WO2022134007A1 - 设备鉴权方法、终端设备、服务器和计算机设备 - Google Patents

设备鉴权方法、终端设备、服务器和计算机设备 Download PDF

Info

Publication number
WO2022134007A1
WO2022134007A1 PCT/CN2020/139433 CN2020139433W WO2022134007A1 WO 2022134007 A1 WO2022134007 A1 WO 2022134007A1 CN 2020139433 W CN2020139433 W CN 2020139433W WO 2022134007 A1 WO2022134007 A1 WO 2022134007A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
preset
identity
terminal device
feature data
Prior art date
Application number
PCT/CN2020/139433
Other languages
English (en)
French (fr)
Inventor
胡鹏
唐小军
张宁
Original Assignee
京东方科技集团股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 京东方科技集团股份有限公司 filed Critical 京东方科技集团股份有限公司
Priority to US18/036,658 priority Critical patent/US20240048558A1/en
Priority to CN202080003695.2A priority patent/CN115668862A/zh
Priority to PCT/CN2020/139433 priority patent/WO2022134007A1/zh
Publication of WO2022134007A1 publication Critical patent/WO2022134007A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44—Program or device authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/105—Multiple levels of security

Definitions

  • the present disclosure relates to the field of communication technologies, and in particular, to a device authentication method, a server, a computer device, and a readable storage medium.
  • embodiments of the present disclosure provide a device authentication method, a server, a computer device, and a readable storage medium.
  • the present disclosure provides a device authentication method for a server, and the device authentication method includes the following steps:
  • the preset device table including a preset terminal device code
  • the physical encoding information of the terminal device does not match all preset terminal device encodings in the preset device table and the total number of preset terminal device encodings in the preset device reaches a threshold, It is determined that the authentication of the terminal device fails.
  • the server in the case of receiving authentication requests sent by multiple terminal devices, performs authentication on multiple terminal devices in a concurrent mode.
  • the authentication request further includes identity feature data for identity authentication; the device authentication method further includes:
  • feature extraction is performed on the identity feature data according to a feature extraction model to obtain target feature data
  • Identity authentication is performed according to the target feature data.
  • the authentication request is sent to the server by means of an Http Post request.
  • the authentication request uses JSON to transmit data.
  • the authentication request is transmitted after being encrypted and encoded with a string.
  • the server includes an identity feature database that stores a correspondence between user identity information and target feature data, and performing identity authentication according to the target feature data includes:
  • the target feature data is compared with the preset identity feature data for identity authentication, user identity information is established when the identity authentication is successful, and the user identity information and the target feature data are added to the identity feature database.
  • the target feature data is compared with preset identity feature data for identity authentication, and when the identity authentication is successful, user identity information is established and the user identity information and the target feature are compared.
  • Data added to the identity feature database includes:
  • the server includes an identity feature database that stores a correspondence between user identity information and target feature data, and performing identity authentication according to the target feature data includes:
  • the target feature data is compared with the target feature data in the identity feature database to perform identity authentication, and when the identity authentication is successful, the user identity information corresponding to the target feature data is determined.
  • the performing identity authentication by comparing the target feature data with the target feature data in the identity feature database, and determining the user identity information corresponding to the target feature data when the identity authentication is successful includes: :
  • the confidence level of the comparison result between the target feature data and the target feature data of the identity feature database is greater than the second threshold, it is determined that the identity authentication is successful.
  • the device authentication method includes:
  • the server uses a concurrent mode to perform feature extraction on the identity feature data corresponding to the multiple terminal devices.
  • the present disclosure provides a server, the server comprising:
  • a receiving module configured to receive an authentication request sent by at least one terminal device, where the authentication request includes physical code information of the terminal device;
  • a parsing module configured to parse the authentication request to authenticate the physical coding information of the terminal device according to a preset device table, where the preset device table includes preset terminal device codes;
  • An authentication module configured to determine that the terminal device has passed the authentication when the physical code information of the terminal device matches the preset terminal device code, and that the terminal device has passed the authentication. In the case where the physical encoding information does not match the preset terminal device encoding and the number of the preset terminal device encodings does not reach the threshold, in response to the operation of adding the device table and determining that the terminal device is authenticated, and in all When the physical coding information of the terminal device does not match all the preset terminal device codes in the preset device table and the total number of preset terminal device codes in the preset device reaches the threshold, determine the The terminal device authentication failed.
  • the present disclosure also provides a computer device, the computer device includes one or more processors and a memory, the memory stores a computer program, and when the computer program is executed by the processor, any of the above The steps of the device authentication method of the embodiment.
  • the present disclosure also provides a non-volatile computer-readable storage medium storing a computer program, and when the computer program is executed by one or more processors, the device authentication method of any of the foregoing embodiments can be implemented. step.
  • the device authentication method server, computer device and readable storage medium of the present disclosure, by receiving and parsing the authentication request sent by the terminal device, and authenticating the terminal device according to the preset device table, the communication between the terminal device and the server can be guaranteed. Safety and reliability.
  • FIG. 1 is a schematic flowchart of a device authentication method according to some embodiments of the present disclosure.
  • FIG. 2 is a schematic structural diagram of a computer device according to some embodiments of the present disclosure.
  • FIG. 3 is a block diagram of a server according to some embodiments of the present disclosure.
  • FIG. 4 is a schematic flowchart of a device authentication method according to some embodiments of the present disclosure.
  • FIG. 5 is a schematic flowchart of a device authentication method according to some embodiments of the present disclosure.
  • FIG. 6 is a schematic flowchart of a device authentication method according to some embodiments of the present disclosure.
  • the present disclosure provides a device authentication method for the server 110, and the device authentication method includes the following steps:
  • S11 Receive an authentication request sent by at least one terminal device
  • Embodiments of the present disclosure provide a computer device 100 .
  • the computer device 100 includes a processor 102 and a memory 104.
  • the memory 104 stores a computer program 106.
  • the computer program 106 When the computer program 106 is executed by the processor 102, it realizes: receives an authentication request sent by at least one terminal device; The physical coding information of the terminal equipment is authenticated; in the case that the physical coding information of the terminal equipment matches the preset terminal equipment code, it is determined that the authentication of the terminal equipment has passed; When all preset terminal equipment codes do not match and the total number of preset terminal equipment codes in the preset equipment does not reach the threshold, the physical code information of the terminal equipment is added to the preset equipment in response to the operation of adding the equipment table Table and determine that the terminal equipment is authenticated; the physical coding information of the terminal equipment does not match all the preset terminal equipment codes in the preset equipment table and the preset terminal equipment codes in the preset equipment When the total number of , reaches the threshold, it is determined that
  • the embodiment of the present disclosure also provides a server 110 , and the device authentication method of the embodiment of the present disclosure may be implemented by the server 110 .
  • the server 110 includes a receiving module 112 , a parsing module 114 and an authentication module 116 .
  • S11 may be implemented by the receiving module 112
  • S12 may be implemented by the parsing module 114
  • S13 - S15 may be implemented by the authentication module 116 .
  • the receiving module 112 is used to receive an authentication request sent by at least one terminal device
  • the parsing module 114 is used to parse the authentication request to authenticate the physical coding information of the terminal device according to the preset device table
  • the authentication module 116 is used to In the case where the physical coding information of the terminal equipment matches the preset terminal equipment coding, it is determined that the terminal equipment is authenticated, and that the physical coding information of the terminal equipment matches all the preset terminal equipment codes in the preset equipment table.
  • the physical code information of the terminal equipment is added to the preset equipment table and it is determined that the terminal equipment authentication passes. , and is used to determine that the terminal device authentication fails when the physical encoding information of the terminal device does not match the preset terminal device encoding and the number of preset terminal device encodings reaches a threshold.
  • the terminal device 100 and server 110 of the present disclosure by receiving and parsing the authentication request sent by the terminal device, the terminal device is authenticated according to the preset device table, and the communication between the terminal device and the server 110 can be ensured security and reliability.
  • the authentication request includes the physical coding information of the terminal device, wherein the physical coding information can be the hardware specific number of the terminal device, the international mobile equipment identification code, the media access control address, etc. used to identify the device characteristics of the terminal device or The unique identification, the physically encoded information is used for authentication between the server 110 and the terminal device.
  • Terminal devices can be smart phones, tablet computers, personal computers, teller machines, gates, cameras, and other devices.
  • the preset equipment table includes preset terminal equipment codes, and the preset terminal equipment codes can be set according to physical coding information of the terminal equipment. It should be noted that the number of preset terminal device codes contained in the preset device table may be fixed or not.
  • the number of preset terminal equipment codes contained in the preset equipment table is fixed, that is, only a preset number of preset terminal equipment codes can be added to the preset equipment table.
  • the preset number can be set according to the usage scenarios of the identity authentication, the processor performance of the server 110, user requirements and other parameters, which are not specifically limited.
  • the preset number of terminal device codes in the preset device table can be set to 100 , 200, 300, 500, etc.
  • the number of preset terminal device codes in the preset device table can be kept relatively stable, and the security and stability of the server 110 can be maintained.
  • the number of preset terminal device codes included in the preset device table is not fixed, that is, the number of preset terminal device codes added in the preset device table can vary randomly.
  • the server 110 After receiving the authentication request sent by the terminal device, the server 110 parses the authentication request, that is, matches the physical code information of the terminal device in the authentication request with the preset terminal device code, and determines whether the authentication of the terminal device is passed according to the matching result.
  • the matching of the physical encoding information with the preset terminal device encoding may mean that the physical encoding information is completely consistent with the preset terminal device encoding, or it may refer to the preset terminal device encoding including all the physical encoding information, or the physical encoding information.
  • the encoding information includes all the preset terminal equipment encoding.
  • the physical code information of the terminal device matches the preset terminal device code, and the server 110 determines that the terminal device is authenticated.
  • the physical encoding information of the terminal device does not match the preset terminal device encoding, and the number of preset terminal device encodings contained in the preset device table is fixed, and the preset terminal device encoding stored in the preset device table The number of codes is less than the preset number. Since the physical encoding information of the terminal device does not match the preset terminal device encoding, that is, the physical encoding information of the terminal device is not stored in the preset device table, the terminal device authentication fails. At this time, the server 110 adds the physical coding information of the terminal device to the preset device table according to the operation of adding the device table, and determines that the authentication of the terminal device is passed.
  • the physical encoding information of the terminal device does not match the preset terminal device encoding, and the number of preset terminal device encodings contained in the preset device table is fixed, and the preset terminal device encoding stored in the preset device table The number of device codes is greater than or equal to the preset number. Because the physical coding information of the terminal device does not match the preset terminal device coding, that is to say, the physical coding information of the terminal device is not stored in the preset device table, the terminal device authentication fails, and the preset device table stored in the preset device table. Assuming that the number of terminal equipment codes has reached a preset number, it is determined that the terminal equipment authentication fails.
  • the number of preset terminal device codes in the preset device table can be kept relatively stable, and the security and stability of the server 110 can be maintained.
  • the device authentication method includes:
  • S16 In the case of receiving the authentication requests sent by the multiple terminal devices, use the concurrent mode to authenticate the multiple terminal devices.
  • S16 may be implemented by the authentication module 116 .
  • the authentication module 116 is configured to use the concurrent mode to authenticate the multiple terminal devices in the case of receiving the authentication requests sent by the multiple terminal devices.
  • the processor 102 is configured to authenticate multiple terminal devices in a concurrent mode when receiving authentication requests sent by multiple terminal devices.
  • the server 110 can simultaneously respond to authentication requests of multiple terminal devices, and it is understandable that the terminal device here can be any terminal device. After the authentication of the terminal device is passed, the server 110 in the concurrent mode can simultaneously respond to data processing requests of multiple authenticated terminal devices.
  • the authentication efficiency can be improved, the time for the user to wait for the authentication result can be shortened, and the user experience can be optimized.
  • the authentication request further includes identity feature data for identity authentication;
  • the device authentication method includes:
  • S18 Perform identity authentication according to the target feature data.
  • S17 and S18 may be implemented by the authentication module 116 .
  • the authentication module 116 is configured to perform feature extraction on the identity feature data according to the feature extraction model to obtain the target feature data after the authentication of the terminal device is passed. and for authentication based on target feature data.
  • the processor 102 is configured to perform feature extraction on the identity feature data according to the feature extraction model to obtain target feature data after the terminal device is authenticated. and for authentication based on target feature data.
  • the feature extraction model may adopt a model based on a convolutional neural network. In this way, it is possible to effectively learn from a large number of samples, avoid a complex feature extraction process, make the processing of identity feature data faster, and shorten the time for users to wait for an identity authentication result.
  • the identity feature data in the feature extraction model can be stored as a JSON string.
  • request instructions can be flexibly added to call different data, which is suitable for the application of the device authentication method in multiple occasions, and the specific application method is not limited.
  • an instruction to request to call the data representing the gender of the character in the identity feature data can be added, and to call the data representing the gender of the character to perform operations such as service recommendation.
  • various usage scenarios can be taken into account, and the application scenarios of the device authentication method can be expanded.
  • the identity feature data may be data such as face image data, fingerprint data, voiceprint data, and/or pupil data that can be used to identify a person's identity, which is not specifically limited.
  • the target feature data may be some feature information in the identity feature data, which is used to identify the identity of a specific person.
  • the identity feature data is face image data.
  • the feature extraction model performs feature extraction on the face image data, and can convert the face features into multiple data, that is, target feature data, and store the target feature data in the server 110 .
  • the extracted 512-dimensional data is stored in the server 110 as target feature data. In this way, the effect of facilitating subsequent identity feature comparison can be achieved.
  • the terminal device detects the face image according to the face position detection model to obtain the face position frame, and according to the face key point detection model, the face position frame is located.
  • the face image is detected to obtain face key points
  • the face key points are processed to obtain frontal face image data
  • the face image is detected according to the face angle detection model to obtain the face deflection angle
  • the frontal face image is detected according to the face image.
  • the data and the face deflection angle determine the target frontal face image data.
  • the processing of the face key points includes obtaining the reference key point data of the frontal face in a preset size, and obtaining the frontal face image data by using coordinate point interpolation transformation in the spatial domain according to the reference key point data and the face key points.
  • the terminal device detects the face image according to the face position detection model, and can obtain the face position frame.
  • the face position frame can represent the position of the face in the face image, which is convenient for subsequent detection of key points of the face and detection of the deflection angle of the face.
  • the confidence level of the face position frame can be set, so that a good balance can be achieved between the recall rate of face position detection and the accuracy of face position detection, that is, to make the face position detection
  • the recall rate of position detection is high
  • the precision of face position detection is also high.
  • the confidence level can be used to characterize the reliability of the face recognition result. Relatively speaking, the higher the confidence level, the higher the reliability of the face recognition result. On the contrary, the lower the confidence level, the higher the reliability of the face recognition result. Low. It can be considered that the recall rate of the face position detection represents the recall rate of the face position in the face image, and the accuracy of the face position detection represents the accuracy of calibrating the face position in the face image.
  • the confidence level of the face position frame For example, set the confidence level of the face position frame to 0.9, so that the recall rate of face position detection is greater than 0.99, and the accuracy of face position detection is greater than 0.98, that is, the recall of the face position in the face image
  • the accuracy rate and the accuracy of calibrating the face position in the face image are both high. In this way, the accurate recognition of the face image can be realized, and the user experience can be optimized in actual use.
  • the face image where the face position frame is located is detected according to the face key point detection model to obtain face key points, and the face key points are processed to obtain frontal face image data.
  • the key points of the face can be the five points of the two eye centers, the two corners of the mouth and the tip of the nose, or the contour lines of the three organs of the eyes, nose and mouth, or the eyebrows, eyes, nose, mouth,
  • the contour of one or more parts, such as the mandible, is not specifically limited.
  • the face key points are detected in the face image where the face position frame is located, and the face key points are processed. Get face image data.
  • the face angle detection model it is judged whether the face deflection angle exceeds the predetermined deflection angle according to the face position frame obtained after processing by the face position detection model and the face key points obtained after processing by the face key point detection model Threshold, to determine the face image whose face deflection angle does not exceed the deflection angle threshold.
  • the deflection angle threshold can be set according to parameters such as the detection accuracy of the face angle detection model, the use scene of the face angle detection, etc., which is not specifically limited.
  • the angle range is 15 degrees to 30 degrees, and it can be 15 degrees , 20 degrees, 25 degrees, 30 degrees, etc.
  • the face angle detection model can directly obtain the face deflection angle, and process the face image according to the different face deflection angles.
  • the corresponding frontal face image data in the face key point detection model is determined as the target frontal face image data.
  • the face position detection model, the face key point detection model and the face angle detection model can adopt the model based on the convolutional neural network. In this way, it can effectively learn from a large number of samples, avoid the complex feature extraction process, and make the The processing speed of face images is faster, and the time for users to wait for the authentication result is shortened.
  • the face in the face image is detected by a plurality of detection models, and the target frontal face image data is obtained, thereby realizing the accurate recognition of the face image.
  • the preset size can be set according to parameters such as the usage scenario of identity authentication and the accuracy of face detection, which is not specifically limited.
  • the benchmark key point data can be obtained in advance by providing a large amount of data, machine learning, etc.
  • the interpolation transformation method may be the nearest neighbor element method, bilinear interpolation method, cubic interpolation method, etc., which can be set according to the usage scenarios of identity authentication, the accuracy of face detection and other parameters, which are not limited here.
  • the face in the face image is detected by a plurality of detection models, and the target frontal face image data is obtained, thereby realizing the accurate recognition of the face image.
  • the server 110 After the authentication of the terminal device is passed, the server 110 performs feature extraction on the identity feature data according to the feature extraction model to obtain target feature data, and performs identity authentication according to the target feature data.
  • the security of the communication between the server 110 and the terminal device can be ensured, the time for the user to wait for the identity authentication result can be shortened, and the user experience can be optimized.
  • the authentication request is sent by means of an Http Post request.
  • Http Post since the Http Post will not be cached or stored in the log of the server 110, using the Http Post to send the authentication request can ensure the security of the communication between the server 110 and the terminal device. And since Http Post can send a larger amount of data and more data types, sending the authentication request by means of Http Post request can not only ensure the communication security between the server 110 and the terminal device, but also can transmit a larger amount of data. data, taking into account more usage scenarios.
  • the authentication request uses JSON to transmit data.
  • the authentication request may be sent in the form of JavaScript Object Notation (JavaScript Object Notation, JSON).
  • JSON JavaScript Object Notation
  • request commands can be flexibly added to call different data, which is suitable for multiple applications of device authentication, and the specific application method is not limited. For example, an instruction to request to call the data representing the gender of the character in the identity feature data can be added, and to call the data representing the gender of the character to perform operations such as service recommendation.
  • the device authentication can take into account multiple usage scenarios, and the application scenarios of the device authentication method can be expanded.
  • the authentication request is transmitted after being encrypted and encoded with a string.
  • the authentication request is transmitted in the server 110 after being encrypted and encoded with a character string.
  • a character string For example, encryption encoding methods such as base64, base32, and base16 may be used. In this way, the communication security between the server 110 and the terminal device can be further ensured.
  • the server 110 includes an identity feature database storing the correspondence between user identity information and target feature data, and S18 includes:
  • S182 Compare the target feature data with the preset identity feature data for identity authentication, establish user identity information when the identity authentication is successful, and add the user identity information and the target feature data to the identity feature database.
  • S181 and S182 may be implemented by the authentication module 116 .
  • the authentication module 116 is used to obtain the preset identity feature data, and to compare the target feature data with the preset identity feature data for identity authentication, and when the identity authentication is successful, the user identity information is established and the user identity Information and target feature data are added to the identity feature database.
  • the processor 102 is configured to obtain preset identity feature data, and to compare the target feature data with the preset identity feature data to perform identity authentication, establish user identity information when the identity authentication is successful, and Add user identity information and target feature data to the identity feature database.
  • the preset identity feature data is used for comparison with the target feature data, and the preset identity feature data is set according to the type of the target feature data, such as face image data, fingerprint data, voiceprint data and/or pupil data Data, etc., are not specifically limited.
  • the preset identity feature data may be obtained by accessing other servers 110 or other terminal devices, or may be preset identity feature data stored locally by the server 110 .
  • the target feature data is compared with the preset identity feature data for identity authentication, and if the identity authentication is successful, the user identity information is established, and the user identity information and the target feature data are added to the identity feature database.
  • the user identity information can be set according to the usage scenario of identity authentication, user needs, etc., for example, it can be information such as employee number, medical insurance card number, ID number and so on.
  • the target feature data is face feature data
  • the preset identity feature data is the face feature data in the ID photo.
  • the face image data is compared with the face feature data in the ID photo for identity authentication. If the identity authentication is successful, the user identity information is established, and the user identity information and target feature data are added to the identity feature database.
  • performing identity authentication on the target feature data according to the preset identity feature data can ensure the reliability of the authentication result, and when the identity authentication is successful, the user identity information and the target feature data are added to the identity feature database, and during subsequent identity authentication, It can quickly find the corresponding user identity information, shorten the user's waiting time, and optimize the user experience.
  • S182 includes:
  • S1821 may be implemented by the authentication module 116 .
  • the authentication module 116 is configured to determine that the identity authentication is successful when the confidence level of the comparison result between the target feature data and the preset identity feature data is greater than the first threshold.
  • the processor 102 is configured to determine that the identity authentication is successful when the confidence level of the comparison result between the target feature data and the preset identity feature data is greater than a first threshold.
  • the first threshold can be set according to the use scenario of identity authentication, the type of preset identity feature data, user requirements and other parameters, which are not specifically limited, for example, it can be 0.7, 0.75, 0.8, 0.85, 0.9, 0.95, 0.99 equal threshold.
  • the first threshold can be used to characterize the similarity between the target feature data and the preset identity feature data. It can be considered that the higher the first threshold, the higher the similarity between the target feature data and the preset identity feature data, that is, the target feature data. The higher the probability that the corresponding user and the user corresponding to the preset identity feature data are the same person. Conversely, the lower the first threshold, the lower the similarity between the target feature data and the preset identity feature data, that is, the lower the probability that the user corresponding to the target feature data and the user corresponding to the preset identity feature data are the same person.
  • the confidence level of the comparison result between the target feature data and the preset identity feature data is greater than the first threshold, it is determined that the identity authentication is successful. In this way, the accuracy and reliability of the identity authentication result can be further ensured, user information security is ensured, and user experience is optimized.
  • the server 110 includes an identity feature database storing the correspondence between the user identity information and the target feature data, and S18 includes:
  • S183 Compare the target feature data with the target feature data in the identity feature database to perform identity authentication, and determine user identity information corresponding to the target feature data when the identity authentication is successful.
  • S183 may be implemented by the authentication module 116 .
  • the authentication module 116 is configured to compare the target feature data with the target feature data in the identity feature database to perform identity authentication, and determine the user identity information corresponding to the target feature data when the identity authentication is successful.
  • the processor 102 is configured to compare the target feature data with the target feature data in the identity feature database to perform identity authentication, and determine the user identity information corresponding to the target feature data when the identity authentication is successful.
  • the target feature data is compared with the target feature data in the identity feature database for identity authentication, and when the identity authentication is successful, the user identity information corresponding to the target feature data is determined.
  • the target feature data is face image data.
  • the face image data is compared with the face image data in the identity feature database for identity authentication, and when the identity authentication is successful, the user identity information corresponding to the target feature data is determined.
  • performing identity authentication on the target feature data according to the target feature data in the identity feature database can ensure the reliability of the authentication result, and when the identity authentication is successful, determine the user identity information corresponding to the target feature data, shorten the user's waiting time, and optimize the user experience. .
  • S183 includes:
  • S1831 may be implemented by the authentication module 116 .
  • the authentication module 116 is configured to determine that the identity authentication is successful when the confidence level of the comparison result between the target feature data and the target feature data in the identity feature database is greater than the second threshold.
  • the processor 102 is configured to determine that the identity authentication is successful when the confidence level of the comparison result between the target feature data and the target feature data in the identity feature database is greater than the second threshold.
  • the second threshold can be set according to the use scenario of identity authentication, the type of preset identity feature data, user requirements and other parameters, which are not specifically limited, for example, can be 0.7, 0.75, 0.8, 0.85, 0.9, 0.95, 0.99 equal threshold.
  • the second threshold can be used to characterize the similarity between the target feature data and the preset identity feature data. It can be considered that the higher the second threshold, the higher the similarity between the target feature data and the preset identity feature data, that is, the target feature data. The higher the probability that the corresponding user and the user corresponding to the preset identity feature data are the same person. Conversely, the lower the second threshold, the lower the similarity between the target feature data and the preset identity feature data, that is, the lower the probability that the user corresponding to the target feature data and the user corresponding to the preset identity feature data are the same person.
  • the confidence of the comparison result between the target feature data and the target feature data of the identity feature database is greater than the second threshold, it is determined that the identity authentication is successful. In this way, the accuracy and reliability of the identity authentication result can be further ensured, the security of user information is guaranteed, and the user is optimized. experience.
  • the second threshold may be set larger than the first threshold. That is to say, when matching the target feature data and the target feature data of the identity feature database, the requirement for similarity can be higher, and when matching the target feature data and the preset identity feature data, the requirement for similarity can be appropriately reduced. . For example, set the first threshold to 0.8 and the second to 0.9.
  • the device authentication method includes:
  • S19-S20 may be implemented by the authentication module 116 .
  • the authentication module 116 is configured to generate the authentication feedback request according to the authentication result or the identity authentication result, and to send the authentication feedback request to the corresponding terminal device.
  • the processor 102 is configured to generate an authentication feedback request according to the authentication result or the identity authentication result, and to send the authentication feedback request to the corresponding terminal device.
  • the server 110 performs identity authentication according to the target feature data, and may first compare the target feature data with the target feature data in the identity feature database. If the confidence level of the comparison result of the target feature data is greater than the second threshold, it is considered that the identity authentication is successful.
  • the confidence level of the comparison result between the target feature data and the target feature data in the identity feature database is less than the second threshold, obtain preset identity feature data, compare the target feature data with the preset identity feature data, If the confidence level of the comparison result between the data and the preset identity feature data is greater than the first threshold, it is considered that the identity authentication is successful.
  • the target feature data is facial feature data.
  • the confidence level of the comparison result between the facial feature data and the facial feature data stored in the identity feature database is greater than the second threshold, and the identity authentication If successful, the successful authentication result is returned to the terminal device in the form of an authentication feedback request, and the corresponding user identity information is determined according to the target face feature data, and the user identity information is sent to the terminal device.
  • the target feature data is face feature data.
  • the target feature data is face feature data.
  • the device authentication method includes:
  • S21 may be implemented by the authentication module 116 .
  • the authentication module 116 is configured to perform feature extraction on the identity feature data corresponding to the multiple terminal devices in a concurrent mode when the multiple terminal devices are authenticated.
  • the processor 102 is configured to perform feature extraction on the identity feature data corresponding to the multiple terminal devices in a concurrent mode when the authentication of the multiple terminal devices is passed.
  • the server 110 can simultaneously respond to authentication requests of multiple terminal devices, and it is understood that the terminal devices here can be any terminal device. After the authentication of the terminal device is passed, the server 110 in the concurrent mode can simultaneously respond to data processing requests of multiple authenticated terminal devices.
  • the authentication efficiency can be improved, the time for the user to wait for the authentication result can be shortened, and the user experience can be optimized.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Power Engineering (AREA)
  • Software Systems (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Collating Specific Patterns (AREA)

Abstract

一种设备鉴权方法，用于服务器(110)，设备鉴权方法包括：(S11)接收至少一个终端设备发送的认证请求；(S12)解析认证请求以根据预设设备表对终端设备的物理编码信息进行鉴权；(S13)在终端设备的物理编码信息与预设终端设备编码相匹配的情况下，确定终端设备鉴权通过；(S14)在终端设备的物理编码信息与预设设备表中的全部的预设终端设备编码都不匹配且预设设备中的预设终端设备编码的总数量未达到阈值的情况下，响应于添加设备表的操作以将终端设备的物理编码信息加入预设设备表并确定终端设备鉴权通过；(S15)在所述终端设备的物理编码信息与所述预设设备表中的全部的预设终端设备编码都不匹配且所述预设设备中的预设终端设备编码的总数量达到阈值的情况下，确定终端设备鉴权失败。本公开还公开了一种服务器(110)、计算机设备(100)和可读存储介质。

Description

设备鉴权方法、终端设备、服务器和计算机设备 技术领域
本公开涉及通信技术领域，特别涉及一种设备鉴权方法、服务器、计算机设备和可读存储介质。
背景技术
随着互联网技术的发展，信息安全成为人们日益关注的问题。在对不同终端设备提供信息的场景中，提供信息之前如何对终端设备进行准确可靠的设备鉴权或身份鉴权，成为亟待解决的技术问题。
发明内容
有鉴于此，本公开的实施方式提供一种设备鉴权方法、服务器、计算机设备和可读存储介质。
本公开提供了一种设备鉴权方法，用于服务器，所述设备鉴权方法包括以下步骤：
接收至少一个终端设备发送的认证请求，所述认证请求包括所述终端设备的物理编码信息；
解析所述认证请求以根据预设设备表对所述终端设备的物理编码信息进行鉴权，所述预设设备表包括预设终端设备编码；
在所述终端设备的物理编码信息与所述预设终端设备编码相匹配的情况下，确定所述终端设备鉴权通过；
在所述终端设备的物理编码信息与所述预设设备表中的全部的预设终端设备编码都不匹配且所述预设设备中的预设终端设备编码的总数量未达到阈值的情况下，响应于添加设备表的操作以将所述终端设备的物理编码信息加入所述预设设备表并确定所述终端设备鉴权通过；
在所述终端设备的物理编码信息与所述预设设备表中的全部的预设终端设备编码都不匹配且所述预设设备中的预设终端设备编码的总数量达到阈值的情况下，确定所述终端设备鉴权失败。
在某些实施方式中，在接收到多个所述终端设备发送的认证请求的情况下，所述服务器采用并发模式对多个所述终端设备进行鉴权。
在某些实施方式中，所述认证请求还包括用于身份认证的身份特征数据；所述设备鉴权方法还包括：
在所述终端设备鉴权通过后，根据特征提取模型对所述身份特征数据进行特征提取以得到目标特征数据；和
根据所述目标特征数据进行身份认证。
在某些实施方式中，所述认证请求通过Http Post请求的方式向服务器发送。
在某些实施方式中，所述认证请求采用JSON方式传输数据。
在某些实施方式中，所述认证请求经过字符串加密编码后进行传输。
在某些实施方式中，所述服务器包括存储有用户身份信息和目标特征数据的对应关系的身份特征数据库，所述根据所述目标特征数据进行身份认证包括：
获取预设身份特征数据；和
将所述目标特征数据与预设身份特征数据进行比对以进行身份认证，在身份认证成功时建立用户身份信息并将所述用户身份信息和所述目标特征数据加入所述身份特征数据库。
在某些实施方式中，所述将所述目标特征数据与预设身份特征数据进行比对以进行身份认证，在身份认证成功时建立用户身份信息并将所述用户身份信息和所述目标特征数据加入所述身份特征数据库包括：
在所述目标特征数据与预设身份特征数据比对结果的置信度大于第一阈值的情况下，确定身份认证成功。
在某些实施方式中，所述服务器包括存储有用户身份信息和目标特征数据的对应关系的身份特征数据库，所述根据所述目标特征数据进行身份认证包括：
将所述目标特征数据与所述身份特征数据库的目标特征数据进行比对以进行身份认证，在身份认证成功时确定所述目标特征数据对应的用户身份信息。
在某些实施方式中，所述将所述目标特征数据与所述身份特征数据库的目标特征数据进行比对以进行身份认证，在身份认证成功时确定所述目标特征数据对应的用户身份信息包括：
在所述目标特征数据与所述身份特征数据库的目标特征数据比对结果的置信度大于第二阈值的情况下，确定身份认证成功。
在某些实施方式中，所述设备鉴权方法包括：
根据鉴权结果或身份认证结果生成认证反馈请求；和
将所述认证反馈请求发送给对应的所述终端设备。
在某些实施方式中，在多个所述终端设备鉴权通过的情况下，所述服务器采用并发模式对多个所述终端设备对应的身份特征数据进行特征提取。
本公开提供了一种服务器，所述服务器包括：
接收模块，所述接收模块用于接收至少一个终端设备发送的认证请求，所述认证请求包括所述终端设备的物理编码信息；
解析模块，所述解析模块用于解析所述认证请求以根据预设设备表对所述终端设备的物理编码信息进行鉴权，所述预设设备表包括预设终端设备编码；
鉴权模块，所述鉴权模块用于在所述终端设备的物理编码信息与所述预设终端设备编码相匹配的情况下，确定所述终端设备鉴权通过，及在所述终端设备的物理编码信息与所述预设终端设备编码不匹配且所述预设终端设备编码的数量未达到阈值的情况下，响应于添加设备表的操作并确定所述终端设备鉴权通过，以及在所述终端设备的物理编码信息与所述预设设备表中的全部的预设终端设备编码都不匹配且所述预设设备中的预设终端设备编码的总数量达到阈值的情况下，确定所述终端设备鉴权失败。
本公开还提供了一种计算机设备，所述计算机设备包括一个或多个处理器和存储器，所述存储器存储有计算机程序，在所述计算机程序被所述处理器执行的情况下，实现上述任意实施方式的设备鉴权方法的步骤。
本公开还提供了一种存储有计算机程序的非易失性计算机可读存储介质，在所述计算机程序被一个或多个处理器执行的情况下，实现上述任意实施方式的设备鉴权方法的步骤。
本公开的设备鉴权方法、服务器、计算机设备和可读存储介质中，通过接收和解析终端设备发送的认证请求，根据预设设备表对终端设备进行鉴权，能够保证终端设备与服务器通信的安全性和可靠性。
附图说明
本公开的上述和/或附加的方面和优点从结合下面附图对实施方式的描述中将变得明显和容易理解，其中：
图1是本公开某些实施方式的设备鉴权方法的流程示意图。
图2是本公开某些实施方式的计算机设备的结构示意图。
图3是本公开某些实施方式的服务器的模块示意图。
图4是本公开某些实施方式的设备鉴权方法的流程示意图。
图5是本公开某些实施方式的设备鉴权方法的流程示意图。
图6是本公开某些实施方式的设备鉴权方法的流程示意图。
具体实施方式
下面详细描述本公开的实施方式，所述实施方式的示例在附图中示出，其中自始至终相同或类似的标号表示相同或类似的元件或具有相同或类似功能的元件。下面通过参考附图描述的实施方式是示例性的，仅用于解释本公开，而不能理解为对本公开的限制。
请参阅图1-3，本公开提供了一种设备鉴权方法，用于服务器110，设备鉴权方法包括以下步骤：
S11：接收至少一个终端设备发送的认证请求；
S12：解析认证请求以根据预设设备表对终端设备的物理编码信息进行鉴权；
S13：在终端设备的物理编码信息与预设终端设备编码相匹配的情况下，确定终端设备鉴权通过；
S14：在终端设备的物理编码信息与预设设备表中的全部的预设终端设备编码都不匹配且预设设备中的预设终端设备编码的总数量未达到阈值的情况下，响应于添加设备表的操作以将终端设备的物理编码信息加入预设设备表并确定终端设备鉴权通过；
S15：在所述终端设备的物理编码信息与所述预设设备表中的全部的预设终端设备编码都不匹配且所述预设设备中的预设终端设备编码的总数量达到阈值的情况下，确定终端设备鉴权失败。
本公开实施方式提供了一种计算机设备100。计算机设备100包括处理器102和存储器104，存储器104存储有计算机程序106，计算机程序106被处理器102执行时实现：接收至少一个终端设备发送的认证请求；解析认证请求以根据预设设备表对终端设备的物理编码信息进行鉴权；在终端设备的物理编码信息与预设终端设备编码相匹配的情况下，确定终端设备鉴权通过；在终端设备的物理编码信息与预设设备表中的全部的预设终端设备编码都不匹配且预设设备中的预设终端设备编码的总数量未达到阈值的情况下，响应于添加设备表的操作以将终端设备的物理编码信息加入预设设备表并确定终端设备鉴权通过；在所述终端设备的物理编码信息与所述预设设备表中的全部的预设终端设备编码都不匹配且所述预设设备中的预设终端设备编码的总数量达到阈值的情况下，确定终端设备鉴权失败。其中，处理器102可以是计算机设备100为实施设备鉴权方法而单独设置的处理器，也可以是计算机设备100自身的处理器，具体不做限定。
本公开实施方式还提供了一种服务器110，本公开实施方式的设备鉴权方法可以由服务器110实现。服务器110包括接收模块112、解析模块114和鉴权模块116。S11可以由接收模块112实现，S12可以由解析模块114实现，S13-S15可以由鉴权模块116实现。或者说，接收模块112用于接收至少一个终端设备发送的认证请求，解析模块114用于解析认证请求以根据预设设备表对终端设备的物理编码信息进行鉴权，鉴权模 块116用于在终端设备的物理编码信息与预设终端设备编码相匹配的情况下，确定终端设备鉴权通过，及用于在终端设备的物理编码信息与预设设备表中的全部的预设终端设备编码都不匹配且预设设备中的预设终端设备编码的总数量未达到阈值的情况下，响应于添加设备表的操作以将终端设备的物理编码信息加入预设设备表并确定终端设备鉴权通过，以及用于在终端设备的物理编码信息与预设终端设备编码不匹配且预设终端设备编码的数量达到阈值的情况下，确定终端设备鉴权失败。
具体地，本公开的设备鉴权方法、计算机设备100和服务器110中，通过接收和解析终端设备发送的认证请求，根据预设设备表对终端设备进行鉴权，能够保证终端设备与服务器110通信的安全性和可靠性。
进一步地，认证请求包括终端设备的物理编码信息，其中，物理编码信息可以是终端设备的硬件专属号码、国际移动设备识别码、媒体存取控制位址等用于标识出终端设备的设备特征或者独特性的标识，物理编码信息用于服务器110与终端设备的鉴权。终端设备可以是智能手机、平板电脑、个人计算机、柜员机、出入口闸机、摄像头等设备。
预设设备表包括预设终端设备编码，预设终端设备编码可以根据终端设备的物理编码信息设定。需要说明地，预设设备表中包含的预设终端设备编码的个数可以是固定的，也可以是不固定的。
在一些实施例中，预设设备表中包含的预设终端设备编码的个数固定，也即是说，预设设备表中只能添加预设数量的预设终端设备编码。预设数量可以根据身份认证的使用场景、服务器110的处理器性能、用户需求等参数设定，具体不做限定，例如可以设定预设设备表中的预设终端设备编码个数为100个、200个、300个、500个等。
如此，能够保持预设设备表中预设终端设备编码个数的相对稳定，维护服务器110的安全性与稳定性。
在另一些实施例中，预设设备表中包含的预设终端设备编码的个数不固定，也即是说，预设设备表中添加的预设终端设备编码的数量可以随机变化。
如此，能够灵活应对设备鉴权的多种应用场合，扩大适用范围，优化用户体验。
服务器110接收到终端设备发送的认证请求后，对认证请求进行解析，即，将认证请求中的终端设备的物理编码信息与预设终端设备编码进行匹配，根据匹配结果确定终端设备鉴权是否通过。可以理解地，物理编码信息与预设终端设备编码相匹配可以是指物理编码信息与预设终端设备编码完全一致，也可以是指预设终端设备编码中包括物理编码信息的全部，或是物理编码信息中包括预设终端设备编码的全部。
在一些实施例中，终端设备的物理编码信息与预设终端设备编码相匹配，服务器110确定终端设备鉴权通过。
在一些实施例中，终端设备的物理编码信息与预设终端设备编码不匹配，且预设设备表中包含的预设终端设备编码的个数固定，预设设备表中保存的预设终端设备编码个数小于预设数量。由于终端设备的物理编码信息与预设终端设备编码不匹配，也即是说预设设备表中未存储终端设备的物理编码信息，终端设备鉴权未通过。此时服务器110根据添加设备表的操作，将终端设备的物理编码信息添加至预设设备表，并确定终端设备鉴权通过。
在另一些实施例中，终端设备的物理编码信息与预设终端设备编码不匹配，且预设设备表中包含的预设终端设备编码的个数固定，预设设备表中保存的预设终端设备编码个数大于或等于预设数量。由于终端设备的物理编码信息与预设终端设备编码不匹配，也即是说预设设备表中未存储终端设备的物理编码信息，终端设备鉴权未通过，且预设设备表中存储的预设终端设备编码已达预设数量，则确定终端设备鉴权失败。
如此，能够保持预设设备表中预设终端设备编码个数的相对稳定，维护服务器110的安全性与稳定性。
在某些实施方式中，设备鉴权方法包括：
S16：在接收到多个终端设备发送的认证请求的情况下，采用并发模式对多个终端设备进行鉴权。
在某些实施方式中，S16可以由鉴权模块116实现。或者说，鉴权模块116用于在接收到多个终端设备发送的认证请求的情况下，采用并发模式对多个终端设备进行鉴权。
在某些实施方式中，处理器102用于在接收到多个终端设备发送的认证请求的情况下，采用并发模式对多个终端设备进行鉴权。
具体地，可以认为，在并发模式下，服务器110对于多个终端设备的鉴权请求均能同时响应，可以理解地，此处的终端设备可以是任意终端设备。在终端设备鉴权通过后，并发模式下的服务器110对于多个通过鉴权的终端设备的数据处理请求均能同时响应。
如此，能够提高鉴权的效率，缩短用户等待鉴权结果的时间，优化用户体验。
请参阅图4，在某些实施方式中，认证请求还包括用于身份认证的身份特征数据；设备鉴权方法包括：
S17：在终端设备鉴权通过后，根据特征提取模型对身份特征数据进行特征提取以得到目标特征数据；和
S18：根据目标特征数据进行身份认证。
在某些实施方式中，S17和S18可以由鉴权模块116实现。或者说，鉴权模块116用于在终端设备鉴权通过后，根据特征提取模型对身份特征数据进行特征提取以得到 目标特征数据。以及用于根据目标特征数据进行身份认证。
在某些实施方式中，处理器102用于在终端设备鉴权通过后，根据特征提取模型对身份特征数据进行特征提取以得到目标特征数据。以及用于根据目标特征数据进行身份认证。
具体地，特征提取模型可以采用基于卷积神经网络的模型。如此，能够有效地从大量样本中进行学习，避免复杂的特征提取过程，使得处理身份特征数据的速度更快，缩短用户等待身份认证结果的时间。
特征提取模型中的身份特征数据可以以JSON串的形式存储。在JSON串中，能够灵活添加请求指令，以调用不同的数据，适应设备鉴权方法的多场合应用，具体应用方式不做限定。例如，可以添加请求调用身份特征数据中表示人物性别的数据的指令，调用表示人物性别的数据进行服务推荐等操作。如此，能够兼顾多种使用场景，扩大设备鉴权方法的应用场合。
身份特征数据可以是人脸图像数据、指纹数据、声纹数据和/或瞳孔数据等能够用于识别人物身份的数据，具体不做限定。目标特征数据可以是身份特征数据中的一些特征信息，用于识别特定人物身份。
在一些实施例中，身份特征数据为人脸图像数据。特征提取模型对人脸图像数据进行特征提取，可以将人脸特征转化为多个数据，即目标特征数据，并将目标特征数据存储至服务器110。例如，提取512维数据作为目标特征数据存储至服务器110。如此，能够达到便利后续进行身份特征比对的效果。
进一步地，在身份特征数据为人脸图像数据的情况下，终端设备根据人脸位置检测模型对人脸图像进行检测以得到人脸位置框，根据人脸关键点检测模型对人脸位置框所在的人脸图像进行检测以得到人脸关键点，对人脸关键点进行处理以得到正脸图像数据，根据人脸角度检测模型对人脸图像进行检测以得到人脸偏转角度，以及根据正脸图像数据和人脸偏转角度确定目标正脸图像数据。其中，对人脸关键点进行处理包括获取在预设尺寸下正脸的基准关键点数据，以及根据基准关键点数据和人脸关键点在空间域利用坐标点插值变换计算得到正脸图像数据。
具体而言，终端设备根据人脸位置检测模型对人脸图像进行检测，能够得到人脸位置框。人脸位置框可以表示人脸图像中的人脸的位置，便利后续检测人脸关键点和检测人脸偏转角度。
在人脸位置检测模型中，可以设置人脸位置框的置信度，使得人脸位置检测的召回率和人脸位置检测的精度之间能够达到较好的平衡，也即是说，使得人脸位置检测的召回率较高的情况下，人脸位置检测的精度也较高。其中，置信度可以用于表征人 脸识别结果的可靠性，相对而言，置信度越高，人脸识别结果的可靠性越高，反之，置信度越低，人脸识别结果的可靠性越低。可以认为，人脸位置检测的召回率代表人脸图像中人脸位置的查全率，人脸位置检测的精度代表在人脸图像中标定人脸位置的准确率。
例如，将人脸位置框的置信度设置为0.9，使得人脸位置检测的召回率大于0.99，且人脸位置检测的精度大于0.98，也即是说，人脸图像中人脸位置的查全率和人脸图像中标定人脸位置的准确率均较高。如此，能够实现人脸图像的精确识别，在实际使用中能够优化用户体验。
更进一步地，根据人脸关键点检测模型对人脸位置框所在的人脸图像进行检测，得到人脸关键点，并对人脸关键点进行处理，能够得到正脸图像数据。其中，人脸关键点可以是两个眼中心、两个嘴角和鼻尖这五个点，也可以是眼、鼻、嘴这三个器官的轮廓线，还可以是眉、眼、鼻、嘴、下颌等其中一个或多个部位的轮廓，具体不做限定。
在人脸关键点检测模型中，根据人脸位置检测模型处理后得到的人脸位置框，在人脸位置框所在的人脸图像中检测人脸关键点，并对人脸关键点进行处理，得到正脸图像数据。
在人脸角度检测模型中，根据人脸位置检测模型处理后得到的人脸位置框，以及人脸关键点检测模型处理后得到的人脸关键点，判断人脸偏转角度是否超过预定的偏转角度阈值，确定人脸偏转角度未超过偏转角度阈值的人脸图像。需要说明地，偏转角度阈值可以根据人脸角度检测模型的检测精度、人脸角度检测的使用场景等参数设定，具体不做限定，例如角度范围在15度-30度，具体可以是15度、20度、25度、30度等。在另一些实施例中，人脸角度检测模型可以直接得出人脸偏转角度，根据人脸偏转角度的不同，对人脸图像进行处理。
最后，根据人脸角度检测模型选出的人脸偏转角度未超过偏转角度阈值的人脸图像，确定人脸关键点检测模型中相应的正脸图像数据为目标正脸图像数据。
此外，人脸位置检测模型、人脸关键点检测模型和人脸角度检测模型可以采用基于卷积神经网络的模型，如此，能够有效地从大量样本中进行学习，避免复杂的特征提取过程，使得人脸图像的处理速度更快，缩短用户等待身份认证结果的时间。
如此，通过多个检测模型对人脸图像中的人脸进行检测，得到目标正脸图像数据，实现人脸图像的精确识别。
再进一步地，对人脸关键点进行处理时，先获取在预设尺寸下正脸的基准关键点数据，并在空间域利用坐标点插值变换的方法对基准关键点数据和人脸关键点进行计 算，得到正脸图像数据。
其中，预设尺寸可以根据身份认证的使用场景、人脸检测的精度等参数设定，具体不做限定，例如可以是112*112、224*112、40*40、60*40等尺寸。基准关键点数据可以事先通过提供大量数据、机器学习等方式获得。插值变换的方法可以是最邻近元法、双线性内插法、三次内插法等，具体可以根据身份认证的使用场景、人脸检测的精度等参数设定，此处不做限定。
如此，通过多个检测模型对人脸图像中的人脸进行检测，得到目标正脸图像数据，实现人脸图像的精确识别。
在终端设备鉴权通过后，服务器110根据特征提取模型对身份特征数据进行特征提取，得到目标特征数据，并根据所述目标特征数据进行身份认证。
如此，能够保证服务器110和终端设备之间的通信安全，且能够缩短用户等待身份认证结果的时间，优化用户体验。
在某些实施方式中，认证请求通过Http Post请求的方式发送。
具体地，由于Http Post不会被缓存或被保存在服务器110日志中，使用Http Post发送认证请求，能够保证服务器110和终端设备之间的通信安全。且由于Http Post能够发送较大的数据量和较多的数据类型，因此，通过Http Post请求的方式发送认证请求，不仅能够保证服务器110和终端设备之间的通信安全，还能够传输更大的数据、兼顾更多的使用场景。
在某些实施方式中，认证请求采用JSON方式传输数据。
具体地，认证请求可以采用JavaScript对象简谱(JavaScript Object Notation，JSON)的形式发送。在JSON串中，能够灵活添加请求指令，以调用不同的数据，适应设备鉴权的多场合应用，具体应用方式不做限定。例如，可以添加请求调用身份特征数据中表示人物性别的数据的指令，调用表示人物性别的数据进行服务推荐等操作。
如此，能够使得设备鉴权兼顾多种使用场景，扩大设备鉴权方法的应用场合。
在某些实施方式中，认证请求经过字符串加密编码后进行传输。
具体地，认证请求在服务器110中经过字符串加密编码后进行传输，例如，可以使用base64、base32、base16等加密编码方式。如此，能够进一步保证服务器110和终端设备之间的通信安全。
请参阅图5，在某些实施方式中，服务器110包括存储有用户身份信息和目标特征数据的对应关系的身份特征数据库，S18包括：
S181：获取预设身份特征数据；和
S182：将目标特征数据与预设身份特征数据进行比对以进行身份认证，在身份认 证成功时建立用户身份信息并将用户身份信息和目标特征数据加入身份特征数据库。
在某些实施方式中，S181和S182可以由鉴权模块116实现。或者说，鉴权模块116用于获取预设身份特征数据，以及用于将目标特征数据与预设身份特征数据进行比对以进行身份认证，在身份认证成功时建立用户身份信息并将用户身份信息和目标特征数据加入身份特征数据库。
在某些实施方式中，处理器102用于获取预设身份特征数据，以及用于将目标特征数据与预设身份特征数据进行比对以进行身份认证，在身份认证成功时建立用户身份信息并将用户身份信息和目标特征数据加入身份特征数据库。
具体地，预设身份特征数据用于与目标特征数据进行比对，预设身份特征数据根据目标特征数据的类型设定，例如可以是人脸图像数据、指纹数据、声纹数据和/或瞳孔数据等，具体不做限定。预设身份特征数据可以通过访问其他服务器110或其他终端设备获得，也可以是服务器110本地存储的预设身份特征数据。
将目标特征数据与预设身份特征数据进行比对以进行身份认证，在身份认证成功的情况下，建立用户身份信息，并将用户身份信息和目标特征数据加入身份特征数据库。其中，用户身份信息可以根据身份认证的使用场景、用户需求等设定，例如可以是员工编号、医保卡号码、身份证号码等信息。
在一些实施例中，目标特征数据为人脸特征数据，预设身份特征数据为证件照中的人脸特征数据。将人脸图像数据与证件照中的人脸特征数据进行比对，以进行身份认证，在身份认证成功的情况下，建立用户身份信息，并将用户身份信息和目标特征数据加入身份特征数据库。
如此，根据预设身份特征数据对目标特征数据进行身份认证，能够确保认证结果的可靠性，且在身份认证成功时将用户身份信息和目标特征数据加入身份特征数据库，在后续进行身份认证时，能够较快地查找到相应的用户身份信息，缩短用户等待时长，优化用户体验。
在某些实施方式中，S182包括：
S1821：在目标特征数据与预设身份特征数据比对结果的置信度大于第一阈值的情况下，确定身份认证成功。
在某些实施方式中，S1821可以由鉴权模块116实现。或者说，鉴权模块116用于在目标特征数据与预设身份特征数据比对结果的置信度大于第一阈值的情况下，确定身份认证成功。
在某些实施方式中，处理器102用于在目标特征数据与预设身份特征数据比对结果的置信度大于第一阈值的情况下，确定身份认证成功。
具体地，第一阈值可以根据身份认证的使用场景、预设身份特征数据的类型、用户需求等参数设定，具体不做限定，例如可以是0.7、0.75、0.8、0.85、0.9、0.95、0.99等阈值。第一阈值可以用于表征目标特征数据与预设身份特征数据的相似度，可以认为，第一阈值越高，目标特征数据与预设身份特征数据的相似度越高，也即是目标特征数据对应的用户与预设身份特征数据对应的用户为同一人的概率越高。反之，第一阈值越低，目标特征数据与预设身份特征数据的相似度越低，也即是目标特征数据对应的用户与预设身份特征数据对应的用户为同一人的概率越低。
在目标特征数据与预设身份特征数据比对结果的置信度大于第一阈值的情况下，确定身份认证成功，如此，能够进一步保证身份认证结果的准确可靠，保障用户信息安全，优化用户体验。
在某些实施方式中，服务器110包括存储有用户身份信息和目标特征数据的对应关系的身份特征数据库，S18包括：
S183：将目标特征数据与身份特征数据库的目标特征数据进行比对以进行身份认证，在身份认证成功时确定目标特征数据对应的用户身份信息。
在某些实施方式中，S183可以由鉴权模块116实现。或者说，鉴权模块116用于将目标特征数据与身份特征数据库的目标特征数据进行比对以进行身份认证，在身份认证成功时确定目标特征数据对应的用户身份信息。
在某些实施方式中，处理器102用于将目标特征数据与身份特征数据库的目标特征数据进行比对以进行身份认证，在身份认证成功时确定目标特征数据对应的用户身份信息。
具体地，将目标特征数据与身份特征数据库的目标特征数据进行比对以进行身份认证，在身份认证成功时，确定目标特征数据对应的用户身份信息。
在一些实施例中，目标特征数据为人脸图像数据。将人脸图像数据与身份特征数据库中的人脸图像数据进行比对，以进行身份认证，在身份认证成功时，确定目标特征数据对应的用户身份信息。
如此，根据身份特征数据库的目标特征数据对目标特征数据进行身份认证，能够确保认证结果的可靠性，且在身份认证成功时确定目标特征数据对应的用户身份信息，缩短用户等待时长，优化用户体验。
在某些实施方式中，S183包括：
S1831：在目标特征数据与身份特征数据库的目标特征数据比对结果的置信度大于第二阈值的情况下，确定身份认证成功。
在某些实施方式中，S1831可以由鉴权模块116实现。或者说，鉴权模块116用于 在目标特征数据与身份特征数据库的目标特征数据比对结果的置信度大于第二阈值的情况下，确定身份认证成功。
在某些实施方式中，处理器102用于在目标特征数据与身份特征数据库的目标特征数据比对结果的置信度大于第二阈值的情况下，确定身份认证成功。
具体地，第二阈值可以根据身份认证的使用场景、预设身份特征数据的类型、用户需求等参数设定，具体不做限定，例如可以是0.7、0.75、0.8、0.85、0.9、0.95、0.99等阈值。第二阈值可以用于表征目标特征数据与预设身份特征数据的相似度，可以认为，第二阈值越高，目标特征数据与预设身份特征数据的相似度越高，也即是目标特征数据对应的用户与预设身份特征数据对应的用户为同一人的概率越高。反之，第二阈值越低，目标特征数据与预设身份特征数据的相似度越低，也即是目标特征数据对应的用户与预设身份特征数据对应的用户为同一人的概率越低。
在目标特征数据与身份特征数据库的目标特征数据比对结果的置信度大于第二阈值的情况下，确定身份认证成功，如此，能够进一步保证身份认证结果的准确可靠，保障用户信息安全，优化用户体验。
进一步地，考虑到在采集预设身份特征数据时可能没有对预设身份特征数据经过预先处理，导致预设身份特征数据中存在一些异常数据、无关数据或错误数据，致使预设身份特征数据与目标特征数据的差异较多，因此，可以设置第二阈值大于第一阈值。也即是说，在匹配目标特征数据与身份特征数据库的目标特征数据时，对相似度的要求可以较高，在匹配目标特征数据与预设身份特征数据时，对相似度的要求可以适当降低。例如，将第一阈值设置为0.8，第二阈值设置为0.9。
如此，能够更精确地进行身份认证，优化用户体验。
请参阅图6，在某些实施方式中，设备鉴权方法包括：
S19：根据鉴权结果或身份认证结果生成认证反馈请求；和
S20：将认证反馈请求发送给对应的终端设备。
在某些实施方式中，S19-S20可以由鉴权模块116实现。或者说，鉴权模块116用于根据鉴权结果或身份认证结果生成认证反馈请求，以及用于将认证反馈请求发送给对应的终端设备。
在某些实施方式中，处理器102用于根据鉴权结果或身份认证结果生成认证反馈请求，以及用于将认证反馈请求发送给对应的终端设备。
具体地，特征提取模型提取得到目标特征数据后，服务器110根据目标特征数据进行身份认证，可以先将目标特征数据与身份特征数据库的目标特征数据进行比对，在目标特征数据与身份特征数据库的目标特征数据比对结果的置信度大于第二阈值的 情况下，认为身份认证成功。
在目标特征数据与身份特征数据库的目标特征数据比对结果的置信度小于第二阈值的情况下，获取预设身份特征数据，将目标特征数据与预设身份特征数据进行比对，在目标特征数据与预设身份特征数据比对结果的置信度大于第一阈值的情况下，认为身份认证成功。
在目标特征数据与预设身份特征数据比对结果的置信度小于第一阈值的情况下，认为身份认证未成功。
在一些实施例中，目标特征数据为人脸特征数据。将人脸特征数据与身份特征数据库中存储的人脸特征数据进行比对时，人脸特征数据与身份特征数据库中存储的人脸特征数据的比对结果的置信度大于第二阈值，身份认证成功，则将认证成功的结果以认证反馈请求的方式返回至终端设备，并根据目标人脸特征数据确定对应的用户身份信息，将用户身份信息下发至终端设备。
如此，用户只需通过人脸认证即可查询相应的用户身份信息，而无需携带卡片或资料等，优化用户体验。
在另一些实施例中，目标特征数据为人脸特征数据。将人脸特征数据与身份特征数据库中存储的人脸特征数据进行比对时，人脸特征数据与身份特征数据库中存储的人脸特征数据的比对结果的置信度小于第二阈值，则获取证件照中的人脸特征数据，将人脸特征数据与证件照中的人脸特征数据进行比对，在人脸特征数据与证件照中的人脸特征数据的比对结果大于第一阈值时，身份认证成功，建立用户身份信息，并将用户身份信息和目标特征数据加入身份特征数据库中，将用户身份信息和目标特征数据进行绑定。
如此，在用户后续进行身份认证时，能够较快地查找到相应的用户身份信息，缩短用户等待时长，优化用户体验。
在某些实施方式中，设备鉴权方法包括：
S21：在多个终端设备鉴权通过的情况下，采用并发模式对多个终端设备对应的身份特征数据进行特征提取。
在某些实施方式中，S21可以由鉴权模块116实现。或者说，鉴权模块116用于在多个终端设备鉴权通过的情况下，采用并发模式对多个终端设备对应的身份特征数据进行特征提取。
在某些实施方式中，处理器102用于在多个终端设备鉴权通过的情况下，采用并发模式对多个终端设备对应的身份特征数据进行特征提取。
具体地，可以认为，在并发模式下，服务器110对于多个终端设备的鉴权请求均 能同时响应，可以理解地，此处的终端设备可以是任意终端设备。在终端设备鉴权通过后，并发模式下的服务器110对于多个通过鉴权的终端设备的数据处理请求均能同时响应。
如此，能够提高鉴权的效率，缩短用户等待鉴权结果的时间，优化用户体验。
在本说明书的描述中，参考术语“一个实施方式”、“一些实施方式”、“示意性实施方式”、“示例”、“具体示例”、或“一些示例”等的描述意指结合实施方式或示例描述的具体特征、结构、材料或者特点包含于本公开的至少一个实施方式或示例中。在本说明书中，对上述术语的示意性表述不一定指的是相同的实施方式或示例。而且，描述的具体特征、结构、材料或者特点可以在任何的一个或多个实施方式或示例中以合适的方式结合。
尽管已经示出和描述了本公开的实施方式，本领域的普通技术人员可以理解：在不脱离本公开的原理和宗旨的情况下可以对这些实施方式进行多种变化、修改、替换和变型，本公开的范围由权利要求及其等同物限定。

Claims (15)

  1. 一种设备鉴权方法，用于服务器，其特征在于，所述设备鉴权方法包括以下步骤：
    接收至少一个终端设备发送的认证请求，所述认证请求包括所述终端设备的物理编码信息；
    解析所述认证请求以根据预设设备表对所述终端设备的物理编码信息进行鉴权，所述预设设备表包括预设终端设备编码；
    在所述终端设备的物理编码信息与所述预设终端设备编码相匹配的情况下，确定所述终端设备鉴权通过；
    在所述终端设备的物理编码信息与所述预设设备表中的全部的预设终端设备编码都不匹配且所述预设设备中的预设终端设备编码的总数量未达到阈值的情况下，响应于添加设备表的操作以将所述终端设备的物理编码信息加入所述预设设备表并确定所述终端设备鉴权通过；
    在所述终端设备的物理编码信息与所述预设设备表中的全部的预设终端设备编码都不匹配且所述预设设备中的预设终端设备编码的总数量达到阈值的情况下，确定所述终端设备鉴权失败。
  2. 根据权利要求1所述的设备鉴权方法，其特征在于，在接收到多个所述终端设备发送的认证请求的情况下，所述服务器采用并发模式对多个所述终端设备进行鉴权。
  3. 根据权利要求2所述的设备鉴权方法，其特征在于，所述认证请求还包括用于身份认证的身份特征数据；所述设备鉴权方法还包括：
    在所述终端设备鉴权通过后，根据特征提取模型对所述身份特征数据进行特征提取以得到目标特征数据；和
    根据所述目标特征数据进行身份认证。
  4. 根据权利要求1-3任一项所述的设备鉴权方法，其特征在于，所述认证请求通过Http Post请求的方式发送。
  5. 根据权利要求4所述的设备鉴权方法，其特征在于，所述认证请求采用JSON方式传输数据。
  6. 根据权利要求3所述的设备鉴权方法，其特征在于，所述认证请求经过字符串加密编码后进行传输。
  7. 根据权利要求3所述的设备鉴权方法，其特征在于，所述服务器包括存储有用户身份信息和目标特征数据的对应关系的身份特征数据库，所述根据所述目标特征数据进行身份认证包括：
    获取预设身份特征数据；和
    将所述目标特征数据与预设身份特征数据进行比对以进行身份认证，在身份认证成功时建立用户身份信息并将所述用户身份信息和所述目标特征数据加入所述身份特征数据库。
  8. 根据权利要求7所述的设备鉴权方法，其特征在于，所述将所述目标特征数据与预设身份特征数据进行比对以进行身份认证，在身份认证成功时建立用户身份信息并将所述用户身份信息和所述目标特征数据加入所述身份特征数据库包括：
    在所述目标特征数据与预设身份特征数据比对结果的置信度大于第一阈值的情况下，确定身份认证成功。
  9. 根据权利要求3所述的设备鉴权方法，其特征在于，所述服务器包括存储有用户身份信息和目标特征数据的对应关系的身份特征数据库，所述根据所述目标特征数据进行身份认证包括：
    将所述目标特征数据与所述身份特征数据库的目标特征数据进行比对以进行身份认证，在身份认证成功时确定所述目标特征数据对应的用户身份信息。
  10. 根据权利要求9所述的设备鉴权方法，其特征在于，所述将所述目标特征数据与所述身份特征数据库的目标特征数据进行比对以进行身份认证，在身份认证成功时确定所述目标特征数据对应的用户身份信息包括：
    在所述目标特征数据与所述身份特征数据库的目标特征数据比对结果的置信度大于第二阈值的情况下，确定身份认证成功。
  11. 根据权利要求3所述的设备鉴权方法，其特征在于，所述设备鉴权方法包括：
    根据鉴权结果或身份认证结果生成认证反馈请求；和
    将所述认证反馈请求发送给对应的所述终端设备。
  12. 根据权利要求3所述的设备鉴权方法，其特征在于，在多个所述终端设备鉴权通过的情况下，所述服务器采用并发模式对多个所述终端设备对应的身份特征数据进行特征提取。
  13. 一种服务器，其特征在于，所述服务器包括：
    接收模块，所述接收模块用于接收至少一个终端设备发送的认证请求，所述认证请求包括所述终端设备的物理编码信息；
    解析模块，所述解析模块用于解析所述认证请求以根据预设设备表对所述终端设备的物理编码信息进行鉴权，所述预设设备表包括预设终端设备编码；
    鉴权模块，所述鉴权模块用于在所述终端设备的物理编码信息与所述预设终端设备编码相匹配的情况下，确定所述终端设备鉴权通过，及在所述终端设备的物理编码信息与所述预设设备表中的全部的预设终端设备编码都不匹配且所述预设设备中的预设终端设备编码的总数量未达到阈值的情况下，响应于添加设备表的操作并确定所述终端设备鉴权通过，以及在所述终端设备的物理编码信息与所述预设设备表中的全部的预设终端设备编码都不匹配且所述预设设备中的预设终端设备编码的总数量达到阈值的情况下，确定所述终端设备鉴权失败。
  14. 一种计算机设备，其特征在于，所述计算机设备包括一个或多个处理器和存储器，所述存储器存储有计算机程序，在所述计算机程序被所述处理器执行的情况下，实现权利要求1-12中任意一项所述的设备鉴权方法的步骤。
  15. 一种存储有计算机程序的非易失性计算机可读存储介质，其特征在于，在所述计算机程序被一个或多个处理器执行的情况下，实现权利要求1-12中任意一项所述的设备鉴权方法的步骤。
PCT/CN2020/139433 2020-12-25 2020-12-25 设备鉴权方法、终端设备、服务器和计算机设备 WO2022134007A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
US18/036,658 US20240048558A1 (en) 2020-12-25 2020-12-25 Device authentication method, terminal device, server, and computer device
CN202080003695.2A CN115668862A (zh) 2020-12-25 2020-12-25 设备鉴权方法、终端设备、服务器和计算机设备
PCT/CN2020/139433 WO2022134007A1 (zh) 2020-12-25 2020-12-25 设备鉴权方法、终端设备、服务器和计算机设备

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/139433 WO2022134007A1 (zh) 2020-12-25 2020-12-25 设备鉴权方法、终端设备、服务器和计算机设备

Publications (1)

Publication Number Publication Date
WO2022134007A1 true WO2022134007A1 (zh) 2022-06-30

Family

ID=82157270

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/139433 WO2022134007A1 (zh) 2020-12-25 2020-12-25 设备鉴权方法、终端设备、服务器和计算机设备

Country Status (3)

Country Link
US (1) US20240048558A1 (zh)
CN (1) CN115668862A (zh)
WO (1) WO2022134007A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130198832A1 (en) * 2012-01-31 2013-08-01 Dell Products L.P. Multilevel passcode authentication
CN105025014A (zh) * 2015-06-18 2015-11-04 顺丰科技有限公司 无人机启用方法、系统及装置
US20160105798A1 (en) * 2013-05-24 2016-04-14 Prashant Govind PAIMA Process for authenticating an identity of a user
CN106131045A (zh) * 2016-08-09 2016-11-16 深圳市西迪特科技有限公司 Gpon olt系统中对onu的认证方法及gpon olt系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130198832A1 (en) * 2012-01-31 2013-08-01 Dell Products L.P. Multilevel passcode authentication
US20160105798A1 (en) * 2013-05-24 2016-04-14 Prashant Govind PAIMA Process for authenticating an identity of a user
CN105025014A (zh) * 2015-06-18 2015-11-04 顺丰科技有限公司 无人机启用方法、系统及装置
CN106131045A (zh) * 2016-08-09 2016-11-16 深圳市西迪特科技有限公司 Gpon olt系统中对onu的认证方法及gpon olt系统

Also Published As

Publication number Publication date
CN115668862A (zh) 2023-01-31
US20240048558A1 (en) 2024-02-08

Similar Documents

Publication Publication Date Title
US10798081B2 (en) Method, apparatus, and system for providing a security check
TWI752418B (zh) 伺服器、客戶端、用戶核身方法及系統
CN105681316B (zh) 身份验证方法和装置
WO2020024398A1 (zh) 生物特征辅助支付方法、装置、计算机设备及存储介质
KR101997371B1 (ko) 신원 인증 방법 및 장치, 단말기 및 서버
US8970348B1 (en) Using sequences of facial gestures to authenticate users
US9147061B1 (en) Multi-level authentication
WO2019179036A1 (zh) 深度神经网络模型、电子装置、身份验证方法和存储介质
WO2020077885A1 (zh) 身份验证方法、装置、计算机设备和存储介质
US20120140993A1 (en) Secure biometric authentication from an insecure device
US11665157B2 (en) Systems and methods for authenticating users within a computing or access control environment
WO2017114289A1 (zh) 一种银行卡信息认证方法、客户端及银行系统
US11244146B2 (en) Systems and methods for secure user logins with facial recognition and blockchain
CN103714282A (zh) 一种互动式的基于生物特征的识别方法
WO2021159669A1 (zh) 系统安全登录方法、装置、计算机设备和存储介质
US11552944B2 (en) Server, method for controlling server, and terminal device
US11496470B2 (en) Methods for randomized multi-factor authentication with biometrics and devices thereof
CN115374420B (zh) 基于人脸安全验证的跨浏览器高并发数据访问的软件系统
US20190130084A1 (en) Authentication method, electronic device, and computer-readable program medium
Verma et al. A novel model to enhance the data security in cloud environment
WO2022134007A1 (zh) 设备鉴权方法、终端设备、服务器和计算机设备
CN109995761B (zh) 服务处理方法、装置、电子设备及存储介质
CA3142780A1 (en) Webpage access method, apparatus, computer device and storage medium
US10728760B2 (en) Frictionless hardening of digital consent
CN110162942B (zh) 基于时间戳的身份验证方法、装置、设备及存储介质

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 18036658

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED26.10.2023).