CN102215223A - Fuzzy strong box remote identity authentication method based on face feature - Google Patents

Abstract

The invention discloses a fuzzy strong box remote identity authentication method based on a face feature. The method comprises: fuzzy strong box data is generated according to a human feature and a user password, wherein the fuzzy strong box data comprises a human feature value and key information; the fuzzy strong box data is stored into a server; a client obtains a user face image and a password when a user registers, and encrypts the obtained face feature to generate fuzzy strong box data, and sends the data to a database server; the database server obtains a user registration key and a user login key by computing the fuzzy strong box data, and compares the user login key with the registration key; if the user login key is the same as the registration key, the database server regards that the user can log in the system; and the user can select different passwords to protect the human feature, therefore, the cross-database search can be effectively prevented, the safety and privacy of the method can be effectively guaranteed, and the fuzzy strong box remote identity authentication method has application value.

Description

A kind of fuzzy safety box long-distance identity-certifying method based on face characteristic

Technical field

The present invention is a kind of based on the real name identity identifying method and the system of encrypting people's face, belongs to information security field.

Background technology

Along with community networkization and informationalized development, people have faced a very general problem, and how quicker, convenient, safe that be exactly the authentication of carrying out.Authentication occupies extremely important status in safety system, be the most basic security service, and other security service all will depend on it.In case identity authorization system is broken, all safety measures of other of system all will perform practically no function so.And the target of assault often is exactly an identity authorization system.Therefore to accelerate the construction of information security, add strong identity authentication research theoretical and that use and just seem more important.In addition, after the super-ordinate right user except the hacker (such as the keeper) login system, can revise the sensitive data of domestic consumer easily, and the system that declares has been subjected to assault.

Existing identity identifying method mainly contains following three classes:

One, learns identity identifying method based on conventional cipher

Conventional cipher method is maintained secrecy to user's content by encryption key.This method requires the user to input specific password.If adopt the simple identity identifying technology based on password, when user cipher is stolen or loses, authentication does not just have safety and can not say.Encryption key all is made up of the long Bit String that generates at random usually, in case key is lost, the user can reset to key easily.Yet for the user, the key of Sheng Chenging is difficult to remember at random;

Two, based on the identity identifying method of biological characteristic

Based on the identity identifying method of biological characteristic, i.e. method by using features such as biological fingerprint, iris, palmmprint, people's face to carry out authentication.The benefit of these class methods is, need not the user remember anything, only need provide own biological characteristic to use conveniently by authentication, and uniqueness is good, and is not easy to be stolen.Along with the biological characteristic authentication broad application, the fail safe of biological characteristic and privacy problem highlight.At first biological characteristic belongs to individual privacy, if stolen individual privacy just is exposed.Secondly, biological characteristic has very strong uniqueness, is example with the fingerprint characteristic, and everyone fingerprint characteristic all is different, even if same individual's difference finger, fingerprint is also inequality.The user changes new password and gets final product after the password loss, and the identity information that is equivalent to the people after biological characteristic is stolen is stolen, and finger can't be changed, and promptly fingerprint characteristic can not change, and therefore says that biological characteristic does not have defeasibility.

Three, the identity identifying method of encrypting based on biological characteristic

Advantage inferior position at conventional cipher and biometric authentication method, people expect if biological characteristic and user cipher can be combined, even if the user is with password loss so, if the assailant can not provide correct biological attribute data, then authentication is same just can not be successful.A kind of identity authorization system of encrypting at orderly biological characteristic arises at the historic moment.Advantages such as the existing traditional living things feature recognition of this method is convenient for carrying, uniqueness is good can effectively be protected user's primitive organism template again.

How research protects the primitive organism feature templates; purpose is both can use biological character for identity authentication; can guarantee the fail safe and the privacy of this biological characteristic again; in a single day while is stolen through the biological characteristic of overprotection; people can cancel it easily, change it and get final product for the new biological characteristic through overprotection.

Typical biometric templates guard method roughly is divided into two classes: based on the method for conversion and the method that combines with cryptography.The former through stochastic transformation, is transformed to the primitive organism feature one group of new feature and is used for authentication; The latter combines biological characteristic with cryptography, comprise Binding key and generate key two classes, in the key generative process, can directly utilize biological characteristic to generate, and be applied in the authentication process.The cryptographic binding process is with biological characteristic and key bindings together, and both hide mutually, thereby reaches the purpose of protection biological template.Canonical biometric template protection method has fuzzy safety box and fuzzy extraction etc.

Fuzzy safety box is to share method by the secret based on polynomial interopolation that Juels and Sudan proposes, its main thought be at first with the user key Information hiding in polynomial coefficient, each characteristic value with the user biological feature projects on the multinomial afterwards, obtain the projection value of multinomial correspondence, under cover user key and user biological characteristic information in these projection values are called the help data.Generate a large amount of interfering datas, will help data hidden in interfering data, generate fuzzy safety box.When the user carries out authentication, need from fuzzy safety box, extract the help data according to the biological characteristic that the user provides, by helping data to reconstruct multinomial, from polynomial coefficient, extract user key at last and carry out authentication again.The multinomial that uses in fuzzy safety box method is rebuild in the principle, can rebuild the P order polynomial by P+1 help data, and the multinomial process of reconstruction does not require that feature has order.When fingerprint is described, usually to use the minutia of fingerprint, be typically not have sequence characteristics.Fuzzy safety box at first is to be applied in the protection of fingerprint biometric templates by people such as Clancy as a kind of encryption method, and a lot of afterwards people improve this algorithm.Because help still to comprise the primitive organism characteristic information in the data, therefore, there is following problem in this scheme:

1) when confirming successfully, the primitive organism feature templates is exposed, and is abnormally dangerous;

2) this method does not have above-mentioned diversity and defeasibility feature;

3) fail safe of the non-uniform Distribution characteristic of the primitive organism feature method that may be descends.

Have the people that fuzzy safety box is used for face characteristic, but effect is not fine yet.We feel to have following aspect to analyze its reason:

1) fingerprint recognition is typically not have sequence characteristics;

2) fingerprint characteristic change in the class comparatively speaking less, so can tolerate after feature quantized in to a certain degree the class and change;

3) uniqueness is better between each component of detail characteristics of fingerprints, the phenomenon of the cross-matched between each component generally can not occur.Comparatively speaking, face characteristic has been generally sequence characteristics, and such scheme does not make full use of the order of face characteristic;

4) variation is bigger in the class of face characteristic, and the quantification progression of a fixed step size is difficult to change in the tolerance class; A lot of face characteristics such as PCA, LDA etc. are made up of the scalar that some distribute within the specific limits, and being easy to of these scalars is identical, and therefore, the uniqueness between each component of feature is bad, is easy to occur cross-matched between each component.

In this simultaneously, the fast development of ecommerce is also had higher requirement to the security performance of online authentication.Based on above-mentioned some reason, we have proposed the fuzzy safety box long-distance identity-certifying method based on face characteristic, and are applied to the online identity authentication.This method can guarantor's face biological characteristic defeasibility and fail safe, and can guarantee certain authentication performance, and can generate multiple biometric templates that promptly this method has diversity according to different keys.

Summary of the invention

We have proposed a kind of fuzzy safety box scheme based on orderly people's face biometric characteristic, and are applied in the online identity verification process.Experiment showed, diversity, defeasibility and fail safe that this scheme can guarantor's face biological characteristic, and can guarantee certain authentication performance.

According to the curstomer-oriented end/server architecture structure of common identity authorization system, we are divided into two stages with the fuzzy safety box certificate scheme of face characteristic: registration phase and authentication phase.

At registration phase, the user provides user name, three kinds of information of password and facial image.Client computer is done several things:

A kind of fuzzy safety box long-distance identity-certifying method based on face characteristic, it is characterized in that: this method comprises the steps:

1.1 being carried out feature extraction, facial image obtains orderly face characteristic sequence;

1.2 generate a plurality of biological Hash sequences: the password by user's input produces a series of pseudo random numbers as random seed, and the array that obtains is carried out binaryzation, generates character string sequence, promptly generates biological Hash sequence;

1.3 fuzzy in order safety box coding:

1.3.1) generator polynomial: the password by user's input generates key, and key is cut apart as polynomial coefficient to be generated; The biological Hash sequence that step 1.2 is obtained is updated to the functional value of trying to achieve correspondence in the multinomial successively, and store, the result exists among the two-dimensional array G, this two-dimensional array is called the help data, the biological cryptographic Hash of the first row representative, secondary series is represented the projection sequence after biological Hash sequence projects to multinomial;

1.3.2) in helping data, interleave many group interfering datas, finally form fuzzy safety box; So far, 1.1-1.3 has finished the cataloged procedure of fuzzy safety box;

1.4. client computer is user name the most at last, three kinds of data of key and fuzzy safety box are sent in the server stores;

In authentication phase, the user still provides user name, password and facial image; Step is as follows:

2.1 extraction face characteristic: client computer carries out feature extraction to facial image, obtains orderly face characteristic value;

2.2 generate biological Hash sequence: as random seed, generate a plurality of biological Hash sequences by password, user name and biological Hash sequence are sent to server by face characteristic;

2.3 fuzzy safety box decoding: the user name that server provides according to client, extract corresponding password and fuzzy safety box; And carry out fuzzy in order safety box by the biological Hash sequence that fuzzy safety box and client provide and decode, generate corresponding key;

2.4 coupling: if the key agreement of preserving on key that generates and the server, then by authentication, otherwise authentification failure.

The beneficial effect of this programme is as follows:

1) has defeasibility

Face characteristic is obtained biological Hash sequence by shining upon at random, what server was finally stored is the help data that face characteristic obtains through stochastic transformation, help to comprise people's face information and user's password information in the data, complex structure, it is not direct facial image, thereby guaranteed secure user data, the production method of biological Hash sequence can have multiple, in the production process, as long as choose different parameters, will draw diverse result, this just provides defeasibility for algorithm, after promptly the face template of storing in the server is lost, if register again, only need to change the parameter in the Hash procedure, can obtain different face templates, thereby provide defeasibility for algorithm;

2) greatly reduce the FAR accuracy of system identification

We have proposed to blur the safety box coding and decoding scheme in order, have made full use of the order of face characteristic, have avoided the aliasing coupling of different characteristic, greatly reduce the FAR accuracy of system identification, and promptly nonregistered user is by authentication; By orderly insertion real replica, dwindle the scope of searching registration, will increase the success rate of registration greatly.

3) guaranteed the fail safe of system

Because the front has adopted the method for biological Hash that face characteristic is transformed to random sequence, therefore, the orderly insertion noise spot in fuzzy safety box generative process is little to the influence of security performance.Correctly obtaining 9 help data theoretically can be by authentication.Suppose that the assailant knows that our rule is that insertion noise spot number is 20 in each group help data, obtain B biological Hash sequence by A primitive man's face PCA feature, under the situation without any priori, the assailant need find a real help data computation amount to be from per 20 random numbers

Find 9 real help data can be by authentication, the minimum needs calculates Plant combination.The cost of doing like this is sizable.Can reach a conclusion thus, the fail safe of system is improved

Though this paper scheme is based on orderly people's face biological characteristic proposition, it is equally applicable to all orderly biological characteristics, in the process of using, as long as face characteristic is replaced to other orderly biological characteristic, as standardized and orderly iris feature, MB-LBP feature, PCA etc.Mapping method at random in the mathematics is used to generate biological Hash sequence, has guaranteed the variation and the defeasibility of scheme.In order fuzzy safety box Code And Decode has made full use of the order of face characteristic, has improved the algorithm authentication performance simultaneously.

Description of drawings

Fig. 1 is the algorithm frame of overall plan

Embodiment

The scheme that we propose adopts people's face Hash to realize the randomization of face characteristic; Further, propose in order fuzzy safety box coding and decoding scheme, this scheme has made full use of the order of people's face biometric characteristic.Concrete scheme as shown in Figure 1.

Scheme curstomer-oriented end/server architecture comprises registration and authenticates two stages.

1.1 being carried out feature extraction, facial image obtains orderly face characteristic sequence;

1.2 generate a plurality of biological Hash sequences: the password by user's input produces a series of pseudo random numbers and forms matrix Q according to particular order as random seed, face characteristic is done mapping at random, being about to face characteristic sequence and matrix Q multiplies each other, the array that obtains is carried out binaryzation give birth to, become character string sequence (promptly generating biological Hash sequence);

1.3 fuzzy in order safety box coding:

1.3.1 generator polynomial: the password by user's input passes through Hash and carries out CRC cyclic redundancy check (CRC) code generation key, and key is cut apart, and produces one group of decimal number, as polynomial coefficient to be generated.The 1.2 biological Hash sequences that obtain are updated to successively the functional value of trying to achieve correspondence in the multinomial, and store, the result exists among the two-dimensional array G, this two-dimensional array is called the help data, the biological cryptographic Hash of the first row representative, secondary series is represented the projection value after biological cryptographic Hash projects to multinomial.

1.3.2 insert many group interfering datas at each interline, the fuzzy safety box of final formation.So far, 1.1-1.3 has finished the cataloged procedure of fuzzy safety box.

1.4. client computer is user name the most at last, three kinds of data of key and fuzzy safety box are sent in the server stores.

In authentication phase, the user still provides user name, password and facial image.Step is as follows:

2.1 extraction face characteristic: client computer carries out feature extraction to facial image, obtains orderly face characteristic value;

2.2 generate biological Hash sequence: as random seed, generate a plurality of biological Hash sequences by password, user name and biological Hash sequence are sent to server by face characteristic.Preceding 2 steps of authentication phase so far are all identical with registration phase.

2.3 fuzzy safety box decoding: the user name that server provides according to client, extract corresponding password and fuzzy safety box.And carry out fuzzy in order safety box by the biological Hash sequence that fuzzy safety box and client provide and decode, generate corresponding key.

2.4 coupling: if the key agreement of preserving on key that generates and the server, then by authentication, otherwise authentification failure.

To do concrete argumentation with regard to the correlation technique that the present invention uses below.

Registration phase

At registration phase, the user need provide user name, password and three kinds of information of facial image:

A1. extract the face characteristic value

Client utilizes picture pick-up device to take facial image, from facial image, extract face characteristic, can utilize existing face characteristic extracting mode (as PCA, MB-LBP feature etc.) the face characteristic value Y that obtains, if adopt the PCA mode to carry out feature extraction, the dimension of Y can be accompanied by the change facial image and change.For the ease of realizing that directly the statistical nature according to adopting image limits dimension, making it is definite value, and the selection of dimension N draws through training, in case selected, just continue to use always, each facial image is all adopted identical dimension.

A2. generate biological Hash sequence

A21. utilize cryptography method, generate one group of random number, the number that generates random number should be N * L * M, and here to not to L, the value of M is strict with, and only need and follow-up calculating is consistent and gets final product, and N is the dimension of face characteristic among the A1..

N * L * M the random number grouping that generates, the two-dimensional array Q ' of M N * L of formation=Q ' ₁, Q ' ₂..., Q ' _M.Each array is carried out orthogonalization among the pair set Q ' again, constitutes new quadrature array set Q={Q ₁, Q ₂... Q _i..., Q _M}

A22. among the Q of face characteristic of Ti Quing and quadrature each element do matrix multiplication operation respectively, the dimension of face characteristic is N, the random matrix Q of quadrature _iDimension be N * L, d is promptly arranged _i=Y * Q _i, finally obtain d={d ₁, d ₂... d _i..., d _M, d _i={ d _i ¹, d _i ²..., d _i ^L.D is carried out binaryzation, promptly

${b_i}^j=\left\{\begin{array}{cc}0& {d_i}^j<\mathrm{\&tau;}\\ 1& {d_i}^j\&GreaterEqual;\mathrm{\&tau;}\end{array}\right.,$

Obtain b={b _i ^j, i=1,2 ..., M; J=1,2 ..., L} is called the conversion template, wherein

$\mathrm{\&tau;}=\underset{j=1}{\overset{L}{\mathrm{\&Sigma;}}}{d_i}^j/L.$

A23. with b={b _i ^j, i=1,2 ..., M; J=1,2 ..., L} is the xi form that each row in the conversion template convert character string sequence to, finally obtains biological Hash sequence x={x ₁, x ₂..., x _i..., x _M.

A3. generate fuzzy safety box

A31. construct multinomial

Constitute shape such as f (x)=c ₀+ c ₁x ¹+ ... ,+c ₇x ⁷+ c ₈x ⁸Multinomial, the coefficient c of equation wherein ₀, c ₁.., c ₇, c ₈Be that the password that the user inputs obtains through numerical transformation, conversion process is: the data that earlier password obtained 128bit with the MD5 method, the data stationary that herein obtains is 128, and this is the result who is produced by the algorithm that adopts MD5, and is irrelevant with the figure place of input password.Obtain 144 binary keys K after the cyclic redundancy check (CRC) through CRC _CRC16 at the every interval of this key is cut apart once, so K _CRC9 metric integer c have been divided into ₀, c ₁.., c ₇, c ₈, as polynomial f (x)=c ₀+ c ₁x ¹+ ... ,+c ₇x ⁷+ c ₈x ⁸Coefficient.With x={x ₁, x ₂..., x _i..., x _MBe updated to polynomial f (x)=c ₀+ c ₁x ¹+ ... ,+c ₆x ⁶+ c ₇x ⁷+ c ₈x ⁸In, so can construct G={ (x in this programme _i, f (x _i)), i=1,2 ..., M}.G is the common generation of people's face data and user cipher, can fully reflect user's private information, in case attacked, will bring immeasurable loss, therefore need be protected.

A32. generate and insert noise spot

Adopt the method that generates random number to generate one group of noise spot, and it is mixed with helping data, form new data acquisition system, be called fuzzy safety box.To blur the safety box data and deposit server in.The benefit of doing like this is; even server is under attack; the fuzzy safety box of storage is revealed; because the adding of noise spot is arranged; what make that the assailant obtains is noise spot and the combination that has that helps data; making the assailant which can not be distinguished is noise spot, and which is to help data, thereby protects privacy of user effectively.Can be inserted into interfering data and concentrate with G according to certain insertion position, also interfering data can be inserted among the G according to rule.These two kinds of methods are of equal value, all are two kinds of data to be mixed.In actual applications, in order to increase fog-level, the quantity of noise spot should be far longer than the dimension of G.

For the ease of calculating, what adopt in the scheme is the method for inserting the G component in interfering data.

The step of inserting is as follows:

1) generating random number q in [1, K] scope, in the computer realm there is much the mode of general random number;

2) calculate insertion sequence number e=(i-1) K+q.

3) with i the component (x of G _i, f (x _i)) according to inserting sequence number e, be inserted into e component (s among the interfering data set C _e, w _e) the position;

All M component to G repeats above-mentioned insertion process step.Obtain final fuzzy safety box.

A4. client computer blurs safety box, key K accordingly to user name _CRCSending to server stores.

Authentication phase

In authentication phase, the user need provide three kinds of information, i.e. user name, password and facial image equally.The A1-A2 that works in registration phase that is done at authentication phase first half B1-B2 is identical, that is:

B1. extract face characteristic

Picture pick-up device by client arrives face images of users, to the facial image feature extraction, is designated as Y ', and dimension is still N.

B2. generate biological Hash sequence

Utilize password to obtain gang's random number sequence, random number sequence and face characteristic data multiplied each other, change into one group of character string array, promptly obtain biological Hash sequence x '=x ' ₁, x ' ₂..., x ' _i..., x ' _M.

B3. fuzzy safety box decoding

B31. calculate smallest hamming distance

Calculate biological Hash sequence x '=x ' ₁, x ' ₂..., x ' _i..., x ' _MAnd the fuzzy safety box data of registration phase between Hamming distance, and Hamming distance sorted, choose 12 Hamming distances of value minimum.The all corresponding one group of data that helps in the data of each minimum Hamming distance obtain G '={ (x _{1_min}, f (x ₁_ min), x _{2_min}, f (x ₂_ min) ..., x _{12_min}, f (x ₁₂_ min) }, these data are extracted from fuzzy safety box, both may be that the help data also may be noise spots.

Theoretically, need 9 Hamming distances can recover the multinomial coefficient that is, therefore, when adopting 12 groups of Hamming distances, can obtain at most

Plant compound mode and recover key, every kind of combination can be calculated by the method for polynomial interopolation and be produced a key.In the practical application, if comprise erroneous point in a certain combination, because it is a random number, then corresponding combination just can't produce a real key.When the point in a certain combination is at true, just can obtain key.In fact, all comprise all, and truly the key of the combination results of point is identical, so, as long as obtain a group key, directly its output is got final product.

B32. polynomial interopolation

With G '={ (x _{1_min}, f (x ₁_ min), x _{2_min}, f (x ₂_ min) ..., x _{12_min}, f (x ₁₂_ min) } substitution formula f (x _{I_min})=c ' ₀+ c ' ₁x _{I_min}+ c ' ₂x _{I_min} ²+ L+c ' ₈x _{I_min} ⁸In, the method by Lagrange's interpolation can recover this polynomial coefficient c ' ₀, c ' ₁.., c ' ₇, c ' ₈

B4. compare key, draw authentication result

With multinomial coefficient c ' ₀, c ' ₁.., c ' ₇, c ' ₈Through CRC be cyclic redundancy check (CRC) obtain 144 key K ' _CRC, the key K of taking-up user correspondence from server _CRC, compare, if identical, then authentication success, if inequality, authentification failure then.

Above example only in order to the explanation the present invention and and unrestricted technical scheme described in the invention; Therefore, although this specification has been described in detail the present invention with reference to each above-mentioned example,, those of ordinary skill in the art should be appreciated that still and can make amendment or be equal to replacement the present invention; And all do not break away from the technical scheme and the improvement thereof of the spirit and scope of invention, and it all should be encompassed in the middle of the claim scope of the present invention.

Claims (1)

1. fuzzy safety box long-distance identity-certifying method based on face characteristic, it is characterized in that: this method comprises the steps:

1.1 being carried out feature extraction, facial image obtains orderly face characteristic sequence;

1.2 generate a plurality of biological Hash sequences: the password by user's input produces a series of pseudo random numbers as random seed, and the array that obtains is carried out binaryzation, generates character string sequence, promptly generates biological Hash sequence;

1.3 fuzzy in order safety box coding:

1.3.1) generator polynomial: the password by user's input generates key, and key is cut apart as polynomial coefficient to be generated; The biological Hash sequence that step 1.2 is obtained is updated to the functional value of trying to achieve correspondence in the multinomial successively, and store, the result exists among the two-dimensional array G, the biological cryptographic Hash of the first row representative, and secondary series is represented the projection sequence after biological Hash sequence projects to multinomial;

1.3.2) in helping data, interleave many group interfering datas, finally form fuzzy safety box; So far, 1.1-1.3 has finished the cataloged procedure of fuzzy safety box;

1.4. client computer is user name the most at last, three kinds of data of key and fuzzy safety box are sent in the server stores;

In authentication phase, the user still provides user name, password and facial image; Step is as follows:

2.1 extraction face characteristic: client computer carries out feature extraction to facial image, obtains orderly face characteristic value;

2.2 generate biological Hash sequence: as random seed, generate a plurality of biological Hash sequences by password, user name and biological Hash sequence are sent to server by face characteristic;

2.3 fuzzy safety box decoding: the user name that server provides according to client, extract corresponding password and fuzzy safety box; And carry out fuzzy in order safety box by the biological Hash sequence that fuzzy safety box and client provide and decode, generate corresponding key;

2.4 coupling: if the key agreement of preserving on key that generates and the server, then by authentication, otherwise authentification failure.