WO2022170759A1 - Procédé et appareil de traitement d'informations, et dispositif électronique, serveur et support - Google Patents

Procédé et appareil de traitement d'informations, et dispositif électronique, serveur et support Download PDF

Info

Publication number
WO2022170759A1
WO2022170759A1 PCT/CN2021/117232 CN2021117232W WO2022170759A1 WO 2022170759 A1 WO2022170759 A1 WO 2022170759A1 CN 2021117232 W CN2021117232 W CN 2021117232W WO 2022170759 A1 WO2022170759 A1 WO 2022170759A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
user
identity
authenticated
identity authentication
Prior art date
Application number
PCT/CN2021/117232
Other languages
English (en)
Chinese (zh)
Inventor
李定洲
郭伟
祖立军
钱进
Original Assignee
中国银联股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国银联股份有限公司 filed Critical 中国银联股份有限公司
Publication of WO2022170759A1 publication Critical patent/WO2022170759A1/fr

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G06Q20/4014—Identity check for transactions
    • G06Q20/40145—Biometric identity checks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/409—Device specific authentication in transaction processing
    • G06Q20/4097—Device specific authentication in transaction processing using mutual authentication between devices and transaction partners
    • G06Q20/40975—Device specific authentication in transaction processing using mutual authentication between devices and transaction partners using encryption therefor

Definitions

  • the present disclosure belongs to the field of Internet technologies, and in particular, relates to an information processing method, an apparatus, an electronic device, a server and a medium.
  • identity authentication can be performed by comparing the image of the user's identity document with the image of the user, or by reading the identity information of the chip in the user's identity document.
  • the former identity authentication method is difficult to identify the authenticity of the user's identity document.
  • the wear of the surface information of the user's identity document or the poor image capture effect will also reduce the accuracy of the identity authentication result.
  • the latter method of identity authentication will also cause the user's identity information to be maliciously tampered with and leaked due to the low security of the platform that reads the user's identity document.
  • the embodiments of the present disclosure provide an information processing method, apparatus, electronic device, server and medium, which can effectively improve the accuracy of identity authentication results, prevent user identity information from being leaked and tampered with, and improve network information security.
  • an embodiment of the present disclosure provides an information processing method, which is applied to an electronic device, including:
  • the target information includes the user's first biometric information, and a user image acquired within a preset time period, the user image includes the user's second biometrics information;
  • the user identity authentication result of the identity information to be authenticated is determined.
  • an embodiment of the present disclosure provides an information processing method, applied to an electronic device, including:
  • an embodiment of the present disclosure provides an information processing method, applied to a server, including:
  • the device type of the electronic device When it is detected that the device type of the electronic device is the preset target device type, acquire target information corresponding to the user's identity information to be authenticated and used to characterize the user's identity, the target information including the user's first biometric feature information ;
  • an embodiment of the present disclosure provides an information processing apparatus, which is applied to an electronic device, including:
  • a receiving module for receiving the first input for user identity authentication
  • an acquisition module configured to acquire the user's identity information to be authenticated through near field communication in a trusted execution environment in response to the first input;
  • the processing module is configured to determine target information used to characterize the user's identity according to the user's identity information to be authenticated, the target information includes the user's first biometric information, and the user image obtained within a preset time period, and the user image includes the user's first biometric information. the second biometric information;
  • the determining module is configured to determine the user identity authentication result of the identity information to be authenticated based on the comparison result between the first biometric information and the second biometric information.
  • an embodiment of the present disclosure provides an information processing apparatus, which is applied to an electronic device, and may specifically include:
  • a receiving module for receiving the first input for user identity authentication
  • an acquisition module configured to acquire the user's identity information to be authenticated through near field communication in a trusted execution environment in response to the first input;
  • a sending module configured to send the user's identity information to be authenticated to the server, and the user's identity information to be authenticated is used to determine the user identity authentication result of the identity information to be authenticated;
  • the sending module is further configured to acquire a user image within a preset time period, and send the user image to the server, where the user image is used to compare with the user's identity to be authenticated to determine the user identity authentication result;
  • the receiving module is further configured to receive the user identity authentication result of the identity information to be authenticated sent by the server.
  • an embodiment of the present disclosure provides an information processing apparatus, which is applied to a server, and may specifically include:
  • a receiving module configured to receive the identity information to be authenticated of the user sent by the electronic device
  • the acquisition module is configured to acquire target information corresponding to the user's identity information to be authenticated and used to characterize the user's identity when it is detected that the device type of the electronic device is a preset target device type, and the target information includes the user's first biometric information;
  • the receiving module is also used for receiving the user image sent by the electronic device
  • a determination module for determining the user identity authentication result of the identity information to be authenticated based on the comparison result of the first biometric information and the second biometric information in the user image;
  • the sending module is used for sending the user identity authentication result to the electronic device.
  • an embodiment of the present disclosure provides an electronic device, the electronic device comprising: a processor and a memory storing computer program instructions;
  • the information processing method shown in the first aspect or the second aspect is implemented when the processor executes the computer program instructions.
  • an embodiment of the present disclosure provides a server, the server comprising: a processor and a memory storing computer program instructions;
  • the information processing method shown in the third aspect is implemented when the processor executes the computer program instructions.
  • an embodiment of the present disclosure provides a computer-readable storage medium, where computer program instructions are stored on the computer-readable storage medium, and when the computer program instructions are executed by a processor, the information processing method shown in the first aspect is implemented .
  • the information processing method, device, device, and medium of the embodiments of the present disclosure obtain the trusted target information for characterizing the user's identity by obtaining the user's identity information to be authenticated in the trusted execution environment TEE and the near field communication NFC.
  • the identity document information can avoid the problem of forging identity documents, and also avoid the problem of inaccurate target information obtained due to poor photographing effect or insufficient photographing hardware, resulting in incorrect user identity authentication results.
  • TEE Trusted Execution Environment
  • FIG. 1 is a schematic diagram of an information processing architecture of an embodiment of an information processing method according to the first aspect of the present disclosure
  • FIG. 2 is a schematic structural diagram of an electronic device and a server according to an embodiment of the information processing method of the first aspect of the present disclosure
  • FIG. 3 is a schematic architectural diagram of an application scenario of an embodiment of the information processing method according to the first aspect of the present disclosure
  • FIG. 4 is a schematic diagram of an APDU instruction execution position corresponding to a category to which an electronic device belongs according to an embodiment of the information processing method of the first aspect of the present disclosure
  • FIG. 5 is a schematic flowchart of an information processing method according to an embodiment of the information processing method of the first aspect of the present disclosure
  • FIG. 6 is a schematic diagram of an information processing interface according to an embodiment of the information processing method of the first aspect of the present disclosure
  • FIG. 7 is a schematic diagram of an original image histogram of an embodiment of the information processing method according to the first aspect of the present disclosure
  • FIG. 8 is a schematic diagram of a trusted identity authentication initialization process according to an embodiment of the information processing method of the first aspect of the present disclosure
  • FIG. 9 is a schematic flowchart of a trusted identity authentication comparison according to an embodiment of the information processing method of the first aspect of the present disclosure.
  • FIG. 10 is a schematic structural diagram of an embodiment of an information processing apparatus based on an electronic device of the information processing apparatus according to the fourth aspect of the present disclosure
  • FIG. 11 is a schematic structural diagram of an embodiment of an electronic device-based information processing apparatus of the information processing apparatus according to the fifth aspect of the present disclosure.
  • FIG. 12 is a schematic structural diagram of an embodiment of a server-based information processing apparatus of the information processing apparatus according to the sixth aspect of the present disclosure.
  • FIG. 13 is a schematic diagram of a hardware structure of an embodiment of an information processing apparatus according to a seventh aspect of the present disclosure.
  • the operating system of the identity authentication scheme is mostly Android system, so the security of identity authentication is highly dependent on the security of the Android system itself. There are also loopholes in the scheme. If the identity authentication process is initiated by an application and executed in the Android environment, and the security of the Android system environment itself is low, once an attacker is attacked, such as an attacker obtaining root privileges, by implanting a Trojan horse and other means, stealing and Tampering with the information in the user's identity authentication process, falsifying the identity authentication results that are inconsistent with the actual situation, and even using the forged identity information to carry out illegal activities, resulting in the disclosure of the user's identity information.
  • identity authentication can be performed by comparing the user image in the user's identity document and obtaining the user's image in real time, or by reading the identity information of the chip in the user's identity document.
  • the former identity authentication method is difficult to identify the authenticity of the user's identity document, and the result of identity authentication is inaccurate due to the wear and tear of the surface information of the user's identity document or the poor image capture effect of the electronic device.
  • the latter identity authentication scheme is usually authorized to the operating organization of the application for reading and identity authentication. If the personnel of the operating organization intentionally disclose the authorization credentials to the unauthorized organization, or the unauthorized organization uses reverse engineering, malicious debugging and other means If the authorization certificate is stolen, the unauthorized organization may use the certificate to obtain improper benefits.
  • the identity authentication process of performing face comparison in the method of obtaining the identity information of the chip in the user's identity document is performed in an Android control in the Android system, or as a part of the Android application. Low security, resulting in malicious tampering and disclosure of user identity information.
  • the embodiments of the present disclosure provide an information processing method, apparatus, device, and storage medium, which can obtain a user's waiting list by using a trusted execution environment (TEE) and near field communication (NFC).
  • TEE trusted execution environment
  • NFC near field communication
  • TEE Trusted Execution Environment
  • FIG. 1 is a schematic diagram of an information processing architecture of an embodiment of an information processing method according to the first aspect of the present disclosure.
  • the information processing system includes an electronic device 10 , a server 20 and a near field communication chip 30 , such as a chip in an ID document, a chip in a bank card document, a chip in a recharge card, and other chips that support near field communication.
  • a near field communication chip 30 such as a chip in an ID document, a chip in a bank card document, a chip in a recharge card, and other chips that support near field communication.
  • the electronic device 10 establishes a communication link with the server 20
  • a first input for user identity authentication is received.
  • the electronic device 10 acquires the identity information to be authenticated of the user in the near field communication chip 30 through near field communication in a trusted execution environment.
  • the electronic device 10 determines target information for characterizing the user's identity according to the user's identity information to be authenticated, the target information includes the user's first biometric information, and the user image acquired within a preset time period, and the user image includes the user's first biometric information. two biometric information, and based on the comparison result of the first biometric information and the second biometric information, determine the user identity authentication result of the identity information to be authenticated.
  • the electronic device 10 may also send the user's identity information to be authenticated to the server 20, so that the server 20 determines a target for characterizing the user's identity according to the user's identity information to be authenticated information, and determine the user identity authentication result of the identity information to be authenticated through the user image captured by the electronic device 10, and then feed back the user identity authentication result of the identity information to be authenticated to the electronic device 10, so that the electronic device 10 displays the user identity to the user. Authentication result.
  • the electronic device 10 in the embodiment of the present disclosure may include an electronic device application 101 , a trusted identity authentication service control 102 and a trusted identity authentication service TA103 .
  • the electronic device application 101 include the trusted identity authentication service SDK1011, which is a software development kit (SDK), and the trusted identity authentication service TA103, which is a trusted application (trusted application, TA).
  • the electronic device 10 has a trusted execution environment TEE, and the electronic device 10 passes a third-party application (Application, APP) related to the trusted identity authentication service, which is provided by a platform that needs to carry out user authentication service, such as a shopping application or an industry party.
  • APP application
  • the trusted identity authentication service control 102 runs on the electronic device as an independent application
  • the trusted identity authentication service TA103 runs in the trusted execution environment TEE.
  • the server 20 in the embodiment of the present disclosure may run a platform supporting management classes, such as a trusted identity service platform.
  • the operating trusted identity service platform may include an authoritative identity authentication module 201 , a trusted identity authentication background module 202 and a face authentication comparison module 203 .
  • the authoritative identity authentication module 201 is used to interact with the identity authentication server of the identity authentication platform, and parse the identity information plaintext data of the identity information to be authenticated of the user.
  • the trusted identity service platform in the embodiment of the present disclosure is used to manage third-party applications that access and use the trusted identity service platform.
  • the authentication service control 102 provides the business function processing flow.
  • the existing identity document information such as the user's identity document image and the identity document number
  • the technical basis of the example There are two prerequisites to realize the safe reading and parsing of the ID card through NFC. One is to realize the safe transmission of ID information from the electronic device 10 through the server to the identity authentication server, and the other is to realize the safe reading of the ID information through NFC.
  • the embodiments of the present disclosure propose a security information interaction method from the electronic device to the server based on the TEE security guarantee mechanism.
  • the embodiment of the present disclosure grants the authoritative identity authentication module 201 the function of docking with an identity authentication server, and pre-installs the server certificate granted by the identity authentication server in the server, and the server certificate is used to indicate that the server has the authority to authenticate the user's identity to be authenticated. information for identification.
  • the trusted application management platform Truste.g., TAM
  • TAM Trusted Application Management
  • the electronic device when the electronic device receives the user's first input for user identity authentication, the electronic device can use the trusted identity authentication service SDK 1011 and the trusted identity authentication service control 102 in the Android system and/or the ios system in the electronic device to realize the authentication of the user's identity. Invoke the trusted identity authentication service TA103, and initiate the collection and processing of the identity information to be authenticated, and then it is credibly connected to the trusted identity service platform to communicate with the trusted identity authentication background module 202. Finally, the verification and parsing processing of the identity information to be authenticated is completed by the authoritative identity authentication module 201 .
  • the trusted identity authentication service TA generates a pair of public and private keys based on the digital certificate of the electronic device such as the root trust certificate. Among them, the device public key and user address (UserId) and the unique identifier of the electronic device in the public-private key pair will be recorded on the trusted identity service platform. When a risk is found in an electronic device, it will quickly locate an electronic device and Terminate its continued access to the trusted identity service platform, which provides effective support for the trusted identity service platform to carry out risk prevention and control of electronic equipment.
  • the identity authentication platform After ensuring the security of the identity authentication information transmission from the electronic device to the identity authentication platform, it has the ability to securely accept the verification and analysis of the identity information to be authenticated.
  • the information and the process of securely docking with the trusted identity service platform can be described in detail with reference to FIG. 3 .
  • FIG. 3 is an architectural schematic diagram of an application scenario of an embodiment of an information processing system provided according to the present disclosure.
  • the near field communication chip is a chip that includes the user's identity information to be authenticated, and the chip supports NFC communication, such as a second-generation identity document.
  • the electronic device 10 includes an NFC module and a trusted identity authentication service TA103.
  • the NFC module is used to read and transmit the identity information to be authenticated of the user in the second-generation identity document.
  • the trusted identity authentication service TA103 runs in the TEE trusted execution environment.
  • the second-generation ID card When the second-generation ID card communicates with the NFC using Application Protocol Data Unit (APDU) commands, it judges and compares the current Internet of Things electronic devices, and determines the communication process between the NFC access and the second-generation ID card. For example, in some IoT electronic devices with severely limited resources, such as wearable devices, smart door locks and other devices that cannot carry a large amount of computing, it is necessary to further customize the process in the NFC communication process, and access the NFC
  • the APDU command interaction with the second-generation ID document is executed in the device TEE, and the generation, assembly and APDU response processing of the second-generation ID document access APDU command are carried out on the background of the trusted identity authentication service.
  • the specific content can be Specifically refer to the content shown in FIG. 4 .
  • the server 20 runs a trusted identity service platform, which is used as a support management platform for the information processing method based on the trusted identity authentication service.
  • the operating trusted identity service platform may include an APDU instruction operation module and an authoritative identity authentication module 201, wherein the APDU instruction operation module is used to process the generation, assembly and response of the second-generation identity document access APDU instruction, which is mainly related to the authoritative identity authentication.
  • Module 201 interacts.
  • the authoritative identity authentication module 201 is used for securely interacting with the identity authentication platform to determine the identity information plaintext data of the identity information to be authenticated of the user.
  • the embodiment of the present disclosure implements secure reading of NFC information through TEE, and then enables the trusted identity authentication service TA103 to comprehensively monitor NFC reading operations outside the device.
  • the trusted identity authentication service TA103 receives the ID card operation request, it will safely call the NFC module of the electronic device, execute the APDU command set according to the second-generation ID card specification, and execute the command response to the identity information to be authenticated. return.
  • the trusted identity authentication service TA103 sends the received ciphertext information of the identity information to be authenticated to the authoritative identity authentication module 201 through the secure link between the electronic device and the server.
  • the authoritative identity authentication module 201 establishes a secure communication with the identity authentication server after receiving the ciphertext information of the identity information to be authenticated, and parses it through the identity authentication server and splices and assembles it into a target for characterizing the user identity through the identity authentication server attribute format.
  • the trusted identity service service platform responds the original text string of the target information to the trusted identity authentication service TA103.
  • the trusted identity authentication service TA103 can decrypt the original character string of the authorization certificate and the target information according to the target information data of the pre-saved authoritative identity authentication agency, and the identity information to be authenticated, such as the identity document number, the identity document image and the identity document image Decrypt the user's face image, etc., to obtain target information such as the user's face image in the ID document image.
  • the trusted identity authentication service TA103 reads the identity information to be authenticated of the second-generation identity document through the NFC near field, and then hands it over to the authoritative identity authentication module 201 to process and parse the identity information of the identity information to be authenticated. data.
  • the information processing method in the embodiment of the present disclosure may be executed on the side of the electronic device, and may also be executed on the electronic device and the server. Therefore, in some possible embodiments, for example, in some IoT electronic devices with severely limited resources, such as wearable devices, smart door locks, etc. that cannot carry a large amount of computing, it is also necessary to check the NFC communication process. Its process is further customized. These Internet of Things electronic devices can be specifically described with reference to FIG. 4 . As shown in FIG. 4 , for some IoT electronic devices (such as wearable devices, smart door locks, etc.) with severely limited resources provided by the embodiments of the present disclosure, the process needs to be further customized in the NFC communication process.
  • the access to NFC and the APDU command interaction with the ID document are executed in the device TEE, and the generation, assembly and APDU response processing of the ID document access APDU command are carried out on the trusted identity service platform. That is, the embodiment of the present disclosure realizes the secure reading of NFC information through TEE, and then enables the trusted identity authentication service TA103 to comprehensively monitor the reading operation of NFC outside the device.
  • the trusted identity authentication service TA103 receives the ID card swiping operation request, it will safely call the NFC module of the electronic device, and execute the near field communication command in the APDU command set according to the second-generation ID card specification, and will execute the command response to the waiting list.
  • the authenticated identity information is returned.
  • the instructions in the APDU instruction set are determined by the server.
  • the trusted identity authentication service TA103 sends the received ciphertext information of the identity information to be authenticated to the authoritative identity authentication module 201 through the secure link between the electronic device and the server.
  • the authoritative identity authentication module 201 establishes a secure communication with the identity authentication server after receiving the ciphertext information of the identity information to be authenticated, and is parsed by the identity authentication server and assembled into a target for characterizing the user identity by splicing and splicing according to the identity document attribute format.
  • the original text string of the information is returned to the authoritative identity authentication module 201 .
  • the authoritative identity authentication module 201 can decrypt the original character string of the authorization certificate and the target information according to the target information data of the authoritative identity authentication agency saved in advance, such as the identity information to be authenticated, such as the identity document number, the identity document image and the identity document image. Decryption of the user's face image, etc., to obtain target information such as the user's face image in the identity document image.
  • the trusted identity authentication service TA103 reads the identity information to be authenticated of the second-generation identity document through the NFC near field, and then hands it over to the authoritative identity authentication module 201 to process and parse the identity information of the identity information to be authenticated. data.
  • the Internet of Things electronic device When customizing the communication process between NFC access and ID documents according to the Internet of Things electronic device, select the appropriate processing process according to the performance, use and type of the Internet of Things electronic device, such as smart phones, portable/tablet computers, smart POS equipment, smart cars, Self-service vending machines and self-service gates use the scheme of calling NFC in the TEE to perform APDU command interaction between NFC and second-generation ID documents; smart watches/bands, smart door locks/access control use the device to execute APDU commands, and the trusted identity
  • the service platform generates, assembles and processes APDU instructions.
  • the electronic device when the electronic device receives the user's first input for user identity authentication, in response to the first input, in a trusted execution environment, the user's identity information to be authenticated is obtained through near field communication, and the user's identity information to be authenticated is sent to the server. Authentication identity information, the user's identity information to be authenticated is used to determine the user identity authentication result of the identity information to be authenticated.
  • the server receives the identity information to be authenticated of the user sent by the electronic device, and when it detects that the device type of the electronic device is the preset target device type, that is, the device type of the electronic device conforms to the wearable device, smart door lock, etc., it cannot bear the computational burden.
  • target information corresponding to the user's identity information to be authenticated and used to characterize the user's identity is acquired, and the target information includes the user's first biometric feature information. Furthermore, the electronic device acquires the user image within a preset time period, and sends the user image to the server, where the user image is used to compare with the user's identity to be authenticated to determine the user identity authentication result.
  • the server receives the user image sent by the electronic device, determines the second biometric information of the user in the user image, and determines the user identity authentication of the identity information to be authenticated based on the comparison result between the first biometric information and the second biometric information
  • the user identity authentication result of the identity information to be authenticated is sent to the electronic device.
  • the electronic device receives the user identity authentication result of the identity information to be authenticated sent by the server, so as to prompt the user with the user identity authentication result of the identity information to be authenticated.
  • the server may send an instruction to acquire the user image to the electronic device, where the user image instruction is used to instruct the electronic device to acquire the user image within a preset time period.
  • the electronic device acquires the user image when receiving the instruction for acquiring the user image sent by the server.
  • the electronic device may also acquire the user image.
  • the electronic device may obtain the user's identity information to be authenticated by executing the near field communication instruction in the protocol data instruction set provided by the server in a trusted execution environment.
  • the server When the server is in the target information, it can specifically go through the following steps, that is, according to the ciphertext information of the identity information to be authenticated, determine the original character string assembled and assembled according to the attribute format of the identity document and used to represent the target information of the user's identity, according to the pre-stored target information
  • the information data decrypts the original character string of the authorization certificate and the target information, decrypts the identity information to be authenticated, and obtains the target information.
  • the server sends a protocol data instruction to the identity authentication server, and the protocol data instruction is used to instruct the identity authentication server to splicing and assemble the original text of the target information used to represent the user identity according to the identity document attribute format.
  • String receiving the original text string of the target information sent by the authentication server.
  • an embodiment of the present disclosure proposes an information processing method for trusted identity authentication based on TEE and NFC, which can securely access NFC through the TEE to read the identity information to be authenticated of the identity document to obtain reliable and trusted identity information.
  • Target information representing the user's identity and in some embodiments, can interact with the trusted identity service platform running in the server in the trusted execution environment TEE, so as to avoid the problem of forgery of ID cards, and also avoid the problem of ineffective photographing. This will result in inaccurate target information obtained and improve the accuracy of identity authentication.
  • the problem that the identity information to be authenticated may be stolen by the Trojan virus during the interaction between the electronic device and the server is eliminated.
  • the source of the user image used for comparison and authentication that is, the real-time user image, can be trusted, preventing the injection of fake face photos or videos.
  • the embodiments of the present disclosure utilize the 4th generation mobile communication technology (4G), the fifth generation mobile communication technology ( 5th generation mobile networks, 5G) has the characteristics of higher transmission rate and lower delay, and splits the commands for interaction between NFC and second-generation ID cards.
  • 4G the 4th generation mobile communication technology
  • 5G 5th generation mobile networks
  • the part that obtains the user's identity information to be authenticated through near field communication is electronic
  • the device is implemented, mainly dealing with the identity document APDU request response and interaction protocol, and the back-end part is moved to the server to run, and is mainly responsible for the generation and assembly of the identity document access APDU command and the processing of the APDU response.
  • the space ratio of the NFC interaction protocol of electronic devices is reduced, and it has stronger applicability to IoT terminal devices with limited resources such as wearable devices.
  • the method of determining the comparison result between the electronic equipment and the server is determined, which ensures the availability and adaptability of ID card reading and face comparison functions in the case of limited TEE space resources of electronic equipment.
  • TEE to securely access NFC to read the user's identity information to be authenticated ensures that the data source of the acquired identity card information is true and accurate, and has the effect of anti-counterfeiting identity cards.
  • the trusted execution environment TEE prevents malware from intercepting identity card information data. replaced and tampered with.
  • the embodiments of the present disclosure are implemented based on the security closed loop between the electronic device TEE and the server, which can ensure that the information is sent to the trusted identity authentication background decrypted in ciphertext and then transmitted back through the secure TEE secure channel for use, which is applicable to more authentication scenarios.
  • FIG. 5 is a schematic flowchart of an information processing method according to an embodiment of the information processing method of the first aspect of the present disclosure.
  • the information processing method may be applied to the electronic device shown in FIG. 1 , and the information processing method may specifically include the following steps.
  • step 510 a first input for user identity authentication is received.
  • step 520 in response to the first input, in a trusted execution environment, acquire the user's identity information to be authenticated through near field communication.
  • step 530 according to the user's identity information to be authenticated, determine the target information used to represent the user's identity, the target information includes the user's first biometric information, and the user image obtained within a preset time period, the user image Include second biometric information of the user.
  • step 540 based on the comparison result of the first biometric information and the second biometric information, determine the user identity authentication result of the identity information to be authenticated.
  • the trusted target information for characterizing the user's identity such as identity document information
  • the trusted target information can be obtained to avoid the problem of forging identity documents.
  • it also avoids the problem that the obtained target information is inaccurate due to poor photographing effect or insufficient photographing hardware, resulting in incorrect user identity authentication results.
  • malware can effectively prevent malicious software from intercepting and tampering with identity document information.
  • secure access to the cameras of electronic devices through the Trusted Execution Environment ensures the accuracy of user images used for comparison authentication and prevents the injection of fake facial images or videos.
  • the embodiment of the present disclosure provides the following at least two ways to obtain the to-be-authenticated identity information of the user of the identity certificate, as shown in detail below.
  • step 320 may specifically include:
  • the data interaction environment When the data interaction environment satisfies the preset interaction environment and in the trusted execution environment, read the near field communication chip through near field communication, and obtain the label content and user identity of the near field communication chip;
  • the identity information to be authenticated of the user is generated.
  • the information processing method further includes:
  • the data interaction environment includes the distance value between the electronic device and the near field communication chip and the contact time between the electronic device and the near field communication chip within the preset distance;
  • the distance value satisfies the preset distance value and/or the contact with the market satisfies the preset contact duration, it is determined that the data interaction environment satisfies the preset interaction environment.
  • a target near field communication chip in response to the first input, in a trusted execution environment, a target near field communication chip is determined, and the data interaction environment between the near field communication chip and the electronic device satisfies a preset near field communication environment;
  • the embodiment of the present disclosure provides that the target application protocol data corresponding to the target near field communication chip is acquired according to the preset correspondence between the near field communication chip and the application protocol data.
  • the near field communication chip is an identity document
  • the preset correspondence indicates that the electronic device can access the user's face image in the identity document image
  • the electronic device can obtain the user's face image in the identity document image.
  • the preset correspondence indicates that the electronic device can access the ID number, ID image, and ID user identity information
  • the electronic device can obtain the ID number, ID image, and ID user ID information. , you can obtain its information according to the user's previous settings.
  • the preset corresponding relationship between the near field communication chip and the application protocol data in the embodiment of the present disclosure can be determined by the following steps, that is, obtaining the near field corresponding to the target through the preset corresponding relationship between the near field communication chip and the application protocol data Before the step of the target application protocol data corresponding to the communication chip, the information processing method provided by the embodiment of the present disclosure further includes:
  • the permission request includes the identity information of the electronic device, and the permission request is used to obtain the permission of the near field communication chip;
  • the preset correspondence between the near field communication chip and the application protocol data is obtained.
  • step 330 is involved, and this step can be divided into two parts, that is, one part is determining target information used to characterize the user's identity, and the other part is acquiring a photographed image of the user. Based on this, two parts will be explained separately.
  • the process of determining the target information in the embodiment of the present disclosure is as follows, that is, according to the user's identity information to be authenticated, the target information used to characterize the user's identity is determined, including:
  • Step 3301 Determine the identity information plaintext data of the identity information to be authenticated according to the identity information to be authenticated.
  • this step 3301 may specifically include:
  • Step 33011 Send an identity authentication request to the server, the identity authentication request includes the identity information to be authenticated, and the identity authentication request is used to request the server to parse the identity information to be authenticated to obtain the identity information plaintext data of the identity information to be authenticated;
  • Step 33012 Receive the identity authentication feedback information sent by the server, where the identity authentication feedback information includes the identity information plaintext data of the identity information to be authenticated.
  • Step 3302 Decrypt the authorization certificate according to the plaintext data of the identity information and the target information data to determine the first biometric information.
  • the target information data decryption authorization credential can be determined according to the following steps, which may specifically include steps 33021-33023.
  • Step 33021 Generate a device public-private key pair according to the digital certificate in the electronic device.
  • Step 33022 send a user identity authentication initialization request to the server through the trusted identity authentication initialization interface, the user identity authentication initialization request includes the device public and private key pair, and the user identity authentication initialization request is used to establish a secure communication link with the server, and through the secure communication link Perform key exchange.
  • the trusted identity authentication initialization interface corresponding to the server may be obtained based on the pre-stored server public key.
  • Step 33023 Receive the user identity authentication initialization feedback information from the server, where the user identity authentication initialization feedback information includes the target information data decryption authorization certificate.
  • the user identity authentication initialization request also includes application program information
  • the application program information includes at least one of the following: application program identification, signature certificate information, and certificate fingerprint information, and the application program information is used to determine the identity information to be authenticated.
  • the execution environment of the user authentication result includes at least one of the following: application program identification, signature certificate information, and certificate fingerprint information, and the application program information is used to determine the identity information to be authenticated.
  • step 3302 in this embodiment of the present disclosure may specifically include: sending a biometric information request to the server, where the biometric information request includes the identity information plaintext data and the target information data decryption authorization credential, and the biometric information request It is used to request the server to decrypt the authorization certificate based on the plaintext data of the identity information and the target information data, and determine the first biometric information;
  • the biometric feedback information sent by the server is received, where the biometric feedback information includes the first biometric information encrypted by the public key of the device.
  • the method before executing the step of sending the identity authentication request to the server, the method further includes:
  • the identity authentication request is sent to the server under the condition that the identity identification feedback information indicates that the electronic device does not meet the identity authentication condition.
  • the embodiment of the present disclosure also has a key point in that the parsed first biometric information, such as the user's face image in the identity document image and the identity card holder
  • the second biometric information in the user image of the person is compared to the user image.
  • there is a key problem that needs to be solved urgently that is, there is a difference between the user's current facial information and the original photo when the ID document was collected.
  • the embodiment of the present disclosure also proposes a feature model that is insensitive to the clarity of the image, that is, the target ID document portrait feature model, which is used to optimize the false rejection rate of face comparison ( false reject rate, FRR).
  • step 330 that is, the process of acquiring the user image specifically includes steps 3311-3303.
  • Step 3311 Display the fixed portrait position area, and the fixed portrait position area is used to obtain the human body part image corresponding to the user and the fixed portrait position area.
  • the image of the human body part is acquired by fixing the position area of the portrait.
  • more face feature points are selected for detection, which also consumes more performance resources.
  • the embodiments of the present disclosure propose to use a fixed portrait position on the portrait capture interface of the electronic device, delineate the fixed portrait position area on the portrait capture interface to match the best position of the face, and at the same time discard some special processing of face rotation and alignment, so as to Quickly locate the position of the face in the image and improve the positioning accuracy of the facial feature points.
  • Step 3312 When receiving the second input of the image captured by the user, acquire the image of the human body part to be processed.
  • the target feature points are screened from a plurality of feature points in the human body part through the fixed position area, and the human body part image corresponding to the target feature point is acquired according to the target feature points.
  • Step 3313 Perform grayscale normalization on the image of the human body part to be processed to obtain a user image.
  • the first grayscale value corresponds to the first grayscale level
  • adjusting the human body part image to be processed by grayscale stretching according to the first grayscale level A user image with the first gray level is obtained.
  • grayscale normalization processing may be performed on the photograph of the face in the captured user image.
  • the grayscale normalization process is to perform illumination compensation processing on the user image to overcome the influence of illumination changes.
  • the grayscale stretching method can be used to expand the grayscale distribution in the original image to have the entire grayscale level.
  • Image For example, the collected image is an 8-bit grayscale image, and there should be 256 grayscale levels.
  • the grayscale levels of the image are concentrated in one or several grayscale segments.
  • the grayscale stretching method can be used to expand the image to 256 grayscales.
  • grayscale normalization processing is performed according to the RGB color mode of the user image, according to the following two formulas:
  • D is the brightness
  • R is the red color channel
  • G is the green color channel
  • B is the blue color channel.
  • D' is the color level
  • 255*LOW and 255*HIGH are the lowest point of D and the highest point of D in the original image histogram of the user image, respectively.
  • Image histograms are all grayscale images
  • the x-axis is the grayscale value (usually 0 to 255)
  • the y-axis is the number of pixels corresponding to each grayscale in the y-axis image.
  • step 340 based on the user image obtained in step 330, in some embodiments, before step 340, in the case where the first biometric information includes an image of an identification document, the image of the identification document and the image of the identification document are compared by geometric normalization A user image to obtain a comparison result between the first biometric information and the second biometric information.
  • this proposal uses geometric normalization and grayscale normalization to transform the collected living photos.
  • the processing improves the recognition rate of the comparison between the face photo and the image photo on the ID card, and improves the false rejection rate (False Reject Rate, FRR) of the face comparison.
  • this step may specifically include steps 3401-3403.
  • Step 3401 Identify the user's face area in the identity document image, and obtain a user's face image corresponding to the user's face area.
  • Step 3402 Perform proportional enlargement or reduction of the user face image or the face area in the user image, and calculate the feature values of the user image and the user face image.
  • Step 3403 Obtain a comparison result between the first biometric information and the second biometric information according to the at least one feature value.
  • a geometric normalization algorithm is used to compare the first biometric information with the second biometric information.
  • the face authentication and comparison module in the trusted identity service platform finds the user's face area in the ID document image by locating the face feature model for the ID document image, determines the face position in the user image according to the geometric normalization algorithm, and compares the feature values of the two , in the process of determining the face position in the user image, the geometric figures of the face in the live face photo are compared using proportional enlargement and reduction.
  • the geometric normalization algorithm refers to changing the face position in the user image in the user face region in the ID document image to the same position and size according to the comparison target positioning result.
  • Step 1 find out the area where the eyes and nose of the person in the ID document image are located through face model matching
  • Step 2 set the distance between the two eyes as D, and its center point as O;
  • Step 4 Find out the areas where the eyes and nose are located in the user image through the same face model matching
  • Step 5 the distance between the two eyes in the user image is set to be D', and its center point is O';
  • Step 8 Extract the feature values of the two cropped area pictures for comparison, and convert them into similarity as a comparison result between the first biometric information and the second biometric information according to the equal index of the two feature values.
  • the process of comparing images involved in the embodiments of the present disclosure may be as shown in the above steps 1 to 8.
  • the comparison result between the two may be determined through the target identity document portrait feature model, that is, further, at least A feature value is input into the portrait feature model of the target ID document, and a comparison result between the first biometric information and the second biometric information is obtained.
  • the above-mentioned target ID document portrait feature model can be determined, and the specific process is as follows. Since the ID document image photo is small and the image resolution is low, in order to improve the target ID document portrait feature The comparison accuracy of the model focuses on selecting points with obvious facial features, and discarding the feature points that are easy to be misdetected at low resolution.
  • an embodiment of the present disclosure also provides a method for determining a portrait feature model of a target identity document, which is specifically as follows:
  • the preset ID document portrait feature model is simplified to obtain the target ID document portrait feature model.
  • an embodiment of the present disclosure provides a process for determining a comparison result between the first biometric information and the second biometric information, which is specifically as follows, that is, before step 340 , the information processing method Also includes:
  • the similarity of the biometric comparison result is decrypted by encrypting the private key of the device to obtain the similarity of the biometric comparison result, and the similarity of the biometric comparison result is used to represent the comparison result between the first biometric information and the second biometric information.
  • step 340 may specifically include: in the case that the similarity of the biometric comparison result meets the preset similarity, determining that the user identity authentication of the identity information to be authenticated is successful.
  • the target information in the embodiments of the present disclosure also includes at least one of the following: ID number, ID image, ID user identity information, such as the user's name, gender, ethnicity, and date of birth in the ID. ,address.
  • the first biometric information includes at least one of the following: an image of the user's face in the identity document image, and an iris image of the user corresponding to the identity document.
  • an embodiment of the present disclosure proposes an information processing method for trusted identity authentication based on TEE and NFC, which can securely access NFC through the TEE to read the identity information to be authenticated of the identity document to obtain reliable and trusted identity information.
  • Target information representing the user's identity and in some embodiments, can interact with the trusted identity service platform running in the server in the trusted execution environment TEE, so as to avoid the problem of forgery of ID cards, and also avoid the problem of ineffective photographing. This will result in inaccurate target information obtained and improve the accuracy of identity authentication.
  • the problem that the identity information to be authenticated may be stolen by the Trojan virus during the interaction between the electronic device and the server is eliminated.
  • the source of the user image used for comparison and authentication that is, the real-time user image, can be trusted, preventing the injection of fake face photos or videos.
  • the embodiments of the present disclosure utilize the 4th generation mobile communication technology (4G), the fifth generation mobile communication technology ( 5th generation mobile networks, 5G) has the characteristics of higher transmission rate and lower delay, splitting the commands for interaction between NFC and the second-generation ID card, and obtaining the user's identity information to be authenticated through near field communication.
  • 4G 4th generation mobile communication technology
  • 5G 5th generation mobile networks
  • the back-end part is moved to the server to run, mainly responsible for the generation and assembly of ID document access APDU instructions and the processing of APDU response.
  • the space ratio of the NFC interaction protocol of electronic devices is reduced, and it has stronger applicability to IoT terminal devices with limited resources such as wearable devices.
  • the method of determining the comparison result between the electronic equipment and the server is determined, which ensures the availability and adaptability of ID card reading and face comparison functions in the case of limited TEE space resources of electronic equipment.
  • TEE to securely access NFC to read the user's identity information to be authenticated ensures that the data source of the acquired identity card information is true and accurate, and has the effect of anti-counterfeiting identity cards.
  • the trusted execution environment TEE prevents malware from intercepting identity card information data. replaced and tampered with.
  • the embodiments of the present disclosure are implemented based on the security closed loop between the electronic device TEE and the server, which can ensure that the information is sent to the trusted identity authentication background decrypted in ciphertext and then transmitted back through the secure TEE secure channel for use, which is applicable to more authentication scenarios.
  • FIG. 8 is a process of initializing trusted identity authentication provided by an embodiment of the present disclosure
  • FIG. 9 is a trusted identity authentication initialization process provided by an embodiment of the present disclosure.
  • the process of identity authentication comparison is as follows.
  • the third-party application When a third-party application is a consumer application, the third-party application needs to integrate the trusted authentication service SDK in advance, and install the trusted authentication service control on the electronic device running the third-party application, and use the electronic device to install the trusted authentication service control.
  • the corresponding trusted application management (TAM) installs the trusted identity authentication service TA into the device TEE trusted execution environment. Subsequently, the application identification (AppId), signature certificate information and certificate fingerprint information of the third-party application need to be entered in the trusted identity service platform.
  • the process of initializing trusted identity authentication in the resource processing method may include steps 801 to 813, as shown in detail below.
  • Step 801 the electronic device receives an operation of initializing trusted identity authentication initiated by a user for application A.
  • Step 802 Application A initiates a trusted identity authentication initialization request to the integrated trusted identity authentication service SDK, and transmits the transaction element Context.
  • the transaction elements are detailed in Table 4.
  • Step 803 the trusted identity authentication service SDK obtains the AppId, signature certificate information and certificate fingerprint information of application A through the Context context, calls the trusted identity authentication initialization interface of the trusted identity authentication service control, and passes in the transaction element application program A's AppId, signature certificate information, and certificate fingerprint information.
  • Step 804 the trusted identity authentication service control invokes the trusted identity authentication service TA initialization interface, and inputs the transaction element AppId, signature certificate information and certificate fingerprint information.
  • Step 805 the trusted identity authentication service TA generates a pair of device public and private key pairs according to the device root trust certificate.
  • Step 806 the trusted identity authentication service TA requests the trusted identity service platform, and inputs the AppId of the application A, the signature certificate information and the certificate fingerprint information.
  • Step 807 the server public key of the trusted identity service platform is preset in the trusted identity authentication service TA.
  • the trusted identity authentication service TA establishes a secure link with the trusted identity service platform through the server public key, uses the device public key and the server public key of the trusted identity service platform for session key negotiation, and subsequently uses the negotiated session key for interaction.
  • the trusted identity authentication service TA encrypts the AppId, signature certificate information and certificate fingerprint information of application A with the session key, and transmits it to the trusted identity service platform.
  • Step 808 the trusted identity service platform decrypts using the session key, and verifies whether the AppId, signature certificate information and certificate fingerprint information of application A are consistent with those previously entered in the trusted identity service platform.
  • the trusted identity authentication service TA returns the ciphertext of the authorization certificate for decryption of the target information data of the identity authentication platform encrypted by the public key of the device, such as the identity authentication service of the subordinate institutions of the Ministry of Public Security.
  • Step 809 after receiving the response, the trusted identity authentication service TA verifies the validity of the message containing the ciphertext of the received target information data decryption authorization certificate. In the case of valid verification, decrypt the ciphertext of the authorization certificate for the target information data decryption of the identity authentication platform through the private key of the device, and save the target information data decryption authorization certificate of the identity authentication platform to the trusted identity authentication service TA.
  • Step 810 the trusted identity authentication service TA returns an operation result corresponding to the operation of the trusted identity authentication initialization to the trusted identity authentication service control.
  • Step 811 the trusted identity authentication service control returns an operation result corresponding to the trusted identity authentication initialization operation to the trusted identity authentication service SDK.
  • Step 812 the trusted identity authentication service SDK returns the trusted identity authentication initialization result to application A.
  • Step 813 the application A displays the trusted identity authentication initialization result to the user through the electronic device.
  • the trusted identity authentication and comparison process in the resource processing method includes steps 901 to 916 , as shown in detail below.
  • Step 901 the electronic device receives a comparison operation of the trusted identity authentication initiated by the user with respect to the application A.
  • Step 902 the application A initiates a trusted identity authentication comparison request to the integrated trusted identity authentication service SDK, and passes in the transaction element to be authenticated identity information UserId, such as the transaction element, as shown in FIG. 4 .
  • Step 903 the trusted identity authentication service SDK invokes the authentication comparison interface of the trusted identity authentication service control, and inputs the identity information UserId of the transaction element to be authenticated.
  • Step 904 the trusted identity authentication service control invokes the trusted identity authentication service TA authentication comparison interface.
  • Step 905 the trusted identity authentication service TA accesses the NFC module of the device, so that the electronic device displays the ID card swiping interface.
  • Step 906 the electronic device obtains the identity information to be authenticated in the near field communication chip, the NFC module responds the identity information to be authenticated to the trusted identity authentication service TA, and the trusted identity authentication service TA sends the identity information to be authenticated to the authoritative identity authentication module Such as the identity authentication service platform of the subordinate institutions of the Ministry of Public Security.
  • Step 907 The authoritative identity authentication module processes the received identity information to be authenticated, and returns the processed identity information to be authenticated in plaintext to the trusted identity authentication service TA.
  • Step 908 the trusted identity authentication service TA sends the target information data decryption authorization certificate of the authoritative identity authentication module and the information plaintext of the identity information to be authenticated to the trusted identity service platform.
  • Step 909 the trusted identity service platform obtains target information through the authoritative identity authentication module, the target information includes the user's face image in the identity document image, encrypted with the device public key, and returned to the trusted identity authentication service TA.
  • Step 910 the trusted identity authentication service TA securely accesses the camera of the electronic device to obtain the user image.
  • Step 911 the trusted identity authentication service TA submits the user's face image in the identity document image and the user image decrypted using the device private key to the trusted identity service platform using symmetric key encryption.
  • Step 912 the trusted identity service platform uses the symmetric key to decrypt to obtain the face image in the user image, compares the two images according to the preprocessing process of the face image in the user image and the user face image in the identity document image, and returns to use the device public image. Key-encrypted biometric comparison results similarity.
  • Step 913 the trusted identity authentication service TA decrypts the biometric comparison result similarity using the device private key, and returns it to the trusted identity authentication service control.
  • Step 914 the trusted identity authentication service control returns the similarity of the biometric comparison result to the trusted identity authentication service SDK.
  • Step 915 the trusted identity authentication service SDK returns the similarity of the biometric comparison result to the application A.
  • Step 916 the application A displays the user identity authentication result of the identity information to be authenticated corresponding to the similarity of the biometric comparison result to the user.
  • the life cycle based on the trusted identity authentication service operation may include the trusted identity authentication service initialization function, the trusted identity authentication service registration function, the trusted identity authentication function, the trusted identity witness comparison function, and the trusted identity authentication function.
  • the authentication service logout function in which the trusted identity authentication service can be initialized first, and if the initialization verification is passed, the trusted identity authentication registration, trusted identity witness comparison and trusted identity authentication logout operations can be performed.
  • an embodiment of the present disclosure proposes an information processing method for trusted identity authentication based on TEE and NFC, which can securely access NFC through the TEE to read the identity information to be authenticated of the identity document to obtain reliable and trusted identity information.
  • Target information representing the user's identity and in some embodiments, can interact with the trusted identity service platform running in the server in the trusted execution environment TEE, so as to avoid the problem of forgery of ID cards, and also avoid the problem of ineffective photographing. This will result in inaccurate target information obtained and improve the accuracy of identity authentication.
  • the problem that the identity information to be authenticated may be stolen by the Trojan virus during the interaction between the electronic device and the server is eliminated.
  • the source of the user image used for comparison and authentication that is, the real-time user image, can be trusted, preventing the injection of fake face photos or videos.
  • the embodiments of the present disclosure utilize the 4th generation mobile communication technology (4G), the fifth generation mobile communication technology ( 5th generation mobile networks, 5G) has the characteristics of higher transmission rate and lower delay, and splits the commands for interaction between NFC and second-generation ID cards.
  • 4G the 4th generation mobile communication technology
  • 5G 5th generation mobile networks
  • the part that obtains the user's identity information to be authenticated through near field communication is electronic
  • the device is implemented, mainly dealing with the identity document APDU request response and interaction protocol, and the back-end part is moved to the server to run, mainly responsible for the generation and assembly of the identity document access APDU command and the processing of the APDU response.
  • the space ratio of the NFC interaction protocol of electronic devices is reduced, and it has stronger applicability to IoT terminal devices with limited resources such as wearable devices.
  • the method of determining the comparison result between the electronic device and the server ensures the availability and adaptability of ID card reading and face comparison functions in the case of limited TEE space resources of electronic devices.
  • TEE to securely access NFC to read the user's identity information to be authenticated ensures that the data source of the acquired identity card information is true and accurate, and has the effect of anti-counterfeiting identity cards.
  • the trusted execution environment TEE prevents malware from intercepting identity card information data. replaced and tampered with.
  • the embodiments of the present disclosure are implemented based on the security closed loop between the electronic device TEE and the server, which can ensure that the information is sent to the trusted identity authentication background decrypted in ciphertext and then transmitted back through the secure TEE secure channel for use, which is applicable to more authentication scenarios.
  • the present disclosure also provides an information processing apparatus. Specifically, detailed description is given with reference to FIG. 10 .
  • FIG. 10 is a schematic structural diagram of an embodiment of an electronic device-based information processing apparatus provided according to the present disclosure.
  • the apparatus shown in FIG. 10 may be provided in the electronic device shown in FIG. 1 .
  • the information processing apparatus 100 may specifically include:
  • a receiving module 1001 configured to receive a first input for user identity authentication
  • an obtaining module 1002 configured to obtain the user's identity information to be authenticated through near field communication in a trusted execution environment in response to the first input;
  • the processing module 1003 is configured to determine target information used to characterize the user's identity according to the user's identity information to be authenticated, the target information includes the user's first biometric information, and the user image obtained within a preset time period, the user image include the user's second biometric information;
  • the determining module 1004 is configured to determine the user identity authentication result of the identity information to be authenticated based on the comparison result between the first biometric information and the second biometric information.
  • the trusted target information for characterizing the user's identity such as identity document information
  • the trusted target information can be obtained to avoid the problem of forging identity documents.
  • it also avoids the problem that the obtained target information is inaccurate due to poor photographing effect or insufficient photographing hardware, resulting in incorrect user identity authentication results.
  • malware can effectively prevent malicious software from intercepting and tampering with identity document information.
  • secure access to the camera of the electronic device through the Trusted Execution Environment (TEE) ensures the accuracy of the user image used for comparison authentication and prevents the injection of fake facial photos or videos.
  • the information processing apparatus 100 in the embodiments of the present disclosure will be described in detail below.
  • the acquiring module 1002 may be specifically configured to, in response to the first input, read the near field communication chip through near field communication when the data interaction environment satisfies the preset interaction environment and under the trusted execution environment , to obtain the label content and user ID of the near field communication chip,
  • the identity information to be authenticated of the user is generated.
  • the information processing apparatus 100 may further include a detection module for detecting a data interaction environment with the near field communication chip, where the data interaction environment includes a distance value between the electronic device and the near field communication chip and/or the electronic device within a preset distance For the contact duration with the near field communication chip, when the distance value meets the preset distance value and/or the contact market meets the preset contact duration, it is determined that the data interaction environment meets the preset interaction environment.
  • the acquiring module 1002 can be specifically configured to, in response to the first input, determine the target near field communication chip under the trusted execution environment, and the data interaction environment between the near field communication chip and the electronic device satisfies the preset near field communication environment, and through According to the preset correspondence between the near field communication chip and the application protocol data, the target application protocol data corresponding to the target near field communication chip is obtained, and the user's identity information to be authenticated is obtained according to the target application protocol data.
  • the processing module 1003 in the embodiment of the present disclosure may be specifically configured to, according to the identity information to be authenticated, determine the identity information plaintext data of the identity information to be authenticated, and determine the identity information plaintext data of the identity information to be authenticated according to the identity information plaintext data and the target information data. Decrypt the authorization credential to determine the first biometric information.
  • the information processing apparatus 100 in the embodiment of the present disclosure may further include a sending module. Based on this, a sending module is used to send an identity authentication request to the server, where the identity authentication request includes the identity information to be authenticated, and the identity authentication request is used to request the server to parse the identity information to be authenticated to obtain the identity information of the identity information to be authenticated plaintext data.
  • a sending module is used to send an identity authentication request to the server, where the identity authentication request includes the identity information to be authenticated, and the identity authentication request is used to request the server to parse the identity information to be authenticated to obtain the identity information of the identity information to be authenticated plaintext data.
  • the receiving module 1001 in the embodiment of the present disclosure receives the identity authentication feedback information sent by the server, and the identity authentication feedback information includes the identity information plaintext data of the identity information to be authenticated.
  • the sending module in the embodiments of the present disclosure may also be configured to send the identity identification of the electronic device to the server, where the electronic identification of the electronic device is used to determine whether the electronic device satisfies the conditions for identity authentication.
  • the receiving module 1001 in the embodiment of the present disclosure is further configured to receive the identity feedback information sent by the server.
  • the sending module in the embodiment of the present disclosure may also be configured to send an identity authentication request to the server under the condition that the identity identification feedback information indicates that the electronic device does not meet the identity authentication condition.
  • the information processing apparatus 100 in this embodiment of the present disclosure may further include a generating module, configured to generate a device public-private key pair according to the digital certificate in the electronic device.
  • the sending module in the embodiment of the present disclosure can also be used to send a user identity authentication initialization request to the server through a trusted identity authentication initialization interface, where the user identity authentication initialization request includes the device public and private key pair, and the user identity authentication initialization request uses It establishes a secure communication link with the server and performs key exchange through the secure communication link.
  • the receiving module 1001 in the embodiment of the present disclosure is further configured to receive the user identity authentication initialization feedback information of the server, where the user identity authentication initialization feedback information includes the target information data decryption authorization certificate.
  • the obtaining module in the embodiments of the present disclosure may also be used to obtain a trusted identity authentication initialization interface corresponding to the server based on the server public key.
  • the user identity authentication initialization request in the embodiment of the present disclosure further includes application program information, and the application program information includes at least one of the following: an application program identifier, signature certificate information, and certificate fingerprint information, wherein the application program information is used to determine the pending The execution environment of the user authentication result that authenticates the identity information.
  • the processing module 1003 in this embodiment of the present disclosure may be specifically configured to send a biometric information request to the server, where the biometric information request includes the identity information plaintext data and the target information data decryption authorization credential, and the biometric information request It is used to request the server to decrypt the authorization certificate based on the plaintext data of the identity information and the target information data, determine the first biometric information, and receive the biometric feedback information sent by the server, where the biometric feedback information includes the first biometric information encrypted by the device public key.
  • the information processing apparatus 100 in this embodiment of the present disclosure may further include a display module, configured to display a fixed portrait position area, and the fixed portrait position area is used to obtain a human body part image corresponding to the user and the fixed portrait position area.
  • the acquiring module 1002 in the embodiment of the present disclosure may be specifically configured to acquire the image of the human body part to be processed through the fixed location area when receiving the second input of the captured image by the user.
  • the processing module 1003 in the embodiment of the present disclosure may be specifically configured to perform grayscale normalization processing on the image of the human body part to be processed to obtain a user image.
  • the acquisition module 1002 in the embodiment of the present disclosure can be specifically used to select target feature points from a plurality of feature points in a human body part through a fixed location area, and obtain a human body part image corresponding to the target feature point according to the target feature points .
  • the processing module 1003 in this embodiment of the present disclosure can be specifically configured to obtain a first grayscale value of a human body part image to be processed, where the first grayscale value corresponds to the first grayscale level, and according to the first grayscale level Stretch and adjust the image of the human body part to be processed to obtain a user image with a first gray level.
  • the determining module 1004 in this embodiment of the present disclosure may be specifically configured to, in the case that the first biometric information includes an image of an ID document, compare the image of the ID document and the user image through geometric normalization, and obtain The comparison result of the first biometric information and the second biometric information.
  • the determining module 1004 in the embodiment of the present disclosure can be specifically used to identify the user's face area in the ID document image, obtain the user's face image corresponding to the user's face area, perform the user's face image or the face area in the user image, etc.
  • the ratio is enlarged or reduced, and the feature values of the user image and the user face image are calculated, and a comparison result between the first biometric information and the second biometric information is obtained according to at least one feature value.
  • the determining module 1004 in this embodiment of the present disclosure may be specifically configured to input at least one feature value into the target ID document portrait feature model to obtain a comparison result between the first biometric information and the second biometric information.
  • the information processing apparatus 100 in this embodiment of the present disclosure may further include a simplification module, configured to simplify the preset identity document portrait feature model according to the training feature values of the user's face image in the target identity document, to obtain The target identity document portrait feature model.
  • the information processing apparatus 100 may further include an encryption module configured to encrypt the first biometric information and the second biometric information by using a symmetric key to obtain encrypted biometric information.
  • the sending module in the embodiment of the present disclosure is further configured to send an identity authentication result request to the server, where the identity authentication result request includes encrypted biometric information, and the identity authentication result request is used to request the server according to the first biometric information and the second biometric information , and calculate the similarity of the biometric comparison results between the first biometric information and the second biometric information.
  • the receiving module 1001 in the embodiment of the present disclosure is further configured to receive the identity authentication result feedback information sent by the server, where the identity authentication result feedback information includes the similarity of the biometric comparison result encrypted by the public key of the device.
  • the processing module 1003 in this embodiment of the present disclosure is further configured to decrypt the similarity of the biometric comparison result by encrypting the device private key to obtain the similarity of the biometric comparison result, and the similarity of the biometric comparison result is used to represent the first biometric information Comparison result with the second biometric information.
  • the determining module 1004 in this embodiment of the present disclosure may be specifically configured to determine that the user identity authentication of the identity information to be authenticated is successful if the similarity of the biometric comparison result meets the preset similarity.
  • the target information involved in the above also includes at least one of the following: ID number and ID image.
  • the first biometric information includes at least one of the following: an image of the user's face in the identity document image, and an iris image of the user corresponding to the identity document.
  • the trusted target information for characterizing the user's identity such as identity document information
  • the trusted target information can be obtained to avoid the problem of forging identity documents.
  • it also avoids the problem that the obtained target information is inaccurate due to poor photographing effect or insufficient photographing hardware, resulting in incorrect user identity authentication results.
  • TEE Trusted Execution Environment
  • the information processing apparatus 100 shown in FIG. 10 can execute various steps in the information processing method embodiments shown in FIGS. 1-9 , and implement each step in the method embodiments shown in FIGS. 1-9 . The process and effect will not be repeated here.
  • the present disclosure also provides an information processing device based on electronic devices such as wearable devices, smart door locks, etc. that cannot carry a large amount of computation. Specifically, detailed description is given with reference to FIG. 11 .
  • FIG. 11 is a schematic structural diagram of another embodiment of an electronic device-based information processing apparatus provided according to the present disclosure.
  • the apparatus shown in FIG. 11 may be set in a wearable device, a smart door lock, or other information processing equipment that cannot carry a large amount of computation.
  • the information processing apparatus 1100 may specifically include:
  • a receiving module 1110 configured to receive a first input for user identity authentication
  • an obtaining module 1120 configured to, in response to the first input, obtain the user's identity information to be authenticated through near field communication in a trusted execution environment;
  • the sending module 1130 is configured to send the user's identity information to be authenticated to the server, and the user's identity information to be authenticated is used to determine the user identity authentication result of the identity information to be authenticated;
  • the sending module 1130 is further configured to obtain a user image within a preset time period, and send the user image to the server, where the user image is used to compare with the user's identity to be authenticated to determine the user identity authentication result;
  • the receiving module 1110 is further configured to receive the user identity authentication result of the identity information to be authenticated sent by the server.
  • the obtaining module 1120 provided by the embodiment of the present disclosure is specifically configured to obtain the user's identity information to be authenticated by executing the near field communication instruction in the protocol data instruction set in a trusted execution environment; wherein the near field communication instruction is set by Server OK.
  • the present disclosure also provides a server. Specifically, detailed description is given with reference to FIG. 12 .
  • FIG. 12 is a schematic structural diagram of an embodiment of a server-based information processing apparatus provided according to the present disclosure.
  • the information processing apparatus 1200 may specifically include:
  • a receiving module 1210 configured to receive the identity information to be authenticated of the user sent by the electronic device
  • the obtaining module 1220 is configured to obtain target information corresponding to the user's to-be-authenticated identity information and used to characterize the user's identity when it is detected that the user's to-be-authenticated identity information is used to determine the user's identity authentication result of the to-be-authenticated identity information, the target information including the user's first biometric information;
  • the receiving module 1210 is further configured to receive the user image sent by the electronic device
  • a determination module 1230 configured to determine the user identity authentication result of the identity information to be authenticated based on the comparison result between the first biometric information and the second biometric information in the user image;
  • the sending module 1240 is further configured to send the user identity authentication result to the electronic device.
  • the obtaining module 1220 in the embodiment of the present disclosure is specifically used to determine a protocol data instruction according to the ciphertext information of the identity information to be authenticated, and the protocol data instruction is used to indicate that the user identity is represented by splicing and assembling according to the attribute format of the identity document.
  • the original character string of the target information is decrypted according to the pre-stored target information data and the original character string of the authorization certificate and the target information, and the identity information to be authenticated is decrypted to obtain the target information.
  • the sending module 1230 can also be used to send a protocol data instruction to the identity authentication server, where the protocol data instruction is used to instruct the identity authentication server to spliced and assembled according to the identity document attribute format and is used to characterize the original character string of the target information of the user identity.
  • the receiving module 1210 may also be configured to receive the original character string of the target information sent by the identity authentication server.
  • the present disclosure also provides an information processing device. Specifically, detailed description is given with reference to FIG. 13 .
  • FIG. 13 shows a schematic diagram of a hardware structure of an information processing device provided by an embodiment of the present disclosure.
  • the information processing 1300 may include an electronic device or a server involved in the embodiments of the present disclosure.
  • Information processing 1300 may include a processor 1301 and a memory 1302 storing computer program instructions.
  • the above-mentioned processor 1301 may include a central processing unit (CPU), or a specific integrated circuit (Application Specific Integrated Circuit, ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present disclosure.
  • CPU central processing unit
  • ASIC Application Specific Integrated Circuit
  • Memory 1302 may include mass storage for data or instructions.
  • memory 1302 may include a Hard Disk Drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a Universal Serial Bus (USB) drive or two or more A combination of more than one of the above.
  • Memory 1302 may include removable or non-removable (or fixed) media, where appropriate.
  • Storage 1302 may be internal or external to the integrated gateway disaster recovery device, where appropriate.
  • memory 1302 is non-volatile solid state memory.
  • memory 1302 includes read only memory (ROM).
  • the ROM may be a mask programmed ROM, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), electrically rewritable ROM (EAROM) or flash memory or A combination of two or more of the above.
  • PROM programmable ROM
  • EPROM erasable PROM
  • EEPROM electrically erasable PROM
  • EAROM electrically rewritable ROM
  • flash memory or A combination of two or more of the above.
  • the processor 1301 reads and executes the computer program instructions stored in the memory 1302 to implement any one of the information processing methods in the foregoing embodiments.
  • the data processing device may also include a communication interface 1303 and a bus 1310 .
  • the processor 1301 , the memory 1302 , and the communication interface 1303 are connected through the bus 1310 and complete the mutual communication.
  • the communication interface 1303 is mainly used to implement communication between modules, apparatuses, units and/or devices in the embodiments of the present disclosure.
  • the bus 1310 includes hardware, software, or both, coupling the components of the flow control device to each other.
  • the bus may include Accelerated Graphics Port (AGP) or other graphics bus, Enhanced Industry Standard Architecture (EISA) bus, Front Side Bus (FSB), HyperTransport (HT) Interconnect, Industry Standard Architecture (ISA) Bus, Infiniband Interconnect, Low Pin Count (LPC) Bus, Memory Bus, Microchannel Architecture (MCA) Bus, Peripheral Component Interconnect (PCI) Bus, PCI-Express (PCI-X) Bus, Serial Advanced Technology Attachment (SATA) bus, Video Electronics Standards Association Local (VLB) bus or other suitable bus or a combination of two or more of the above.
  • Bus 1310 may include one or more buses, where appropriate. Although embodiments of the present disclosure describe and illustrate a particular bus, this disclosure contemplates any suitable bus or interconnect.
  • the data processing device can execute the information processing method in the embodiment of the present disclosure, thereby realizing the information processing method and apparatus described in conjunction with FIG. 1 to FIG. 10 .
  • the embodiments of the present disclosure may be implemented by providing a computer-readable storage medium.
  • Computer program instructions are stored on the computer-readable storage medium, and when the computer program instructions are executed by the processor, any one of the information processing methods in the foregoing embodiments is implemented.
  • Examples of computer-readable storage media include non-transitory computer-readable storage media, such as read-only memory (Read-Only Memory, ROM for short), random access memory (Random Access Memory, RAM for short), magnetic disk, or optical disk, and the like.
  • the functional blocks shown in the above structural block diagrams may be implemented as hardware, software, firmware, or a combination thereof.
  • hardware When implemented in hardware, it may be, for example, an electronic circuit, an application specific integrated circuit (ASIC), suitable firmware, a plug-in, a function card, or the like.
  • ASIC application specific integrated circuit
  • elements of the present disclosure are programs or code segments used to perform the required tasks.
  • the program or code segments may be stored in a machine-readable medium or transmitted over a transmission medium or communication link by a data signal carried in a carrier wave.
  • a "machine-readable medium” may include any medium that can store or transmit information.
  • machine-readable media examples include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, and the like.
  • the code segments may be downloaded via a computer network such as the Internet, an intranet, or the like.
  • the exemplary embodiments mentioned in the present disclosure describe some methods or systems based on a series of steps or devices.
  • the present disclosure is not limited to the order of the above steps, that is, the steps may be performed in the order mentioned in the embodiment, or may be different from the order in the embodiment, or several steps may be performed simultaneously.

Landscapes

  • Business, Economics & Management (AREA)
  • Engineering & Computer Science (AREA)
  • Accounting & Taxation (AREA)
  • Computer Security & Cryptography (AREA)
  • Finance (AREA)
  • Strategic Management (AREA)
  • Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Collating Specific Patterns (AREA)

Abstract

L'invention concerne un procédé et un appareil de traitement d'informations, ainsi qu'un dispositif électronique, un serveur et un support. Le procédé de traitement d'informations consiste : recevoir une première entrée pour une authentification d'identité d'utilisateur ; en réponse à la première entrée, acquérir les informations d'identité à authentifier d'un utilisateur au moyen d'une communication en champ proche dans un environnement d'exécution de confiance ; déterminer, en fonction des informations d'identité à authentifier de l'utilisateur, les informations cibles permettant de représenter l'identité de l'utilisateur, les informations cibles comprenant des premières informations de caractéristiques biologiques de l'utilisateur, puis acquérir une image d'utilisateur dans une période prédéfinie, l'image d'utilisateur comprenant des secondes informations de caractéristiques biologiques de l'utilisateur ; d'après un résultat de comparaison entre les premières informations de caractéristiques biologiques et les secondes informations de caractéristiques biologiques, déterminer un résultat d'authentification d'identité d'utilisateur des informations d'identité à authentifier. Au moyen du procédé, la précision d'un résultat d'authentification d'identité peut être améliorée de manière efficace, on empêche que les informations d'identité de l'utilisateur soient divulguées et altérées, et la sécurité des informations du réseau est améliorée.
PCT/CN2021/117232 2021-02-09 2021-09-08 Procédé et appareil de traitement d'informations, et dispositif électronique, serveur et support WO2022170759A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110179442.7 2021-02-09
CN202110179442.7A CN112819475B (zh) 2021-02-09 2021-02-09 信息处理方法、装置、电子设备、服务器及介质

Publications (1)

Publication Number Publication Date
WO2022170759A1 true WO2022170759A1 (fr) 2022-08-18

Family

ID=75864920

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/117232 WO2022170759A1 (fr) 2021-02-09 2021-09-08 Procédé et appareil de traitement d'informations, et dispositif électronique, serveur et support

Country Status (2)

Country Link
CN (1) CN112819475B (fr)
WO (1) WO2022170759A1 (fr)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117915005A (zh) * 2023-10-19 2024-04-19 广州翼拍联盟网络技术有限公司 多功能采集设备、数据采集系统、方法及其相关设备
CN118194265A (zh) * 2024-05-13 2024-06-14 湖南三湘银行股份有限公司 一种基于nfc快速识别采集身份信息的方法

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR102642788B1 (ko) 2020-01-27 2024-03-05 애플 인크. 모바일 키 등록 및 사용
CN112819475B (zh) * 2021-02-09 2024-08-16 中国银联股份有限公司 信息处理方法、装置、电子设备、服务器及介质
EP4226338A2 (fr) * 2021-06-06 2023-08-16 Apple Inc. Interfaces utilisateur pour justificatif d'identité numérique
CN113946812A (zh) * 2021-09-29 2022-01-18 北京达佳互联信息技术有限公司 一种身份认证方法、装置、电子设备及存储介质
CN113645045B (zh) * 2021-10-13 2022-01-04 北京创米智汇物联科技有限公司 Tee中的安全控制方法、装置及设备、存储介质
CN114584970A (zh) * 2022-02-14 2022-06-03 国网思极紫光(青岛)微电子科技有限公司 通信认证方法、签约验证方法以及通信方法
CN115099814B (zh) * 2022-06-13 2024-08-02 马上消费金融股份有限公司 信息处理方法、装置、设备及存储介质
CN115208704B (zh) * 2022-09-16 2023-01-13 欣诚信息技术有限公司 一种身份认证系统及政法服务应用系统
CN115811403A (zh) * 2022-11-21 2023-03-17 航天信息股份有限公司 身份认证方法、系统、电子设备以及存储介质

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2014082387A1 (fr) * 2012-11-28 2014-06-05 鹤山世达光电科技有限公司 Système d'authentification d'empreinte digitale et procédé d'authentification d'empreinte digitale basés sur nfc
CN105187217A (zh) * 2015-09-16 2015-12-23 成都三零凯天通信实业有限公司 一种双因子身份认证方法及装置
CN107682545A (zh) * 2017-09-28 2018-02-09 山西特信环宇信息技术有限公司 基于生物识别技术的人证机合一手机终端系统及操作方法
CN108462725A (zh) * 2018-05-29 2018-08-28 北京华大智宝电子系统有限公司 一种电子签名设备、身份验证方法和系统
CN109325332A (zh) * 2018-09-17 2019-02-12 北京旷视科技有限公司 人证核验方法、服务器、后台及系统
CN111831995A (zh) * 2020-09-08 2020-10-27 杭州海宴科技有限公司 一种基于eID和人体生物信息的可信身份认证方法和系统
CN112819475A (zh) * 2021-02-09 2021-05-18 中国银联股份有限公司 信息处理方法、装置、电子设备、服务器及介质

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108833359A (zh) * 2018-05-22 2018-11-16 深圳市商汤科技有限公司 身份验证方法、装置、设备、存储介质及程序

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2014082387A1 (fr) * 2012-11-28 2014-06-05 鹤山世达光电科技有限公司 Système d'authentification d'empreinte digitale et procédé d'authentification d'empreinte digitale basés sur nfc
CN105187217A (zh) * 2015-09-16 2015-12-23 成都三零凯天通信实业有限公司 一种双因子身份认证方法及装置
CN107682545A (zh) * 2017-09-28 2018-02-09 山西特信环宇信息技术有限公司 基于生物识别技术的人证机合一手机终端系统及操作方法
CN108462725A (zh) * 2018-05-29 2018-08-28 北京华大智宝电子系统有限公司 一种电子签名设备、身份验证方法和系统
CN109325332A (zh) * 2018-09-17 2019-02-12 北京旷视科技有限公司 人证核验方法、服务器、后台及系统
CN111831995A (zh) * 2020-09-08 2020-10-27 杭州海宴科技有限公司 一种基于eID和人体生物信息的可信身份认证方法和系统
CN112819475A (zh) * 2021-02-09 2021-05-18 中国银联股份有限公司 信息处理方法、装置、电子设备、服务器及介质

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117915005A (zh) * 2023-10-19 2024-04-19 广州翼拍联盟网络技术有限公司 多功能采集设备、数据采集系统、方法及其相关设备
CN118194265A (zh) * 2024-05-13 2024-06-14 湖南三湘银行股份有限公司 一种基于nfc快速识别采集身份信息的方法
CN118194265B (zh) * 2024-05-13 2024-10-15 湖南三湘银行股份有限公司 一种基于nfc快速识别采集身份信息的方法

Also Published As

Publication number Publication date
CN112819475A (zh) 2021-05-18
TW202232407A (zh) 2022-08-16
CN112819475B (zh) 2024-08-16

Similar Documents

Publication Publication Date Title
WO2022170759A1 (fr) Procédé et appareil de traitement d'informations, et dispositif électronique, serveur et support
US10326761B2 (en) Web-based user authentication techniques and applications
KR102450025B1 (ko) 암호화 방법 및 시스템
US9673981B1 (en) Verification of authenticity and responsiveness of biometric evidence and/or other evidence
KR102358546B1 (ko) 장치에 대해 클라이언트를 인증하기 위한 시스템 및 방법
KR102431834B1 (ko) 상이한 채널들을 통해 강한 인증 이벤트를 운반하기 위한 시스템 및 방법
US10061910B2 (en) Secure biometric data capture, processing and management for selectively prohibiting access to a data storage component from an application execution environment
EP3138265B1 (fr) Sécurité améliorée pour un enregistrement de dispositifs d'authentification
EP3005202B1 (fr) Système et procédé d'identification biométrique avec attestation de dispositif
KR20200092368A (ko) 트랜잭션 확인 및 암호화폐를 위한 보안 키 저장소의 확장
US20130198519A1 (en) Strong authentication token with visual output of pki signatures
CN105227316A (zh) 基于人脸图像身份验证的移动互联网账号登录系统及方法
US11665157B2 (en) Systems and methods for authenticating users within a computing or access control environment
WO2021004519A1 (fr) Terminal, système et procédé de traitement de sécurité de données
US20180343247A1 (en) Method, user terminal and authentication service server for authentication
JP2023139259A (ja) 画像収集装置、サーバ、暗号化方法、及び復号化方法
JP2011165102A (ja) 生体認証システムおよび携帯端末
KR20220136963A (ko) 보안성이 우수한 비대면 본인인증 시스템 및 그 방법
US9413533B1 (en) System and method for authorizing a new authenticator
KR101792494B1 (ko) 사용자 인증 방법 및 이를 수행하는 장치
KR101674314B1 (ko) Captcha를 이용한 일회성 보안 문자 인증 방법
CN109299945B (zh) 一种基于生物识别算法的身份验证的方法及装置
TW202134911A (zh) 身分認證方法
CN114900289A (zh) 一种数据安全处理方法、系统、设备及介质
KR20200107976A (ko) 검증 가능한 클레임들을 바인딩하기 위한 시스템 및 방법

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21925411

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21925411

Country of ref document: EP

Kind code of ref document: A1