服务器根据开户请求开设与用户身份信息匹配的账户。
在具体实施时，在步骤S301-S303中，本实施例提供的远程开户方法与实施例3的区别在于，终端获取待验证信息后，可以将待验证信息和开户请求一起发送至后台服务器，后台服务器接收待验证信息和开户请求，也可以将携带有待验证信息的开户请求发送至后台服务器，后台服务器接收携带有待验证信息的开户请求，远程开户方法应用实施例3中的身份验证方法对用户身份的有效性、合法性进行验证。如果用户身份验证不通过，则远程开户系统终止开户流程(即停止执行步骤S304)，如果验证通过，则执行步骤S304，即，后台服务器根据开户请求开设与用户身份信息匹配的账户。完成开户后，后台服务器可以将账户信息发送至终端，用户通过终端获知新开设的账户信息。
图4为本实施例提供的另一个可选的远程开户方法的流程图，该方法主要包括以下步骤：
S401：终端向后台服务器发送开户请求，开户请求中至少携带有用户身份信息；
在具体实施时，用户需要远程开户时，通过终端向后台服务器发送开户请求，开户请求中至少携带有用户身份信息，如银行卡号、电子密钥设备10的序列号、身份证信息明文等可以用于唯一标识用户身份的信息；开户请求中还可以包括请求开设的账户类型等。
S402：电子密钥设备获取提示信息，向用户提示提示信息；
在步骤S402中，除了实施例3中提到到电子密钥设备获取提示信息的几种方式之外，作为一种可选的实施方式，提示信息还可以是后台服务器在接收到终端发送的开户请求后，返回的开户请求中携带的提示信息。
S403：终端获取待验证信息，并将待验证信息发送至后台服务器；
S404：后台服务器接收待验证信息，提取视频数据中的待校验身份信息，将从视频数据中提取的待校验身份信息与后台服务器获取的校验身份信息进行比对，比对一致，完成身份验证；
S405：后台服务器根据开户请求开设与所述用户身份信息匹配的账户。
在具体实施时，在步骤S402-S404，远程开户方法应用实施例3中的身份验证方法对用户身份的有效性、合法性进行验证。如果用户身份验证不通过，则远程开户系统终止开户流程(即停止执行步骤S405)，如果验证通过，则执行步骤S405，即，后台服务器根据开户请求开设与用户身份信息匹配的账户。完成开户后，后台服务器可以将账户信息发送至终端，用户通过终端获知新开设的账户信息。
通过本实施例提供的远程开户系统，能够实现用户坐在家里、或者身处任何地方都能随时远程开户，并且保证远程开户的安全性。
流程图中或在此以其他方式描述的任何过程或方法描述可以被理解为，表示包括一个或更多个用于实现特定逻辑功能或过程的步骤的可执行指令的代码的模块、片段或部分，并且本申请的优选实施方式的范围包括另外的实现，其中可以不按所示出或讨论的顺序，包括根据所涉及的功能按基本同时的方式或按相反的顺序，来执行功能，这应被本申请的实施例所属技术领域的技术人员所理解。
应当理解，本申请的各部分可以用硬件、软件、固件或它们的组合来实现。在上述实施方式中，多个步骤或方法可以用存储在存储器中且由合适的指令执行系统执行的软件或固件来实现。例如，如果用硬件来实现，和在另一实施方式中一样，可用本领域公知的下列技术中的任一项或他们的组合来实现：具有用于对数据信号实现逻辑功能的逻辑门电路的离散逻辑电路，具有合适的组合逻辑门电路的专用集成电路，可编程门阵列(PGA)，现场可编程门阵列(FPGA)等。
本技术领域的普通技术人员可以理解实现上述实施例方法携带的全部或部分步骤是可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，该程序在执行时，包括方法实施例的步骤之一或其组合。
此外，在本申请各个实施例中的各功能单元可以集成在一个处理模块中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。所述集成的模块如果以软件功能模块的形式实现并作为独立的产品销售或使用时，也可以存储在一个计算机可读取存储介质中。
上述提到的存储介质可以是只读存储器，磁盘或光盘等。
在本说明书的描述中，参考术语“一个实施例”、“一些实施例”、“示例”、“具体示例”、或“一些示例”等的描述意指结合该实施例或示例描述的具体特征、结构、材料或者特点包含于本申请的至少一个实施例或示例中。在本说明书中，对上述术语的示意性表述不一定指的是相同的实施例或示例。而且，描述的具体特征、结构、材料或者特点可以在任何的一个或多个实施例或示例中以合适的方式结合。
尽管上面已经示出和描述了本申请的实施例，可以理解的是，上述实施例是示例性的，不能理解为对本申请的限制，本领域的普通技术人员在不脱离本申请的原理和宗旨的情况下在本申请的范围内可以对上述实施例进行变化、修改、替换和变型。本申请的范围由所附权利要求及其等同限定。

Claims (20)

  1. 一种身份验证方法，其特征在于，所述方法包括：
    电子密钥设备获取提示信息，向用户提示所述提示信息；
    终端获取待验证信息，并发送至后台服务器，所述待验证信息至少包含签名信息和所述用户读取所述提示信息的视频数据；
    所述后台服务器接收所述待验证信息，对所述待验证信息中的所述签名信息进行验签，验签通过后，提取所述视频数据中的待校验身份信息，将从所述视频数据中提取的待校验身份信息与所述后台服务器获取的校验身份信息进行比对，比对一致，则完成身份验证。
  2. 根据权利要求1所述的身份验证方法，其特征在于，所述电子密钥设备获取提示信息，包括以下方式至少之一：
    所述电子密钥设备获取由所述后台服务器发送的所述提示信息；
    所述电子密钥设备基于与所述后台服务器同步的数据计算得到所述提示信息；
    所述电子密钥设备接收所述后台服务器发送的待计算信息，计算得到所述提示信息；
    所述电子密钥设备接收输入设备输入的待计算信息，计算得到所述提示信息。
  3. 根据权利要求1或2所述的身份验证方法，其特征在于，所述终端获取包含所述用户读取所述提示信息的视频数据，包括以下方式至少之一：
    所述终端录制包含所述用户读取所述提示信息的视频；
    所述电子密钥设备录制包含所述用户读取所述提示信息的视频，并发送至所述终端；
    除所述终端和所述电子密钥设备之外的其他终端录制包含所述用户读取所述提示信息的视频，并发送至所述终端。
  4. 根据权利要求1至3任一项所述的身份验证方法，其特征在于，所述签名信息为通过对以下一个或多个进行签名获得的信息：身份证信息明文、身份证信息密文、所述视频数据和单次认证数据。
  5. 根据权利要求1至4任一项所述的身份验证方法，其特征在于，所述待校验身份信息包括待校验用户信息和/或所述提示信息，所述校验身份信息包括校验用户信息和/或校验提示信息；
    所述将从所述视频数据中提取的待校验身份信息与所述后台服务器获取的校验身份信息进行比对，包括：
    将从所述视频数据中提取的所述待校验用户信息与所述后台服务器获取的所述校验用户信息进行比对；和/或
    将从所述视频数据中提取的所述提示信息与所述后台服务器获取的所述校验提示信息 进行比对。
  6. 根据权利要求5所述的身份验证方法，其特征在于，所述待校验用户信息包括：待校验用户照片和/或待校验用户声纹信息，所述校验用户信息包括：校验用户照片和/或校验用户声纹信息；
    所述将从所述视频数据中提取的所述待校验用户信息与所述后台服务器获取的所述校验用户信息进行比对，包括：
    将从所述视频数据中提取的所述待校验用户照片与所述后台服务器获取的所述校验用户照片进行比对；和/或
    将从所述视频数据中提取的所述待校验用户声纹信息与所述后台服务器获取的所述校验用户声纹信息进行比对。
  7. 根据权利要求1至6任一项所述的身份验证方法，其特征在于，所述待验证信息还包括：用户身份信息；
    所述将从所述视频数据中提取的待校验身份信息与后台服务器数据库获取的校验身份信息进行比对，包括：所述后台服务器在所述获取的校验身份信息中找到与所述用户身份信息对应的校验身份信息，将从所述视频数据中提取的待校验身份信息与所述用户身份信息对应的校验身份信息进行比对。
  8. 根据权利要求1至6任一项所述的身份验证方法，其特征在于，所述待验证信息还包括：用户身份信息，所述用户身份信息至少包括身份证信息明文；
    在所述后台服务器接收所述待验证信息后，在将从所述视频数据中提取的待校验身份信息与所述后台服务器获取的校验身份信息进行比对时，所述方法还包括：
    所述后台服务器获取预先存储的身份信证信息，并在获取的身份证信息中找到与所述电子密钥设备匹配的身份证信息，将所述身份证信息明文与所述电子密钥设备匹配的身份证信息进行比对，在所述待校验身份信息与所述校验身份信息比对一致以及所述身份证信息明文与所述电子密钥设备匹配的身份证信息比对一致的情况下，完成身份验证。
  9. 根据权利要求8所述的身份验证方法，其特征在于，
    所述找到与所述电子密钥设备匹配的身份证信息包括以下方式至少之一：
    根据所述电子密钥设备的序列号找到与所述电子密钥设备匹配的身份证信息；
    根据所述电子密钥设备发送的数字证书找到与所述电子密钥设备匹配的身份证信息。
  10. 一种采用所述权利要求1-9中任一项所述的身份验证方法的远程开户方法，其特征在于，
    在所述后台服务器接收所述待验证信息之前，所述方法还包括：
    所述终端向所述后台服务器发送开户请求；所述开户请求中至少携带有用户身份信息；
    在所述后台服务器完成身份验证之后，所述方法还包括：
    所述后台服务器根据所述开户请求开设与所述用户身份信息匹配的账户。
  11. 一种身份验证系统，其特征在于，所述系统包括：电子密钥设备、终端以及后台服务器；
    所述电子密钥设备，用于获取提示信息，向用户提示所述提示信息；
    所述终端，用于获取待验证信息，并发送至后台服务器，所述待验证信息至少包含签名信息和用户读取所述提示信息的视频数据；
    所述后台服务器，用于接收所述待验证信息，对所述待验证信息中的所述签名信息进行验签，验签通过后，提取所述视频数据中的待校验身份信息，将从所述视频数据中提取的待校验身份信息与后台服务器获取的校验身份信息进行比对，比对一致后完成身份验证。
  12. 根据权利要求11所述的身份验证系统，其特征在于，所述电子密钥设备通过以下方式至少之一获取提示信息：
    所述电子密钥设备获取由所述后台服务器发送的所述提示信息；
    所述电子密钥设备基于与所述后台服务器同步的数据计算得到所述提示信息；
    所述电子密钥设备接收所述后台服务器发送的待计算信息，计算得到所述提示信息；
    所述电子密钥设备接收输入设备输入的待计算信息，计算得到所述提示信息。
  13. 根据权利要求11或12所述的身份验证系统，其特征在于，所述终端通过以下方式至少之一获取包含所述用户读取所述提示信息的视频数据：
    所述终端录制包含所述用户读取所述提示信息的视频；
    所述电子密钥设备录制包含所述用户读取所述提示信息的视频，并发送至所述终端；
    除所述终端和所述电子密钥设备之外的其他终端录制包含所述用户读取所述提示信息的视频，并发送至所述终端。
  14. 根据权利要求11至13任一项所述的身份验证系统，其特征在于，所述签名信息为通过对以下一个或多个进行签名获得的信息：身份证信息明文、身份证信息密文、所述视频数据和单次认证数据。
  15. 根据权利要求11至14中任一项所述的身份验证系统，其特征在于，所述待校验身份信息包括：待校验用户信息和/或所述提示信息，所述校验身份信息包括：校验用户信息和/或校验提示信息；
    所述后台服务器，用于将从所述视频数据中提取的待校验用户信息与所述后台服务器获取的校验身份信息进行比对，包括：
    所述后台服务器将从所述视频数据中提取的所述待校验用户信息与所述后台服务器获取的所述校验用户信息进行比对；和/或
    所述后台服务器将从所述视频数据中提取的所述提示信息与所述后台服务器获取的所述校验提示信息进行比对。
  16. 根据权利要求15所述的身份验证系统，其特征在于，
    所述待校验用户信息包括：待校验用户照片和/或待校验用户声纹信息，所述校验用户信息包括：校验用户照片和/或校验用户声纹信息；
    所述后台服务器，用于将从所述视频数据中提取的待校验用户信息与所述后台服务器获取的所述校验用户信息进行比对，包括：
    所述后台服务器将从所述视频数据中提取的所述待校验用户照片与所述后台服务器获取的所述校验用户照片进行比对；和/或
    所述后台服务器将从所述视频数据中提取的所述待校验用户声纹信息与所述后台服务器获取的所述校验用户声纹信息进行比对。
  17. 根据权利要求11至16任一项所述的身份验证系统，其特征在于，
    所述待验证信息还包括：用户身份信息；
    所述后台服务器，用于将从所述视频数据中提取的待校验身份信息与后台服务器获取的校验身份信息进行比对，包括：
    所述后台服务器，用于在所述获取的校验身份信息中找到与所述用户身份信息对应的校验身份信息，将从所述视频数据中提取的待校验身份信息与所述用户身份信息对应的校验身份信息进行比对。
  18. 根据权利要求11至16任一项所述的身份验证系统，其特征在于，所述待验证信息还包括：用户身份信息，所述用户身份信息至少包括身份证信息明文；
    所述后台服务器，还用于在接收所述待验证信息后，在将从所述视频数据中提取的待校验身份信息与所述后台服务器获取的校验身份信息进行比对时，获取预先存储的身份信证信息，并在获取的身份证信息中找到与所述电子密钥设备匹配的身份证信息，将所述身份证信息明文与找到的与所述电子密钥设备匹配的身份证信息进行比对，在所述待校验身份信息与所述校验身份信息比对一致以及所述身份证信息明文与所述电子密钥设备匹配的身份证信息比对一致的情况下，完成身份验证。
  19. 根据权利要求18所述的身份验证系统，其特征在于，
    所述后台服务器通过以下方式至少之一找到与所述电子密钥设备匹配的身份证信息：
    根据所述电子密钥设备的序列号找到与所述电子密钥设备匹配的身份证信息；
    根据所述电子密钥设备发送的证书找到与所述电子密钥设备匹配的身份证信息；
    根据所述电子密钥设备发送的所述签名信息找到与所述电子密钥设备匹配的身份证信息。
  20. 一种包括所述权利要求11-19中任一项所述的身份验证系统的远程开户系统，其特征在于，
    所述终端，还用于向所述后台服务器发送开户请求；所述开户请求中至少携带有用户身份信息；
    所述后台服务器，还用于在完成身份验证之后，根据所述开户请求开设与所述用户身份信息匹配的账户。
PCT/CN2016/098331 2015-09-07 2016-09-07 远程开户方法和系统及其身份验证方法和系统 WO2017041716A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510564019.3 2015-09-07
CN201510564019.3A CN105141615A (zh) 2015-09-07 2015-09-07 一种远程开户方法和系统及其身份验证方法和系统

Publications (1)

Publication Number Publication Date
WO2017041716A1 true WO2017041716A1 (zh) 2017-03-16

Family

ID=54726823

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/098331 WO2017041716A1 (zh) 2015-09-07 2016-09-07 远程开户方法和系统及其身份验证方法和系统

Country Status (2)

Country Link
CN (1) CN105141615A (zh)
WO (1) WO2017041716A1 (zh)

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2019002832A1 (en) * 2017-06-30 2019-01-03 Cryptomathic Ltd USER AUTHENTICATION BASED ON AN IDENTIFICATION DOCUMENT ACTIVATED BY RFID AND AN INTERROGATION-RESPONSE PROTOCOL BY GESTURE
CN109345623A (zh) * 2018-09-30 2019-02-15 Oppo广东移动通信有限公司 模型校验方法及服务器、计算机存储介质
CN109413007A (zh) * 2017-08-17 2019-03-01 金联汇通信息技术有限公司 校验身份信息的方法、装置及服务器
CN111753271A (zh) * 2020-06-28 2020-10-09 深圳壹账通智能科技有限公司 基于ai识别的开户身份验证方法、装置、设备及介质
CN112202725A (zh) * 2020-09-10 2021-01-08 中国联合网络通信集团有限公司 业务的校验方法及装置
CN112491834A (zh) * 2020-11-16 2021-03-12 中国联合网络通信集团有限公司 信息认证方法及认证服务器
CN113256288A (zh) * 2021-06-08 2021-08-13 中国银行股份有限公司 银行卡解挂方法及装置
CN115633025A (zh) * 2022-12-01 2023-01-20 北财在线科技(北京)有限公司 基于USBServer的智能一体化设备及应用方法
WO2023044671A1 (zh) * 2021-09-23 2023-03-30 京东方科技集团股份有限公司 数据库管理方法、人脸认证方法、设备及存储介质

Families Citing this family (23)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105141615A (zh) * 2015-09-07 2015-12-09 天地融科技股份有限公司 一种远程开户方法和系统及其身份验证方法和系统
CN105245341B (zh) * 2015-09-07 2018-11-30 天地融科技股份有限公司 远程身份认证方法和系统以及远程开户方法和系统
CN105590257A (zh) * 2015-12-22 2016-05-18 深圳前海微众银行股份有限公司 银行远程开户的安全处理方法及装置
CN105654065A (zh) * 2016-02-01 2016-06-08 深圳市富途网络科技有限公司 用于身份验证的数字化系统及其方法
CN105939197B (zh) * 2016-03-17 2019-02-12 天地融科技股份有限公司 一种身份认证方法和系统
CN108121943B (zh) * 2016-11-30 2022-05-06 阿里巴巴集团控股有限公司 基于图片的判别方法及装置和计算设备
CN108234126B (zh) * 2016-12-21 2021-04-09 金联汇通信息技术有限公司 用于远程开户的系统和方法
CN108200037B (zh) * 2017-12-28 2020-12-11 天地融科技股份有限公司 一种利用安全设备执行安全操作的方法及系统
CN108337235B (zh) * 2017-12-28 2020-12-15 天地融科技股份有限公司 一种利用安全设备执行安全操作的方法及系统
CN108322439B (zh) * 2017-12-28 2020-12-15 天地融科技股份有限公司 一种利用安全设备注册方法和注册系统
CN108322440B (zh) * 2017-12-28 2020-12-11 天地融科技股份有限公司 一种利用安全设备读卡登录方法及安全登录系统
US10839238B2 (en) * 2018-03-23 2020-11-17 International Business Machines Corporation Remote user identity validation with threshold-based matching
CN108769011A (zh) * 2018-05-29 2018-11-06 北京华大智宝电子系统有限公司 一种电子签名设备、身份验证方法和系统
CN108833431B (zh) * 2018-06-29 2020-11-17 腾讯科技（深圳）有限公司 一种密码重置的方法、装置、设备及存储介质
CN109067791B (zh) * 2018-09-25 2020-05-12 阿里巴巴集团控股有限公司 网络中用户身份认证方法和装置
CN109583976A (zh) * 2018-10-10 2019-04-05 山西特信环宇信息技术有限公司 一种证件链电子税务票据系统及其使用方法
CN109816521A (zh) * 2019-01-31 2019-05-28 中国银行股份有限公司 一种银行业务处理方法、装置及系统
CN110213522B (zh) * 2019-05-27 2021-07-27 腾讯科技（深圳）有限公司 一种视频数据处理方法、装置以及相关设备
CN110380864B (zh) * 2019-07-05 2021-10-01 创新先进技术有限公司 人脸数据采集、验证的方法、设备及系统
CN112037020B (zh) * 2020-09-01 2023-09-19 中国银行股份有限公司 海外客户开通境内移动支付的方法、装置、设备及介质
CN112367314B (zh) * 2020-10-30 2022-10-28 中国工商银行股份有限公司 身份认证的方法、装置、计算设备和介质
CN114666045A (zh) * 2022-03-14 2022-06-24 胡金钱 家庭创业预认证装置及家庭创业预认证方法
CN114826744A (zh) * 2022-04-28 2022-07-29 中国银行股份有限公司 一种信息处理方法、装置、设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103853950A (zh) * 2014-03-20 2014-06-11 深圳市中兴移动通信有限公司 一种基于移动终端的认证方法及移动终端
CN104361274A (zh) * 2014-10-30 2015-02-18 深圳市富途网络科技有限公司 一种基于视频识别的身份认证方法及其系统
CN105141615A (zh) * 2015-09-07 2015-12-09 天地融科技股份有限公司 一种远程开户方法和系统及其身份验证方法和系统
CN105245341A (zh) * 2015-09-07 2016-01-13 天地融科技股份有限公司 远程身份认证方法和系统以及远程开户方法和系统
CN105245340A (zh) * 2015-09-07 2016-01-13 天地融科技股份有限公司 一种基于远程开户的身份认证方法和系统

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP2065823A1 (en) * 2007-11-26 2009-06-03 BIOMETRY.com AG System and method for performing secure online transactions
CN101650854A (zh) * 2009-07-09 2010-02-17 广州广电运通金融电子股份有限公司 远程交互式自助银行系统
CN103067460A (zh) * 2012-12-14 2013-04-24 厦门天聪智能软件有限公司 面向司法社区矫正的生物识别远程身份验证方法
CN104298909B (zh) * 2013-07-19 2018-11-30 富泰华工业（深圳）有限公司 电子装置、身份验证系统及方法
CN104348778A (zh) * 2013-07-25 2015-02-11 信帧电子技术（北京）有限公司 一种在手机端进行人脸初步验证的远程身份认证的系统、终端和方法
CN104504321B (zh) * 2015-01-05 2017-07-14 湖北微模式科技发展有限公司 一种基于摄像头实现远程用户身份验证的方法与系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103853950A (zh) * 2014-03-20 2014-06-11 深圳市中兴移动通信有限公司 一种基于移动终端的认证方法及移动终端
CN104361274A (zh) * 2014-10-30 2015-02-18 深圳市富途网络科技有限公司 一种基于视频识别的身份认证方法及其系统
CN105141615A (zh) * 2015-09-07 2015-12-09 天地融科技股份有限公司 一种远程开户方法和系统及其身份验证方法和系统
CN105245341A (zh) * 2015-09-07 2016-01-13 天地融科技股份有限公司 远程身份认证方法和系统以及远程开户方法和系统
CN105245340A (zh) * 2015-09-07 2016-01-13 天地融科技股份有限公司 一种基于远程开户的身份认证方法和系统

Cited By (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2019002832A1 (en) * 2017-06-30 2019-01-03 Cryptomathic Ltd USER AUTHENTICATION BASED ON AN IDENTIFICATION DOCUMENT ACTIVATED BY RFID AND AN INTERROGATION-RESPONSE PROTOCOL BY GESTURE
AU2018293402B2 (en) * 2017-06-30 2023-06-15 Cryptomathic Ltd User authentication based on RFID-enabled identity document and gesture challenge-response protocol
US11595380B2 (en) 2017-06-30 2023-02-28 Cryptomathic Ltd User authentication based on RFID-enabled identity document and gesture challenge-response protocol
CN109413007A (zh) * 2017-08-17 2019-03-01 金联汇通信息技术有限公司 校验身份信息的方法、装置及服务器
CN109345623A (zh) * 2018-09-30 2019-02-15 Oppo广东移动通信有限公司 模型校验方法及服务器、计算机存储介质
CN109345623B (zh) * 2018-09-30 2023-12-08 Oppo广东移动通信有限公司 模型校验方法及服务器、计算机存储介质
CN111753271A (zh) * 2020-06-28 2020-10-09 深圳壹账通智能科技有限公司 基于ai识别的开户身份验证方法、装置、设备及介质
CN112202725A (zh) * 2020-09-10 2021-01-08 中国联合网络通信集团有限公司 业务的校验方法及装置
CN112202725B (zh) * 2020-09-10 2023-04-07 中国联合网络通信集团有限公司 业务的校验方法及装置
CN112491834B (zh) * 2020-11-16 2023-03-24 中国联合网络通信集团有限公司 信息认证方法及认证服务器
CN112491834A (zh) * 2020-11-16 2021-03-12 中国联合网络通信集团有限公司 信息认证方法及认证服务器
CN113256288A (zh) * 2021-06-08 2021-08-13 中国银行股份有限公司 银行卡解挂方法及装置
CN113256288B (zh) * 2021-06-08 2024-02-27 中国银行股份有限公司 银行卡解挂方法及装置
WO2023044671A1 (zh) * 2021-09-23 2023-03-30 京东方科技集团股份有限公司 数据库管理方法、人脸认证方法、设备及存储介质
CN115633025A (zh) * 2022-12-01 2023-01-20 北财在线科技(北京)有限公司 基于USBServer的智能一体化设备及应用方法

Also Published As

Publication number Publication date
CN105141615A (zh) 2015-12-09

Similar Documents

Publication Publication Date Title
WO2017041716A1 (zh) 远程开户方法和系统及其身份验证方法和系统
US20220229893A1 (en) Identity authentication using biometrics
CN105939197B (zh) 一种身份认证方法和系统
CN107800725B (zh) 一种数字证书远程在线管理装置及方法
CN109150548B (zh) 一种数字证书签名、验签方法及系统、数字证书系统
CN105933280B (zh) 身份认证方法和系统
CN107070667B (zh) 身份认证方法
WO2017041715A1 (zh) 远程身份认证方法和系统以及远程开户方法和系统
CN105847247A (zh) 一种认证系统及其工作方法
CN105939196B (zh) 身份认证方法和系统
AU2016297557A1 (en) System and method for validating authorship of an electronic signature session
WO2021004519A1 (zh) 数据安全处理终端、系统及方法
CN103039098A (zh) 利用便携终端器的认证方法及系统
JP2018205906A5 (zh)
US10282532B2 (en) Secure storage of fingerprint related elements
WO2015104001A1 (zh) 一种数据传输方法和系统
CN108985037A (zh) 一种身份验证方法、登录终端及系统
US11240029B2 (en) Method of registration and access control of identity for third-party certification
CN105787319B (zh) 基于虹膜识别的便携式终端及其方法
US20120330663A1 (en) Identity authentication system and method
JP6578080B1 (ja) 証明書認定システム、証明書認定方法及びプログラム
US20210365531A1 (en) Method and electronic device for authenticating a user
CN105989481B (zh) 数据交互方法及系统
WO2018006344A1 (zh) 一种基于超声波使用智能门禁的方法及系统
KR102547590B1 (ko) 바이오 인증서를 이용하여 비대면으로 본인 확인을 수행하는 장치 및 방법

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16843654

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16843654

Country of ref document: EP

Kind code of ref document: A1