WO2019210698A1

WO2019210698A1 - Authentication method

Info

Publication number: WO2019210698A1
Application number: PCT/CN2018/124942
Authority: WO
Inventors: 陈晓磊
Original assignee: 上海掌门科技有限公司
Priority date: 2018-05-04
Filing date: 2018-12-28
Publication date: 2019-11-07
Also published as: CN108600250A

Abstract

Disclosed in embodiments of the present application is an authentication method. One specific embodiment of the method comprises: obtaining an authentication request, the authentication request comprising user face data and a user identifier; determining whether a pre-stored first face database comprises face data matching the user face data; in response to the determination that the first face database does not comprise the face data matching the user face data, generating a data request and sending same to a predetermined electronic device, the electronic device generating and returning a request result on the basis of the data request and a pre-stored second face database, and the second face database being isolated from the first face database; and generating an authentication result according to the request result. The embodiment provides a novel face recognition authentication approach.

Description

Authentication method

Technical field

The embodiments of the present application relate to the field of computer technologies, and in particular, to an authentication method.

Background technique

With the development of face recognition technology, more and more authentication scenarios use face recognition technology for authentication. Face recognition authentication is fast and safe.

In the process of face recognition authentication, face data needs to be collected and stored in advance for use as a basis for authentication. Then, the face data to be verified is compared with the face data stored in advance to determine whether the authentication is passed.

Summary of the invention

The embodiment of the present application proposes an authentication method.

In a first aspect, an embodiment of the present application provides an authentication method, where the method includes: acquiring an authentication request, where the authentication request includes user face data and a user identifier; determining whether the pre-stored first face database includes the foregoing The face data matched by the user face data, wherein the face database includes face data and an identity corresponding to the face data; and in response to determining that the first face database does not include a face that matches the user face data Data, generating and transmitting a data request to a predetermined electronic device, wherein the data request includes the user face data and/or the user identifier, and the electronic device generates the second face database based on the data request and the pre-stored data. And returning the result of the request, wherein the second face database and the first face database are isolated from each other; and the authentication result is generated according to the result of the request, wherein the authentication result is used to indicate that the authentication passes or the authentication fails.

In some embodiments, the data request includes the user identifier, and the electronic device searches for the identity identifier matching the user identifier in the second face database, and returns the face data corresponding to the found identity identifier as a result of the request. And generating the authentication result according to the foregoing request result, comprising: determining whether the received face data matches the user face data; and in response to determining that the received face data matches the user face data, generating Indicates the certification result passed by the certification.

In some embodiments, the data request includes the user face data; the electronic device searches for the face data matching the user face data in the second face database, and the identity corresponding to the found face data is And the identifier is returned as the result of the request; and the generating the authentication result according to the foregoing request result, comprising: determining whether the received identity identifier matches the foregoing user identifier; and generating, in response to determining that the received identity identifier matches the user identifier, generating The certification result passed by the certification.

In some embodiments, the data request includes the user face data and the user identifier; the electronic device searches for the identity identifier matching the user identifier in the second face database, and determines the person corresponding to the found identity identifier. Whether the face data matches the user face data, and in response to determining that the face data corresponding to the found identity identifier matches the user face data, the authentication consistency information is returned as a request result; and the foregoing generating the authentication according to the request result As a result, in response to receiving the above-described authentication matching information, an authentication result indicating that the authentication is passed is generated.

In some embodiments, determining whether the pre-stored first face database includes the face data matching the user face data includes: searching, in the first face database, the matching with the user face data. The method further includes: determining, in response to finding the face data that matches the user face data, whether the identity identifier corresponding to the found face data matches the user identifier; and determining the found The identity identifier corresponding to the face data matches the foregoing user identifier, and generates an authentication result indicating that the authentication is passed.

In some embodiments, determining whether the pre-stored first face database includes face data matching the user face data includes: searching, in the first face database, an identity that matches the user identifier. Determining whether the face data corresponding to the found identity identifier matches the user face data in response to finding the identity identifier that matches the user identifier; and the method further includes: responding to determining the corresponding identity identifier that is found The face data matches the user face data described above, and generates an authentication result indicating that the authentication is passed.

In some embodiments, determining whether the pre-stored first face database includes the face data matching the user face data, further comprising: determining, according to the user face data, the person indicated by the user face data Whether the face is a living human face; in response to determining that the face indicated by the user face data is not a living face, an authentication result indicating that the authentication fails is generated.

In some embodiments, the terminal acquires the user face data and the user identifier, and generates an authentication request according to the user face data and the user identifier, in response to receiving operation information for triggering a predefined operation.

In some embodiments, the terminal performs the above predefined operation in response to obtaining an authentication result indicating that the authentication is passed.

In a second aspect, the embodiment of the present application provides an authentication apparatus, where the apparatus includes: an obtaining unit configured to acquire an authentication request, where the authentication request includes user face data and a user identifier; and the determining unit is configured to determine Whether the pre-stored first face database includes face data matching the user face data, wherein the face database includes face data and an identity corresponding to the face data; the first generating unit is configured to respond Determining that the first face database does not include face data matching the user face data, generating and transmitting a data request to the predetermined electronic device, wherein the data request includes the user face data and/or the user The identifier, the electronic device generates and returns a request result based on the data request and the pre-stored second face database, wherein the second face database and the first face database are isolated from each other; and the second generating unit, Is configured to generate an authentication result according to the result of the request, wherein the above recognition The result of the certificate is used to indicate that the certification has passed or the certification has not passed.

In a third aspect, an embodiment of the present application provides an electronic device, where the electronic device includes: one or more processors; and a storage device, configured to store one or more programs, when the one or more programs are When executed by a plurality of processors, the one or more processors described above are implemented as described in any one of the first aspects.

In a fourth aspect, an embodiment of the present application provides a computer readable medium having stored thereon a computer program, wherein the computer program is executed by a processor to implement the method as described in any one of the first aspects.

The authentication method provided by the embodiment of the present application determines whether the first face database includes face data matching the user face data by using the execution body first; if not, sending a data request to the predetermined electronic device, the electronic The device returns the request result by using the second face database; the execution body further generates an authentication result according to the request result, and may invoke the second face of the other civil subject if the face data of the first face database lacks face data. The database, for authentication support, provides a new face recognition authentication method.

DRAWINGS

Other features, objects, and advantages of the present application will become more apparent from the detailed description of the accompanying drawings.

1 is an exemplary system architecture diagram to which the present application can be applied;

2 is a flow chart of one embodiment of an authentication method in accordance with the present application;

3A is a schematic diagram showing an exemplary relationship between a first face database and a second face database according to the present application;

3B is a schematic diagram showing an exemplary relationship between a first face database and a second face database according to the present application;

3C is a schematic diagram showing an exemplary relationship between a first face database and a second face database according to the present application;

4 is a schematic diagram of an application scenario of an authentication method according to the present application;

FIG. 5 is a schematic diagram of another application scenario of an authentication method according to the present application; FIG.

6 is a flow chart of still another embodiment of an authentication method in accordance with the present application;

7 is a flow chart of still another embodiment of an authentication method in accordance with the present application;

8 is a flow chart of still another embodiment of an authentication method in accordance with the present application;

9 is a flow chart of still another embodiment of an authentication method in accordance with the present application;

10 is a flow chart of still another embodiment of an authentication method in accordance with the present application;

11 is a schematic structural diagram of a computer system suitable for implementing a terminal device or a server of an embodiment of the present application.

detailed description

The present application will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the invention, rather than the invention. It is also to be noted that, for the convenience of description, only the parts related to the related invention are shown in the drawings.

It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict. The present application will be described in detail below with reference to the accompanying drawings.

FIG. 1 illustrates an exemplary system architecture 100 in which an embodiment of an authentication method of the present application may be applied.

As shown in FIG. 1, the system architecture 100 can include a terminal device 101, a network 102, a first server 103, and a second server 104. The network 102 is used to provide a medium for a communication link between the terminal device 101, the first server 103, and the second server 104. Network 102 can include a variety of connection types, such as wired, wireless communication links, fiber optic cables, and the like.

The user can use the terminal device 101 to interact with the first server 103 or the second server 104 via the network 102 to receive or send a message or the like. The terminal device 101 can be installed with various communication client applications, such as a payment application, a web browser application, a shopping application, a search application, an instant communication tool, a mailbox client, a social platform software, and the like.

The terminal device 101 may be hardware or software. When the terminal device 101 is hardware, it may be various electronic devices with image capturing functions, including but not limited to smart phones, tablets, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III, motion picture experts) Compress standard audio level 3), MP4 (Moving Picture Experts Group Audio Layer IV) player, laptop portable computer and desktop computer, etc. When the terminal device 101 is software, it can be installed in the above-listed electronic devices. It can be implemented as a plurality of software or software modules (for example to provide distributed services) or as a single software or software module. This is not specifically limited.

The first server 103 may be a server that provides various services, such as a background server that provides support for applications installed on the terminal device 101. The background server may perform processing such as analyzing the received authentication request and the like, and feed back the processing result (for example, the authentication result) to the terminal device.

The second server 104 may be a server that provides various services, such as a background server that provides support for the authentication function of the first server 103. The background server may perform processing such as analyzing data such as the received data request, and feed back the processing result (for example, the result of the request) to the first server 103.

The first server or the second server is a server that can provide services in response to a user's service request. It can be understood that one server can provide one or more services, and the same service can also be provided by multiple servers.

It should be noted that the authentication method provided by the embodiment of the present application may be performed by the first server 103 or the terminal device 101. Accordingly, the authentication device may be disposed in the first server 103 or the terminal device 101.

It should be noted that the first server 103 and the second server 104 may be hardware or software. When the first server 103 and the second server 104 are hardware, a distributed server cluster composed of a plurality of servers may be implemented, or may be implemented as a single server. When the first server 103 and the second server 104 are software, they may be implemented as multiple software or software modules (for example, to provide distributed services), or may be implemented as a single software or software module. This is not specifically limited.

It should be understood that the number of terminal devices, networks, first servers, and second servers in FIG. 1 are merely illustrative. Depending on the implementation needs, there may be any number of terminal devices, networks, first servers, and second servers.

Referring to Figure 2, a flow 200 of one embodiment of an authentication method is illustrated. This embodiment is mainly illustrated by the method being applied to an electronic device having a certain computing capability. The electronic device may be the first server 103 shown in FIG. 1 or the terminal device 101 shown in FIG. The authentication method includes the following steps:

Step 201: Acquire an authentication request.

In the present embodiment, an execution body of the authentication method (for example, the first server shown in FIG. 1) can acquire an authentication request.

Optionally, if the execution entity is the first server, the first server may receive the authentication request from the terminal used by the user by using a wired connection manner or a wireless connection manner, and then store the authentication request, and then obtain the authentication request locally.

Optionally, if the foregoing execution entity is a terminal, the terminal may generate an authentication request, which is equivalent to obtaining an authentication request.

In this embodiment, the foregoing authentication request may include user face data and a user identifier.

In this embodiment, the user face data may be capable of indicating data of the user's face features. As an example, the user face data may include, but is not limited to, at least one of: a face image of the user and a feature map extracted from the face image of the user.

In this embodiment, the user identifier may be an identifier of an collection object for indicating user face data. As an example, the user identification may include, but is not limited to, at least one of the following: an identification assigned to the user's face data, an identification number of the user, a terminal identification of the terminal used by the user, and a telephone number of the user. It should be noted that the user identifier may indicate the identity of the foregoing collection object, or may not indicate the identity of the collection object.

In some optional implementation manners of the embodiment, if the user identifier indicates the identity of the collection object, the authentication request may be used to request authentication: the collection object of the user face data is instructed by the user identifier. The object is consistent.

In some optional implementation manners of the embodiment, if the user identifier does not indicate the identity of the collection object, the authentication request may be used to request the following items: whether the object of the user face data can be authenticated. (has passed permissions).

As an example, in the application scenario where the gate is released, the terminal can collect the user face data of the person to be identified. At this time, the terminal does not know the identity of the person to be identified, in which case the terminal can assign the user identifier to the collected user face data. As an example, the user identification can be a string of numbers used to identify the collected user face data. The terminal can send the user face data to the first server. The first server stores a release list, and the release list includes a releaseable identity. The first server may determine the user identity corresponding to the user face data through the first face database, or receive the user identity corresponding to the user face data returned by the second server. Then, the first server may determine whether the user identity corresponding to the user face data is in the release list. Finally, if the user identity corresponding to the user face data is in the playable list, the first server may generate an authentication result indicating that the authentication is passed. If the user identity corresponding to the user face data is not in the release list, the first server may generate an authentication result indicating that the authentication fails.

In some optional implementation manners of this embodiment, the terminal may receive operation information for triggering a predefined operation. Then, the terminal may acquire the user face data and the user identifier in response to receiving the operation information. Then, the terminal may generate an authentication request according to the user face data and the user identifier.

As an example, the above predefined operations may include, but are not limited to, at least one of the following: a login operation and a payment operation.

Step 202: Determine whether the pre-stored first face database includes face data matching the user face data.

In the present embodiment, based on the above-described execution subject (for example, the first server shown in FIG. 1), it can be determined whether the pre-stored first face database includes face data matching the above-described face data.

In this embodiment, the face database may include face data and an identity corresponding to the face data. As an example, the face data may include, but is not limited to, at least one of the following: a face image and an image feature extracted from the face image. The identity may include, but is not limited to, at least one of the following: an identification number, a terminal identification, and a telephone number.

In this embodiment, determining whether the user face data matches the face data in the face database can be implemented by calculating the similarity between the user face data and the face data in the face database. For how to calculate the similarity between the face data, refer to the calculation method in the face recognition technology, and details are not described herein again.

In some optional implementation manners of the embodiment, the step 202 may include: determining, according to the user face data, whether the face indicated by the user face data is a living face; and determining the user face data in response to determining The indicated face is not a living face, and an authentication result indicating that the authentication is not passed is generated.

It should be noted that, under normal circumstances, the face indicated by the user face data is a living face, in other words, the terminal collects the object of the user face data as a living face. However, there may be abnormal situations. For example, an illegal user wants to use another person's face image (such as a photo) or a three-dimensional face model to impersonate a legitimate user to operate. In this case, the face indicated by the user face data is not Living face. If it is determined that the face indicated by the user face data is not a living face, it is an abnormal situation. At this time, an authentication result indicating that the authentication is not passed may be generated.

Optionally, how to determine whether the face indicated by the user face data is a living face according to the user face data, may be implemented by: predetermining some features, and summarizing the characteristics of the living face for these features. Parameters and characteristic parameters of non-living faces. The feature parameters of the user face data are analyzed, and then compared with the feature parameters of the living face and the feature parameters of the non-living face to determine whether the face indicated by the user face data is a living face. The above features may include, but are not limited to, at least one of the following: color features, texture features, two-dimensional shape features, two-dimensional spatial relationship features, three-dimensional shape features, three-dimensional spatial relationship features, face features, facial features, facial features, and Proportional characteristics.

It should be noted that before the user face data is compared with the face data in the face database, it is detected in advance whether the face indicated by the user face data is a living face, and the illegal user can be prevented from impersonating the legitimate user. To improve the effectiveness of authentication, it is also possible to save computing resources by reducing the amount of calculation of face data comparison.

Step 203, in response to determining that the first face database does not include face data matching the user face data, generating and transmitting a data request to the predetermined electronic device.

In this embodiment, based on the execution body (for example, the first server shown in FIG. 1), in response to determining that the first face database does not include face data matching the user face data, generating and predetermining The electronic device (such as the second server shown in Figure 1) sends a data request.

In this embodiment, the above data request can be used to request data. The above data request may include user face data and/or user identification.

In this embodiment, the association information may be pre-stored in the execution entity, and the association information may indicate an electronic device identifier of the electronic device having an association relationship with the execution entity. The above-mentioned execution entity can learn the predetermined electronic device by acquiring the associated information.

In this embodiment, the electronic device may generate and return a request result based on the data request and the pre-stored second face database.

It should be noted that the electronic device (for example, the second server shown in FIG. 1) and the execution body (for example, the first server shown in FIG. 1) may be electronic devices or different electronic devices.

It should be noted that the first face database and the second face database in the present application are both face databases. As defined above for the face database, both the first face database and the second face database may include face data and an identity corresponding to the face data. However, the first face database and the second face database are isolated from each other. The isolation between the first face database and the second face database can be at least reflected in the following aspects:

First, the process of use is independent of each other. Face recognition using the first face database and face recognition using the second face database are two independent use processes that do not interfere with each other.

Second, the included face data is different.

As an example, please refer to Figures 3A, 3B and 3C. A set of face data in the first face database may be referred to as a first face data set 301. A set of face data in the second face database may be referred to as a second face data set 302. FIG. 3A illustrates an exemplary relationship between the first face data set and the second face data set (which may also be said to be an exemplary relationship between the first face database and the second face database), ie, The intersection of a face data set and a second face data set is an empty set. FIG. 3B illustrates another exemplary relationship between the first face data set and the second face data set, that is, the intersection of the first face data set and the second face data set is not empty, and is not The first face data collection. FIG. 3C illustrates still another exemplary relationship of the first face data set and the second face data set, that is, the intersection of the first face data set and the second face data set is the first face data set.

Third, the civil subject is different.

Under normal circumstances, civil subjects can also be called "the subject of civil legal relations." The civil subject may be a person who enjoys the rights and obligations under the civil legal relationship, and can be a civil subject with citizens (natural persons) and legal persons. It can be understood that the ownership of the face database can be attributed to the civil subject.

In this embodiment, the first face database and the second face database may belong to different civil subjects respectively. As an example, the first face database and the second face database belong to different civil subjects, respectively, and the ownership of the first face database and the ownership of the second face database belong to different civil subjects respectively; The right to use the face database and the right to use the second face database belong to different civil subjects.

For example, the first face database may belong to company A, and the second face database may belong to company B. For another example, the first face database may belong to company A, and the second face database may belong to a public security organ. It should be noted that when the public security organ opens a face database (or provides an interface for use) to a civil subject, and participates in civil activities. Public security organs can be considered as civil subjects.

Optionally, fourth, the storage location is different. The first face database may be stored in the above-described execution body (for example, the first server in FIG. 1). The second face database may be stored in the above electronic device (eg, the second server in FIG. 1).

Step 204: Generate an authentication result according to the result of the request.

In this embodiment, the execution body (for example, the first server shown in FIG. 1) may generate an authentication result according to the result of the request returned by the electronic device.

In this embodiment, the foregoing authentication result is used to indicate that the authentication is passed or the authentication is not passed.

In some optional implementation manners of the embodiment, the authentication pass may be: the collection object of the user face data is consistent with the object indicated by the user identifier. The authentication failure may mean that the collection object of the user face data is inconsistent with the object indicated by the user identifier.

In some optional implementation manners of the embodiment, the authentication object may refer to the collection object of the user face data having the permission of the user; the authentication failure may mean that the collection object of the user face data does not have the permission.

In some optional implementation manners of this embodiment, in a case that the terminal receives the operation information for triggering the predefined operation, the terminal may perform the predefined in response to acquiring the authentication result for indicating the authentication pass. operating.

For example, the foregoing operation information may trigger a login operation, and the terminal performs a login operation when receiving an authentication result indicating that the authentication is passed. For another example, the operation information may trigger a payment operation, and the terminal performs a payment operation when receiving an authentication result indicating that the authentication is passed.

In some optional implementation manners of the embodiment, if the execution entity is a terminal, the terminal may generate an authentication result by itself, which is equivalent to obtaining an authentication result. If the execution entity is not a terminal but a server, the terminal may receive an authentication result returned by the server to obtain an authentication result.

With continued reference to Fig. 4, Fig. 4 is a schematic diagram of an application scenario of the authentication method according to the present embodiment. In the application scenario of Figure 4:

The terminal 401 generates an authentication request and then transmits the authentication request 402 to the server 403.

Server 403 can obtain authentication request 402.

The server 403 may determine whether the pre-stored first face database includes face data that matches the user face data described above.

The server 403 may generate and send a data request 405 to the predetermined server 404 in response to determining that the first face database does not include face data that matches the user face data.

The server 404 can generate the request result 406 based on the data request 405 and the pre-stored second face database, and then return the request result 406 to the server 403.

The server 403 can generate an authentication result 407 according to the above request result 406.

The server 403 can transmit the authentication result 407 to the terminal 401.

With continued reference to FIG. 5, FIG. 5 is a schematic diagram of another application scenario of the authentication method according to the present embodiment. In the application scenario of Figure 5:

The terminal 501 can generate an authentication request, which is equivalent to obtaining an authentication request.

The terminal 501 may determine whether the pre-stored first face database includes face data that matches the user face data described above.

The terminal 501 may generate a data request 502 in response to determining that the first face database does not include face data that matches the user face data. Terminal 501 then sends a data request 502 to predetermined server 503.

The server 503 can generate the request result 504 based on the data request 502 and the pre-stored second face database, and then return the request result 504 to the terminal 501.

The terminal 501 can generate an authentication result according to the above request result 504.

The method provided by the above embodiment of the present application first determines whether the first face database includes face data matching the user face data by the execution body; if not, sends a data request to the predetermined electronic device, the electronic The device returns the request result by using the second face database; the execution entity further generates an authentication result according to the request result, and may be indirectly separated from the first face database if the face data of the first face database lacks face data. The second face database is used for authentication support. The technical effects include at least:

First, provide a new face recognition authentication method.

Second, reduce the computational resources required to collect and store face data. If a face database establishes a cooperative authentication relationship with other face databases, the face database can reduce the amount of face data collected and stored. Therefore, in the field of face recognition authentication, through the mechanism of joint authentication, the computational resources consumed in this field are reduced, and the popularity of face recognition authentication is improved.

Optionally, if a civil subject establishes a cooperative relationship with the face database of other civil subjects, the current civil subject can reduce the collection and storage capacity of the face database. Furthermore, it is possible to establish a cooperative relationship of cooperation between each civil subject and other civil subjects, which can reduce the amount of face data collection and processing in the face recognition field as a whole.

Third, avoid repeatedly collecting face images for users. The establishment of the face database requires the collection of the user's face image. In the prior art, the same user may provide a face image for the process of establishing a plurality of face databases, and there is a problem that the user needs to repeatedly submit personal information (including a face image) to different face databases.

After the cooperative relationship of the joint authentication is established, the face data sharing of the same user can be realized, and the face image of the same user does not need to be repeatedly collected. Thereby, the user's time can be saved. Moreover, reducing the collection and storage opportunities of the face image can improve the security of the user information.

With further reference to FIG. 6, a flow 600 of yet another embodiment of an authentication method is illustrated. The process 600 of the authentication method includes the following steps:

Step 601: Acquire an authentication request.

Step 602: In the first face database, find an identity that matches the user identifier.

In this embodiment, an execution body of the authentication method (for example, the first server shown in FIG. 1) may search for an identity identifier matching the user identifier in the first face database.

In this embodiment, the user identifier may indicate identity information of the user.

In this embodiment, determining whether the user identifier and the identity identifier match may be implemented by: directly comparing whether the user identifier and the identity identifier are consistent; calculating a similarity between the two, and the similarity is greater than the similarity threshold to confirm the match. .

Step 603: Determine, according to the identifier that matches the user identifier, whether the face data corresponding to the found identity identifier matches the user face data.

In this embodiment, the execution entity of the authentication method (for example, the first server shown in FIG. 1) may determine the face data corresponding to the found identity identifier and the user in response to finding the identity identifier that matches the user identifier. Whether the face data matches.

In some optional implementation manners of this embodiment, if there is no match, information indicating that the authentication fails, and then the process stops, and steps 605, 606, and 607 are not performed.

Step 604, in response to determining that the face data corresponding to the found identity identifier matches the user face data, generating an authentication result for indicating that the authentication is passed.

In this embodiment, the execution body of the authentication method (for example, the first server shown in FIG. 1) may generate, in response to determining that the face data corresponding to the found identity identifier matches the user face data, Certification results.

Step 605: In response to determining that the face data corresponding to the found identity identifier does not match the user face data, determine that the first face database does not include face data that matches the user face data.

In this embodiment, the execution entity of the authentication method (for example, the first server shown in FIG. 1) may determine that the face data corresponding to the found identity does not match the user face data, and is generated to indicate that the authentication fails. Certification results.

Step 606, in response to determining that the first face database does not include face data matching the user face data, generating and transmitting a data request to the predetermined electronic device.

Step 607: Generate an authentication result according to the result of the request.

The specific operations of the step 601, the step 606, and the step 607 in the embodiment are substantially the same as the operations in the step 201, the step 203, and the step 204 in the embodiment shown in FIG. 2, and details are not described herein again.

As can be seen from FIG. 6, the flow 600 of the authentication method in this embodiment highlights the following aspects compared to the embodiment corresponding to FIG. 2:

First, in the case that the user identifier can indicate the identity information of the user, first look up the identity identifier matching the user identifier in the first face database, and then determine the face data that matches the user face data with the found identity identifier. , whether it matches. It can be understood that the calculation amount of the search identity is smaller than the calculation amount of the face data match. In the case that the identity of the user can be determined, the target face data in the first face database is locked by the identity identifier, and it is determined whether the target face data matches the user face data, which can reduce the calculation amount.

Second, in a case where the first user face database determines that the target face data does not match the user face data, the data request is sent to the predetermined electronic device. In this process, even if the first face database determines that the target face data does not match the user face data, it does not conclude that the authentication fails, but uses the second face database for further verification, thereby improving the accuracy of the authentication. rate.

With further reference to FIG. 7, a flow 700 of yet another embodiment of an authentication method is illustrated. The process 700 of the authentication method includes the following steps:

Step 701: Acquire an authentication request.

In this embodiment, the user identifier may not indicate the identity of the user.

Step 702: In the first face database, look for face data that matches the user face data.

In the present embodiment, the execution body of the authentication method (e.g., the first server shown in Fig. 1) can look up the face data matching the user face data in the first face database.

Step 703: Determine, according to the face data that matches the user face data, whether the identity identifier corresponding to the found face data matches the user identifier.

In this embodiment, the execution body of the authentication method (for example, the first server shown in FIG. 1) may determine the identity identifier corresponding to the found face data in response to finding the face data matching the user face data. Whether it matches the above user ID.

Step 704: In response to determining that the identity identifier corresponding to the found face data matches the user identifier, generate an authentication result for indicating that the authentication is passed.

In this embodiment, the execution body of the authentication method (for example, the first server shown in FIG. 1) may generate an authentication for indicating the passing of the authentication by determining that the identity identifier corresponding to the found face data matches the user identifier. result.

Step 705: In response to determining that the identity identifier corresponding to the found face data does not match the user identifier, generate an authentication result indicating that the authentication fails.

In this embodiment, the execution body of the authentication method (for example, the first server shown in FIG. 1) may generate, in response to determining that the identity identifier corresponding to the found face data does not match the foregoing user identifier, to generate an indication that the authentication fails. Certification results.

Step 706, in response to not finding the face data matching the user face data, determining that the first face database does not include face data matching the user face data.

In this embodiment, based on the foregoing execution body (for example, the first server shown in FIG. 1), it may be determined that the first face database does not include the user person in response to not finding the face data matching the user face data. Face data matching face data.

Step 707, in response to determining that the first face database does not include face data matching the user face data, generating and transmitting a data request to the predetermined electronic device.

Step 708: Generate an authentication result according to the result of the request.

The specific operations of step 701, step 707, and step 708 in the embodiment are substantially the same as those in step 201, step 203, and step 204 in the embodiment shown in FIG. 2, and details are not described herein again.

As can be seen from FIG. 7, compared with the embodiment corresponding to FIG. 2, the process 700 of the authentication method in this embodiment highlights that the user is accessed through the first face database if the user identity cannot indicate the identity of the user. The step of identifying and authenticating the face data. Thus, the solution described in this embodiment can implement more comprehensive face recognition authentication.

With further reference to FIG. 8, a flow 800 of yet another embodiment of an authentication method is illustrated. The process 800 of the authentication method includes the following steps:

Step 801: Acquire an authentication request.

Step 802: Determine whether the pre-stored first face database includes face data matching the user face data.

Step 803, in response to determining that the first face database does not include face data matching the user face data, generating and transmitting the user identifier to the predetermined electronic device.

The electronic device searches for the identity identifier matching the user identifier in the second face database, and returns the face data corresponding to the found identity identifier as a result of the request, where the second face database includes the face data and the person User ID corresponding to the face data.

Step 804: Determine whether the received face data matches the user face data.

Step 805, in response to the received face data matching the user face data, generating an authentication result indicating that the authentication is passed.

Step 806, in response to the received face data not matching the user face data, generating an authentication result indicating that the authentication fails.

It can be seen from FIG. 8 that the process 800 of the authentication method in this embodiment highlights that the execution entity sends a user identifier to the electronic device and receives face data from the electronic device, as compared with the embodiment corresponding to FIG. 2 . Then, the execution body confirms whether the received face data matches the user face data. Thus, the solution described in this embodiment can provide a more comprehensive interaction.

With further reference to FIG. 9, a flow 900 of yet another embodiment of an authentication method is illustrated. The process 900 of the authentication method includes the following steps:

In step 901, an authentication request is obtained.

Step 902: Determine whether the pre-stored first face database includes face data matching the user face data.

Step 903, in response to determining that the first face database does not include face data matching the user face data, generating and transmitting the user face data to the predetermined electronic device.

Then, the electronic device searches for the face data matching the user face data in the second face database, and returns the identity identifier corresponding to the found face data as a result of the request.

Step 904: Determine whether the received identity identifier matches the user identifier.

Step 905: In response to the received identity identifier matching the user identifier, generate an authentication result indicating that the authentication is passed.

Step 906: In response to the received identity identifier not matching the user identifier, generate an authentication result indicating that the authentication fails.

It can be seen from FIG. 9 that the flow 900 of the authentication method in this embodiment highlights that the execution entity sends user face data to the electronic device and receives an identity from the electronic device, as compared with the embodiment corresponding to FIG. 2 . And the step of confirming, by the above-mentioned execution entity, whether the received identity matches the user identifier. Thus, the solution described in this embodiment can provide a more comprehensive interaction.

With further reference to FIG. 10, a flow 1000 of yet another embodiment of an authentication method is illustrated. The process 1000 of the authentication method includes the following steps:

Step 1001: Acquire an authentication request.

Step 1002: Determine whether the pre-stored first face database includes face data matching the user face data.

Step 1003, in response to determining that the first face database does not include face data matching the user face data, generating and transmitting the user face data and the user identifier to the predetermined electronic device.

In some optional implementation manners of the embodiment, the electronic device searches for the identity identifier that matches the user identifier in the second face database, and determines the face data corresponding to the found identity identifier and the user face. Whether the data matches; determining that the face data corresponding to the found identity matches the user face data, and returning the authentication consistency information as a result of the request; and responding to determining the face data corresponding to the found identity and the user The face data does not match, and the authentication inconsistency information is returned as the result of the request.

In some optional implementation manners of the embodiment, the electronic device searches for the face data corresponding to the user face data in the second face database, and determines the identity identifier corresponding to the found face data and the foregoing Whether the user identifier matches or not; in response to determining that the identity identifier corresponding to the searched face data matches the user identifier, the authentication consistency information is returned as the request information; and the identity identifier corresponding to the determined face data does not match the user identifier. , the authentication inconsistency information is returned as the request information.

Step 1004: In response to receiving the authentication consistency information, generate an authentication result indicating that the authentication is passed.

Step 1005: In response to receiving the authentication inconsistency information, generate an authentication result indicating that the authentication fails.

As can be seen from FIG. 10, compared with the embodiment corresponding to FIG. 2, the process 1000 of the authentication method in this embodiment highlights that the execution entity sends the user face data and the user identifier to the electronic device from the execution body. The step of receiving authentication conformance information or authentication inconsistency information. Therefore, the solution described in this embodiment can complete the authentication process mainly by the above electronic device, and liberate the above-mentioned execution subject. Therefore, the above-mentioned execution body can process more authentication requests and improve the authentication efficiency.

Referring now to Figure 11, a block diagram of a computer system 1100 suitable for use in implementing a terminal device or server of an embodiment of the present application is shown. The terminal device or server shown in FIG. 11 is merely an example, and should not impose any limitation on the function and scope of use of the embodiments of the present application.

As shown in FIG. 11, the computer system 1100 includes a central processing unit (CPU) 1101, which can be loaded into random access according to a program stored in a read only memory (ROM) 1102 or from a storage portion 1108. Various appropriate operations and processes are executed by the program in the RAM (Random Access Memory) 1103. In the RAM 1103, various programs and data required for the operation of the system 1100 are also stored. The CPU 1101, the ROM 1102, and the RAM 1103 are connected to each other through a bus 1104. An input/output (I/O, Input/Output) interface 1105 is also coupled to bus 1104.

The following components are connected to the I/O interface 1105: an input portion 1106 including a keyboard, a mouse, etc.; an output portion 1107 including a cathode ray tube (CRT, a cathode crystal ray), a liquid crystal display (LCD), and the like, and a speaker or the like. A storage portion 1108 including a hard disk or the like; and a communication portion 1109 including a network interface card such as a LAN (Local Area Network) card, a modem, and the like. The communication section 1109 performs communication processing via a network such as the Internet. Driver 1110 is also connected to I/O interface 1105 as needed. A removable medium 1111 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory or the like is mounted on the drive 1110 as needed so that a computer program read therefrom is installed into the storage portion 1108 as needed.

In particular, the processes described above with reference to the flowcharts may be implemented as a computer software program in accordance with an embodiment of the present disclosure. For example, an embodiment of the present disclosure includes a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising program code for executing the method illustrated in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network via the communication portion 1109, and/or installed from the removable medium 1111. When the computer program is executed by the central processing unit (CPU) 1101, the above-described functions defined in the method of the present application are performed. It should be noted that the computer readable medium described above may be a computer readable signal medium or a computer readable storage medium or any combination of the two. The computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the above. More specific examples of computer readable storage media may include, but are not limited to, electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read only memory (ROM), erasable Programmable read only memory (EPROM or flash memory), optical fiber, portable compact disk read only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the foregoing. In the present application, a computer readable storage medium may be any tangible medium that can contain or store a program, which can be used by or in connection with an instruction execution system, apparatus or device. In the present application, a computer readable signal medium may include a data signal that is propagated in the baseband or as part of a carrier, carrying computer readable program code. Such propagated data signals can take a variety of forms including, but not limited to, electromagnetic signals, optical signals, or any suitable combination of the foregoing. The computer readable signal medium can also be any computer readable medium other than a computer readable storage medium, which can transmit, propagate, or transport a program for use by or in connection with the instruction execution system, apparatus, or device. . Program code embodied on a computer readable medium can be transmitted by any suitable medium, including but not limited to wireless, wire, fiber optic cable, RF, etc., or any suitable combination of the foregoing.

Computer program code for performing the operations of the present application may be written in one or more programming languages, or combinations thereof, including an object oriented programming language such as Java, Smalltalk, C++, and conventional Procedural programming language—such as the "C" language or a similar programming language. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer, partly on the remote computer, or entirely on the remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any kind of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (eg, using an Internet service provider) Internet connection).

The flowchart and block diagrams in the Figures illustrate the architecture, functionality and operation of possible implementations of systems, methods and computer program products in accordance with various embodiments of the present application. In this regard, each block of the flowchart or block diagram can represent a module, a program segment, or a portion of code that includes one or more of the logic functions for implementing the specified. Executable instructions. It should also be noted that in some alternative implementations, the functions noted in the blocks may also occur in a different order than that illustrated in the drawings. For example, two successively represented blocks may in fact be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending upon the functionality involved. It is also noted that each block of the block diagrams and/or flowcharts, and combinations of blocks in the block diagrams and/or flowcharts, can be implemented in a dedicated hardware-based system that performs the specified function or operation. Or it can be implemented by a combination of dedicated hardware and computer instructions.

The units involved in the embodiments of the present application may be implemented by software or by hardware. The described unit may also be provided in the processor, for example, as a processor including an acquisition unit, a determination unit, a first generation unit, and a second generation unit. The names of these units do not constitute a limitation on the unit itself under certain circumstances. For example, the obtaining unit may also be described as “acquiring an authentication request”.

In another aspect, the present application also provides a computer readable medium, which may be included in the apparatus described in the above embodiments, or may be separately present and not incorporated into the apparatus. The computer readable medium carries one or more programs, when the one or more programs are executed by the device, causing the device to: obtain an authentication request, wherein the authentication request includes user face data and a user identifier; Whether the stored first face database includes face data matching the user face data, wherein the face database includes face data and an identity corresponding to the face data; and in response to determining that the first face database is not Included with the face data matching the user face data, generating and transmitting a data request to a predetermined electronic device, wherein the data request includes the user face data and/or the user identifier, and the electronic device is based on the data request And generating, by the second face database, and returning the result of the request, wherein the second face database and the first face database are isolated from each other; and the authentication result is generated according to the result of the request, wherein the authentication result is Used to indicate that the authentication passed or the authentication failed.

The above description is only a preferred embodiment of the present application and a description of the principles of the applied technology. It should be understood by those skilled in the art that the scope of the invention referred to in the present application is not limited to the specific combination of the above technical features, and should also be covered by the above technical features or without departing from the above inventive concept. Other technical solutions formed by arbitrarily combining the equivalent features. For example, the above features are combined with the technical features disclosed in the present application, but are not limited to the technical features having similar functions.

Claims

An authentication method that includes:

Obtaining an authentication request, where the authentication request includes user face data and a user identifier;

Determining whether the pre-stored first face database includes face data matching the user face data, wherein the face database includes face data and an identity identifier corresponding to the face data;

Generating and transmitting a data request to a predetermined electronic device in response to determining that the first face database does not include face data that matches the user face data, wherein the data request includes the user face data And/or the user identifier, the electronic device generates and returns a request result based on the data request and a pre-stored second face database, wherein the second face database and the first face database Isolated from each other;

And generating an authentication result according to the result of the request, where the authentication result is used to indicate that the authentication passes or the authentication fails.
The method according to claim 1, wherein the data request includes the user identifier; the electronic device searches for a identity identifier matching the user identifier in a second face database, and the found identity identifier The corresponding face data is returned as a result of the request;

And generating, according to the result of the request, an authentication result, including:

Determining whether the received face data matches the user face data;

In response to determining that the received face data matches the user face data, an authentication result indicating that the authentication is passed is generated.
The method according to claim 1, wherein said data request includes said user face data; said electronic device in said second face database searches for face data matching said user face data, The identity corresponding to the found face data is returned as a result of the request;

And generating, according to the result of the request, an authentication result, including:

Determining whether the received identity identifies a match with the user identity;

In response to determining that the received identity identifies a match with the user identity, an authentication result is generated to indicate that the authentication passed.
The method of claim 1, wherein the data request includes the user face data and the user identification; the electronic device in the second face database looks for an identity that matches the user identification Determining whether the face data corresponding to the found identity matches the user face data, and in response to determining that the face data corresponding to the found identity identifier matches the user face data, the authentication consistency information is used as a request. The result is returned;

And generating, according to the result of the request, an authentication result, including:

In response to receiving the authentication agreement information, an authentication result indicating that the authentication is passed is generated.
The method according to claim 1, wherein the determining whether the pre-stored first face database includes face data matching the user face data comprises:

Finding face data matching the user face data in the first face database;

The method further includes:

Determining whether the identity identifier corresponding to the found face data matches the user identifier, in response to finding the face data that matches the user face data;

And in response to determining that the identity identifier corresponding to the found face data matches the user identifier, generating an authentication result indicating that the authentication is passed.
The method according to claim 1, wherein the determining whether the pre-stored first face database includes face data matching the user face data comprises:

In the first face database, searching for an identity that matches the user identifier;

Determining whether the face data corresponding to the found identity identifier matches the user face data in response to finding the identity identifier that matches the user identifier;

The method further includes:

And in response to determining that the face data corresponding to the found identity identifier matches the user face data, generating an authentication result indicating that the authentication is passed.
The method according to any one of claims 1 to 6, wherein the determining whether the pre-stored first face database includes face data matching the user face data further comprises:

Determining, according to the user face data, whether the face indicated by the user face data is a living face;

In response to determining that the face indicated by the user face data is not a living face, an authentication result indicating that the authentication fails is generated.
The method according to any one of claims 1 to 6, wherein the terminal acquires the user face data and the user identifier in response to receiving operation information for triggering a predefined operation, and according to the user The face data and the user identification generate an authentication request.
The method of claim 8, wherein the terminal performs the predefined operation in response to obtaining an authentication result indicating that the authentication is passed.
An electronic device comprising:

One or more processors;

a storage device on which one or more programs are stored,

The one or more programs are executed by the one or more processors such that the one or more processors implement the method of any of claims 1-9.
A computer readable medium having stored thereon a computer program, wherein the program is executed by a processor to implement the method of any of claims 1-9.