Face verification method and device

A face authentication method includes receiving, from a first user terminal, a user account and a face image, obtaining a reference image corresponding to the user account, the reference image being prestored, and determining a second user terminal for helping the first user terminal complete face authentication of the face image with the reference image, the second user terminal being in a state of waiting to receive a first authentication code for the second user terminal to complete identity authentication of the first user terminal. The method further includes generating the first authentication code, sending, to the second user terminal, the first authentication code, the face image, and the reference image, and receiving, from the second user terminal, a result of the face authentication of the face image with the reference image, the result indicating whether the face authentication succeeds.

BACKGROUND

Methods and apparatuses consistent with embodiments relate to the security authentication field, and in particular, to a face authentication method and a face authentication apparatus.

2. Description of Related Art

Biometric authentication technologies are the most convenient and safe identity identification technologies currently. Persons are identified by using the biometric authentication technologies and no other identifiers may be required. In the biometric authentication technologies, identity identification is performed by using physiological characteristics and behavior characteristics of persons. Fingerprint identification, face identification, iris identification, gait identification, and the like may be included. Face identification is a big hotspot in the current biometric authentication field. Compared with current widely applied fingerprint identification technologies, the biometric authentication technologies have significant advantages such as intuition, convenience, non-contact, friendliness, and high user acceptance.

As a common biometric characteristic, faces have been widely applied to fields such as financial payment and security. Two-dimensional face identification is based on a single face planar image. Generally, a face planar image is collected by using a camera; face swiping, eye positioning, and feature extraction are performed; then comparison with a template library is performed; and finally identification and determination are made.

SUMMARY

According to embodiments, there is provided a face authentication method being performed by at least one processor of a server, and the method including receiving, from a first user terminal, a user account and a face image, obtaining a reference image corresponding to the user account, the reference image being prestored, and determining a second user terminal for helping the first user terminal complete face authentication of the face image with the reference image, the second user terminal being in a state of waiting to receive a first authentication code for the second user terminal to complete identity authentication of the first user terminal. The method further includes generating the first authentication code, sending, to the second user terminal, the first authentication code, the face image, and the reference image, receiving, from the second user terminal, a result of the face authentication of the face image with the reference image, the result indicating whether the face authentication succeeds, and determining, based on the result of the face authentication, whether the face authentication succeeds.

According to embodiments, there is provided a face authentication apparatus including at least one memory configured to store computer program code, and at least one processor configured to access the at least one memory and operate according to the computer program code. The computer program code includes receiving code configured to cause the at least one processor to receive, from a first user terminal, a user account and a face image, and determining code configured to cause the at least one processor to obtain a reference image corresponding to the user account, the reference image being prestored, and determine a second user terminal for helping the first user terminal complete face authentication of the face image with the reference image, the second user terminal being in a state of waiting to receive a first authentication code for the second user terminal to complete identity authentication of the first user terminal. The apparatus further includes authentication code generating code configured to cause the at least one processor to generate the first authentication code, sending code configured to cause the at least one processor to send, to the second user terminal, the first authentication code, the face image, and the reference image, and authentication code configured to cause the at least one processor to receive, from the second user terminal, a result of the face authentication of the face image with the reference image, the result indicating whether the face authentication succeeds, and determine, based on the result of the face authentication, whether the face authentication succeeds.

According to embodiments, there is provided a non-transitory computer-readable storage medium storing instructions that cause at least one processor of a server to receive, from a first user terminal, a user account and a face image, obtain a reference image corresponding to the user account, the reference image being prestored, and determine a second user terminal for helping the first user terminal complete face authentication of the face image with the reference image, the second user terminal being in a state of waiting to receive a first authentication code for the second user terminal to complete identity authentication of the first user terminal. The instructions further cause the at least one processor to generate the first authentication code, send, to the second user terminal, the first authentication code, the face image, and the reference image, receive, from the second user terminal, a result of the face authentication of the face image with the reference image, the result indicating whether the face authentication succeeds, and determine, based on the result of the face authentication, whether the face authentication succeeds.

DESCRIPTION OF EMBODIMENTS

To enable a person skilled in the art to better understand the technical solutions of this application, the following clearly and completely describes the technical solutions in the embodiments of this application with reference to the accompanying drawings in the embodiments of this application. Apparently, the described embodiments are some of the embodiments of this application rather than all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of this application without creative efforts shall fall within the protection scope of this application.

In the specification, claims, and accompanying drawings of this application, the terms “first,” “second,” and so on are intended to distinguish between similar objects rather than describe a specific order. Data used in this way is exchangeable in a proper case, so that the embodiments described herein of this application can be implemented in another order except those shown or described herein. In addition, the terms “include,” “have,” and any variants thereof are intended to cover a non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units specified expressly, but may include other steps or units not specified expressly or inherent to such a process, method, system, product, or device.

Embodiments of this application provide a face authentication method and apparatus.

FIG. 1is a schematic structural diagram of an implementation environment100of a face authentication method and apparatus according to an embodiment. The implementation environment includes at least two user terminals (a user terminal104and a user terminal101) and a server105(including a face authentication apparatus102). The user terminal104and the user terminal101respectively access the server105by using a network130. The server105is configured to provide a data service to a user108aand a user108b, and maintains a database. The user terminal104includes a camera160configured to photograph a face image of the user108aof the user terminal104. The user terminal101, the user terminal104, the server105, and the database communicate with and connected to each other by using a link170.

In this embodiment of this application, it is assumed that the user108aneeds to perform face authentication, to complete an operation such as a login, payment, or authentication. In this case, the user terminal104photographs a face image of the user108aby using the camera160. The user terminal104sends, to the server105, the photographed face image and a user account number that is input by the user108a.

The server105obtains, by querying the database according to the received user account number, a reference image corresponding to the user account number that is prestored in the database. The server105determines the user108bthat is in a state of waiting to receive an authentication code from the server105, generates the authentication code for the user108b, and sends the authentication code, the face image, and the reference image to the user terminal101of the user108b.

The user terminal101receives the authentication code, the face image, and the reference image that are sent by the server105; completes authentication of the user terminal101according to the authentication code, and obtains an authentication result according to the face image and the reference image, in which the authentication result indicates whether persons in the face image and the reference image are the same; and feeds back the authentication result to the server.

After receiving the authentication result fed back by the user terminal101, the server105determines, according to the authentication result, whether the authentication on the user108asucceeds.

In the implementation environment, there may be one or more servers105. When face authentication needs to be performed on a relatively large quantity of user terminals104, face authentication apparatuses102in the plurality of servers105may perform operations in parallel, thereby improving a face authentication speed.

The database stores information such as the reference image, the user account number, and a corresponding password.

During registration, the user terminal104obtains at least one face image, and sends the collected at least one face image to the server105. The server105uses the received face image as the reference image, and associatively save the reference image and the login account of the user108ain the database. In some embodiments, the at least one face image obtained by the user terminal104may be a face image photographed by using the camera160, or may be a face image read from a storage medium of the user terminal104. The at least one face image may include a plurality of face images of the user108ain different angles.

In some embodiments, the database may be independent of the server105. Alternatively, the database may be configured in the server105, so that the face authentication apparatus102may directly obtain data from the local database.

In some embodiments, the link170may be any communications link, or may be implemented by using any network protocol, including various wired or wireless protocols. For example, the link170may be any one or a combination of the following various connection manners: a wired connection, an internal connection, a wireless connection, and the like.

The network130may include a local area network (LAN) and a wide area network (WAN) such as the Internet. Any known network protocol, including various wired or wireless protocols, may be used to implement the network130.

In some embodiments, examples of the user terminal101and the user terminal104include but are not limited to a smartphone, a palmtop computer, a wearable computing device, a wearable computing device, a personal digital assistant (PDA), a tablet computer, a notebook computer, or a combination of any two or more of these data processing devices and another data processing device.

FIG. 2is a flowchart of a face authentication method according to an embodiment. The method may be performed by the face authentication apparatus102shown inFIG. 1. As shown inFIG. 2, the method includes the following steps:

Step S201. The face authentication apparatus receives a user account and a to-be-authenticated face image that are sent by a first user terminal.

When a first user of the first user terminal needs to complete a login, payment, or another operation, the first user terminal receives a user account input by the first user, photographs a face image of the first user, and sends the user account and the photographed face image to the face authentication apparatus. The face authentication apparatus receives the user account and the face image that are sent by the first user terminal, to complete subsequent face authentication.

For example, for the login operation, the first user terminal displays a login page to the first user, receives the login account number input by the first user, and photographs a face image of the first user. The received login account number and the photographed face image are sent to the face authentication apparatus, to perform subsequent face authentication.

Step S202. The face authentication apparatus obtains a reference image corresponding to the user account from a database.

After receiving the user account and the face image that are sent from the first user terminal, the face authentication apparatus searches, according to the user account, the database for the reference image corresponding to the user account.

In this embodiment of this application, the reference image is prestored in the database, and is a face image corresponding to the user account. The reference image may be a face image that is submitted by a user during registration and that is prestored in the first user terminal, or may be a face image that is collected by the first user terminal in real-time during user registration. The server correspondingly stores the reference image and the user account in the database.

Step S203. The face authentication apparatus determines a second user terminal for helping the first user terminal to complete face authentication.

In this embodiment of this application, the second user terminal is a user terminal in a state of waiting the server to send an authentication code. For example, the second user terminal sends a user request message to the server, and is waiting for the server to return the authentication code used for identity authentication, to complete an operation such as a login or payment.

In this embodiment of this application, the authentication code may be a character authentication code or may be an image authentication code. A specific manner of the authentication code is not limited in this embodiment of this application.

In this embodiment of this application, for all the second user terminals that have sent request messages and to which the server does not return the authentication code, the second user terminals may be sorted in chronological order of the request messages sent by the second user terminals, and a preset quantity of second user terminals that send request message earliest may be selected as second user terminals for helping the first user terminal complete the face authentication.

Herein, the selected preset quantity of second user terminals may be one or more.

In some embodiments, if there is no second user terminal waiting for the server to return the authentication code currently, the server may complete the face authentication on the first user terminal by using another method. For example, a face authentication algorithm of the server may be enabled to determine the face image and the prestored reference image that are sent by the first user terminal, and determine, according to a determining result, whether the authentication on the first user terminal succeeds. Alternatively, the user may be prompted to input a password to complete the authentication.

In this embodiment of this application, step S202and step S203may be performed at the same time or in any sequence.

Step S204. The face authentication apparatus generates an authentication code used by the second user terminal to perform identity authentication.

In this embodiment of this application, after determining the second user terminal for helping the first user terminal complete the face authentication, the server generates the authentication code used by the second user terminal to perform the identity authentication.

Step S205. The face authentication apparatus sends the authentication code, the face image, and the reference image to the second user terminal.

In this embodiment of this application, the face authentication apparatus sends the generated authentication code in step S204, the received face image in step S201, and the reference image queried in step S202to the second user terminal determined in step S203.

In some embodiments, the authentication code, the face image, and the reference image may be delivered to the second user terminal by using a message. Alternatively, the authentication code may be sent to the second user terminal first, and if the authentication performed by the second user terminal succeeds, the face image and the reference image are sent to the second user terminal.

Step S206: The face authentication apparatus receives an authentication result fed back by the second user terminal, and determines whether the face authentication on a user succeeds.

The face authentication apparatus receives the authentication result fed back by the second user terminal, and if the authentication result is that persons in the face image and the reference image are the same, it is determined that the authentication on the first user terminal succeeds; otherwise, it is determined that the authentication on the first user terminal fails.

For a case in which there is a plurality of second user terminals, statistics collection may be respectively performed on a quantity of authentication results indicating that persons in the face image and the reference image are the same and a quantity of authentication results indicating that persons in the face image and the reference image are different persons, and if the quantity of authentication results indicating that persons in the face image and the reference image are the same exceeds a preset ratio, it is determined that the authentication on the first user terminal succeeds.

The method provided in this embodiment of this application does not require a large quantity of manually annotated training samples, and is applicable to different scenarios. In different scenarios, neither training set adjusting nor retraining is required. Therefore, the authentication accuracy is high, and an authentication speed is fast.

FIG. 3is a flowchart of a face authentication method according to an embodiment. The method may be applied to a face swiping login scenario. The method may be performed by the face authentication apparatus102shown inFIG. 1. Referring toFIG. 3, the method procedure includes the following steps.

Pre-registration includes the following steps. A user inputs registration information. The registration information includes a login account number and a corresponding reference image. The foregoing reference image may be a face image of the registered user that is collected during registration, or may be a face image submitted by the registered user to a registration system. The reference image is in one-to-one correspondence to the login account number, and the reference image is used as an image password of the login account number.

S301. Obtain a to-be-authenticated face image and a reference image from a first user terminal.

After a user inputs a login account number on the first user terminal, an image collection apparatus of the first user terminal performs face image collection for the first user. The image collection apparatus may be a camera. In addition, the corresponding reference image may be obtained by using an association mapping between the login account number and the reference image.

S302. Generate an authentication code corresponding to the face image and the reference image.

A character string authentication code is generated by an authentication code system, and the generated authentication code is configured corresponding to the foregoing obtained face image and reference image.

S303. Send the authentication code, the face image, and the reference image to a second user terminal for authentication.

A scenario in which the second user terminal is located is a scenario in which the second user terminal receives various authentication codes, for example, scenarios such as a system login, password payment, and real-name authentication. To complete a login task, a payment task, or an authentication task of the second user terminal, the second user terminal needs to receive the authentication code, the face image, and the reference image. First, a user of the second user terminal needs to input a character authentication code, and determines the face image and the reference image under the premise that the input authentication code is correct. A determining content is whether faces in the two images are the same, and if yes, an authentication result indicates that the authentication succeeds, or if not, an authentication result indicates that the authentication fails. If the character authentication code input by the user of the second user terminal is incorrect, no further determining needs to be performed on the face image and the reference image, or a determining result made by the second user terminal is discarded.

S304. Receive an authentication result returned by the second user terminal.

After receiving the authentication result returned by the second user terminal, a subsequent operation is generated. If the authentication result indicates that the authentication succeeds, the login of the user of the first user is successful. If the authentication result indicates that the authentication fails, the login of the user of the first user terminal is prevented.

To avoid instability of the authentication result caused by incorrect identification performed by a single user, an embodiment of this application provides a face authentication method based on a plurality of identification user terminals. The method may be applied to a real-name authentication scenario.

FIG. 4is a flowchart of a face authentication method based on a plurality of identification user terminals according to an embodiment. Referring toFIG. 4, the method procedure includes:

Pre-registration includes the following steps. A user inputs registration information. The registration information includes an authentication account number and a corresponding reference image. The foregoing reference image may be a face image of the registered user that is collected during registration, or may be a face image submitted by the registered user to a registration system. The reference image is in one-to-one correspondence to the authentication account number, and the reference image is used as an image authentication password of the authentication account number.

S401. Obtain a to-be-authenticated face image and a reference image from a first user terminal.

After a user inputs an authentication account number on the first user terminal, an image collection apparatus of the first user terminal performs face image collection for the user. The image collection apparatus is a camera. In addition, the corresponding reference image may be obtained by using an association mapping between the authentication account number and the reference image.

S402. Generate an authentication code corresponding to the face image and the reference image.

A character string authentication code is generated by an authentication code system, and the generated authentication code is configured corresponding to the foregoing obtained face image and reference image.

S403. Send the authentication code, the face image, and the reference image to a plurality of second user terminals for authentication.

A scenario in which the plurality of second user terminals is located is a scenario in which the plurality of second user terminals receives various authentication codes, for example, scenarios such as a system login, password payment, and real-name authentication. The plurality of second user terminals may be located in a same scenario or may be located in different scenarios. To complete a login task, a payment task, or an authentication task of the second user terminal, the second user terminal needs to receive the authentication code, the face image, and the reference image.

S404. Determine whether an authentication code input by the second user terminal is correct. If the authentication code is correct, perform S405; otherwise, discard an authentication result made by the second user terminal.

The authentication code system receives the authentication code input by the second user terminal, and the authentication code system compares whether the authentication code input by the second user terminal and the generated character string authentication code are the same, and if yes, the authentication code is correct, or if not, the authentication code is incorrect. If the authentication code is incorrect, no further determining needs to be performed on the face image and the reference image, or a determining result made by the second user terminal is discarded.

S405. The second user terminal determines the face image and the reference image.

The face image and the reference image are determined under the premise that the input authentication code is correct. A determining content is whether faces in the two images are the same, and if yes, an authentication result indicates that the authentication succeeds, or if not, an authentication result indicates that the authentication fails.

S406. Receive authentication results returned by the second user terminals.

Each second user terminal returns an authentication result. A plurality of second user terminals returns a plurality of authentication results. The authentication result includes: the authentication succeeds and the authentication fails.

S407. Collect statistics on authentication results of the second user terminal, and select a large quantity of same authentication results as an authentication result.

Statistics collection is performed on a quantity of results indicating that the authentication succeeds and a quantity of results indicating that the authentication fails, and selection may be performed according to a rule of selecting a large quantity of authentication results, or selection may be performed according to a set quantity ratio. This is not specifically limited in this embodiment of this application.

After a final authentication result is selected, a subsequent operation is generated. If the authentication result indicates that the authentication succeeds, the authentication on the user of the first user terminal succeeds. If the authentication result indicates that the authentication fails, the authentication on the user of the first user terminal fails.

The face authentication technical solutions of this application may be independently used or may be used as a technology supplement of another authentication algorithm (such deep learning). To improve timeliness of an identification authentication process, an embodiment of this application provides a face authentication method with a set time threshold. The method may be applied to a face swiping payment scenario.

FIG. 5is a flowchart of a face authentication method with a set time threshold according to an embodiment, andFIG. 6is a schematic diagram of a face authentication algorithm according to an embodiment. Referring to theFIG. 5, the method procedure includes:

Pre-registration includes the following steps. A user inputs registration information. The registration information includes a payment account number and a corresponding reference image. The foregoing reference image may be a face image of the registered user that is collected during registration, or may be a face image submitted by the registered user to a registration system. The reference image is in one-to-one correspondence to the payment account number, and the reference image is used as an image authentication password of the payment account number.

S501. Obtain a to-be-authenticated face image and a reference image from a first user terminal.

After a user inputs a payment account number on the first user terminal, an image collection apparatus of the first user terminal performs face image collection for the user. The image collection apparatus is a camera. In addition, the corresponding reference image may be obtained by using an association mapping between the payment account number and the reference image.

S502. Generate an authentication code corresponding to the face image and the reference image.

A character string authentication code is generated by an authentication code system, and the generated authentication code is configured corresponding to the foregoing obtained face image and reference image.

S503. Send the authentication code, the face image, and the reference image to a second user terminal for authentication.

A scenario in which a plurality of second user terminals is located is a scenario in which the plurality of second user terminals receives various authentication codes, for example, scenarios such as a system login, password payment, and real-name authentication. To complete a login task, a payment task, or an authentication task of the second user terminal, the second user terminal needs to receive the character authentication code, the face image, and the reference image. The authentication code system receives the authentication code input by the second user terminal, and the authentication code system compares whether the authentication code input by the second user terminal and the generated character string authentication code are the same, and if yes, the authentication code is correct, or if not, the authentication code is incorrect. If the authentication code is incorrect, no further determining needs to be performed on the face image and the reference image, or a determining result made by the second user terminal is discarded. A process of performing the authentication by the second user terminal is as follows: the face image and the reference image are determined under the premise that the input authentication code is correct. A determining content is whether faces in the two images are the same, and if yes, an authentication result indicates that the authentication succeeds, or if not, an authentication result indicates that the authentication fails.

S504. Preset a time threshold, and determine whether the second user terminal returns an authentication result within the time threshold. If yes, perform S505; otherwise, enable a face authentication algorithm.

A face swiping payment speed of the first user terminal depends on an authentication speed of the second user terminal. However, the authentication speed of the second user terminal is limited by an environment or an application scenario, for example, an online user of the second user terminal is not in a scenario of receiving the authentication code, or the Internet is not smooth. Further, the authentication speed of the second user terminal is affected by a subjective factor of a user on the second user terminal, for example, the user of the second user terminal does not submit the authentication result in time. In conclusion, the time threshold needs to be set to ensure timeliness of face swiping payment of the first user terminal. Assuming that the set time threshold is 30 seconds, an authentication result returned by the second user terminal within 30 seconds is a valid result, and an authentication result returned by the second user terminal beyond 30 seconds is an invalid result. The valid result is used and the invalid result is discarded.

If a quantity of valid authentication results returned within a time threshold is 0, the face authentication algorithm is enabled to perform face payment authentication on the user of the first user terminal. A procedure of the face authentication algorithm is shown inFIG. 6. The procedure mainly includes two parts: pre-processing and feature extraction. The pre-processing part includes face image detection, positioning of five sense organs, face image slicing, and illumination normalization. The feature extraction part is implemented by using a deep convolutional network, and further includes registration and database importing and authentication.

S505. Receive the authentication result returned by the second user terminal.

Regardless of whether the second user terminal returns the valid authentication result within a time threshold, the user of the first user terminal finally receives the authentication result and generates a subsequent operation. If the authentication result indicates that the authentication succeeds, face swiping payment of the user of the first user terminal succeeds; and if the authentication result indicates that the authentication fails, face swiping payment of the user of the first user terminal fails.

To improve timeliness of an identification authentication process, an embodiment of this application provides a second face authentication method based on a time threshold. The method may be applied to a web page or an app login scenario.

FIG. 7is a flowchart of a face authentication method according to an embodiment. Referring toFIG. 7, the method procedure includes:

Pre-registration includes the following steps. A user inputs registration information, in which the registration information includes a login account number and a corresponding registered face image; and registers with a login password. The registered face image is referred to as a reference image for short below. The reference image is in one-to-one correspondence to the login account number. The reference image is used as an image authentication password of the login account number. The login password is used as a character string authentication password of the login account number.

S701. Obtain a to-be-authenticated face image and a reference image from a first user terminal.

After a user inputs a login account number on the first user terminal, an image collection apparatus of the first user terminal performs face image collection for the user. The image collection apparatus is a camera. In addition, the corresponding reference image may be obtained by using an association mapping between the login account number and the reference image.

S702. Generate an authentication code corresponding to the face image and the reference image.

A character string authentication code is generated by an authentication code system, and the generated authentication code is configured corresponding to the foregoing obtained face image and reference image.

S703. Send the authentication code, the face image, and the reference image to a second user terminal for authentication.

A scenario in which a plurality of second user terminals is located is a scenario in which the plurality of second user terminals receives various authentication codes, for example, scenarios such as a system login, password payment, and real-name authentication. To complete a login task, a payment task, or an authentication task of the second user terminal, the second user terminal needs to receive the character authentication code, the face image, and the reference image. The authentication code system receives the authentication code input by the second user terminal, and the authentication code system compares whether the authentication code input by the second user terminal and the generated character string authentication code are the same, and if yes, the authentication code is correct, or if not, the authentication code is incorrect. If the authentication code is incorrect, no further determining needs to be performed on the face image and the reference image, or a determining result made by the second user terminal is discarded. A process of performing the authentication by the second user terminal is as follows: the face image and the reference image are determined under the premise that the input authentication code is correct. A determining content is whether faces in the two images are the same, and if yes, an authentication result indicates that the authentication succeeds, or if not, an authentication result indicates that the authentication fails.

S704. Preset a time threshold, and determine whether the second user terminal returns an authentication result within the time threshold. If yes, perform S705; otherwise, enable a face authentication algorithm.

A face swiping payment speed of the first user terminal depends on an authentication speed of the second user terminal. However, the authentication speed of the second user terminal is limited by an environment or an application scenario, for example, an online user of the second user terminal is not in a scenario of receiving the authentication code, or the Internet is not smooth. Further, the authentication speed of the second user terminal is affected by a subjective factor of a user on the second user terminal, for example, the user of the second user terminal does not submit the authentication result in time. In conclusion, the time threshold needs to be set to ensure timeliness of face swiping payment of the first user terminal. Assuming that the set time threshold is 60 seconds, an authentication result returned by the second user terminal within 60 seconds is a valid result, and an authentication result returned by the second user terminal beyond 30 seconds is an invalid result. The valid result is used and the invalid result is discarded.

If a quantity of valid authentication results returned within the time threshold is 0, login is performed by using password authentication. A system in which the first user terminal is located prompts a to-be-logged in user to input a login password. The system receives the to-be-authenticated input password and compare whether the input password and a registered login password are the same, and if yes, the login is successful; or if not, the login fails.

S705. Receive the authentication result returned by the second user terminal.

The second user terminal returns the valid authentication result within the time threshold, and the user of the first user terminal generates a subsequent operation according to the received authentication result. If the authentication result indicates that the authentication succeeds, a face swiping login of the user of the first user terminal succeeds; and if the authentication result indicates that the authentication fails, the face swiping login of the user of the first user terminal fails.

For ease of description, the foregoing method embodiments are described as a series of action combination. However, a person of ordinary skill in the art may know that this application is not limited to the order of the described actions, because according to this application, some steps may be performed in other orders or performed simultaneously. Secondarily, a person skilled in the art may also know that the embodiments described in the specification all belong to embodiments and the involved actions and modules are not necessary for this application.

Based on the foregoing descriptions of the implementations, a person skilled in the art may clearly understand that the foregoing embodiment methods may be implemented by software in addition to universal hardware or by hardware only. In most circumstances, the former is an implementation. Based on such an understanding, the technical solutions of this application or the part that makes contributions to the existing technology may be substantially embodied in the form of a software product. The computer software product is stored in a storage medium (for example, a ROM/RAM, a magnetic disk, or an optical disc), and contains several instructions for instructing a terminal device (which may be a mobile phone, a computer, a server, or a network device) to perform the method according to the embodiments of this application.

FIG. 8is a schematic structural diagram of a face authentication apparatus according to an embodiment. The face authentication apparatus includes one or more processors (CPU)810, a memory820, a user interface830, a network interface840, and a communications bus850used to interconnect these components.

In some embodiments, the network interface840may be connected, by using one or more networks, to a server configured to provide a data service.

The user interface830includes one or more output devices832. The one or more output devices832include one or more visual displays. The user interface830further includes one or more input devices834. The input devices834include, for example, a keyboard, a mouse, or another input button or control.

The memory820may be a high speed random access memory such as a DRAM, an SRAM, a DDR RAM, or another random access solid-state storage device; or may be a non-volatile memory such as one or more disk storage devices, disc storage devices, flash devices, or another non-volatile solid-state memory.

The memory820stores a machine readable instruction module, and the machine readable instruction module includes:

a receiving module8201, configured to receive a user account and a to-be-authenticated face image that are sent by a first user terminal;

a determining module8202, configured to: obtain a reference image corresponding to the user account, the reference image being a prestored face image corresponding to the user account; and determine a second user terminal for helping the first user terminal complete face authentication, the second user terminal being in a state of waiting to receive an authentication code;

an authentication code module8203, configured to generate the authentication code;

a sending module8204, configured to send the authentication code, the face image, and the reference image to the second user terminal, the second user terminal completing identity authentication of the second user terminal according to the authentication code, and feeding back an authentication result for the face image and the reference image, and the authentication result including: the authentication succeeds or the authentication fails; and

an authentication module8205, configured to: receive the authentication result returned by the second user terminal, and determine, according to the authentication result, whether the face authentication on the first user terminal succeeds.

In some embodiments, the determining module8202is further configured to, for second user terminals that have sent request messages but does not receive the authentication code, sort second user terminals in chronological order of the request messages sent by the second user terminal, and select a preset quantity of second user terminals that send request message earliest as second user terminals for helping the first user terminal complete the face authentication.

In some embodiments, the determining module8204is further configured to send the authentication code to the second user terminal by using a first message, the receiving module8201is further configured to receive a second message fed back by the second user terminal, and the sending module8204is further configured to, if an authentication code carried in the second message is the same as the authentication code sent by using the first the message, send the face image and the reference image to the second user terminal by using a third message.

In some embodiments, the authentication module8205is further configured to receive authentication results returned by a plurality of second user terminals, collect statistics on a quantity of authentication results indicating that the authentication succeeds in the authentication results returned by the plurality of second user terminals, and if a ratio of the quantity of authentication results indicating that the authentication succeeds to all the authentication results exceeds a preset threshold, determine that the face authentication on the first user terminal succeeds.

In some embodiments, the authentication module8205is further configured to use authentication results received by the second user terminals within a preset time length after sending the authentication code as valid authentication results, and collect statistic on a quantity of authentication results indicating that the authentication succeeds in the valid authentication results.

In some embodiments, the authentication module8205is further configured to, if a quantity of the received authentication results returned by the second user terminals within the preset time length is 0, perform pre-processing on the to-be-authenticated face image, perform feature extraction, and compare the face image with the reference image according to the extracted feature, to obtain an authentication result.

In some embodiments, the authentication module8205is further configured to, if a quantity of the received authentication results returned by the second user terminals within the preset time length is 0, prompt the user to input a password on the first terminal, receive the password sent by the first terminal, and determine, according to the password, whether the authentication on the first user terminal succeeds.

FIG. 9is an architectural diagram of modules of a face authentication apparatus according to an embodiment. The apparatus includes the following modules:

a storage module911, configured to store a login account number registered on a first user terminal and a reference image associated with the login account number;

a record module912, configured to obtain the login account number on the first user terminal and a to-be-authenticated face image;

an authentication code module913, configured to generate an authentication code;

a sending module920, configured to send the authentication code, the face image, and the reference image to a second user terminal;

an authentication module930, configured to: authenticate the authentication code and determine the face image and the reference image, to generate an authentication result; and

a receiving module940, configured to receive the authentication result of the authentication module.

The apparatus further includes an image collection module914, configured to collect the reference image and the to-be-authenticated face image.

In an optional embodiment, the face authentication apparatus sends the authentication code, the face image, and the reference image to a plurality of second user terminals. Correspondingly, the apparatus further includes a statistics collection module960, configured to collect statistics on and compare authentication results returned by the plurality of second user terminals. If the authentication code input by the second user terminal is correct and it is determined that persons in the face image and the reference image are the same, the authentication result indicating that authentication succeeds; otherwise, the authentication result indicates that the authentication fails. A larger quantity of same authentication results is selected as the authentication result.

In another optional embodiment, the face authentication apparatus presets a time threshold to limit a speed of face authentication. Correspondingly, the apparatus further includes a time threshold module950, configured to delete the authentication result returned by the second user terminal beyond a range of the time threshold.

Feedback is performed according to information of the time threshold module950. If a feedback result is within the time threshold, a quantity of returned authentication results is 0, authentication and a login need to be performed in another manner.

A first manner is enabling a face authentication algorithm, and the apparatus may be used with reference to another authentication algorithm (such as deep learning). That is, the apparatus further includes a face authentication algorithm module970, configured to: perform pre-processing on the to-be-authenticated face image, and perform feature extraction, to perform comparison and authentication on the face image and the reference image.

A second manner is enabling a password login. Correspondingly, the apparatus further includes a password login module980, configured to pre-register a login account number and a corresponding login password, receive a to-be-authenticated input password, and compare whether the input password and the registered login password are the same. If yes, the login is successful, or if not, the login fails.

In conclusion, the face authentication apparatus according to an embodiment of this application combines a registered face image in a database and a current authentication image into an image authentication code, and delivers the image authentication code and a character authentication code together to a real user. If a character authentication code submitted by the real user is correct, determining of the real user on the image authentication code is trusted, that is, a determining result indicating whether persons in the reference image and the current face image are the same is trusted. To avoid uncertainty caused by incorrect identification of a single user, the image authentication code and the character authentication code may be delivered to a plurality of real users. A larger quantity of same authentication results of all the real users is selected as a final result. By the apparatus provided in this embodiment of this application, the accuracy of the face authentication result reaches the identification precision of human beings. In addition, the face authentication result may be provided to a face authentication algorithm for training.

When the face authentication apparatus provided in the foregoing embodiments performs user face authentication, the foregoing division of the functional modules is an example for description. During practical application, the foregoing functions may be allocated to and completed by different functional modules, that is, an inner structure of the apparatus is divided into different functional modules, to complete all or some of the functions described above. In addition, the face authentication apparatus embodiment provided in this embodiment and the face authentication method provided in the foregoing embodiments belong to one concept. For details of an implementation process, refer to the method embodiments.

The method embodiments provided in the embodiments of this application may be performed in a mobile terminal, a computer terminal, or a similar computing apparatus. Using an example in which the method is performed on a computer terminal.

FIG. 10is a structural block diagram of hardware of a computer terminal of a face authentication apparatus according to an embodiment. As shown inFIG. 10, a terminal1000may include components such as an RF (Radio Frequency, radio frequency) circuit1010, a memory1020including one or more computer readable storage mediums, an input unit1030, a display unit1040, a sensor1050, an audio circuit1060, a WiFi (wireless fidelity, wireless fidelity) module1070, a processor1080including one or more processing cores, and a power supply1090. A person skilled in the art may understand that the structure of the terminal shown inFIG. 10does not constitute a limitation to the terminal, and the terminal may include more components or fewer components than those shown in the figure, or some components may be combined, or a different component deployment may be used.

The RF circuit1010may be configured to receive and send signals during information receiving and sending or during a call. The RF circuit1010receives downlink information from a base station, then delivers the downlink information to one or more processors1080for processing, and sends related uplink data to the base station. The RF circuit1010includes, but is not limited to, an antenna, at least one amplifier, a tuner, one or more oscillators, a subscriber identity module (SIM) card, a transceiver, a coupler, a low noise amplifier (LNA), a duplexer, and the like. In addition, the RF circuit1010may also communicate with a network and another device by wireless communication. The wireless communication may use any communication standard or protocol, including but not limited to Global System for Mobile communications (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE), email, Short Messaging Service (SMS), and the like.

The memory1020may be configured to store a software program and module. The processor1080runs the software program and module stored in the memory1020, to implement various functional applications and data processing. The memory1020may mainly include a program storage area and a data storage area. The program storage area may store an operating system, an application program used by a function (such as a sound playback function and an image display function), and the like. The data storage area may store data (such as audio data and an address book) created according to use of the terminal1000, and the like. In addition, the memory1020may include a high speed random access memory, and may further include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory, or other volatile solid-state storage devices. Correspondingly, the memory1020may further include a memory controller, to provide access of the processor1080and the input unit1030to the memory1020.

The input unit1030may be configured to receive input digit or character information, and generate a keyboard, mouse, joystick, optical or track ball signal input related to the user setting and function control. The input unit1030may include a touch-sensitive surface1031and another input device132. The touch-sensitive surface1031, which is also referred to as a touchscreen or a touch panel, may collect a touch operation of a user on or near the touch-sensitive surface (such as an operation of a user on or near the touch-sensitive surface1031by using any suitable object or accessory, such as a finger or a stylus), and drive a corresponding connection apparatus according to a preset program. Optionally, the touch-sensitive surface1031may include two parts: a touch detection apparatus and a touch controller. The touch detection apparatus detects a touch position of the user, detects a signal generated by the touch operation, and transfers the signal to the touch controller. The touch controller receives touch information from the touch detection apparatus, converts the touch information into touch point coordinates, and sends the touch point coordinates to the processor1080. Moreover, the touch controller can receive and execute an instruction sent by the processor1080. In addition, the touch-sensitive surface1031may be a resistive, capacitive, infrared, or surface sound wave type touch-sensitive surface. In addition to the touch-sensitive surface1031, the input unit1030may further include another input device1032. The another input device1032may include, but is not limited to: one or more of a physical keyboard, a functional key (such as a volume control key or a switch key), a track ball, a mouse, and a joystick.

The display unit1040may be configured to display information input by the user or information provided to the user, and various graphical user interfaces of the terminal1000. The graphical user interfaces may be composed of graphics, text, icons, videos, and any combination thereof. The display unit1040may include a display panel1041. Optionally, the display panel1041may be configured by using a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like. Further, the touch-sensitive surface1031may cover the display panel1041. After detecting a touch operation on or near the touch-sensitive surface1031, the touch-sensitive surface1041transfers the touch operation to the processor1080, to determine the type of the touch event. Then, the processor1080provides a corresponding visual output on the display panel1041according to the type of the touch event. Although, inFIG. 10, the touch-sensitive surface1031and the display panel1041are used as two separate parts to implement input and output functions, in some embodiments, the touch-sensitive surface1031and the display panel1041may be integrated to implement the input and output functions.

The terminal1000may further include at least one sensor1050such as an optical sensor, a motion sensor, and other sensors. The optical sensor may include an ambient light sensor and a proximity sensor. The ambient light sensor may adjust luminance of the display panel1041according to brightness of the ambient light. The proximity sensor may switch off the display panel1041and/or backlight when the terminal1000is moved to the ear. As one type of motion sensor, a gravity acceleration sensor may detect magnitude of accelerations in various directions (e.g., on three axes), may detect magnitude and a direction of the gravity when static, and may be applied to an application that recognizes the attitude of the terminal (for example, switching between landscape orientation and portrait orientation, a related game, and magnetometer attitude calibration), a function related to vibration recognition (such as a pedometer and a knock), and the like. Other sensors such as a gyroscope, a barometer, a hygrometer, a thermometer, and an infrared sensor may be configured in the terminal1000.

The audio circuit1060, a speaker1061, and a microphone1062may provide audio interfaces between the user and the terminal1000. The audio circuit1060may convert received audio data into an electric signal and transmit the electric signal to the speaker161. The speaker1061converts the electric signal into a sound signal for output. On the other hand, the microphone1062converts a collected sound signal into an electric signal. The audio circuit1060receives the electric signal and converts the electric signal into audio data, and outputs the audio data to the processor1080for processing. Then, the processor1080sends the audio data to, for example, another terminal by using the RF circuit1010, or outputs the audio data to the memory1020for further processing. The audio circuit1060may further include an earplug jack, to provide communication between a peripheral earphone and the terminal1000.

WiFi is a short distance wireless transmission technology. The terminal1000may help, by using the WiFi module1070, the user to receive and send e-mails, browse a web page, access streaming media, and so on, which provides wireless broadband Internet access to the user. AlthoughFIG. 10shows the WiFi module1070, it may be understood that the WiFi module is not a necessary component of the terminal1000, and the WiFi module may be omitted as long as the scope of the essence of the disclosure is not changed.

The processor1080is the control center of the terminal1000, and is connected to various parts of the terminal by using various interfaces and lines. By running or executing the software program and/or module stored in the memory1020, and invoking data stored in the memory1020, the processor1080performs various functions and data processing of the terminal1000, thereby performing overall monitoring on the terminal. Optionally, the processor1080may include one or more processing cores. In some embodiments, the processor1080may integrate an application processor and a modem processor. The application processor mainly processes an operating system, a user interface, an application program, and the like. The modem processor mainly processes wireless communication. It may be understood that the foregoing modem processor may alternatively not be integrated into the processor1080.

The terminal1000further includes the power supply1090(such as a battery) for supplying power to the components. The power supply may be logically connected to the processor1080by using a power management system, thereby implementing functions such as charging, discharging, and power consumption management by using the power management system. The power supply1090may further include one or more of any component such as a direct current or alternating current power supply, a re-charging system, a power failure detection circuit, a power supply converter or inverter, or a power supply state indicator.

The terminal1000may further include a camera, a Bluetooth module, and the like. In this embodiment, the display unit of the terminal is a touchscreen display, and the terminal further includes a memory and one or more programs. The one or more programs are stored in the memory, and are configured to be executed by the one or more processors. The one or more programs include instructions for performing the following operations:

receiving a user account and a to-be-authenticated face image that are sent by a first user terminal;

obtaining a reference image corresponding to the user account, the reference image being a prestored face image corresponding to the user account;

determining a second user terminal for helping the first user terminal complete face authentication, the second user terminal being in a state of waiting to receive an authentication code;

generating the authentication code;

sending the authentication code, the face image, and the reference image to the second user terminal, the second user terminal completing identity authentication according to the authentication code, and feeding back an authentication result for the face image and the reference image, and the authentication result including: the authentication succeeds or the authentication fails; and

receiving the authentication result returned by the second user terminal, and determining, according to the authentication result, whether the face authentication on the first user terminal succeeds.

Based on the foregoing descriptions of the implementations, a person skilled in the art may clearly understand that the face authentication technical solutions provided in this application may be implemented by software in addition to an universal hardware platform or by hardware only. In most circumstances, the former is an implementation. Based on such an understanding, the technical solutions of this application or the part that makes contributions to the existing technology may be substantially embodied in the form of a software product. The computer software product is stored in a storage medium (for example, a ROM/RAM, a magnetic disk, or an optical disc), and contains several instructions for instructing a terminal device (which may be a mobile phone, a computer, a server, or a network device) to perform the method according to the embodiments of this application.

An embodiment of this application provides a computer readable storage medium. The computer readable storage medium may be a computer readable storage medium included in the memory in the foregoing embodiment; or may be computer readable storage medium that exists alone and that is not assembled to a terminal. The computer readable storage medium stores one or more programs. The one or more programs are executed by one or more processors to execute the foregoing face authentication method. The method includes:

obtaining a to-be-authenticated face image and a reference image from a first client;

generating an authentication code corresponding to the face image and the reference image;

sending the authentication code, the face image, and the reference image to a second client for authentication; and

receiving an authentication result returned by the second client.

Further, before the obtaining a to-be-authenticated face image and a reference image, the method further includes obtaining a login account number corresponding to the to-be-authenticated face image.

The obtaining a to-be-authenticated face image and a reference image includes presetting an associated reference image for the login account number, and obtaining the associated reference image by using the obtained login account number.

In some embodiments, the sending the authentication code, the face image, and the reference image to a second client for authentication includes authenticating whether an authentication code input by the second client is correct, if yes, receiving a determining result made by the second client, and otherwise, deleting a determining result made by the second client, in which if the determining result made by the second client is deleted, the authentication result returned by the second client indicates that the authentication fails.

The determining result made by the second client includes determining, by the second client, whether persons in the face image and the reference image are the same, and if a determining result is that the persons in the face image and the reference image are the same, the authentication result returned by the second client indicates that the authentication succeeds. Alternatively, if a determining result is that the persons in the face image and the reference image are different, the authentication result returned by the second client indicates that the authentication fails.

In some embodiments, the authentication code, the face image, and the reference image are sent to a plurality of second clients for authentication. Each second client returns an authentication result, and the authentication result indicates that the authentication succeeds and the authentication fails. Authentication results returned by the plurality of second clients are collected, and a larger quantity of same authentication results is selected as the authentication result.

Further, the method further includes setting a time threshold and deleting an authentication result returned by the second client beyond a range of the time threshold.

In some embodiments, if a quantity of authentication results returned by the second client within the time the threshold is 0, the following two standby manners may be selected:

a first standby manner is enabling a face authentication algorithm, including performing pre-processing on the to-be-authenticated face image and performing feature extraction, to perform comparison and authentication on the face image and the reference image; and

a second standby manner is enabling a password login, including pre-registering a login account number and a corresponding login password, receiving a to-be-authenticated input password and comparing whether the input password and the registered login password are the same, if yes, the login is successful, otherwise, the login fails.

The obtaining a to-be-authenticated face image includes receiving the to-be-authenticated face image collected by a camera.