WO2021184974A1

WO2021184974A1 - Identity authentication method for privacy protection, and apparatus

Info

Publication number: WO2021184974A1
Application number: PCT/CN2021/074244
Authority: WO
Inventors: 王立彬; 李亮; 郑丹丹
Original assignee: 支付宝(杭州)信息技术有限公司
Priority date: 2020-03-19
Filing date: 2021-01-28
Publication date: 2021-09-23
Also published as: CN111382409A

Abstract

Embodiments of the present description provide an identity authentication method for privacy protection and an apparatus. In the authentication method, a biological feature of a user to be authenticated is obtained; encryption is performed on the biological feature of the user to be authenticated using a private encryption key, and an encrypted feature is obtained; decryption is performed on an encrypted library file, and an original library file is obtained; with respect to the original library file, a second decryption key corresponding to a second encryption key is used and decryption is performed once on each encrypted record within said file, and encrypted records having undergone decryption once are obtained; the encrypted feature and the encrypted records having undergone decryption once are compared, and if the encrypted feature matches with any one among the encrypted records having undergone decryption once, then the user to be authenticated passes identity authentication. Thereby identity authentication can be implemented while performing privacy protection on a biological feature of a user.

Description

Identity authentication method and device for protecting privacy

Technical field

One or more embodiments of this specification relate to the field of computer technology, and in particular to an identity authentication method and device for protecting privacy.

Background technique

With the continuous development of Internet technology, more and more users choose to operate on web pages and obtain various services provided by service providers. In order to prevent the account of a legitimate user from being intercepted by an illegal user, the service provider needs to authenticate the identity of the current user before providing various services to the user.

At present, the identity authentication method can be executed on the server side or directly on the client side. When executed directly on the client, the authentication process can be as follows: the client collects the user's biometrics (such as facial features, fingerprint features, or iris features), and compares the collected biometrics with pre-stored biometrics , Determine whether the user's identity authentication is passed based on the comparison result. However, the biometrics stored on the client are at risk of being stolen, so that the existing identity authentication methods executed by the client cannot realize the privacy protection of the user's biometrics.

Therefore, it is necessary to provide an identity authentication method to improve the security of the user's biological characteristics.

Summary of the invention

One or more embodiments of this specification describe a privacy-protecting identity authentication method and device, which can improve the security of the user's biological characteristics.

In a first aspect, a privacy-protecting identity authentication method is provided, including: obtaining the biological characteristics of the user to be authenticated; using the private encryption key to encrypt the biological characteristics of the user to be authenticated to obtain the encrypted characteristics; The encrypted library file is decrypted to obtain the original library file; for the original library file, the second decryption key corresponding to the second encryption key is used to decrypt each encrypted record once to obtain the Each encrypted record decrypted at one time; comparing the encryption feature with each encrypted record after decrypting once, and if it matches any encrypted record after decrypting once, the identity authentication of the user to be authenticated passes.

In a second aspect, a privacy-protecting identity authentication method is provided, including: obtaining the biological characteristics of the current user; using a private encryption key to encrypt the biological characteristics to obtain the encryption characteristics of the current user; and using a second encryption key Key, the encryption feature of the current user is re-encrypted to obtain the encrypted record of the current user; the encrypted record of the current user is output to the corresponding original library file; when the number of encrypted records in the original library file reaches the threshold , Encrypt the original library file to obtain an encrypted library file; send the encrypted library file to the client, so that the client decrypts the encrypted library file by decrypting each of the encrypted library files once. An encrypted record is compared with the encryption feature of the user to be authenticated to realize the identity authentication of the user to be authenticated.

In a third aspect, a privacy-protecting identity authentication device is provided, which includes: an obtaining unit for obtaining the biometric characteristics of a user to be authenticated; and an encryption unit for using the private encryption key to obtain information from the obtaining unit The biological characteristics of the user to be authenticated are encrypted to obtain the encrypted characteristics; the decryption unit is used to decrypt the encrypted library file to obtain the original library file; the decryption unit is also used to obtain the original library file , Using the second decryption key corresponding to the second encryption key to decrypt each of the encrypted records once to obtain each encrypted record that has been decrypted once; The encryption feature is compared with each encrypted record that has been decrypted once and obtained by the decryption unit, and if it matches any encrypted record that has been decrypted once, the identity authentication of the user to be authenticated passes.

In a fourth aspect, a privacy-protecting identity authentication device is provided, including: an acquisition unit for acquiring the biological characteristics of the current user; an encryption unit for using a private encryption key to verify the biological characteristics The feature is encrypted to obtain the encryption feature of the current user; the encryption unit is also used to use the second encryption key to perform secondary encryption on the encryption feature of the current user to obtain the encryption record of the current user; the output unit is used to The encrypted record of the current user obtained by the encryption unit is output to the corresponding original library file; the encryption unit is also used to compare the original library file when the number of encrypted records in the original library file reaches a threshold. Encrypting to obtain an encrypted library file; a sending unit for sending the encrypted library file obtained by the encrypting unit to the client, so that the client decrypts the encrypted library file through the process Each encrypted record decrypted at one time is compared with the encryption feature of the user to be authenticated to realize the identity authentication of the user to be authenticated.

In a fifth aspect, a computer storage medium is provided with a computer program stored thereon, and when the computer program is executed in a computer, the computer is caused to execute the method of the first aspect or the method of the second aspect.

In a sixth aspect, a computing device is provided, including a memory and a processor, the memory stores executable code, and when the processor executes the executable code, the method of the first aspect or the method of the second aspect is implemented method.

In the privacy-protecting identity authentication method and device provided by one or more embodiments of this specification, when the identity of the user to be authenticated is authenticated, the private encryption key is first used to encrypt the biological characteristics of the user to be authenticated to obtain the encrypted characteristics. After that, decrypt the encrypted library file stored in advance on the client, and decrypt each encrypted record in the original library file once to obtain the biological characteristics of each user encrypted only with the private encryption key. The encryption feature is compared with the biological feature of each user encrypted only with the private encryption key, and based on the comparison result, it is determined whether the identity authentication of the user to be authenticated passes. Since this solution uses the encryption domain data comparison method when authenticating the user's identity, it can effectively improve the security of the user's biometrics. In addition, even if the user's biological characteristics are stolen, the user's biological characteristics stored in advance can be forced to become invalid by changing the private encryption key, thereby effectively avoiding fraudulent behaviors and improving user experience.

Description of the drawings

In order to explain the technical solutions of the embodiments of this specification more clearly, the following will briefly introduce the drawings needed in the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the specification. A person of ordinary skill in the art can obtain other drawings based on these drawings without creative work.

Figure 1 is a schematic diagram of the application scenario of the privacy-protecting identity authentication method provided in this specification;

2 is a flowchart of an identity authentication method for protecting privacy provided by an embodiment of this specification;

FIG. 3 is a flowchart of an identity authentication method for protecting privacy provided by another embodiment of this specification;

4 is a schematic diagram of an identity authentication device for protecting privacy provided by an embodiment of this specification;

Fig. 5 is a schematic diagram of an identity authentication device for protecting privacy provided by another embodiment of this specification.

Detailed ways

The following describes the solutions provided in this specification with reference to the accompanying drawings.

Before describing the solution provided in this specification, the following description of the inventive concept of this solution is provided.

As mentioned above, the existing identity authentication method executed by the client has the risk of the user's biometrics being stolen. In order to improve the security of the user's biological characteristics, the applicant of this application considers to replace the direct comparison of the original data with the comparison of the encrypted domain data when authenticating the user's identity. The specific implementation is as follows:

First, the server generates an encrypted library file and sends the encrypted library file to the client. The encrypted library file here is obtained by encrypting the original library file. There are multiple encrypted records recorded in the original library file, and each of the encrypted records is obtained by at least one encryption of a user's biological characteristics using a private encryption key, and then a second encryption using a second encryption key.

After that, in the process of authenticating the identity of the user to be authenticated, the client first obtains the biological characteristics of the user to be authenticated. Using the above-mentioned private encryption key, the biological characteristics of the user to be authenticated are encrypted to obtain the encrypted characteristics. Then decrypt the encrypted library file to obtain the original library file. For the original library file, use the second decryption key corresponding to the second encryption key to decrypt each encrypted record once to obtain each encrypted record that has been decrypted once. The encryption feature is compared with each encrypted record that has been decrypted once, and if it matches any encrypted record that has been decrypted once, the identity authentication of the user to be authenticated passes.

The above is the inventive concept provided in this specification, and the solution can be obtained based on the inventive concept. The solution will be described in detail below.

Figure 1 is a schematic diagram of the application scenario of the privacy-protecting identity authentication method provided in this specification. In Figure 1, the server can obtain the user's biological characteristics, and sequentially perform encryption, encoding, and secondary encryption on the acquired biological characteristics to obtain an encrypted record. After that, the server can output the encrypted record to the original library file. When the number of encrypted records in the original library file reaches the threshold, the server can encrypt the original library file and can deliver the encrypted library file to the client. After receiving the encrypted library file, the client can decrypt the encrypted library file and decrypt each encrypted record in the original library file after decryption. After that, the identity authentication of the user to be authenticated is achieved by comparing each encrypted record that has been decrypted once with the encryption feature of the user to be authenticated.

The process of generating the encrypted library file on the server side in FIG. 1 will be described in detail below with reference to FIG. 2.

Fig. 2 is a flowchart of an identity authentication method for protecting privacy provided by an embodiment of this specification. The execution subject of the method may be the server in FIG. 1. As shown in FIG. 2, the method may include step 202 to step 212.

Step 202: Acquire the biometric characteristics of the current user.

For example, when the user registers as a member, the biometric characteristics of the current user can be obtained. The biological characteristics here can include physiological characteristics and behavioral characteristics. Among them, the physiological characteristics may include at least one of the following: facial characteristics, fingerprint characteristics, iris characteristics, and so on. Behavioral characteristics can include voice characteristics and gait characteristics.

Taking the biological feature as a face feature as an example, the acquisition process may be as follows: the server receives the face image collected by the client through the collection module (for example, a camera). After that, the face image can be input into the feature extraction model to obtain face features. The feature extraction model here is set on the server, and it can include but is not limited to feature point detection algorithms such as SURF, SIFT, ORB, FAST, and Harris.

It should be understood that the foregoing is only an illustration of the process of obtaining facial features, and when the biological feature is a fingerprint feature, the aforementioned acquisition module may be a fingerprint sensor. The corresponding fingerprint feature acquisition process can be as follows: the server receives the initial fingerprint information collected by the client through the fingerprint sensor. After that, a predetermined operation (for example, averaging) can be performed on the collected initial fingerprint information to obtain fingerprint characteristics.

Step 204: Use the private encryption key to encrypt the acquired biological characteristics to obtain the encryption characteristics of the current user.

It should be noted that the encryption algorithm used by the server here when encrypting can be a predefined encryption algorithm, such as expanding the encrypted data to a specified number of bits. It can also be any public encryption algorithm, such as the elgamal algorithm. The premise is that the encryption algorithm needs to be negotiated in advance by the server and the client. In addition, when the server performs encryption, it can generate corresponding parameters (ie, private encryption keys) for the encryption algorithm, so that the server performs encryption by using the negotiated encryption algorithm and the corresponding private encryption key. In this specification, the above parameter is referred to as a private encryption key because there is no corresponding decryption key for the private encryption key.

It is understandable that the private encryption key generated by the server for the above encryption algorithm is kept secret and will not be disclosed to the outside world.

Optionally, for the aforementioned encryption feature, the server can use an encoding algorithm to encode the encryption feature to obtain an encoding result. In an example, the encoding algorithm may be a base64 algorithm or the like. It is understandable that by performing this encoding step, the storage space occupied by the encryption feature can be saved.

Step 206: Use the second encryption key to perform secondary encryption on the encryption feature of the current user to obtain the encryption record of the current user.

For the aforementioned encryption feature, or the result of the encryption feature, the server can perform secondary encryption on it to obtain the encrypted record of the user. Here, the encryption algorithm used by the server for secondary encryption can be any public encryption algorithm, such as the elgamal algorithm. The encryption algorithm used in the secondary encryption can also be negotiated in advance by the server and the client. Similarly, when the server performs secondary encryption, it can also generate the corresponding parameters (ie, the second encryption key) for the encryption algorithm, so that the server performs the secondary encryption by using the negotiated encryption algorithm and the corresponding second encryption key. encryption. It should be noted that the second encryption key here corresponds to the second decryption key.

Step 208: Output the encrypted record of the current user to the corresponding original library file.

Step 210: When the number of encrypted records in the original library file reaches the threshold, encrypt the original library file to obtain an encrypted library file.

After obtaining the user's encrypted record, the server can output the user's encrypted record to the corresponding original library file. The original library file can be generated in advance by the server. After that, it can be judged whether the number of encrypted records in the original library file reaches the threshold, and if so, the original library file can be encrypted to obtain the encrypted library file.

It should be noted that the encryption algorithm used for encrypting the original library file can also be any public encryption algorithm negotiated in advance by the server and the client. In addition, when the server encrypts the original library file, it can also generate corresponding parameters for the encryption algorithm (hereinafter referred to as the database encryption key), so that the server uses the negotiated encryption algorithm and the database encryption key to compare the original library file Encrypted. The database encryption key corresponds to the database decryption key.

It should also be noted that in practical applications, the number of generated encrypted library files can be multiple.

Step 212: Send the encrypted library file to the client, so that after decrypting the encrypted library file, the client compares each encrypted record that has been decrypted once with the encryption characteristics of the user to be authenticated to realize the user's information to be authenticated. Authentication.

It can be seen from the above that, in the embodiment of this specification, the user's biometrics sent by the server to the client are encrypted with multiple layers, so this solution can effectively improve the security of the user's biometrics.

The following describes the user's identity authentication process based on the encrypted library file issued by the server on the client.

Fig. 3 is a flowchart of an identity authentication method for protecting privacy provided by another embodiment of this specification. The execution subject of the method may be the client in FIG. 1. As shown in FIG. 3, the method may include step 302 to step 310.

Step 302: Obtain the biological characteristics of the user to be authenticated.

For example, when the user to be authenticated requests a certain service (such as a payment service) from the client, the biometric characteristics of the user to be authenticated can be obtained. The biological characteristics here can include physiological characteristics and behavioral characteristics. Among them, the physiological characteristics may include at least one of the following: facial characteristics, fingerprint characteristics, iris characteristics, and so on. Behavioral characteristics can include voice characteristics and gait characteristics.

Taking the biometric feature as the face feature as an example, the acquisition process may be: the client terminal collects the face image of the user to be authenticated through a collection module (for example, a camera). After that, the face image can be input into the feature extraction model to obtain face features. The feature extraction model here is set on the client, and it can include but is not limited to feature point detection algorithms such as SURF, SIFT, ORB, FAST, and Harris.

It should be understood that the foregoing is only an illustration of the process of obtaining facial features, and when the biological feature is a fingerprint feature, the aforementioned acquisition module may be a fingerprint sensor. The corresponding fingerprint feature acquisition process may be: the client uses the fingerprint sensor to collect the initial fingerprint information of the user to be authenticated. After that, a predetermined operation (for example, averaging) can be performed on the collected initial fingerprint information to obtain fingerprint characteristics.

Step 304: Use the private encryption key to encrypt the biological characteristics of the user to be authenticated to obtain the encrypted characteristics.

The private encryption key here is the private encryption key used by the server to encrypt the user's biometrics once. In addition, the encryption algorithm used here is also the predefined one used by the server for one-time encryption. Encryption algorithm or any public encryption algorithm. In other words, the encryption algorithm and private encryption key used in this step are the same as those in step 204.

Step 306: Decrypt the encrypted library file to obtain the original library file.

It should be understood that when the number of encrypted library files is more than one, each encrypted library file may be sequentially read into the memory and decrypted here. After that, step 308 to step 310 are performed for each original library file obtained after decryption.

In step 306, the key used to decrypt the encrypted library file is the aforementioned database decryption key, which may be generated by the server when generating the corresponding database encryption key for the encryption algorithm of the original library file. Taking the encryption algorithm as the elgamal algorithm as an example, since the corresponding decryption algorithm is the elgamal algorithm, when the database encryption key is generated, the database decryption key corresponding to the database encryption key can be generated at the same time.

Step 308: For the original library file, use the second decryption key corresponding to the second encryption key to decrypt each encrypted record once to obtain each encrypted record that has undergone one decryption.

The second decryption key here may be generated when the server generates the corresponding second encryption key for the encryption algorithm used in the secondary encryption. Taking the encryption algorithm as the elgamal algorithm as an example, since the corresponding decryption algorithm is the elgamal algorithm, when the second encryption key is generated, the second decryption key corresponding to the second encryption key can be generated at the same time.

It should be noted that when the server does not perform the encoding step, each encrypted record that has been decrypted once is the encrypted feature of each user after the server uses the private encryption key to encrypt the biological characteristics of multiple users once. . When the server also performs the encoding step, after obtaining the above-mentioned encrypted records that have been decrypted once, the server can also decode them based on the decoding algorithm corresponding to the encoding algorithm to obtain the decoded encrypted records . Furthermore, each encrypted record after decoding is the encrypted feature of each user after the server uses the private encryption key to encrypt the biological characteristics of multiple users once.

It should be noted that in practical applications, the execution order of the above steps 302 to 304 and steps 306 to 308 can also be interchanged, or can be executed in parallel, which is not limited in this specification.

Step 310: Compare the encryption feature of the user to be authenticated with each encrypted record that has been decrypted once, and if it matches any encrypted record that has been decrypted once, the identity authentication of the user to be authenticated passes.

In an example, the step of comparing may specifically include: sequentially calculating the similarity between the encryption feature of the user to be authenticated and each encrypted record that has been decrypted once. The similarity here can include but is not limited to cosine similarity, Euclidean distance, Manhattan distance, Pearson correlation coefficient, and so on. If the similarity with any encrypted record that has been decrypted once is greater than the threshold, it can be considered that the encryption feature of the user to be authenticated matches the encrypted record that has been decrypted once, and the identity of the user to be authenticated is authenticated.

It can be concluded from the above that the embodiment of this specification adopts the method of comparing encrypted domain data when authenticating the identity of the user to be authenticated, which can avoid storing the user’s original biological characteristics on the client side, thereby effectively improving the user’s biological characteristics. Characteristic security. In addition, because this solution adopts the method of comparing encrypted domain data, when the user's biological characteristics are stolen, the private encryption key can be changed to force the pre-stored user's biological characteristics to become invalid. In the case that the pre-stored user's biometrics are invalid, the comparison process will fail, which can effectively avoid fraudulent behaviors, thereby improving user experience.

Corresponding to the above-mentioned privacy-protecting identity authentication method, an embodiment of this specification also provides a privacy-protecting identity authentication device, which is set on the client. The client here maintains an encrypted library file, which is obtained by encrypting the original library file. There are multiple encrypted records recorded in the original library file, and each of the encrypted records is obtained at least by first encrypting a user's biological characteristics with a private encryption key once, and then using a second encryption key for a second encryption. As shown in Figure 4, the device may include the following units.

The acquiring unit 402 is configured to acquire the biological characteristics of the user to be authenticated.

The biological characteristics here can include physiological characteristics and behavioral characteristics. Among them, the physiological characteristics may include at least one of the following: facial characteristics, fingerprint characteristics, iris characteristics, and so on. Behavioral characteristics can include voice characteristics and gait characteristics.

The encryption unit 404 is configured to use the private encryption key to encrypt the biological characteristics of the user to be authenticated obtained by the obtaining unit 402 to obtain the encrypted characteristics.

The decryption unit 406 is used to decrypt the encrypted library file to obtain the original library file.

The decryption unit 406 is also configured to use the second decryption key corresponding to the second encryption key to decrypt each encrypted record once for the original library file to obtain each encrypted record that has been decrypted once.

The comparison unit 408 is configured to compare the encryption feature obtained by the encryption unit 404 with each encrypted record obtained by the decryption unit 406 after one decryption, and if it matches any encrypted record after one decryption, the user to be authenticated The identity authentication passed.

The function of each functional module of the device in the above-mentioned embodiment of this specification can be realized by the steps of the above-mentioned method embodiment. Therefore, the specific working process of the device provided in an embodiment of this specification will not be repeated here.

The privacy-protecting identity authentication device provided by an embodiment of this specification can effectively improve the security of the user's biological characteristics.

Corresponding to the aforementioned privacy-protecting identity authentication method, an embodiment of this specification also provides a privacy-protecting identity authentication device, which is set on the server. As shown in Figure 5, the device may include the following units.

The acquiring unit 502 is configured to acquire the biological characteristics of the current user.

The encryption unit 504 is configured to use the private encryption key to encrypt the biological characteristics obtained by the obtaining unit 502 to obtain the encryption characteristics of the current user.

The encryption unit 504 is also configured to use the second encryption key to perform secondary encryption on the encryption feature of the current user to obtain the encryption record of the current user.

The output unit 506 is configured to output the encrypted record of the current user obtained by the encryption unit 504 to the corresponding original library file.

The encryption unit 504 is further configured to encrypt the original library file to obtain the encrypted library file when the number of encrypted records in the original library file reaches the threshold.

The sending unit 508 is configured to send the encrypted library file obtained by the encrypting unit 504 to the client, so that after decrypting the encrypted library file, the client decrypts each encrypted record that has been decrypted once and the encryption characteristics of the user to be authenticated. The comparison is performed to realize the identity authentication of the user to be authenticated.

Optionally, the device may further include: an encoding unit (not shown in the figure) for encoding the encryption feature of the current user according to an encoding algorithm to obtain an encoding result.

The encryption unit 504 may be specifically configured to: use the second encryption key to perform secondary encryption on the encoding result to obtain the encrypted record of the current user.

On the other hand, the embodiments of this specification provide a computer-readable storage medium on which a computer program is stored, and when the computer program is executed in a computer, the computer is caused to execute the method shown in FIG. 2 or FIG. 3.

On the other hand, the embodiments of the present specification provide a computing device, including a memory and a processor, the memory stores executable code, and when the processor executes the executable code, the implementation shown in FIG. 2 or FIG. 3 is implemented. Indicates the method.

The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, as for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and for related parts, please refer to the part of the description of the method embodiment.

The steps of the method or algorithm described in conjunction with the disclosure of this specification can be implemented in a hardware manner, or can be implemented in a manner in which a processor executes software instructions. Software instructions can be composed of corresponding software modules, which can be stored in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, mobile hard disk, CD-ROM or any other form of storage known in the art Medium. An exemplary storage medium is coupled to the processor, so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium may also be an integral part of the processor. The processor and the storage medium may be located in the ASIC. In addition, the ASIC may be located in the server. Of course, the processor and the storage medium may also exist as discrete components in the server.

Those skilled in the art should be aware that, in one or more of the above examples, the functions described in the present invention can be implemented by hardware, software, firmware, or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on the computer-readable medium. The computer-readable medium includes a computer storage medium and a communication medium, where the communication medium includes any medium that facilitates the transfer of a computer program from one place to another. The storage medium may be any available medium that can be accessed by a general-purpose or special-purpose computer.

The foregoing describes specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims can be performed in a different order than in the embodiments and still achieve desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or sequential order shown in order to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

The specific implementations described above further describe the purpose, technical solutions and beneficial effects of this specification. It should be understood that the above are only specific implementations of this specification and are not intended to limit the description of this specification. The scope of protection, any modification, equivalent replacement, improvement, etc. made on the basis of the technical solution of this specification shall be included in the scope of protection of this specification.

Claims

A privacy-protecting identity authentication method, executed by a client; the client maintains an encrypted library file, which is obtained by encrypting the original library file; the original library file records multiple encrypted records, Each of the encrypted records is obtained by at least one encryption of a user's biological characteristics using a private encryption key, and then a second encryption using a second encryption key; the method includes:

Obtain the biological characteristics of the user to be authenticated;

Use the private encryption key to encrypt the biological characteristics of the user to be authenticated to obtain encrypted characteristics;

Decrypt the encrypted library file to obtain the original library file;

For the original library file, use a second decryption key corresponding to the second encryption key to decrypt each encrypted record once to obtain each encrypted record that has been decrypted once;

The encryption feature is compared with each encrypted record that has been decrypted once, and if it matches any encrypted record that has been decrypted once, the identity authentication of the user to be authenticated passes.
The method according to claim 1, wherein the biological characteristics include physiological characteristics and behavioral characteristics; the physiological characteristics include at least one of the following: facial characteristics, fingerprint characteristics, and iris characteristics; the behavioral characteristics include voice characteristics and gait feature.
A privacy-protecting identity authentication method, executed by the server; the method includes:

Obtain the current user's biological characteristics;

Use a private encryption key to encrypt the biological characteristics to obtain the encryption characteristics of the current user;

Use the second encryption key to perform secondary encryption on the encryption feature of the current user to obtain the encryption record of the current user;

Output the encrypted record of the current user to the corresponding original library file;

When the number of encrypted records in the original library file reaches a threshold, encrypt the original library file to obtain an encrypted library file;

Send the encrypted library file to the client, so that the client, after decrypting the encrypted library file, compares each encrypted record that has been decrypted once with the encryption characteristics of the user to be authenticated. Describe the identity authentication of the user to be authenticated.
The method according to claim 3, before said using the second encryption key to perform secondary encryption on the encryption features of the current user, the method further comprises:

Encoding the encryption feature of the current user according to the encoding algorithm to obtain an encoding result;

The using the second encryption key to perform secondary encryption on the encryption feature of the current user includes:

Use the second encryption key to perform secondary encryption on the encoding result to obtain an encrypted record of the current user.
The method according to any one of claims 3 or 4, wherein the biological characteristics include physiological characteristics and behavioral characteristics; the physiological characteristics include at least one of the following: facial characteristics, fingerprint characteristics, and iris characteristics; the behavioral characteristics include Voice characteristics and gait characteristics.
A privacy-protecting identity authentication device is set on a client terminal; the client terminal maintains an encrypted library file obtained by encrypting the original library file; the original library file records multiple encrypted records, Each of the encrypted records is obtained at least by first encrypting the biological characteristics of a user using a private encryption key, and then using a second encryption key to perform secondary encryption; the device includes:

The obtaining unit is used to obtain the biological characteristics of the user to be authenticated;

An encryption unit, configured to use the private encryption key to encrypt the biological characteristics of the user to be authenticated acquired by the acquisition unit to obtain encrypted characteristics;

The decryption unit is used to decrypt the encrypted library file to obtain the original library file;

The decryption unit is further configured to use a second decryption key corresponding to the second encryption key to decrypt each encrypted record once for the original library file to obtain each encrypted record that has been decrypted once. ；

The comparison unit is configured to compare the encryption feature obtained by the encryption unit with each encrypted record obtained by the decryption unit after one decryption, and if it matches any encrypted record after one decryption, then The identity authentication of the user to be authenticated passes.
The device according to claim 6, wherein the biological characteristics include physiological characteristics and behavioral characteristics; the physiological characteristics include at least one of the following: facial characteristics, fingerprint characteristics, and iris characteristics; the behavioral characteristics include voice characteristics and gait feature.
A privacy-protecting identity authentication device, which is set on the server; the device includes:

The acquiring unit is used to acquire the biological characteristics of the current user;

An encryption unit, configured to use a private encryption key to encrypt the biological characteristics acquired by the acquisition unit to obtain the encryption characteristics of the current user;

The encryption unit is further configured to use the second encryption key to perform secondary encryption on the encryption feature of the current user to obtain the encryption record of the current user;

The output unit is configured to output the encrypted record of the current user obtained by the encryption unit to the corresponding original library file;

The encryption unit is further configured to encrypt the original library file to obtain an encrypted library file when the number of encrypted records in the original library file reaches a threshold;

The sending unit is configured to send the encrypted library file obtained by the encryption unit to the client, so that the client decrypts the encrypted library file by combining the encrypted records that have been decrypted once with The encryption features of the user to be authenticated are compared to realize the identity authentication of the user to be authenticated.
The device according to claim 8, further comprising:

An encoding unit, used to encode the encryption feature of the current user according to an encoding algorithm to obtain an encoding result;

The encryption unit is specifically used for:

Use the second encryption key to perform secondary encryption on the encoding result to obtain an encrypted record of the current user.
The device according to any one of claims 8 or 9, wherein the biological characteristics include physiological characteristics and behavioral characteristics; the physiological characteristics include at least one of the following: facial characteristics, fingerprint characteristics, and iris characteristics; the behavioral characteristics include Voice characteristics and gait characteristics.
A computer-readable storage medium having a computer program stored thereon, and when the computer program is executed in a computer, the computer is caused to execute the method described in any one of claims 1-2 or any one of claims 3-5 The method described in one item.
A computing device, comprising a memory and a processor, the memory is stored with executable code, and when the processor executes the executable code, the method or claim in any one of claims 1-2 is implemented The method described in 3-5.