RU2834889C2 - Method and device for personal authentication, terminal and data medium - Google Patents

Abstract

FIELD: physics.

SUBSTANCE: invention relates to a method, a device, a terminal and a computer-readable data medium for personal authentication. Method comprises generating a random matching target function in response to an identity verification command, wherein the arbitrary matching target function is a function generated to associate characters with gestures in an arbitrary manner; displaying a virtual keyboard based on the arbitrary matching target function, wherein the virtual keyboard displays information indicating the need to convert the password, which corresponds to the arbitrary matching target function and which is determined as an indication of the need to convert password characters in the original password into gestures, wherein different password symbols correspond to different gestures, password conversion mode displayed by information indicating the need for password conversion is randomly generated, and password characters include at least one type of numbers, letters, punctuation marks and special characters; wherein the virtual keyboard display based on the arbitrary matching target function comprises: determining a password conversion unit based on the arbitrary matching target function, wherein the password conversion unit includes one of the password symbols and a gesture corresponding to one of the password symbols in the arbitrary matching target function; and displaying the password conversion unit on the virtual keyboard based on the first display mode corresponding to one of the password symbols and the second display mode corresponding to the gesture identifier, wherein the first display mode is different from the second display mode; obtaining facial feature data by extracting facial features from identity verification images collected by the camera; obtaining a sequence of gestures by detecting activity on identity verification images; obtaining a source password by converting a password from a sequence of gestures based on an arbitrary matching target function; and performing identity authentication based on the initial password and facial features data.

EFFECT: high reliability of identity authentication.

11 cl, 7 dwg, 1 tbl

Description

Field of technology to which the present invention relates

[1] Embodiments of the present invention relate to the field of technologies for ensuring information security in cloud environments, in particular, to a method and device for personal authentication, as well as to a terminal, a data carrier and its software product.

Prior art of the present invention

[2] Two-factor authentication (2FA) is a method of authenticating a user's identity by combining two different types of authentication factors (such as account passwords, Short Message Service (SMS) verification codes, and biometric data). During the identity verification process, a user must provide two different authentication factors to confirm their identity, which allows for better protection of users' credentials and the resources available to them compared to a verification method that uses only one factor.

[3] In some practices, the 2FA method typically uses two factors from among the following three authentication factors: (1) users' personal information, such as passwords or personal identification numbers (PINs); (2) users' biometric data, such as voice samples, facial features, fingerprints, and the like; and (3) users' personal assets, such as SMS verification codes, electronic security keys, and the like.

[4] However, personal authentication methods in some cases provide for the following: all methods based on two types of biometric data, such as a method based on passphrases and passwords and a method based on biometric data and the user's personal information, require users to perform at least two verification operations, such as entering voice samples and fingerprints or entering fingerprints and passwords, which complicates the verification operations and delays the verification process.

Brief summary of the present invention

[5] The embodiments of the present invention propose a method and device for authentication of a person, as well as a terminal, a data carrier and its software product. The technical solutions implemented in the present invention are described below.

[6] According to one aspect of the present invention, embodiments thereof provide a method for authenticating a person. This method involves performing the following steps:

[7] generating a random matching target function in response to a command to verify the identity, wherein the random matching target function is a function generated with the ability to match symbols with gestures in an arbitrary manner;

[8] displaying a virtual keyboard based on an arbitrary correspondence target function, wherein password conversion indication information is displayed on the virtual keyboard, which corresponds to an arbitrary correspondence target function and which is defined as an indication of the need to convert password characters in an original password into gestures, wherein different password characters correspond to different gestures, the password character conversion mode displayed by the password conversion indication information is arbitrarily generated, and the password characters include at least one type of digits, letters, punctuation marks and special characters; wherein displaying a virtual keyboard based on an arbitrary correspondence target function comprises: determining a password conversion unit based on an arbitrary correspondence target function, wherein the password conversion unit includes one of the password characters and a gesture corresponding to one of the password characters in the arbitrary correspondence target function; and displaying the password conversion unit on the virtual keyboard based on a first display mode corresponding to one of the password characters and a second display mode corresponding to a gesture identifier, wherein the first display mode is different from the second display mode;

[9] obtaining facial feature data by extracting facial features from identity verification images collected by the camera;

[10] obtaining gesture sequences by detecting activity in images for identity verification;

[11] obtaining the original password by transforming the password from a sequence of gestures based on the arbitrary correspondence objective function; and

[12] Performing identity authentication based on the original password and facial features data.

[13] According to another aspect of the present invention, embodiments thereof provide a device for authenticating a person. This device includes:

[14] a first display module configured to generate an arbitrary correspondence target function in response to an identity verification command, wherein the arbitrary correspondence target function is a function generated with the ability to arbitrarily associate characters with gestures; and displaying a virtual keyboard based on the arbitrary correspondence target function, wherein information indicating the need for converting a password is displayed on the virtual keyboard, which corresponds to the arbitrary correspondence target function and which is determined as an indication of the need for converting password characters in the original password into gestures, wherein different password characters correspond to different gestures, a password character conversion mode displayed by the password conversion indication information is arbitrarily generated, and the password characters include at least one type of digits, letters, punctuation marks and special characters; wherein the first display module is further configured to: determine a password conversion unit based on the arbitrary correspondence target function, wherein the password conversion unit includes one of the password characters and a gesture corresponding to one of the password characters in the arbitrary correspondence target function; and displaying a password conversion block on a virtual keyboard based on a first display mode corresponding to one of the password characters and a second display mode corresponding to the gesture identifier, wherein the first display mode is different from the second display mode;

[15] a first facial feature extraction module configured to obtain facial feature data by extracting facial features from identity verification images collected by a camera;

[16] an activity detection module configured to obtain a sequence of gestures by detecting activity in images for identity verification;

[17] a password conversion module configured to obtain an original password by converting the password from a sequence of gestures; and

[18] a personal authentication module configured to perform personal authentication based on an initial password and facial feature data.

[19] According to another aspect of the present invention, embodiments thereof provide a terminal comprising a processor and a memory; wherein at least one instruction, at least one program, set of codes or set of commands is stored in the memory, and upon loading and execution of at least one instruction, at least one program, set of codes or set of commands, the processor initiates the implementation of a method for authenticating a person according to said aspect.

[20] According to another aspect of the present invention, embodiments thereof provide a machine-readable data carrier in which at least one computer program is stored, wherein this computer program, when loaded and executed by a processor, initiates the implementation by this processor of a method for authenticating a person according to the said aspect.

[21] The technical solutions implemented in the embodiments of the present invention ensure the achievement of at least the following positive effects:

[22] The embodiments of the present invention provide a personality authentication mechanism based on two authentication factors such as a user password and facial features, so that the user can simultaneously enter a password and perform facial identification by entering a gesture only once. Thus, the process of authenticating the user's personality is simplified and the efficiency of the personality authentication is improved. Based on the randomly generated password character conversion mode, the user enters an arbitrary sequence of gestures obtained by converting the original password, so that the user's original password is not "leaked" at the password input stage, and the instant password obtained based on the correct original password allows successful authentication, protecting the facial identification process from attacks using fake facial features and further improving the security level and accuracy of personality authentication.

Brief description of the drawings

[23] Fig. 1 is a schematic diagram of an implementation environment according to some embodiments of the present invention;

[24] Fig. 2 is a block diagram illustrating a method for authenticating an individual according to some embodiments of the present invention;

[25] Fig. 3 is a block diagram illustrating a method for authenticating an individual according to some embodiments of the present invention;

[26] Fig. 4 is a schematic diagram of a virtual keyboard according to some embodiments of the present invention;

[27] Fig. 5 is a block diagram illustrating a method for authenticating an individual according to some embodiments of the present invention;

[28] Fig. 6 is a block diagram illustrating a method for authenticating an individual according to some embodiments of the present invention; and

[29] Fig. 7 is a block diagram of a device for personal authentication according to some embodiments of the present invention.

Detailed disclosure of the present invention

[30] To clarify the objectives, technical solutions and advantages of the present invention, embodiments of the present invention are described in detail below in connection with the accompanying drawings.

[31] The term "set" as used in this document means two or more. The term "and/or" describes an associative relationship between related objects and indicates that there are three possible relationships. For example, the phrase "A and/or B" means (A), (B), or (A and B). The symbol "/" typically indicates an "or" relationship between related objects.

[32] In some practices, the 2FA method typically uses only two factors from the following three authentication factors: (1) users’ personal information, such as passwords or personal identification numbers (PINs); (2) users’ biometric data, such as voice samples, facial features, fingerprints, etc.; and (3) users’ personal means, such as SMS verification codes, electronic security keys, etc. However, in some cases, identity authentication methods provide for the following: a 2FA method based on voice samples and other biometric data (e.g., fingerprints and facial images) requires the user’s device to be equipped with additional special sensors (e.g., a fingerprint scanner) or additional software and hardware security keys; and a 2FA solution based on passwords and graphic symbols often requires the user to enter information multiple times. All personal authentication methods, whether based on two types of biometric data or based on passphrases and passwords, as well as on user biometric data, require users to perform at least two verification operations, such as entering voice samples and fingerprints or entering fingerprints and passwords, which complicates the verification operations and delays the verification process.

[33] The embodiments of the present invention provide a method for authenticating a person that eliminates the above technical problems, increases the efficiency of the 2FA method, and simplifies the process itself. Fig. 1 is a schematic representation of an implementation environment of the present invention according to some embodiments thereof. The implementation environment includes: a terminal 110 and a backend server 120.

[34] The terminal 110 includes a password conversion module 111 and a facial feature extraction module 112. In response to an identity verification command, the password conversion module 111 generates a password character conversion mode, wherein the password character conversion mode is randomly generated. The terminal 110 displays the password character conversion mode through an interface, and based on this mode, the user converts the original password and inputs a gesture sequence through the camera, after which the terminal 110 performs facial feature extraction and detects activity in the identity verification images collected by the camera. The password conversion module 111 obtains the original password by reconstructing the identified gesture sequence based on the password character conversion mode. The facial feature extraction module 112 obtains facial feature data by extracting facial features from the identity verification images. The terminal 110 transmits the original password and the facial feature data to the backend server 120 for identity authentication. Therefore, the proposed method involves entering two authentication factors using the same user data only once, which simplifies the user's work.

[35] After receiving the initial password and the facial feature data, the backend server 120 performs identity authentication based on the database and transmits the authentication result to the terminal 110. Although only one terminal 110 is shown in Fig. 1, in practice, more terminals may communicate with the backend server 120 for identity authentication. The backend server 120 stores the initial passwords and facial feature data corresponding to different accounts.

[36] The following text illustratively describes scenarios for using the method for authenticating a person according to embodiments of the present invention.

[37] 1. Online payment

[38] The proposed identity authentication method can be implemented as an online payment function in an application such as a shopping application or an online payment application or a web page so that the 2FA process is realized by entering data once. Upon receiving a payment transaction, the terminal arbitrarily generates a password character conversion mode, displays the password character conversion mode on the interface, and collects identity verification images by turning on the camera. The user converts the original password of his or her account into an instant gesture sequence based on the password character conversion mode displayed by the terminal and shows the corresponding gestures to the camera. The terminal obtains facial feature data by extracting facial features from the identity verification images, identifies the gesture sequence, performs identity authentication based on the original password and facial features after receiving the original password by recovering the identified gesture sequence, and completes the payment transaction if the 2FA is successful.

[39] 2. Login to your account

[40] For user accounts containing important information or user resources, the above-described identity authentication method is applicable to identity authentication when logging in. In the case of receiving an account login operation, the user inputs the account ID, starts the identity authentication process, and simultaneously inputs the initial password and facial features using the identity authentication gesture input sequence. In addition, the proposed identity authentication method is applicable to the scenario of logging in to an account in an application and on a web page on a terminal.

[41] Fig. 2 is a flow chart illustrating a method for authenticating a person according to some embodiments of the present invention. The embodiments of the present invention are described using the example of a method applicable to a terminal that has image collection and processing functions. This method includes performing the steps described below.

[42] At step S201, information indicating the need to convert the password in response to the identity verification command is displayed.

[43] The password conversion instruction information is defined as an instruction to convert password characters in the original password into gestures, wherein different password characters correspond to different gestures, and the password character conversion mode displayed by the password conversion instruction information is generated arbitrarily.

[44] In some embodiments of the present invention, the identity authentication requires obtaining two authentication factors, such as a password and facial features of the user. Facial identification is used in embodiments of the claimed invention to simplify the process of authenticating the user's identity, i.e., entering the two authentication factors is carried out by performing only one operation. The terminal provides an arbitrary password character conversion mode to prevent the original password from being hacked. In response to a command to verify the identity, the terminal provides the user with a password character conversion mode by displaying information indicating the need to convert the password. The user must convert the original password of his account into an instant gesture sequence based on the password character conversion mode provided by the terminal, and then perform the gesture sequence to enter it through the terminal camera. The password character conversion mode is randomly generated and is an unfixed conversion mode, due to which the password character conversion mode cannot be hacked by third parties.

[45] In some embodiments of the present invention, the password character conversion mode provides mutual conversion of characters and gestures and relates characters to gestures that can be performed by the user. For example, characters include numbers, letters, punctuation marks, special characters, etc., and gestures include various facial expressions, head movements, combined head and hand movements, etc., which is not limiting in embodiments of the claimed invention.

[46] In step S202, facial feature data is obtained by extracting facial features from identity verification images collected by the camera.

[47] After displaying the information indicating that the password needs to be converted, the terminal turns on the camera and uses the camera to collect data in the form of images such as videos or photographs. After collecting the identity verification images, the terminal obtains the user's facial features by extracting the facial features from the identity verification images.

[48] In some embodiments of the present invention, it is provided that after receiving an identity verification command, the terminal automatically turns on the camera to collect an image for identity verification. Alternatively, the terminal displays information indicating the need to convert a password and turns on the camera after receiving a password input confirmation operation (for example, a start operation using the face identification control) to collect images. The terminal turns off the camera to complete the image collection if the camera operation duration reaches a threshold. Alternatively, the terminal turns off the camera upon receiving a password input completion operation (for example, a start operation using the information input completion control). Alternatively, the terminal identifies the collected images for identity verification in real time and automatically turns off the camera if the face is not detected or the user's gesture in the images does not change within a predetermined period of time, which is not limiting in the embodiments of the present invention.

[49] In some embodiments of the present invention, the terminal comprises a facial feature extraction module, and the terminal inputs identity verification images to the facial feature extraction module to obtain facial feature data.

[50] In some embodiments of the present invention, the identity verification images are images captured by the terminal using a camera, or video frames extracted by the terminal from video captured by the camera.

[51] In step S203, a sequence of gestures is obtained by detecting activity in images for identity verification.

[52] After receiving the identity verification images, the terminal further performs activity detection on the identity verification images, receives the user's gestures, and determines the sequence of gestures in chronological order.

[53] In some embodiments of the present invention, the terminal comprises a living body detection module, and the terminal inputs images for identity verification to the detection module and obtains a gesture sequence by identifying the gestures in the images.

[54] In some embodiments of the present invention, the terminal inputs all collected images for identity verification into the facial feature extraction module and the live user detection module. Alternatively, the terminal selects suitable images, such as clear images containing complete faces, from the collected images for identity verification based on the image collection standard of the face recognition system, and inputs the selected images into the facial feature extraction module and the live user detection module, which improves the efficiency and accuracy of identity verification.

[55] It should be noted that Fig. 2 shows only one of the possible algorithms for implementing the proposed method, and steps S202 and S203 are not limited to a strict sequence of their execution, and in an alternative embodiment, the terminal can perform step S203 before step S202 or perform steps S202 and S203 simultaneously.

[56] In step S204, an initial password is obtained by converting the password from a sequence of gestures.

[57] After receiving the gesture sequence, the terminal performs a reverse transformation of the gesture sequence (i.e., recovers the password by determining which word or words were transformed using the password character transformation mode to obtain the above gesture sequence) based on the password character transformation mode used in the current identity authentication, thereby obtaining the original password.

[58] For example, in the mode of converting symbols of a password generated arbitrarily by the terminal, the symbol “1” corresponds to the gesture “Turn head left”. Upon detecting the gesture “Turn head left” in the sequence of gestures, the terminal determines that the symbol corresponding to this gesture is the symbol “1”.

[59] In step S205, identity authentication is performed based on the initial password and the facial feature data.

[60] The terminal performs identity authentication based on two authentication factors, such as the original password and facial feature data. The terminal confirms the success of identity authentication only if the original password obtained by “translating” it matches the registered password corresponding to the account, and the facial feature data matches the registered facial feature data corresponding to the account. If any of these factors do not match, identity authentication will fail.

[61] In some embodiments of the present invention, it is provided that after receiving the initial password and the facial feature data, the terminal performs identity authentication locally. In an alternative embodiment, the terminal transmits the initial password and the facial feature data to the cloud, after which the cloud server performs identity authentication and transmits the result of this authentication back.

[62] To summarize the above, the embodiments of the present invention propose a personal authentication mechanism based on two authentication factors, i.e., a password and the user's facial features, by which the user can enter a password and identify the face by entering a gesture once. Thus, the process of personal authentication is simplified and the efficiency of personal authentication is increased. By using a randomly generated password character conversion mode, the user enters an arbitrary sequence of gestures obtained by converting the original password, thereby preventing the possibility of hacking the user's original password at the input stage, and the instant password obtained on the basis of the correct original password allows successful authentication, protecting the face identification from attacks using fake facial features and further increasing the security and accuracy of personal authentication.

[63] In some embodiments of the present invention, the terminal determines a password character conversion mode based on an arbitrary correspondence function and displays the password character conversion mode using a virtual keyboard. Fig. 3 is a flow chart illustrating a method for authenticating a person according to some embodiments of the present invention. These embodiments are described using an example of a method applicable to a terminal that has a function for collecting and processing images. The proposed method involves performing the steps described below.

[64] At step S301, a random matching target function is generated in response to the identity verification command.

[65] An arbitrary mapping function is a function generated with the ability to map symbols to gestures in an arbitrary way.

[66] In some embodiments of the present invention, it is provided that the types of gestures are pre-stored in the terminal, and the terminal randomly generates a random correspondence target function at each identity authentication to set a corresponding relationship between password characters and gestures. The number of types of gestures is greater than or equal to the number of types of password characters.

[67] For example, the characters that define the password are the digits 0 through 9, and the terminal generates a random matching function (Hrand(x)=FaceExp) as follows:

[68] H _rand (1)=LV, H _rand (2)=RV, H _rand (3)=UP, H _rand (4)=RT, H _rand (5)=LT, H _rand (6)=DW, H _rand (7)=LW, H _rand (8)=RW, H _rand (9)=CE, and H _rand (0)=SM.

[69] In the arbitrary correspondence function, the value of X corresponds to the character, the value of FaceExp corresponds to the gesture identifier, and the corresponding relationships between the identifier and the gesture are shown in Table 1:

[70] In step S302, a virtual keyboard is displayed based on the arbitrary matching target function, and information indicating the need to convert the password corresponding to the arbitrary matching target function is displayed on the virtual keyboard.

[71] The terminal displays information indicating the need to convert the password on the interface in the form of a virtual keyboard, with the password conversion block displayed on the same key of the virtual keyboard. The user first searches the virtual keyboard for the characters contained in the original password, then determines the sequence of gestures required for input using the password conversion blocks, and then makes the corresponding gestures.

[72] In some embodiments of the present invention, step S302 includes the sub-steps described below.

[73] In the sub-step S302a, a password conversion unit is determined based on the arbitrary correspondence target function, wherein the password conversion unit includes a password character and a gesture corresponding to the password character in the arbitrary correspondence target function.

[74] The terminal determines password transformation blocks, each of which includes a password character and a gesture, based on the arbitrary correspondence objective function. The user transforms the original password into a sequence of gestures based on the password characters in the original password and the password transformation blocks displayed by the terminal.

[75] Based on the example of step S301, the terminal determines that the password conversion blocks include: (1, LV), (2, RV), (3, UP), (4, DW), (5, LT), (6, RT), (7, LW), (8, RW), (9, CE), and (0, SM).

[76] In some embodiments of the present invention, the password conversion unit includes a password symbol and a plurality of gestures.

[77] In sub-step S302b, the password conversion block is displayed on the virtual keyboard based on a first display mode corresponding to the password character and a second display mode corresponding to the gesture identifier, wherein the first display mode is different from the second display mode.

[78] In some embodiments of the present invention, the terminal displays a password symbol and a gesture identifier in two different display modes, respectively, so as to distinguish between the password symbol and the gesture identifier on the common key and to avoid a long time for the user to identify the symbol and the identifier in the case where the password symbol and the gesture identifier are displayed in the same display mode. The first display mode differs from the second display mode in at least one of the following parameters:

[79] There are differences in the type between the password symbol and the gesture identifier symbol; there are differences in the display color between the password symbol and the gesture identifier; there are differences in the display font between the password symbol and the gesture identifier; there are differences in the display font size between the password symbol and the gesture identifier; or there are differences in the special display effects between the password symbol and the gesture identifier.

[80] For example, Fig. 4 shows a schematic representation of a virtual keyboard. The virtual keyboard contains 10 keys, each of which displays a password conversion block. In each password conversion block, the password symbol is displayed on the left, and the gesture identifier is displayed on the right. On the virtual keyboard, in contrast to the password symbols, the gesture identifiers are additionally provided with two special effects in the form of bolding and underlining. In particular, the gesture identifiers may differ from the password symbols in color. For example, the password symbols may be black, and the gesture identifiers red.

[81] In some embodiments of the present invention, the password characters and gesture identifiers are displayed on the virtual keyboard simultaneously, and sub-step S302b, in particular, provides for performing the operations described below.

[82] Operation S1: determining the first display position of the password symbol on the virtual keyboard.

[83] Operation S2: displaying a password conversion block corresponding to each character of the password on the virtual keyboard in accordance with the first display position based on the first display mode and the second display mode.

[84] In some embodiments of the present invention, the display position of the password symbol on the virtual keyboard is fixed, and the terminal first determines a first display position of the password symbol on the virtual keyboard, and then displays the password symbol at the first display position.

[85] For example, in the virtual keyboard shown in Fig. 4, the password characters are displayed as digits from 1 to 0 each time, moving from top to bottom and left to right. First, the terminal determines the first positions of 10 password characters on the keyboard in the order of their sequence, and then displays 10 password conversion blocks corresponding to the 10 password characters at the corresponding first display positions. For example, the password conversion block (1, LV) corresponding to the digit 1 is displayed on the key in the upper left corner, and the password conversion block (2, RV) corresponding to the digit 2 is displayed on the keyboard in the middle of the first row.

[86] Since the user constantly needs to monitor, think about, and perform the processes of recovering the original password, searching for the display position of each password character in the original password, determining the gesture corresponding to each password character, etc., in the case where the terminal simultaneously displays the password characters and gesture identifiers, a plurality of characters are displayed on the virtual keys, which causes confusion. In some embodiments of the present invention, the terminal first displays only the password characters on the virtual keyboard, and then displays the gesture identifiers after the user confirms that the password conversion can be started. Sub-step S302b further includes the operations described below.

[87] Operation S3: displaying a password character on the virtual keyboard based on a first display position of the password character on the virtual keyboard and a first display mode.

[88] Similarly, the terminal displays the password characters in the first positions on the virtual keyboard in the default order, allowing the user to quickly determine the display position of each password character in the original password according to the familiar position, making it as easy as possible to subsequently determine the gesture sequence.

[89] Operation S4: determining a second display position of the gesture identifier on the virtual keyboard based on the password character corresponding to this gesture identifier in the password conversion unit, in accordance with the conversion mode display operation.

[90] When the user is ready to convert the password, a conversion mode display operation is performed, allowing the terminal to display the gesture identifier on the virtual keyboard and display the password conversion block.

[91] In some embodiments of the present invention, the operation of displaying the conversion mode is an operation of starting by means of a conversion confirmation control or a voice command for converting a password entered by the user, which is not limiting in the embodiments of the present invention.

[92] After receiving the display operation of the conversion mode, the terminal determines a second display position of each gesture identifier based on a password character corresponding to the gesture identifier in the password conversion unit and a first display position of the password character.

[93] For example, when using the virtual keyboard shown in Fig. 4, the terminal first displays a digit on the left side of each key and then displays a gesture identifier on the right side thereof upon receiving a display operation of the conversion mode.

[94] Operation S5: displaying the gesture identifier on the virtual keyboard according to the second display position based on the second display mode.

[95] After determining the second display positions of all gesture identifiers, the terminal displays the gesture identifiers on the virtual keyboard, allowing the user to determine the instantaneous gesture sequence.

[96] When performing all of the above operations, a virtual keyboard is displayed that fixes the display positions of the password characters. In other words, the display positions of the password conversion blocks are determined based on the first display positions of the password characters, and the first display positions are fixed positions, which facilitates the user to quickly determine the gesture sequence based on the familiar key positions. In practical use, the first display position may also be arbitrary.

[97] In step S303, facial feature data is obtained by extracting facial features from identity verification images collected by the camera.

[98] In step S304, a sequence of gestures is obtained by detecting activity in images for identity verification.

[99] For specific embodiments of steps S303-S304, refer to steps S202-S203, which are not described again in the embodiments of the present invention.

[100] In step S305, an initial password is obtained by converting the password from a sequence of gestures based on an arbitrary correspondence target function.

[101] After receiving a sequence of gestures based on images for identity verification, the terminal obtains a password symbol corresponding to each gesture by inversely transforming (restoring) each gesture in the gesture sequence based on the currently generated random correspondence target function, after which it determines the original password.

[102] For example, when using the password character conversion mode on the virtual keyboard shown in Fig. 4, it is provided that if the original password is written as "1234", the user will determine that the gesture sequence will be "Turn head left-turn head right-raise head-lower head", and will perform the sequence of these gestures. After receiving the gesture sequence "Turn head left-turn head right-raise head-lower head" by collecting and identifying images for identity verification, the terminal will conclude (based on the arbitrary correspondence target function) that the original password is the password "1234".

[103] In step S306, identity authentication is performed based on the initial password and the facial feature data.

[104] For specific embodiments of step S306, refer to step S205, which is not described again in the embodiments of the present invention.

[105] In embodiments of the present invention, the terminal generates an arbitrary correspondence target function, determines a password character conversion mode, and visually displays password conversion blocks specified by the arbitrary correspondence target function in the form of a virtual keyboard, so that the user can quickly and accurately convert the password, and the efficiency and accuracy of entering the password are improved.

[106] The embodiments of the present invention described above illustrate the processes of determining and displaying a password character conversion mode by the terminal and obtaining an initial password by the instantaneous gesture sequence conversion method by the terminal. In order to implement the identity authentication step, in particular, the terminal transmits the obtained initial password and facial feature data to the backend server, and the backend server determines the identity authentication result based on the database. Before performing the identity authentication step, the user first needs to input his/her facial features and the initial password to be stored on the backend server. Fig. 5 is a flow chart illustrating a method for identity authentication according to some embodiments of the present invention. These embodiments are described using an example of a method applicable to a terminal that has image collection and processing functions. The proposed method provides for performing the steps described below.

[107] In step S501, a set of gestures is displayed in response to a command to input facial features.

[108] The gesture set contains all the gestures needed to transform password characters.

[109] In some embodiments of the present invention, the user is required to input his/her facial features before activating the 2FA function. As in the identity authentication stage, the terminal arbitrarily converts the characters of the original password into any gestures in the gesture set, wherein the gestures vary when they are performed by other users, and then the terminal obtains images of all the user's gestures to improve the accuracy of gesture identification. The gestures represent facial expressions or head movements, and the terminal extracts facial features when the user performs the corresponding gesture. In response to the command to input facial features, the terminal displays the gesture set to facilitate the user to input gestures in a certain order.

[110] In step S502, target data of facial features corresponding to each gesture is obtained by extracting facial features from facial images collected by the camera.

[111] In the facial feature registration stage, the terminal obtains the target facial feature data for each gesture by extracting facial features from the collected facial images. Alternatively, the terminal directly transmits the collected facial images to the backend server, and the backend server performs facial feature extraction and stores the facial feature data.

[112] In step S503, the facial feature data and the account identifier are transmitted to the backend server.

[113] The backend server is configured to update a database that stores the relevant relationships between the account, the target initial password, and the target facial feature data.

[114] The terminal transmits the facial feature data and the account ID to the backend server, and the backend server stores the account ID together with the facial feature data in the database after receiving the facial feature data and the account ID. The database stores information such as the account ID, the facial feature data, and the initial password of each account, and this information is used to authenticate the identity based on the database and the received authentication information in the subsequent identity authentication stage.

[115] In addition, in the case of using the said 2FA mechanism, the user also needs to enter the initial password. The initial password is entered before collecting the target facial feature data or after collecting the target facial feature data, which is not limiting in the embodiments of the present invention.

[116] At step S504, information indicating the need to convert the password in response to the identity verification command is displayed.

[117] In step S505, facial feature data is obtained by extracting facial features from identity verification images collected by the camera.

[118] In step S506, a sequence of gestures is obtained by detecting activity in images for identity verification.

[119] In step S507, an initial password is obtained by converting the password from a sequence of gestures.

[120] For specific embodiments of steps S504-S507, refer to steps S201-S204, which are not described again in the embodiments of the present invention.

[121] At step S508, the initial password and facial feature data are transmitted to the backend server.

[122] The backend server is configured to perform identity authentication based on the initial password and facial features data.

[123] In some embodiments of the present invention, it is provided that after receiving the initial password entered by the person whose identity is to be authenticated and the facial feature data, the terminal simultaneously transmits two types of authentication information to the backend server, as a result of which the backend server simultaneously performs two types of authentication and determines the final result of the identity authentication based on the results of the two types of authentication. In an alternative embodiment, it is provided that after receiving the initial password entered by the person whose identity is to be authenticated and the facial feature data, the terminal first transmits one of the two types of authentication information to the backend server. If the backend server confirms that the authentication based on the two types of authentication information is successful, the terminal transmits the other type of information of the two types of authentication information to the backend server; and if the authentication of the first type of authentication information fails, the terminal directly confirms the failure of authentication without transmitting the second type of authentication information, thereby increasing the authentication efficiency while simultaneously improving the accuracy and security level of personal authentication.

[124] After receiving the initial password and the facial feature data, the terminal first determines one type of authentication information, and then transmits another type of authentication information if the authentication of the authentication information is successful. In some embodiments of the present invention, the terminal first transmits the initial password for its authentication, wherein step S508 includes the sub-steps described below.

[125] In sub-step S508a, the initial password and the account identifier of the current login account are transmitted to the backend server, wherein the backend server is configured to determine a first identity authentication result based on the target initial password corresponding to the current login account contained in the database.

[126] The terminal transmits the account identifier (such as the user name) of the current login account and the converted initial password to the backend server. Based on the received account identifier, the backend server searches the database to obtain a target initial password corresponding to the account identifier, and compares the target initial password with the initial password received from the terminal. If the target initial password is exactly the same as the initial password, the backend server confirms that the authentication has succeeded; and if the target initial password is not exactly the same as the initial password, the backend server confirms that the authentication has failed. The backend server transmits the first identity authentication result to the terminal.

[127] In sub-step S508b, the facial feature data is transmitted to the backend server upon receiving from the backend server a first identity authentication result indicating the success of the password authentication, wherein the backend server is configured to determine the second identity authentication result based on the target facial feature data corresponding to the current login account contained in the database.

[128] Upon receiving the first identity authentication result indicating that the password authentication is successful, the terminal transmits the facial feature data to the backend server. The backend server searches the database based on the account identifier to obtain the target facial feature data corresponding to the account identifier. The backend server determines the second identity authentication result by comparing the target facial feature data with the facial feature data of the person whose identity is to be authenticated received from the terminal.

[129] In some embodiments of the present invention, a threshold similarity value is set at the backend server. If the similarity value between the target facial feature data and the facial feature data of the person whose identity is to be authenticated received from the terminal exceeds the threshold similarity value, the backend server confirms that the face authentication has been successful; and if the similarity value between the target facial feature data and the facial feature data of the person whose identity is to be authenticated received from the terminal is less than the threshold similarity value, the backend server confirms that the face authentication has not been successful. The backend server transmits the second identity authentication result to the terminal.

[130] After performing sub-step S508a, the identity authentication method according to the embodiments of the present invention further comprises performing the following operation:

[131] determining the failure of the identity authentication and canceling the transmission of the facial features data upon receipt of the first identity authentication result from the backend server indicating the failure of the identity authentication.

[132] If the first result of the identity authentication indicates that the password authentication is unsuccessful, the terminal does not transmit the facial features data and directly confirms the final result as an authentication failure, thereby reducing the amount of transmitted data and improving the efficiency of identity authentication.

[133] In some embodiments of the present invention, the terminal first transmits facial feature data to authenticate the voice sample, and step S508 further includes the sub-steps described below.

[134] In sub-step S508c, the facial feature data and the account identifier of the current login account are transmitted to the backend server, wherein the backend server is configured to determine a third identity authentication result based on the facial feature data corresponding to the current login account contained in the database.

[135] The terminal transmits the account identifier (such as the user name) of the current login account and the extracted facial feature data to the backend server. The backend server searches the database based on the received account identifier to obtain the target facial feature data corresponding to the account identifier. The backend server determines the third identity authentication result by comparing the target facial feature data with the facial feature data of the person whose identity is to be authenticated obtained from the terminal.

[136] In step S508d, the initial password is transmitted to the backend server upon receiving a third identity authentication result from the backend server indicating that the person authentication has been successful, wherein the backend server is configured to determine a fourth identity authentication result based on the target initial password corresponding to the current login account contained in the database.

[137] Upon receiving the third identity authentication result indicating that the person authentication is successful, the terminal transmits the initial password to the backend server. The backend server searches the database based on the account ID to obtain the target initial password corresponding to the account ID, and compares the target initial password with the initial password received from the terminal. If the target initial password is exactly the same as the initial password, the backend server confirms that the password authentication is successful; and if the target initial password is not exactly the same as the initial password, the backend server confirms that the password authentication is unsuccessful. The backend server transmits the fourth identity authentication result to the terminal.

[138] After performing sub-step S508c, the identity authentication method according to the embodiments of the present invention further comprises performing the following operation:

[139] determining the failure of the identity authentication and canceling the transmission of the original password upon receipt of a third identity authentication result from the backend server indicating the failure of the identity authentication.

[140] In step S509, an identity authentication result is obtained from the backend server, and the identity authentication result is determined as a successful or unsuccessful authentication attempt.

[141] In the case where the terminal simultaneously transmits two types of authentication information, i.e., the facial feature data and the initial password, to the backend server, the terminal immediately determines the success or failure of the authentication based on the identity authentication result received from the backend server. In the case where the terminal first transmits one of the two types of authentication information, the failure of the identity authentication is immediately determined based on the fact of receiving the first identity authentication result or the third identity authentication result indicating the failure of the authentication, or the success or failure of the authentication is determined based on the second identity authentication result or the fourth identity authentication result.

[142] In the embodiments of the present invention, the terminal transmits an initial password and facial feature data to the backend server so that the backend server performs identity authentication based on the database, which improves the security and privacy of user information. In addition, the terminal first transmits one of the types of authentication information to the backend server; determines whether to transmit the second type of authentication information based on the authentication result of the first type of authentication information; and immediately determines the authentication result if the authentication of the first type of authentication information fails, thereby minimizing the amount of data transmission and data leakage, and improving the efficiency of identity authentication.

[143] In some embodiments of the present invention based on the embodiments described above, a method for performing a 2FA task by a terminal and a backend server is illustrated in Fig. 6. This method involves performing the steps described below.

[144] At step S601, the terminal displays a virtual keyboard based on the password character conversion mode.

[145] At step S602, the terminal collects facial images using the camera.

[146] In step S603, the terminal obtains facial feature data by extracting facial features from facial images and obtains an initial password corresponding to a gesture sequence by detecting the activity.

[147] At step S604, the terminal transmits the initial password, facial feature data, and account ID to the backend server.

[148] At step S605, the backend server performs identity authentication based on the facial feature data and the original password.

[149] At step S606, the backend server transmits the identity authentication result to the terminal.

[150] Fig. 7 is a block diagram of a device for authenticating a person according to some exemplary embodiments of the present invention. This device includes modules described below.

[151] The first display module 701 is configured to display information indicating the need to convert a password in response to a command to verify the identity, wherein the information indicating the need to convert a password is defined as an indication of the need to convert password characters in the original password into gestures, wherein different password characters correspond to different gestures, and the mode of converting password characters displayed by the information indicating the need to convert a password is generated arbitrarily.

[152] The first facial feature extraction module 702 is configured to obtain facial feature data by extracting facial features from identity verification images collected by a camera.

[153] The activity detection module 703 is configured to obtain a sequence of gestures by detecting activity in images for identity verification.

[154] The password conversion module 704 is configured to obtain an original password by converting the password from a sequence of gestures.

[155] The identity authentication module 705 is configured to perform identity authentication based on the initial password and facial feature data.

[156] In some embodiments of the present invention, the first display module 701 includes the blocks described below.

[157] The generating unit is configured to generate a random matching target function in response to a command to verify an identity, wherein the random matching function is a function generated with the capability of matching symbols with gestures in an arbitrary manner.

[158] The display unit is configured to display a virtual keyboard based on the arbitrary correspondence target function, wherein information indicating the need to convert a password corresponding to the arbitrary correspondence target function is displayed on the virtual keyboard.

[159] The password conversion module 704 includes the blocks described below.

[160] The conversion unit is configured to obtain the original password by converting the password into a sequence of gestures based on an arbitrary correspondence target function.

[161] In some embodiments of the present invention, the display unit is configured with the additional capability of:

[162] determining a password transformation unit based on a random matching target function, wherein the password transformation unit includes one of the password characters and a gesture corresponding to that one of the password characters in the random matching target function; and

[163] displaying a password conversion block on a virtual keyboard based on a first display mode corresponding to one of the password characters and a second display mode corresponding to a gesture identifier, wherein the first display mode is different from the second display mode.

[164] In some embodiments of the present invention, the display unit is configured to further:

[165] determining the first display position of one of the password symbols on the virtual keyboard; and

[166] displaying a password conversion block corresponding to one of the password characters on the virtual keyboard in accordance with the first display position based on the first display mode and the second display mode.

[167] In some embodiments of the present invention, the display unit is configured with the additional capability of:

[168] displaying one of the password characters on the virtual keyboard based on a first display position of one of the password characters on the virtual keyboard and a first display mode;

[169] determining - in response to receiving the operation of displaying the conversion mode - a second display position of the gesture identifier on the virtual keyboard based on one of the password characters corresponding to the gesture identifier in the password conversion block; and

[170] displaying the gesture identifier on the virtual keyboard in accordance with the second display position based on the second display mode.

[171] In some embodiments of the present invention, the first display mode differs from the second display mode in at least one of the following parameters:

[172] there are differences in type between one of the password characters and the gesture identifier character;

[173] There are differences in the display color between one of the password characters and the gesture identifier;

[174] there are differences in the display font between one of the password characters and the gesture identifier; and

[175] There are differences in the display font size between one of the password characters and the gesture identifier;

[176] There are differences in the special display effects between one of the password characters and the gesture identifier.

[177] In some embodiments of the present invention, the gesture includes a facial expression and a head movement.

[178] The proposed device additionally includes the modules described below.

[179] The second display module is configured to display a set of gestures in response to a command to input facial features, wherein the set of gestures comprises all gestures for converting password characters.

[180] The facial feature collection module is configured to obtain target data of facial features corresponding to each gesture by extracting facial features from facial images collected by the camera.

[181] The information transmission module is configured to transmit the target facial feature data and the account identifier to the backend server, wherein the backend server is configured to update a database that contains corresponding relationships between the account, the target initial password, and the target facial feature data.

[182] In some embodiments of the present invention, the identity authentication module 705 includes the units described below.

[183] The information transmission unit is configured to transmit the initial password and the facial features data to the backend server, wherein the backend server is configured to perform identity authentication based on the initial password and the facial features data.

[184] The information receiving unit is configured to receive the result of the identity authentication from the backend server, wherein the result of the identity authentication indicates the success or failure of the authentication attempt.

[185] In some embodiments of the present invention, the information transmission unit is configured with the additional capability of:

[186] transmitting an initial password and an account identifier of a current login account to a backend server, wherein the backend server is configured to determine a first identity authentication result based on a target initial password corresponding to the current login account contained in the database; and

[187] transmitting the facial feature data to the backend server upon receipt of a first identity authentication result from the backend server indicating successful password authentication, wherein the backend server is configured to determine a second identity authentication result based on the target facial feature data corresponding to the current login account contained in the database.

[188] The proposed device additionally includes the following module:

[189] a first determining module configured to determine the failure of the identity authentication and cancel the transmission of the facial features data upon receipt of a first identity authentication result from the backend server indicating the failure of the password authentication attempt.

[190] In some embodiments of the present invention, the information transmission unit is configured with the additional capability of:

[191] transmitting the facial feature data and the account identifier of the current login account to a backend server, wherein the backend server is configured to determine a third identity authentication result based on the target facial feature data corresponding to the current login account contained in the database; and

[192] transmitting the initial password to the backend server upon receipt of a third result of the personal authentication from the backend server indicating successful completion of the personal authentication, wherein the backend server is configured to determine a fourth result of the personal authentication based on the target initial password corresponding to the current login account contained in the database.

[193] The proposed device additionally includes the following module:

[194] A second determining module configured to determine the failure of the person authentication and cancel the transmission of the original password upon receipt of a third person authentication result from the backend server indicating the failure of the person authentication attempt.

[195] To summarize the above, the embodiments of the present invention provide a mechanism for personal authentication based on two factors, i.e., a password and the user's facial features, using which the user can simultaneously enter a password and perform personal authentication by entering a gesture only once. Thus, the process of personal authentication of the user is simplified and the efficiency of personal authentication is increased. Based on the randomly generated password character conversion mode, the user enters an arbitrary sequence of gestures obtained by converting the original password, so that the user's original password does not "leak" at the password entry stage, and the instant password obtained based on the correct original password allows successful authentication, protecting the process of personal identification from attacks using fake facial features and further increasing the security level and accuracy of personal authentication.

[196] Some embodiments of the present invention further provide a terminal. The terminal includes a processor and a memory, wherein at least one instruction, at least one program, a set of codes, or a set of commands is stored in the memory, and when the at least one instruction, at least one program, a set of codes, or a set of commands is loaded and executed, the processor initiates the implementation of a method for authenticating a person applicable to the terminal, as defined in the above-described embodiments of the present invention.

[197] Embodiments of the present invention further provide a machine-readable data carrier on which at least one instruction is stored, wherein the at least one instruction, when loaded and executed by a processor, initiates the implementation by that processor of a method for authenticating a person according to the embodiments of the claimed invention described above.

[198] According to one aspect of the present invention, a computer program product or a computer program is provided. This computer program product or computer program comprises machine instructions that are stored on a machine-readable storage medium. A terminal processor reads the machine instructions from the machine-readable storage medium, and when the processor executes the machine instructions, the processor initiates the terminal to implement a method for authenticating a person according to various embodiments of the said aspect of the claimed invention.

[199] Those skilled in the art will appreciate that in one or more embodiments of the present invention, the functions described within the disclosure of embodiments of the claimed invention may be implemented as hardware, software, firmware, or any combination thereof. Functions implemented as software may be stored on a computer-readable storage medium or transmitted over as one or more instructions or codes on a computer-readable storage medium. A computer-readable storage medium includes a computer storage medium and a communication medium, where the communication medium includes any medium that facilitates transfer of a computer program from one place to another. The storage medium may be any available storage medium that can be accessed by a general-purpose computer or a special-purpose computer.

[200] It should be noted that the information (including but not limited to the user's device information, the user's personal information, and the like), data (including but not limited to the analysis data, stored data, displayed data, and the like), and signals mentioned in this document must be authorized by the user or fully authorized by various third parties, and the collection, use, and processing of the relevant data must comply with the applicable laws and regulations and standards in the relevant countries and regions. For example, the acquisition of account IDs, initial passwords, facial feature data, and all other similar data involved in the present invention is carried out only under proper authorization.

[201] The above are described only as optional embodiments of the present invention, which in no way limit the claimed invention. Any modifications, equivalent replacements and improvements and other changes made within the scope of the essence and principle of the present invention must be included in the scope of legal protection of the claimed invention.

Claims (48)

1. A method of personal authentication that includes: generating a random matching target function in response to a command to verify the identity, wherein the random matching target function is a function generated with the ability to match symbols with gestures in an arbitrary manner; displaying a virtual keyboard based on an arbitrary correspondence target function, wherein information indicating the need for converting a password is displayed on the virtual keyboard, which corresponds to an arbitrary correspondence target function and which is determined as an indication of the need to convert password characters in the original password into gestures, wherein different password characters correspond to different gestures, the password character conversion mode displayed by the information indicating the need for converting a password is generated in an arbitrary manner, and the password characters include at least one type of digits, letters, punctuation marks and special characters; wherein displaying a virtual keyboard based on an arbitrary correspondence target function comprises: determining a password conversion unit based on an arbitrary correspondence target function, wherein the password conversion unit includes one of the password characters and a gesture corresponding to one of the password characters in the arbitrary correspondence target function; and displaying the password conversion unit on the virtual keyboard based on a first display mode corresponding to one of the password characters and a second display mode corresponding to a gesture identifier, wherein the first display mode is different from the second display mode; obtaining facial feature data by extracting facial features from identity verification images collected by the camera; obtaining a sequence of gestures by detecting activity in images for identity verification; obtaining the original password by transforming the password from the gesture sequence based on the arbitrary correspondence target function; and Performing identity authentication based on the original password and facial features data. 2. The method according to claim 1, wherein the display of the password conversion block on the virtual keyboard based on the first display mode corresponding to one of the password symbols and the second display mode corresponding to the gesture identifier, provides for: determining the first display position of one of the password symbols on the virtual keyboard; and displaying a password conversion block corresponding to each of the password characters on a virtual keyboard in accordance with a first display position based on a first display mode and a second display mode. 3. The method according to claim 1, wherein the display of the password conversion block on the virtual keyboard based on the first display mode corresponding to one of the password symbols and the second display mode corresponding to the gesture identifier, provides for: displaying one of the password characters on the virtual keyboard based on the first display position of one of the password characters on the virtual keyboard and the first display mode; determining, in response to the operation of displaying the conversion mode, a second display position of the gesture identifier on the virtual keyboard based on one of the password symbols corresponding to the gesture identifier in the password conversion block; and displaying a gesture identifier on the virtual keyboard according to the second display position based on the second display mode. 4. The method according to claim 1, wherein the first display mode differs from the second display mode by at least one of the following parameters: there are differences in type between one of the password characters and the gesture identifier character; there are differences in the display color between one of the password characters and the gesture identifier; there are differences in the display font between one of the password characters and the gesture identifier; there is a difference in the display font size between one of the password characters and the gesture identifier; or There are differences in the special display effects between one of the password characters and the gesture identifier. 5. The method according to any one of paragraphs 1-4, in which a gesture includes facial expression and head movement, and Before displaying the virtual keyboard based on the arbitrary correspondence target function, the proposed method provides for: displaying a set of gestures in response to a command to enter facial features, wherein the set of gestures contains all the gestures for converting password characters; obtaining target facial feature data corresponding to each gesture by extracting facial features from facial images collected by the camera; and transmitting the target facial feature data and the account identifier to a backend server, wherein the backend server is configured to update a database that contains corresponding relationships between the account, the target initial password, and the target facial feature data. 6. The method according to paragraph 5, wherein the implementation of authentication of the individual based on the initial password and data on facial features includes: transmitting the initial password and the facial feature data to a backend server, wherein the backend server is configured to perform identity authentication based on the initial password and the facial feature data; and receiving an identity authentication result from the backend server, wherein the identity authentication result indicates the success or failure of the authentication attempt. 7. The method according to item 6, in which Transferring the original password and facial features data to the backend server involves: transmitting an initial password and an account identifier of a current login account to a backend server, wherein the backend server is configured to determine a first identity authentication result based on a target initial password corresponding to the current login account contained in the database; and transmitting the facial feature data to the backend server upon receipt of a first identity authentication result from the backend server indicating successful password authentication, wherein the backend server is configured to determine a second identity authentication result based on the target facial feature data corresponding to the current login account contained in the database; and the proposed method further comprises determining the failure of the identity authentication and canceling the transmission of facial features data upon receipt of the first identity authentication result from the backend server indicating the failure of the password authentication attempt. 8. The method according to item 6, in which Transferring the original password and facial features data to the backend server involves: transmitting the facial feature data and the account identifier of the current login account to a backend server, wherein the backend server is configured to determine a third identity authentication result based on the target facial feature data corresponding to the current login account contained in the database; and transmitting the initial password to the backend server upon receipt of a third result of the personal authentication from the backend server indicating the successful completion of the personal authentication, wherein the backend server is configured to determine the fourth result of the personal authentication based on the target initial password corresponding to the current login account contained in the database; and The proposed method additionally provides determining the failure of the identity authentication and canceling the transmission of the original password upon receipt of a third identity authentication result from the backend server indicating the failure of the attempt to authenticate the person. 9. A device for personal authentication, comprising: a first display module configured to generate an arbitrary correspondence target function in response to a command to verify the identity, wherein the arbitrary correspondence target function is a function generated with the ability to associate characters with gestures in an arbitrary manner; and displaying a virtual keyboard based on the arbitrary correspondence target function, wherein information indicating the need to convert a password is displayed on the virtual keyboard, which corresponds to the arbitrary correspondence target function and which is determined as an indication of the need to convert password characters in the original password into gestures, wherein different password characters correspond to different gestures, the password character conversion mode displayed by the information indicating the need to convert a password is generated in an arbitrary manner, and the password characters include at least one type of digits, letters, punctuation marks and special characters; wherein the first display module is configured with the additional capability of: determining a password conversion unit based on the arbitrary correspondence target function, wherein the password conversion unit includes one of the password characters and a gesture corresponding to one of the password characters in the arbitrary correspondence target function; and displaying a password conversion block on a virtual keyboard based on a first display mode corresponding to one of the password characters and a second display mode corresponding to the gesture identifier, wherein the first display mode is different from the second display mode; a first facial feature extraction module configured to obtain facial feature data by extracting facial features from identity verification images collected by a camera; an activity detection module configured to obtain a sequence of gestures by detecting activity in images for identity verification; a password conversion module configured to obtain an original password by converting a password from a sequence of gestures based on an arbitrary correspondence target function; and a personality authentication module configured to perform personality authentication based on an initial password and facial feature data. 10. A terminal for personal authentication, comprising a processor and a memory, wherein at least one command, at least one program, set of codes or set of commands is stored in the memory, and when loading and executing at least one command, at least one program, set of codes or set of commands, the implementation of the personal authentication method according to any of paragraphs 1-8 is initiated by the processor. 11. A machine-readable data carrier on which at least one computer program is stored, wherein this computer program, when loaded and executed by a processor, initiates the implementation by this processor of the method for authenticating a person according to any of paragraphs 1-8.