HK1246035B - Identity registration method and device based on biological features - Google Patents

Description

Biometric-based identity registration method and device

Technical Field

The present application relates to the field of network communication technology, and in particular to a method and device for identity registration based on biometrics.

Background Art

With the development of biometric technology, it has become possible to identify personal identity by combining computers with optics, acoustics, biosensors, biostatistics and other technical means, using the human body's inherent physiological characteristics such as fingerprints, faces, irises, and voices.

The booming mobile internet has provided a new application platform for biometric technology. For example, fingerprints and facial recognition can be used to log in to accounts and make payments on user devices, eliminating the need to remember and enter passwords. The image or video data required for biometric identification is captured by the user device, and biometric identification can be performed on the user device or on a server. Because uploading this image or video data to a server consumes significant data traffic, biometric identification is often performed on the user device. Once the user's biometric data is verified on the device, the device uploads the verification result to the server, confirming the user's identity.

As can be seen, whether identity authentication succeeds in the above process depends primarily on the biometric verification results of the user's device. Verification results can only be either passed or failed, which is easy to forge. Therefore, the reliability of the user's device will greatly affect the security of the user's account. In the existing technology, the device identifier of the user's device is used in the identity registration and authentication process to represent the device used by a user account using local biometric verification. However, the device identifier can be easily misused (for example, the device identifier can be set on some virtual machines), posing a security risk to the user's account.

Summary of the Invention

In view of this, the present application provides a biometric identity registration method, which is applied to a user device, wherein the user device stores user-side device authentication parameters. The method includes:

Obtain the device ID of the user's device;

Obtaining biometric data of the user and performing biometric verification of the user's identity using the biometric data;

After passing the biometric verification, a registration request message is sent to the business server, wherein the registration request message includes the device identifier and the account identifier, and is encrypted or signed using the user-side device authentication parameters; after receiving the registration request message forwarded by the business server, the authentication server uses the network-side device authentication parameters that are the same as or corresponding to the user-side device authentication parameters to decrypt or verify the registration request message, and saves the correspondence between the device identifier and the account identifier after successful decryption or verification, so as to authenticate the account.

This application provides a biometric identity registration method, which is applied on an authentication server and includes:

Receive a registration request message from a user device from a service server, where the registration request message includes a device identifier and an account identifier of the user device and is encrypted or signed using a user-side device authentication parameter of the user device;

According to the device identifier, obtaining a network-side device authentication parameter that is identical to or corresponds to the user-side device authentication parameter;

The registration request message is decrypted or signed using the network-side device authentication parameter, and after successful decryption or signature verification, the corresponding relationship between the device identifier and the account identifier is saved for use in identity authentication of the account.

The present application also provides a biometric identity registration device, which is applied to a user device that stores user-side device authentication parameters. The device includes:

A device identification obtaining unit, configured to obtain a device identification of a user device;

a biometric verification unit, configured to obtain biometric data of a user and perform biometric verification of the user's identity using the biometric data;

The registration request sending unit is used to send a registration request message to the business server after passing the biometric verification. The registration request message includes a device identifier and an account identifier, and is encrypted or signed using the user-side device authentication parameters; after receiving the registration request message forwarded by the business server, the authentication server uses the network-side device authentication parameters that are the same as or corresponding to the user-side device authentication parameters to decrypt or verify the registration request message, and saves the correspondence between the device identifier and the account identifier after successful decryption or verification, so as to authenticate the account.

This application provides a biometric identity registration device, which is applied to an authentication server and includes:

A registration request receiving unit, configured to receive a registration request message from a user device from a service server, wherein the registration request message includes a device identifier and an account identifier of the user device, and is encrypted or signed using a user-side device authentication parameter of the user device;

a device authentication parameter acquisition unit, configured to acquire, based on the device identifier, a network-side device authentication parameter that is identical to or corresponds to the user-side device authentication parameter;

The registration request processing unit is used to decrypt or verify the registration request message using the network-side device authentication parameter, and save the corresponding relationship between the device identifier and the account identifier after the decryption is successful or the verification is passed, so as to authenticate the account.

It can be seen from the above technical solution that in the embodiment of the present application, the user device uses the user-side device authentication parameters to encrypt or sign the registration request message it sends, and the authentication server obtains the network-side device authentication parameters of the user device based on the device identifier, decrypts or verifies the registration request message, and verifies whether the user device is trustworthy by using the user-side device authentication parameters pre-stored on the user device end and the network-side device authentication parameters pre-stored on the server end, so that identity authentication using local biometric verification is performed on the trusted user device, thereby improving the security of the user account and increasing the reliability of identity authentication.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a network structure diagram of an application scenario of an embodiment of the present application;

FIG2 is a flowchart of a biometric-based identity registration method applied on a user device according to an embodiment of the present application;

FIG3 is a flowchart of a biometric-based identity registration method applied on an authentication server according to an embodiment of the present application;

FIG4 is a flowchart of an interaction between a user device, a service server, and an authentication server for identity registration in an application example of the present application;

FIG5 is an interactive flow chart of identity authentication between a user device, a service server, and an authentication server in an application example of the present application;

FIG6 is a hardware structure diagram of a user device or an authentication server;

FIG7 is a logical structure diagram of an identity registration device based on biometrics and applied on a user device according to an embodiment of the present application;

FIG8 is a logical structure diagram of a biometric-based identity registration device applied on an authentication server in an embodiment of the present application.

DETAILED DESCRIPTION

An embodiment of the present application proposes a new biometric-based identity registration method, in which user-side device authentication parameters are pre-stored on the user device, and network-side device authentication parameters that are identical to or corresponding to the user-side device authentication parameters are pre-stored on the server side. The user device uses the user-side device authentication parameters to encrypt or sign the registration request message, and the authentication server uses the network-side device authentication parameters of the user device to verify the user device by decrypting or verifying the signature, thereby ensuring that identity registration and subsequent identity authentication are performed on a trusted user device, increasing the security of the user device used for identity authentication and the reliability of identity authentication, so as to solve the problems existing in the prior art.

A network structure of the application scenario of the embodiment of the present application is shown in Figure 1, and the user device and the business server, and the business server and the authentication server are mutually accessible through the communication network. Among them, the user device is a terminal device with a biometric recognition function, which can be a mobile phone, tablet computer, PC (Personal Computer), notebook and other devices; the business server is used to receive business requests (including registration and authentication requests) initiated by the user through the user device, and send a response to its request to the user device; the authentication server is used to authenticate the user account; the business server and the authentication server can be a physical or logical server, or can be composed of two or more physical or logical servers that share different responsibilities and work together to realize the various functions of the business server or authentication server in the embodiment of the present application. The embodiment of the present application does not limit the types of user devices, business servers and authentication servers, as well as the types and protocols of the communication networks between user devices and business servers, and between business servers and authentication servers.

In an embodiment of the present application, the process of applying the biometric-based identity registration method on a user device is shown in FIG2 , and the process of applying the method on an authentication server is shown in FIG3 .

In an embodiment of the present application, user-side device authentication parameters are stored on the user device. The authentication server can obtain the correspondence between the device identifier of the user device and the network-side device authentication parameters of the user device from a local or other accessible network storage location. The user-side device authentication parameters and network-side authentication parameters for the same user device are the same or correspond to each other.

User-side device authentication parameters can be pre-stored on the user device before the device leaves the factory; or the corresponding user-side device authentication parameters and network-side device authentication parameters can be generated by the user device, the authentication server, or some other network node and then stored by the user device and the authentication server, respectively; this is not limited in the embodiments of the present application. User-side device authentication parameters can be stored in a secure storage area on the user device, and the software or processes that can access this secure storage area can be restricted to achieve better security.

The user-side device authentication parameters and the network-side device authentication parameters can be keys, passwords, etc. generated by various algorithms in the prior art. For example, an asymmetric encryption algorithm is used to generate a private key (user-side device authentication parameter) and a public key (network-side device authentication parameter); for example, a symmetric encryption algorithm is used to generate the same key (which serves as both the user-side device authentication parameter and the network-side device authentication parameter); the embodiments of this application are not limited thereto.

On the user equipment, in step 210, a device identifier of the user equipment is obtained.

Typically, a unique hardware identifier on a user device may be used as the device identifier of the user device, such as a UUID (Universally Unique Identifier), a MAC (Media Access Control) address, a Bluetooth address, etc. of the user device.

On the user device, in step 220, the user's biometric data is obtained, and the user's identity is biometrically verified using the biometric data.

When a user initiates a biometric authentication registration process on their device, the device requires the user to provide their biometric data for identity registration. This biometric data can be any type of biometric authentication supported by the device (i.e., the biometric recognition capabilities of the device), such as fingerprint, voice, iris, or face. For the same biometric authentication type, the biometric data can be any specific object that the device can recognize, such as a fingerprint from any finger or an iris from any eye.

A user can register for identity authentication for a specific service or service system. In this case, the service system's client running on the user's device (which can be client software installed on the user's device or a webpage of the service system in a browser) can determine the type of biometric authentication to use for identity authentication in the service system and request the user to provide biometric data of that type.

After the user device obtains the biometric data provided by the user (or biometric data of the determined biometric authentication type), it uses the obtained biometric data to perform biometric verification of the user's identity. The specific method of biometric verification can refer to the biometric identification method of user devices in the prior art. For example, it can be compared with sample data pre-stored locally on the user device. If the degree of match meets certain predetermined conditions, the biometric verification is successful.

It should be noted that there is no time sequence relationship between step 210 and step 220 .

On the user device, in step 230, after passing biometric verification, a registration request message is sent to the service server. The registration request message includes the device ID and account ID, and is encrypted or signed using the user-side device authentication parameters. Upon receiving the registration request message forwarded by the service server, the authentication server decrypts or verifies the registration request message using network-side device authentication parameters that are identical or corresponding to the user-side device authentication parameters. After successful decryption or verification, the corresponding relationship between the device ID and account ID is stored for use in authenticating the account.

On the authentication server, in step 310, a registration request message from a user device is received from the service server. The registration request message includes the device identifier and account identifier of the user device and is encrypted or signed using the user-side device authentication parameters of the user device.

After passing biometric verification, the user device encapsulates the device ID and account ID in a registration request message, encrypts or signs the registration request message using locally stored user-side device authentication parameters, and then sends the registration request message to the service server. The service forwards the registration request message to the authentication server.

The account identifier may be information that uniquely corresponds to the user account performing identity registration on the authentication server, such as an account name, an account code, and the like.

On the authentication server, in step 320, based on the device identifier in the registration request message, network-side device authentication parameters that are identical to or corresponding to the user-side device authentication parameters are obtained.

After receiving the registration request message forwarded by the service server, the authentication server extracts the user device's device ID and searches for the network-side device authentication parameters for the user device in the corresponding relationship between device IDs and network-side device authentication parameters. If no network-side device authentication parameters corresponding to the device ID are found, the user device is not a trusted device, and the registration process fails.

On the authentication server, in step 330, the registration request message is decrypted or signed using the acquired network-side device authentication parameters. After successful decryption or signature verification, the corresponding relationship between the device identifier and the account identifier is saved for use in authenticating the account.

After obtaining the network-side device authentication parameters for the user device, the authentication server uses them to decrypt or verify the registration request message. If decryption or signature verification fails, it is likely that the user device with the device identifier in the registration request message has been misused, and the registration process ends in failure. If decryption is successful or signature verification passes, the authentication server saves the correspondence between the device identifier and the account identifier and can use the device identifier to authenticate the account in subsequent identity authentication processes.

The user equipment may carry information related to local biometric verification in the registration request message. For example, the user equipment may notify the service server and the authentication server of the result of the user passing the local biometric verification in the registration request message.

In one implementation, after the user device passes the biometric verification, it obtains a biometric token corresponding to the biometric data provided by the user during the local biometric verification, and carries the biometric token in a registration request message to the business server; after the authentication server receives the registration request message forwarded by the business server and successfully decrypts or verifies the registration request message with the network-side device authentication parameters, it saves the correspondence between the device identifier, account identifier and biometric token in the registration request message, so that the account can be authenticated with the device identifier and biometric token in the subsequent authentication process.

A biometric token is a unique feature or index value on a user's device that corresponds to the sample data used to verify the biometric data. In other words, each fingerprint of a user's finger corresponds to a different biometric token, and each fingerprint of a user's face corresponds to another biometric token. Each time a user uses their thumb for biometric verification, the thumbprint data collected by the user's device is verified using the sample data of the thumbprint, and therefore all of these thumbprints correspond to the same biometric token.

This application does not limit the form of the biometric token or the specific method of generating the biometric token. For example, it may be an information digest obtained by applying a digest algorithm to the sample data or a portion of the sample data, or it may be a random number corresponding to the sample data. The user device may store the sample data used to verify the biometric data together with the corresponding biometric token in a secure storage area of the user device.

In this implementation, the biometric token is used as registration information, and the user device needs to provide the same biometric token to pass the identity authentication. Compared with only providing the successful result of local biometric verification during identity authentication, it greatly increases the difficulty of forging the local biometric verification result, making the user account more secure.

For user devices that support more than two biometric authentication types, the user device can determine one of these biometric authentication types as the biometric authentication type used for user registration and authentication, and obtain the biometric data of this biometric authentication type for local biometric verification. The user device can carry this biometric authentication type in the registration request message; after the registration request message is successfully decrypted or the signature is verified, the authentication server saves the correspondence between the device identifier, account identifier, biometric token, and biometric authentication type in the registration request message, so that the device identifier, biometric token, and biometric authentication type can be used to authenticate the account in the subsequent authentication process.

After the biometric data provided by the user passes the biometric verification, the user device can generate the same or corresponding user-side business authentication parameters and network-side business authentication parameters based on a preset algorithm; the user device saves the user-side business authentication parameters locally, carries the network-side business authentication parameters in the registration request message, uploads it to the business server, and the business server forwards it to the authentication server. After the registration request message is successfully decrypted or the signature is verified, the authentication server saves the correspondence between the device identifier, account identifier, biometric token, biometric authentication type, and network-side business authentication parameters. In subsequent identity authentication, the user device and the authentication server can use the user-side business authentication parameters and the network-side business authentication parameters to encrypt and decrypt or sign and verify the messages in the authentication process to increase the reliability of identity authentication.

The user-side service authentication parameters and the network-side service authentication parameters can be keys, passwords, etc. generated by various algorithms in the prior art. For example, an asymmetric encryption algorithm is used to generate a private key (user-side service authentication parameter) and a public key (network-side service authentication parameter); or a symmetric encryption algorithm is used to generate the same key (which is used as both the user-side service authentication parameter and the network-side service authentication parameter).

It should be noted that if the user device may save together the user-side business authentication parameters generated for the clients of more than two business systems, and/or save together the user-side business authentication parameters of two or more different biometric authentication types generated for the clients of one business system, the correspondence between the user business authentication parameters and the business systems, and/or the user-side business authentication parameters and the biometric authentication types should be saved.

In some application scenarios, the authentication server can provide authentication services for multiple different business systems. These business systems each have their own user accounts, hereinafter referred to as user business accounts. The business account identifier is the information that uniquely corresponds to a business account in a business system.

If the business account identifiers in these business systems may be repeated, before sending the registration request message to the business server, the user device can send a registration information request message to the business server, and the registration information request message includes the user's business account identifier; the business server forwards the registration information request message to the authentication server; after receiving the registration information request message, the authentication server generates a virtual account identifier corresponding to the business account (that is, corresponding to the business account in the business system), encapsulates the virtual account identifier in a registration information response message and sends it to the business server; after receiving the registration information response message, the business server forwards the registration information response message to the user device; the user device extracts the virtual account identifier from the registration information response message, and uses the virtual account identifier as the account identifier in the registration request message.

The virtual account identifier uniquely corresponds to a business account in a business system on the authentication server. The embodiment of the present application does not limit the method of generating the virtual account identifier. For example, the business system identifier and the user's business account identifier in the business system can be used as the virtual account identifier; for example, the index of the user account of the business system in the database of registered accounts on the authentication server can be used as the virtual account identifier.

It should be noted that if the method of generating the virtual account identifier cannot ensure that the same virtual account identifier is generated for the same business account in the same business system, the authentication server must save the correspondence between the generated virtual account identifier and the business account of the business system, so that in the subsequent identity authentication process, the same virtual account identifier as in the registration process can be assigned to the same user account in the same business system.

If the business account identifiers in these business systems are different, the authentication server can directly use the business account identifier as the account identifier, or generate a virtual account identifier corresponding to the business account, and send it to the user device through the business server in the registration information response message, so that the user device uses the virtual account identifier as its account identifier in the registration request message.

During the identity registration process, various security measures can be used to increase the security of the registration process. The following two implementation methods are given as examples.

The first example: In the implementation method in which the user device sends a registration information request message to the service server to obtain the required registration information (such as a virtual account identifier) in the registration request message, after receiving the registration information request message, the authentication server generates a virtual account identifier and a registration challenge code for the virtual account. The registration challenge code can be generated using various one-time password generation algorithms, which are not limited in this example. The authentication server encapsulates the virtual account identifier and the generated registration challenge code in a registration information response message and sends it to the service server, and starts the timer. After receiving the registration information response message forwarded by the service server, the user device uses the virtual account identifier as the account identifier to generate a registration request message, and encapsulates the registration challenge code in the registration response message in the registration request message, and sends it to the service server. After the registration request message is successfully decrypted or the signature is verified, if the registration challenge code in the registration request message is the same as the registration challenge code generated for the virtual account in the registration request message, and the time interval between sending the registration information response message of the virtual account and receiving the registration request message is within the first predetermined time range, the authentication server saves the correspondence between the device identifier and the virtual account identifier in the registration request message; otherwise, the registration process fails and the authentication server rejects the registration request.

In the second example, the corresponding server private key and server public key can be pre-generated on the authentication server. When the user device sends a registration information request message to the service server to obtain the registration information required in the registration request message (such as a virtual account identifier, or a virtual account identifier and a registration challenge code), the authentication server can encapsulate the server public key in a registration information response message, sign the registration information response message with the server private key, and then send it to the service server. After receiving the registration information response message forwarded by the service server, the user device extracts the server public key from it and verifies the signature of the registration information response message. If the signature verification succeeds, the process of generating and sending the registration request message continues. If the signature verification fails, it means that the registration information response message is likely not from a reliable authentication server, and the registration process ends in failure.

It should be noted that the implementation methods in the above two examples can be used alone or in combination, and can also be used in combination with the above-mentioned virtual account identification, user-side and network-side business authentication parameters, biometric authentication type, and biometric token implementation methods.

As can be seen, in the embodiments of the present application, user-side device authentication parameters are pre-stored on the user device, and network-side device authentication parameters that are identical or corresponding to the user-side device authentication parameters are pre-stored on the server. The user device uses the user-side device authentication parameters to encrypt or sign the registration request message it sends. The authentication server obtains the network-side device authentication parameters of the user device based on the device identifier and decrypts or verifies the registration request message. By using the user-side device authentication parameters and the network-side device authentication parameters to verify the credibility of the user device, the embodiments of the present application improve the security of the user device used for identity authentication and increase the reliability of identity authentication.

After completing the registration process described above in the embodiments of this application, the server stores the correspondence between the account identifier and the device identifier, as well as other information. The device identifier and other stored information become the registered information for the account. When a user initiates biometric identity authentication through their user device, the user device provides the authentication server with this registered information for their account, thereby completing the authentication process.

Specifically, after the user initiates a biometric-based identity authentication process on the user device, the user device obtains the device identifier; obtains the user's biometric data and uses the biometric data to perform biometric verification of the user's identity; after passing the biometric verification, the user device sends an authentication request message to the business server, which includes the device identifier and account identifier; the business server forwards the authentication request message to the authentication server; based on the account identifier in the authentication request message, the authentication server compares the device identifier in the authentication request message with the registered device identifier of the account to see if they are the same. If they are the same, the identity authentication is passed.

If the authentication server stores other registered account information, during the authentication process, the user device can obtain the corresponding information and provide it to the authentication server in a similar manner to the registration process. For example, this information can be used to obtain the virtual account identifier and authentication challenge code through authentication information request messages and authentication information response messages; or to obtain the biometric verification type and biometric token. For a detailed description, please refer to the authentication process in the application examples of this application. It should be noted that this registered information can be used independently or in combination, and the embodiments of this application are not limited to this.

In an application example of the present application, a business client and an authentication client are installed on the user device. The business client and the business server complete the various functions provided by their business systems through requests and responses, including the biometric-based identity authentication function. On the user device, the business client implements functions related to biometric-based identity authentication by calling the authentication client, while the business server implements functions related to biometric-based identity authentication by accessing the authentication server. The user device is pre-stored with the device private key of the user device (i.e., the user-side device authentication parameter) before leaving the factory, and the device public key corresponding to the device private key (i.e., the network-side device authentication parameter) is stored in a network storage location accessible to the authentication server.

In the identity registration process, the interaction process between the service client and authentication client on the user device, and the user device, service server and authentication server is shown in Figure 4.

After a user initiates the identity registration process through the business client, the business client calls the authentication client to request device data from the user's device. The authentication client obtains the device ID, device model, supported biometric authentication types, and other device information, and returns this device data to the business client.

The service client sends a registration information request message to the service server. The registration information request message carries the device ID of the user device and the service account ID of the user in the service system. The service server forwards the registration information request message to the authentication server.

The authentication server stores the corresponding server private key and server public key. Upon receiving the registration request message, the authentication server uses the service system ID and service account ID as the virtual account ID corresponding to the service account, generates a registration challenge code for the virtual account, encapsulates the virtual account ID, registration challenge code, and server public key in a registration response message, signs the registration response message with the server private key, sends the registration response message to the service server, and starts the timer. The service server forwards the registration response message to the service client of the user device.

Based on the biometric authentication types supported by the device in the device data returned by the authentication client, the business client determines one of the biometric authentication types as the biometric authentication type used for user registration and authentication, and requests and obtains the biometric data of the biometric authentication type provided by the user.

The service client calls the authentication client with the biometric data of the biometric authentication type provided by the user. The authentication client uses the biometric data to perform local biometric feature verification and notifies the service client of the result of the biometric feature verification.

If the biometric verification fails, the service client ends the registration process and informs the user that the local biometric verification has failed. After the biometric verification passes, the service client calls the authentication client with the received registration information response message.

The authentication client extracts the server public key from the registration information response message and verifies the signature of the registration information response message. If the signature verification fails, the service client is notified, and the service client terminates the registration process as a failure. After the signature verification succeeds, the authentication client obtains the biometric token corresponding to the biometric data used in the most recent successful local biometric verification (i.e., the biometric data used by the service client during local biometric verification) and uses a preset algorithm to generate a service private key (i.e., user-side service authentication parameters) and a service public key (i.e., network-side service authentication parameters). The authentication client also saves the correspondence between the virtual account identifier extracted from the registration information response message, the biometric authentication type used in the most recent successful local biometric verification, the biometric token, and the service private key. The authentication client then assembles and generates a registration request message, which carries the device identifier, virtual account identifier, biometric authentication type, biometric token, service public key, and the registration challenge code extracted from the registration information response message. The authentication client reads the device private key stored in the user device, signs the registration request message, and returns it to the service client.

The service client sends a registration request message to the service server. The service server forwards the registration request message to the authentication server.

The authentication server extracts the device identifier from the received registration request message, searches for the device public key corresponding to the device identifier from an accessible network storage location, and uses the device public key to verify the signature of the registration request message. If the signature verification fails, the authentication server rejects the registration request and notifies the service server, which then notifies the service client of the registration failure. If the signature verification succeeds, the authentication server compares the registration verification code in the registration request message with the registration verification code generated by the authentication server for the virtual account in the registration request message. It also determines the time difference between sending the registration information response message and receiving the registration request message. If the two registration verification codes differ or the time difference exceeds a first predetermined time period, the authentication server rejects the registration request and notifies the service server, which then notifies the service client of the registration failure. Otherwise, the authentication server stores the corresponding relationship between the device identifier, virtual account identifier, biometric authentication type, biometric token, and service public key in the registration request message and returns a registration response message indicating successful registration to the service server, which carries the virtual account identifier and biometric authentication type in the aforementioned relationship, as well as the service account identifier corresponding to the virtual account identifier.

The business server saves the correspondence between the business account identifier, virtual account identifier and biometric authentication type in the registration response message of successful registration, and notifies the business client of the successful registration result.

In the identity authentication process, the interaction process between the service client and authentication client on the user device, and the user device, service server and authentication server is shown in FIG5 .

After a user initiates identity authentication through a service client, the service client calls the authentication client to request device data from the user's device. The authentication client obtains the device ID, device model, supported biometric authentication types, and other device information, and returns this device data to the service client.

The service client sends an authentication information request message to the service server. This message carries the device ID of the user's device and the user's service account ID in the service system. The service server extracts the service account ID from the authentication information request message and checks whether the virtual account ID and biometric authentication type corresponding to the service account ID are stored. If so, it indicates that the service account has registered for biometric-based identity authentication with the authentication server. The service server forwards the authentication information request message to the authentication server. If not, the service server responds to the service client with a message stating that identity authentication has not yet been activated.

After receiving the authentication information request message, the authentication server uses the service system identifier and the service account identifier in the authentication information request message as the virtual account identifier, generates an authentication challenge code for the virtual account, encapsulates the virtual account identifier, authentication challenge code, and server public key in an authentication information response message, signs the authentication information response message with the server private key, sends the authentication information response message to the service server, and starts the timer. The service server forwards the authentication information response message to the service client of the user device.

The service client requests the user according to the determined biometric authentication type and obtains the biometric data of the biometric authentication type provided by the user.

The service client calls the authentication client with the biometric data of the biometric authentication type provided by the user. The authentication client uses the biometric data to perform local biometric feature verification and notifies the service client of the result of the biometric feature verification.

If the biometric verification fails, the business client ends the authentication process and informs the user that the local biometric verification has failed. After the biometric verification passes, the business client calls the authentication client with the received authentication information response message.

The authentication client extracts the server public key from the authentication information response message and verifies the signature of the authentication information response message. If the signature verification fails, the service client is notified, and the service client ends the authentication process as a failure. After the signature verification passes, the authentication client obtains the biometric token corresponding to the biometric data used when the local biometric verification was most recently successful (i.e., the biometric data used by the service client when performing the above-mentioned local biometric verification), encapsulates the device identifier, the virtual account identifier extracted from the authentication information response message, the biometric authentication type used when the local biometric verification was most recently successful, the biometric token, and the authentication challenge code extracted from the authentication information response message, and generates an authentication request message. The authentication server searches the stored correspondence between the virtual account identifier, biometric authentication type, biometric token, and service private key, and finds the service private key corresponding to the biometric authentication type used when the local biometric verification was most recently successful, the virtual account identifier in the authentication information response message, and the biometric token. It then signs the authentication request message with the service private key and returns it to the service client.

The service client sends the authentication request message to the service server. The service server forwards the authentication request message to the authentication server.

The authentication server extracts the authentication verification code from the received authentication request message, compares the authentication verification code in the authentication request message with the authentication verification code generated by the authentication server for the virtual account in the authentication request message, and determines the time difference between sending the authentication information response message and receiving the authentication request message. If the two authentication verification codes are different or the time difference exceeds a first predetermined time period, the authentication server rejects the authentication request and notifies the service server, which then notifies the service client of the authentication failure.

The authentication server searches for the registered biometric token and registered service public key corresponding to the virtual account identifier, device identifier, and biometric authentication type in the authentication request message. It compares the biometric token in the authentication request message with the registered biometric token and verifies the signature of the authentication request message using the registered service public key. If the two biometric tokens are different or the signature verification fails, the authentication server rejects the authentication request and notifies the service server, which then notifies the service client of the authentication failure.

After the authentication code, biometric token, and service public key are verified, the authentication server sends a response message confirming the successful authentication. The service server then performs appropriate service processing based on the successful authentication result and notifies the service client of the successful authentication and/or service processing results.

Corresponding to the above-mentioned process implementation, the embodiment of the present application also provides a biometric identity registration device applied on a user device and a biometric identity registration device applied on an authentication server. The above-mentioned devices can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in the logical sense, it is formed by the CPU (Central Process Unit) of the user device or the authentication server reading the corresponding computer program instructions into the memory and running them. From the hardware level, in addition to the CPU, memory and non-volatile memory shown in Figure 6, the user device usually also includes other hardware such as chips for sending and receiving wireless signals, and the authentication server usually also includes other hardware such as boards for implementing network communication functions.

Figure 7 shows a biometric-based identity registration device provided by an embodiment of the present application, which is applied to a user device, and the user device stores user-side device authentication parameters. The device includes a device identification acquisition unit, a biometric verification unit and a registration request sending unit, wherein: the device identification acquisition unit is used to obtain the device identification of the user device; the biometric verification unit is used to obtain the user's biometric data and use the biometric data to perform biometric verification on the user's identity; the registration request sending unit is used to send a registration request message to the business server after passing the biometric verification, the registration request message includes a device identification and an account identification, and is encrypted or signed using the user-side device authentication parameters; after receiving the registration request message forwarded by the business server, the authentication server uses the network-side device authentication parameters that are the same as or corresponding to the user-side device authentication parameters to decrypt or verify the registration request message, and saves the correspondence between the device identification and the account identification after successful decryption or verification, so as to perform identity authentication on the account.

Optionally, the user-side device authentication parameters are stored in a secure storage area of the user device.

Optionally, the device also includes a biometric token unit, which is used to obtain a biometric token corresponding to the biometric data after passing the biometric verification; the registration request message also includes: the biometric token, for the authentication server to save the correspondence between the device identifier, account identifier and biometric token after the registration request message is successfully decrypted or the signature is verified, so as to authenticate the account.

Optionally, the device also includes a biometric authentication type determination unit for determining the user's biometric authentication type; the biometric verification unit is specifically used to: obtain the user's biometric data based on the determined biometric authentication type, and use the biometric data to perform biometric verification on the user's identity; the registration request message also includes: the biometric authentication type, for the authentication server to save the correspondence between the device identifier, account identifier, biometric token and biometric authentication type after the registration request message is successfully decrypted or the decryption is successful or the signature verification is passed, so as to authenticate the account.

Optionally, the device also includes a business authentication parameter generation unit, which is used to generate the same or corresponding user-side business authentication parameters and network-side business authentication parameters after passing the biometric verification, and save the user-side business authentication parameters; the registration request message also includes: network-side business authentication parameters, for the authentication server to save the correspondence between the device identification, account identification, biometric token, biometric authentication type and network-side business authentication parameters after the registration request message is signed and passed, so as to perform identity authentication on the account.

In one example, the device also includes a registration information request sending unit and a registration information response receiving unit, wherein: the registration information request sending unit is used to send a registration information request message to the business server, and the registration information request message is forwarded by the business server to the authentication server, including a business account identifier; the registration information response receiving unit is used to receive a registration information response message returned by the business server, and the registration information response message is sent by the authentication server to the business server, including a virtual account identifier generated by the authentication server and corresponding to the business account; the account identifier in the registration request message includes: the virtual account identifier.

In the above example, the registration information response message may also include: the registration challenge code of the virtual account generated by the authentication server; the registration request message also includes: the registration challenge code, so that the authentication server can verify the registration request message based on the registration challenge code and the time interval between sending the registration information response message and receiving the registration request message after receiving the registration request message forwarded by the business server.

In the above example, the registration information response message may also include: a server public key; the registration response message is signed by the authentication server using a server private key corresponding to the server public key; the device also includes a server public key verification unit, which is used to verify the registration information response message using the server public key after receiving the registration information response message. If the verification fails, the registration process ends.

Figure 8 shows a biometric-based identity registration device provided by an embodiment of the present application, which is applied on an authentication server and includes a registration request receiving unit, a device authentication parameter acquisition unit and a registration request processing unit, wherein: the registration request receiving unit is used to receive a registration request message from a user device from a business server, the registration request message includes the device identifier and account identifier of the user device, and is encrypted or signed using the user-side device authentication parameters of the user device; the device authentication parameter acquisition unit is used to obtain, based on the device identifier, a network-side device authentication parameter that is identical or corresponding to the user-side device authentication parameter; the registration request processing unit is used to decrypt or verify the registration request message using the network-side device authentication parameter, and save the correspondence between the device identifier and the account identifier after successful decryption or verification, so as to perform identity authentication on the account.

Optionally, the registration request message also includes: a biometric token corresponding to the user's biometric data; the registration request processing unit is specifically used to: use the network-side device authentication parameters to decrypt or verify the registration request message, and save the correspondence between the device identification, account identification and the biometric token after the decryption is successful or the verification is passed, so as to authenticate the account.

Optionally, the registration request message also includes: biometric authentication type; the registration request processing unit is specifically used to: use the network side device authentication parameters to decrypt or verify the registration request message, and save the correspondence between the device identification, account identification, biometric token and biometric authentication type after successful decryption or verification, so as to authenticate the account.

Optionally, the registration request message also includes: network-side service authentication parameters generated by the user device, which are the same as or corresponding to the user-side service authentication parameters stored on the user device; the registration request processing unit is specifically used to: use the network-side device authentication parameters to decrypt or verify the registration request message, and after the decryption is successful or the verification is passed, save the correspondence between the device identification, account identification, biometric token, biometric authentication type and network-side service authentication parameters for use in authenticating the account.

In one example, the device further includes a registration information request receiving unit and a virtual account identification unit, wherein: the registration information request receiving unit is used to receive a registration information request message from the user device from the service server, and the registration information request message includes a service account identifier; the virtual account identification unit is used to generate a virtual account identifier corresponding to the service account, and carry the virtual account identifier in a registration information response message to the service server, so that the service server forwards it to the user device; the account identifier in the registration request message includes: the virtual account identifier.

In the above example, the device may further include a registration challenge code generation unit for generating a registration challenge code for the virtual account; the registration information response message also includes: the generated registration challenge code; the registration request message also includes: the registration challenge code; the registration request processing unit is specifically used to: use the network-side device authentication parameters to decrypt or verify the registration request message, and after the decryption is successful or the verification is passed, if the registration challenge code in the registration request message is the same as the registration challenge code generated for the virtual account in the registration request message, and the time interval between sending the registration information response message and receiving the registration request message is within the first predetermined time range, the correspondence between the device identifier and the virtual account identifier is saved.

In the above example, the authentication server can obtain the server private key; the device also includes a server private key signing unit, which is used to use the server private key to sign the registration information response message; the registration information response message also includes: a server public key corresponding to the server public key, which is used by the user device to verify the registration information response message.

The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and/or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

Claims (26)

1. A biometric-based identity registration method applied to a user device, characterized in that the user device stores user-side device authentication parameters, and the method includes: Obtain the device identifier of the user's device; Acquire the user's biometric data and use the biometric data to verify the user's identity using biometric features; After passing the biometric verification, a biometric token corresponding to the biometric data is obtained; the biometric token is a unique index value on the user device that corresponds to the sample data used to verify the biometric data. A registration request message is sent to the business server. The registration request message includes a device identifier, a biometric token, and an account identifier, and is encrypted or signed using the user-side device authentication parameters. After receiving the registration request message forwarded by the business server, the authentication server decrypts or verifies the registration request message using network-side device authentication parameters that are the same as or corresponding to the user-side device authentication parameters. After successful decryption or signature verification, the authentication server saves the correspondence between the device identifier, biometric token, and account identifier for use in authenticating the account. 2. The method according to claim 1, wherein the user-side device authentication parameters are stored in the secure storage area of the user device. 3. The method according to claim 1, wherein the method further comprises: determining the user's biometric authentication type; The acquisition of user biometric data includes: acquiring user biometric data according to the determined biometric authentication type; The registration request message also includes a biometric authentication type, which the authentication server saves the correspondence between the device identifier, account identifier, biometric token, and biometric authentication type after the registration request message is successfully decrypted or the signature is verified, so as to authenticate the account. 4. The method according to claim 3, wherein the method further comprises: after passing biometric verification, generating identical or corresponding user-side service authentication parameters and network-side service authentication parameters, and saving the user-side service authentication parameters; The registration request message also includes: network-side service authentication parameters, which the authentication server saves the correspondence between the device identifier, account identifier, biometric token, biometric authentication type and network-side service authentication parameters after the registration request message is verified, so as to authenticate the account. 5. The method according to claim 1, characterized in that the method further comprises: A registration information request message is sent to the business server, and the business server forwards the registration information request message to the authentication server, which includes the business account identifier; The system receives a registration information response message returned by the business server. The registration information response message is sent by the authentication server to the business server and includes a virtual account identifier generated by the authentication server corresponding to the business account. The account identifier in the registration request message includes: the virtual account identifier. 6. The method according to claim 5, wherein the registration information response message further includes: a registration challenge code for the virtual account generated by the authentication server; The registration request message also includes: the registration challenge code, which the authentication server uses to verify the registration request message after receiving the registration request message forwarded by the business server, based on the registration challenge code and the time interval between sending the registration information response message and receiving the registration request message. 7. The method according to claim 5, wherein the registration information response message further includes: a server public key; the registration response message is signed by the authentication server using a server private key corresponding to the server public key; The method further includes: after receiving the registration information response message, using the server public key to verify the signature of the registration information response message; if the signature verification fails, the registration process ends. 8. A biometric-based identity registration method, applied on an authentication server, characterized in that it includes: The system receives a registration request message from the user device from the business server. The registration request message includes the device identifier, biometric token, and account identifier of the user device, and is encrypted or signed using the user-side device authentication parameters of the user device. The biometric token is a unique index value on the user device that corresponds to the sample data used to verify the biometric data. Based on the device identifier, obtain network-side device authentication parameters that are the same as or correspond to the user-side device authentication parameters; The registration request message is decrypted or verified using the network-side device authentication parameters. After successful decryption or verification, the correspondence between the device identifier, biometric token, and account identifier is saved for use in authenticating the account. 9. The method according to claim 8, wherein the registration request message further includes: a biometric authentication type; Saving the correspondence between the device identifier and the account identifier after successful decryption or signature verification includes: saving the correspondence between the device identifier, account identifier, biometric token, and biometric authentication type after successful decryption or signature verification, so as to authenticate the account. 10. The method according to claim 9, wherein the registration request message further includes: network-side service authentication parameters generated by the user equipment, which are the same as or correspond to the user-side service authentication parameters stored on the user equipment; Saving the correspondence between the device identifier and the account identifier after successful decryption or signature verification includes: saving the correspondence between the device identifier, account identifier, biometric token, biometric authentication type, and network-side service authentication parameters after successful decryption or signature verification, so as to authenticate the account. 11. The method according to claim 9, characterized in that the method further comprises: The service server receives a registration information request message from the user equipment, the registration information request message including a service account identifier; A virtual account identifier corresponding to the business account is generated and sent to the business server in the registration information response message, so that the business server can forward it to the user equipment; The account identifier in the registration request message includes: the virtual account identifier. 12. The method according to claim 11, wherein the method further comprises: generating a registration challenge code for the virtual account; The registration information response message also includes: the generated registration challenge code; The registration request message also includes: a registration challenge code; The step of saving the correspondence between the device identifier and the account identifier after successful decryption or signature verification includes: after successful decryption or signature verification, if the registration challenge code in the registration request message is the same as the registration challenge code generated for the virtual account in the registration request message, and the time interval between sending the registration information response message and receiving the registration request message is within a first predetermined time range, the correspondence between the device identifier and the virtual account identifier is saved. 13. The method according to claim 11, wherein the authentication server can obtain the server's private key; The method further includes: signing the registration information response message using the server's private key; The registration information response message also includes: a server public key corresponding to the server public key, which the user equipment can use to verify the signature of the registration information response message. 14. A biometric-based identity registration device, applied to a user equipment, characterized in that the user equipment stores user-side device authentication parameters, and the device comprises: The device identifier acquisition unit is used to acquire the device identifier of the user equipment. A biometric verification unit is used to acquire the user's biometric data and use the biometric data to verify the user's identity. A biometric token unit is used to obtain a biometric token corresponding to the biological data after passing biometric verification; the biometric token is a unique index value on the user device corresponding to the sample data used to verify the biological data; The registration request sending unit is used to send a registration request message to the business server. The registration request message includes a device identifier, a biometric token, and an account identifier, and is encrypted or signed using the user-side device authentication parameters. After receiving the registration request message forwarded by the business server, the authentication server decrypts or verifies the registration request message using network-side device authentication parameters that are the same as or corresponding to the user-side device authentication parameters. After successful decryption or signature verification, the authentication server saves the correspondence between the device identifier, biometric token, and account identifier for use in authenticating the account. 15. The apparatus according to claim 14, wherein the user-side device authentication parameters are stored in the secure storage area of the user device. 16. The apparatus according to claim 14, wherein the apparatus further comprises: a biometric authentication type determination unit, configured to determine the user's biometric authentication type; The biometric verification unit is specifically used to: obtain the user's biometric data according to the determined biometric authentication type, and use the biometric data to perform biometric verification of the user's identity; The registration request message also includes a biometric authentication type, which the authentication server saves the correspondence between the device identifier, account identifier, biometric token, and biometric authentication type after the registration request message is successfully decrypted or the signature is verified, so as to authenticate the account. 17. The apparatus according to claim 16, wherein the apparatus further comprises: a service authentication parameter generation unit, configured to generate identical or corresponding user-side service authentication parameters and network-side service authentication parameters after passing biometric verification, and to save the user-side service authentication parameters; The registration request message also includes: network-side service authentication parameters, which the authentication server saves the correspondence between the device identifier, account identifier, biometric token, biometric authentication type and network-side service authentication parameters after the registration request message is verified, so as to authenticate the account. 18. The apparatus according to claim 14, wherein the apparatus further comprises: A registration information request sending unit is used to send a registration information request message to the business server. The registration information request message is forwarded by the business server to the authentication server, and includes a business account identifier. The registration information response receiving unit is used to receive the registration information response message returned by the business server. The registration information response message is sent by the authentication server to the business server and includes a virtual account identifier generated by the authentication server corresponding to the business account. The account identifier in the registration request message includes: the virtual account identifier. 19. The apparatus according to claim 18, wherein the registration information response message further includes: a registration challenge code for the virtual account generated by the authentication server; The registration request message also includes: the registration challenge code, which the authentication server uses to verify the registration request message after receiving the registration request message forwarded by the business server, based on the registration challenge code and the time interval between sending the registration information response message and receiving the registration request message. 20. The apparatus according to claim 18, wherein the registration information response message further includes: a server public key; the registration response message is signed by the authentication server using a server private key corresponding to the server public key; The device further includes a server public key verification unit, which is used to verify the registration information response message using the server public key after receiving the registration information response message. If the verification fails, the registration process ends. 21. A biometric-based identity registration device, applied on an authentication server, characterized in that it comprises: The registration request receiving unit is used to receive a registration request message from a user device from a business server. The registration request message includes the device identifier, biometric token, and account identifier of the user device, and is encrypted or signed using the user-side device authentication parameters of the user device. The biometric token is a unique index value on the user device that corresponds to the sample data used to verify the biometric data. The device authentication parameter acquisition unit is used to acquire network-side device authentication parameters that are the same as or corresponding to the user-side device authentication parameters based on the device identifier. The registration request processing unit is used to decrypt or verify the registration request message using the network-side device authentication parameters. After successful decryption or verification, it saves the correspondence between the device identifier, biometric token, and account identifier for use in authenticating the account. 22. The apparatus according to claim 21, wherein the registration request message further includes: a biometric authentication type; The registration request processing unit is specifically used to: decrypt or verify the registration request message using the network-side device authentication parameters, and after successful decryption or verification, save the correspondence between the device identifier, account identifier, biometric token, and biometric authentication type for use in authenticating the account. 23. The apparatus according to claim 22, wherein the registration request message further includes: network-side service authentication parameters generated by the user equipment, which are the same as or correspond to the user-side service authentication parameters stored on the user equipment; The registration request processing unit is specifically used to: decrypt or verify the registration request message using the network-side device authentication parameters; and after successful decryption or verification, save the correspondence between the device identifier, account identifier, biometric token, biometric authentication type, and network-side service authentication parameters for use in authenticating the account. 24. The apparatus according to claim 22, wherein the apparatus further comprises: A registration information request receiving unit is configured to receive a registration information request message from the user equipment from the service server, wherein the registration information request message includes a service account identifier. The virtual account identifier unit is used to generate a virtual account identifier corresponding to the business account, and send the virtual account identifier in the registration information response message to the business server, so that the business server can forward it to the user equipment; The account identifier in the registration request message includes: the virtual account identifier. 25. The apparatus according to claim 24, wherein the apparatus further comprises: a registration challenge code generation unit, configured to generate a registration challenge code for the virtual account; The registration information response message also includes: the generated registration challenge code; The registration request message also includes: a registration challenge code; The registration request processing unit is specifically used to: decrypt or verify the registration request message using the network-side device authentication parameters; and after successful decryption or verification, if the registration challenge code in the registration request message is the same as the registration challenge code generated for the virtual account in the registration request message, and the time interval between sending the registration information response message and receiving the registration request message is within a first predetermined time range, save the correspondence between the device identifier and the virtual account identifier. 26. The apparatus according to claim 24, wherein the authentication server can obtain the server private key; The device further includes: a server private key signing unit, used to sign the registration information response message using the server private key; The registration information response message also includes: a server public key corresponding to the server public key, which the user equipment can use to verify the signature of the registration information response message.