WO2017004926A1 - 一种虹膜识别方法及装置 - Google Patents

一种虹膜识别方法及装置 Download PDF

Info

Publication number
WO2017004926A1
WO2017004926A1 PCT/CN2015/095665 CN2015095665W WO2017004926A1 WO 2017004926 A1 WO2017004926 A1 WO 2017004926A1 CN 2015095665 W CN2015095665 W CN 2015095665W WO 2017004926 A1 WO2017004926 A1 WO 2017004926A1
Authority
WO
WIPO (PCT)
Prior art keywords
iris
value
encryption key
feature information
vault
Prior art date
Application number
PCT/CN2015/095665
Other languages
English (en)
French (fr)
Inventor
钟焰涛
傅文治
蒋罗
Original Assignee
宇龙计算机通信科技(深圳)有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 宇龙计算机通信科技(深圳)有限公司 filed Critical 宇龙计算机通信科技(深圳)有限公司
Publication of WO2017004926A1 publication Critical patent/WO2017004926A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V40/00—Recognition of biometric, human-related or animal-related patterns in image or video data
    • G06V40/10—Human or animal bodies, e.g. vehicle occupants or pedestrians; Body parts, e.g. hands
    • G06V40/18—Eye characteristics, e.g. of the iris
    • G06V40/197—Matching; Classification
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services

Definitions

  • the present invention relates to the field of electronic technologies, and in particular, to an iris recognition method and apparatus.
  • the main solution is to directly store the iris template in the terminal, or to encrypt the iris template by setting a password, but due to the reversibility of the password encryption (that is, the decryption method can restore the original data), there is still an attacker to take The possibility of leaking the iris template after decrypting the iris template.
  • the technical problem to be solved by the embodiments of the present invention is to provide an iris recognition method and device, which can effectively solve the security risk caused by leaking iris characteristic information.
  • an embodiment of the present invention provides an iris recognition method, where the method includes:
  • an embodiment of the present invention further provides an iris recognition device, where the device includes:
  • An iris acquisition module configured to acquire iris information of a user
  • a vault value reading module configured to read a pre-generated vault value, wherein the vault value is calculated in advance according to the iris feature information of the authorized user and the preset encryption key;
  • a decryption key module configured to calculate a decryption key according to the iris feature information of the user and the vault value
  • a key matching module configured to determine whether the calculated decryption key matches the preset encryption key
  • the identification confirmation module is configured to confirm that the iris recognition is successful if the calculated decryption key matches the preset encryption key.
  • the embodiment of the present invention obtains the iris feature information of the user, and reads the pre-generated vault value, which is calculated according to the iris feature information of the authorized user and the preset encryption key in advance; according to the iris of the user Determining, by the feature information and the vault value, a decryption key; determining whether the calculated decryption key matches the preset encryption key; if yes, confirming that the iris recognition is successful, and implementing encryption protection on the terminal , effectively prevent the leakage of iris characteristic information.
  • FIG. 1 is a schematic flow chart of an iris recognition setting method in an embodiment of the present invention
  • FIG. 2 is a schematic flow chart of an iris recognition method according to an embodiment of the present invention.
  • FIG. 3 is a schematic flow chart of an iris recognition method according to another embodiment of the present invention.
  • FIG. 4 is a schematic structural diagram of an iris recognition device according to an embodiment of the present invention.
  • FIG. 5 is a structural diagram of a decryption key module of FIG. 4 according to an embodiment of the present invention.
  • FIG. 6 is a structural diagram of a key matching module of FIG. 4 according to an embodiment of the present invention.
  • FIG. 7 is a structural diagram of the structure of the vault value module of FIG. 4 in the embodiment of the present invention.
  • FIG. 1 is a schematic flow chart of a method for setting an iris recognition in an embodiment of the present invention.
  • the flow of the method may be implemented by an iris recognition device, which may be a user iris recognition device or a software program running on a user iris recognition device.
  • the user iris recognition device may include a mobile phone, a notebook computer, a tablet computer, a car computer, a POS (Point Of Sales) machine, and the like.
  • the method of this embodiment as shown in the figure may include:
  • Step S101 Acquire the verification iris feature information of the authorized user.
  • the iris recognition device may first acquire an eye image of the authorized user through an iris recognition device camera or other imaging device, and then collect the verification iris feature information from the eye image, or directly collect the image. Demonstrate the iris feature information of the authorized user.
  • the verification iris feature information includes a plurality of verification iris feature point information, and the verification iris feature point information further includes information indicating coordinates, an angle, a position, and the like of the feature points of the authorized user iris feature.
  • the feature points of the verified iris feature acquired and acquired are preset by the device, for example, the device presets feature points for collecting iris and pupil boundaries, feature points of iris and iris boundaries, The feature points of the iris and the center of the eye are the same, and so on.
  • the iris recognition system acquires a total of 20 pieces of the verification iris feature point information, and if one of the verification iris feature point information is represented by a triplet (x 1 , y 1 , ⁇ 1 ), where x, y) represents the position of the plane coordinate of the verification iris feature point, and ⁇ represents the direction of the verification iris feature point, and the verification iris feature information is (x 1 , y 1 , ⁇ 1 ) to (x 20 , a set of the verification iris feature point information of y 20 , ⁇ 20 ).
  • the iris recognition device may prompt the authorized user to align the eye to the camera for eye image acquisition, and after obtaining the clear eye image, the iris recognition device needs to preprocess the eye image. First, it is necessary to detect the position of the iris and the pupil in the eye image, the boundary between the iris and the sclera, the boundary between the iris and the upper eyelid, and the boundary between the iris and the lower eyelid to determine the iris in the image of the eye.
  • the iris recognition device may refer to the position of the iris to extract the verification iris feature information of the authorized user; finally, normalize the verification iris feature information, that is, adjust the verification iris feature information to
  • the iris recognition system presets a fixed size to ensure accurate identification of the iris feature information; the normalized iris feature information after normalization can be enhanced, for example, adjusting brightness, contrast, and smoothness, etc., to Increasing the recognition rate of the verification iris feature information.
  • Step S102 Acquire the preset encryption key.
  • the preset encryption key may be that the iris recognition device is already set at the time of shipment, or may be set or changed by the authorized user, or may be obtained by extracting the iris feature information. Obtained by approximately uniformly distributed random data. Therefore, the iris recognition apparatus only needs to directly acquire the encryption key for use in step S103. For example, if the encryption key is 000010010000001100000001, assuming that the device is implemented on the operation domain GF(2 8 ), the encryption key is (00001001), (00000011), (00000001), and converted into decimal It is 9, 3, 1.
  • Step S103 Generate the vault value according to the verification iris feature information of the authorized user and the encryption key, and store the vault value.
  • the fuzzy vault algorithm can combine the biometric and cryptographic systems to complete the function of using the biometric template to lock the key, and a lock value can be obtained after locking.
  • the iris recognition device generates the vault value according to the iris feature information of the authorized user and the preset encryption key by using a fuzzy vault algorithm.
  • the encryption key may be used as a coefficient to construct an cryptographic polynomial function, and then the vault value is generated according to the verification iris feature information and the cryptographic polynomial function.
  • Step S104 deleting the verification iris feature information of the authorized user.
  • the verification iris feature information of the authorized user does not need to be used again. Therefore, after performing the foregoing steps S101 to S103, the verification user iris information of the authorized user can be completely delete. In this way, it can be ensured that the verification iris feature information of the authorized user cannot be obtained even if another person steals or invades the terminal, thereby effectively preventing the security problem caused by the iris template being leaked and stolen.
  • the embodiment of the present invention obtains the preset iris by obtaining the verification iris feature information of the authorized user. a secret key, generating the vault value according to the verification iris feature information of the authorized user and the encryption key, storing, deleting the verification iris feature information of the authorized user, and the encryption key, and implementing the device
  • the setting of encryption protection is effective to prevent leakage of iris characteristic information.
  • FIG. 2 is a schematic flow chart of an iris recognition method in an embodiment of the present invention.
  • the method of this embodiment as shown in the figure may include:
  • Step S201 Acquire iris feature information of the user.
  • the iris recognition device may first acquire an image of the eye of the user through an iris recognition device camera or other imaging device, and then collect the iris feature information from the eye image, or directly collect the user.
  • Iris feature information includes a plurality of iris feature point information
  • the iris feature point information further includes information such as coordinates, angles, positions, and the like of the feature points that reflect the iris characteristics of the user.
  • the feature points of the iris feature acquired and acquired are preset by the device, for example, the device presets feature points for collecting iris and pupil boundaries, feature points of iris and iris boundaries, and iris. Feature points that are the same distance from the center of the eyeball, and so on.
  • the iris recognition system acquires a total of 20 pieces of the iris feature point information, and if one of the iris feature point information is represented by a triplet (x 11 , y 11 , ⁇ 11 ), where (x, y) indicates the position of the plane coordinate of the iris feature point, and ⁇ indicates the direction of the iris feature point, then the iris characteristic information is (x 11 , y 11 , ⁇ 11 ) to (x 2020 , y 2020 , ⁇ 2020 a set of said iris feature point information.
  • a triplet x 11 , y 11 , ⁇ 11
  • (x, y) indicates the position of the plane coordinate of the iris feature point
  • ⁇ indicates the direction of the iris feature point
  • the iris characteristic information is (x 11 , y 11 , ⁇ 11 ) to (x 2020 , y 2020 , ⁇ 2020 a set of said iris feature point information.
  • Step S202 The pre-generated vault value is calculated, and the vault value is calculated in advance according to the iris feature information of the authorized user and the preset encryption key.
  • the fuzzy vault algorithm can combine the biometric and cryptographic systems to complete the function of using the biometric template to lock the key, and a lock value can be obtained after locking.
  • the vault value read here is the vault value generated by the fuzzy vault algorithm according to the iris feature information of the authorized user and the preset encryption key. After the vault value is read, the terminal may calculate the decryption key by performing step S203.
  • Step S203 calculating a decryption key according to the iris feature information of the user and the vault value.
  • the iris recognition device generates the vault value according to the iris feature information of the authorized user and the preset encryption key by using a fuzzy vault algorithm, so the decryption algorithm of the fuzzy vault algorithm may be used to determine The decryption key.
  • a decryption polynomial function may be constructed according to the iris feature information of the user and the vault value, and then the decryption key is determined according to the decryption polynomial function.
  • Step S204 determining whether the calculated decryption key matches the preset encryption key.
  • step S203 determining whether the decryption key matches the encryption key, whether the decryption key determined in step S203 is correct, that is, whether the iris feature information of the user is the Authorized user's iris feature information.
  • step S205 if yes, it is confirmed that the iris recognition is successful.
  • the decryption key matches the encryption key, it indicates that the user is the authorized user, and then the iris recognition is successful, and the corresponding authorization function or interface may be further opened for the user. It should be noted that the decryption key and the encryption key are not necessarily identical, and a certain range of values may be allowed between them.
  • the pre-generated vault value is obtained by acquiring the iris feature information of the user, and the vault value is calculated according to the iris feature information of the authorized user and the preset encryption key in advance, according to the iris of the user. Determining, by the feature information and the vault value, a decryption key, determining whether the calculated decryption key matches the preset encryption key, and if yes, confirming that the iris recognition is successful, and implementing encryption protection on the terminal At the same time, it effectively prevents the leakage of iris characteristic information.
  • FIG. 3 is a schematic flow chart of an iris recognition method according to another embodiment of the present invention.
  • the method of this embodiment as shown in the figure may include:
  • Step S301 obtaining verification iris feature information of the authorized user.
  • step S101 The specific method refers to step S101.
  • Step S302 Acquire the preset encryption key.
  • step S102 The specific method refers to step S102.
  • Step S303 constructing an encryption polynomial function according to the encryption key.
  • the device may construct the cryptographic polynomial function according to the encryption key acquired in step S302 by using a cryptographic polynomial function configuration rule preset by the device.
  • the cryptographic polynomial function construction rule is a mathematical method of converting the encryption key into the cryptographic polynomial.
  • the cryptographic polynomial function construction rule is to use the encryption key as a coefficient of the cryptographic polynomial function and construct a power polynomial function with x as a variable
  • the encryption key is 000000100000000100000001
  • the device is implemented on the operation domain GF(2 8 ), and the encryption key is (00000010), (00000001), (00000001), and converted into decimal, ie, 2, 1, 1 can be used as the cryptographic polynomial.
  • the coefficient one of the cryptographic polynomial functions can be constructed: 2X 2 + X+1.
  • the device may further process the encryption key by using a preset encryption error correction code technology, and connect the verification code generated by the error correction code technology to the encryption key.
  • An encryption key with a check code is formed, and then the encryption polynomial function is constructed using the encryption key with the verification code.
  • Step S304 generating the vault value according to the verification iris feature information and the cryptographic polynomial function and storing.
  • the verification feature value of the verification iris feature point information after the (x, y) coordinate cascade may be calculated, and then the calculation Determining a mapping point of the feature value on the cryptographic polynomial function and composing a point pair with the corresponding feature value, and then randomly adding a series of hash point pairs to insert the mapping point pair, and finally obtaining the vault value and storing In the terminal.
  • the hash point pair requirement is not on the cryptographic polynomial function and is spaced apart from the feature point of the verification iris feature information.
  • one of the verification iris feature point information is represented by a triplet (x 1 , y 1 , ⁇ 1 ), and the cryptographic polynomial function is P, and the eigenvalue can be obtained by cascading the horizontal and vertical coordinates (x). 1
  • the iris recognition system acquires a total of four of the verification iris feature point information (x 1 , y 1 , ⁇ 1 ) to (x 4 , y 4 , ⁇ 4 ), and calculates the characteristic value.
  • Y) is ⁇ -1, -2, 2 , 4 ⁇
  • the cryptographic polynomial P is 2X 2 + X+1
  • Y) ⁇ is ⁇ (-1,2),(-2,7),(2,11),(4,37) ⁇
  • the resulting vault value is ⁇ (-1,2), (-2,7), (2,11), (4,37), ( 0, 2), (2, 0), (1, 1) ⁇ .
  • Step S305 acquiring the cryptographic hash function constructed in advance.
  • the cryptographic hash function may be that the device is already set at the time of shipment, or may be automatically set or updated by the device, or may be selected after the device program is randomly generated.
  • the cryptographic hash function is one of a hash function, and the function of the hash function is to perform a one-time encryption process on a password or a password to form a hash string, and the encryption process is irreversible, that is, That is to say, even if the terminal is hacked or stolen, only a hash string can be obtained, and the original password or password cannot be restored by the hash string.
  • Step S306 acquiring device identification information of the terminal.
  • the device identification information is a unique identification number representing each of the iris recognition devices, and is generally printed on the outside of the device or stored in the terminal. For example, if the device is a mobile terminal (mobile phone, ipad), it can obtain its IMEI (International Mobile Equipment Identity); if the device is a personal computer, it can obtain its MAC (Media Access Control, Media Access Control) address. Because the IMEI or the MAC address has a unique one-to-one correspondence with a mobile terminal or a personal computer.
  • IMEI International Mobile Equipment Identity
  • MAC Media Access Control, Media Access Control
  • Step S307 substituting the device identification information and the encryption key into the cryptographic hash function, and calculating and storing the cryptographic hash value.
  • the device identification information and the encryption key are substituted, and the encrypted hash value can be calculated.
  • the cryptographic hash function is to avoid the security risk caused by the loss of the encryption key, and then the hash function is encrypted, so that the encryption cannot be recovered even if the obtained cryptographic hash value is obtained by another person. Key.
  • the cryptographic hash function adopts a direct remainder method, that is, the remainder obtained by dividing the device identification information of the device with the encryption key is the cryptographic hash.
  • the device identification information of the device is 35
  • the encrypted hash value is 11.
  • Step S308 deleting the verification iris feature information of the authorized user and the encryption key.
  • the verification iris feature information of the authorized user and the encryption key may not be used again, only by comparing the encrypted hash value and the decrypted hash value. It is sufficient to match, so after the above steps S301 to 307 are performed, the authentication iris feature information of the authorized user and the encryption key can be completely deleted. In this way, it can be ensured that even if other people steal or invade the terminal, the authentication iris information of the authorized user cannot be obtained, thus effectively preventing the security problem caused by the iris template being leaked and stolen.
  • Step S309 acquiring iris feature information of the user.
  • step S201 For the specific method, reference may be made to step S201.
  • Step S310 reading a pre-generated vault value, which is calculated in advance according to the iris feature information of the authorized user and the preset encryption key.
  • step S202 For the specific method, reference may be made to step S202.
  • Step S311 constructing a decryption polynomial function according to the iris feature information of the user and the vault value.
  • the feature value of the iris feature point information after the (x, y) coordinate cascade may be calculated, and then according to the feature value, Searching for the point matching the feature value as the candidate point in the obtained vault value, if the user is an authorized user, this step will filter out a large number of hash point pairs; then, in the searched
  • the decryption polynomial function is constructed using a Lagrange interpolation method in the candidate points.
  • y 11 ) may be obtained by cascading the horizontal and vertical coordinates; then, searching a candidate point pair ⁇ (x 11
  • the iris recognition system acquires a total of four of the iris feature point information (x 11 , y 11 , ⁇ 11 ) to (x 44 , y 44 , ⁇ 44 ), and calculates a characteristic value set of the user.
  • the vault value read in step S310 is ⁇ (-1, 2), (-2, 7), (2, 11), (4, 37) ), (0, 2), (2, 0), (1, 1) ⁇
  • the candidate point pair is ⁇ (-1, 4), (-2, 11), (2, 7 ), (4, 29) ⁇
  • the decryption polynomial function constructed by the Lagrange interpolation method is 2X 2 + X+1.
  • Step S312 determining the decryption key according to the decryption polynomial function.
  • the decryption polynomial function constructed in step S311 may determine the decryption key by using a decryption key recovery rule preset by the device.
  • the decryption key recovery rule is a mathematical method of converting the decryption polynomial function into the decryption key. For example, assuming that the decryption key recovery rule is to use the coefficient of the decryption polynomial function as the decryption key, then when the decryption polynomial function is 2X 2 + X+1, the coefficient is 2, 1 1, assuming that the device is implemented on the operation domain GF (2 8 ), then the decryption key is 000000100000000100000001.
  • the device may first determine the verification code by using the decryption polynomial function in this step.
  • the decryption key is further determined by using the error correction code technique, and finally the decryption key is determined.
  • Step S313 acquiring device identification information of the terminal.
  • Step S314 substituting the device identification information and the decryption key into a pre-configured cryptographic hash function to calculate a decrypted hash value.
  • the device identification information and the decryption key may be substituted according to the pre-configured cryptographic hash function, and the decrypted hash value is calculated.
  • Step S315 determining whether the decrypted hash value matches the encrypted hash value, where the encrypted hash value is calculated by substituting the device identification information and the encryption key into the encrypted hash function.
  • the device determines, according to the cryptographic hash value obtained in step S307 and the decrypted hash value obtained in step S314, whether the decrypted hash value matches the cryptographic hash value, and the step may be determined. Whether the decryption key determined in S312 is correct, that is, the user's iris Whether the sign information is the iris feature information of the authorized user.
  • step S316 if yes, it is confirmed that the iris recognition is successful.
  • the decryption hash value matches the cryptographic hash value, indicating that the user is the authorized user, confirming that the iris recognition is successful, and further opening the corresponding authorization function for the user or interface.
  • the decrypted hash value and the encrypted hash value are not necessarily identical, and a certain range of values may be allowed to be between them.
  • the embodiment of the present invention obtains the iris feature information of the user, and reads the pre-generated vault value, which is calculated according to the iris feature information of the authorized user and the preset encryption key in advance; according to the iris of the user Determining, by the feature information and the vault value, a decryption key; determining whether the calculated decryption key matches the preset encryption key; if yes, confirming that the iris recognition is successful, and implementing encryption protection on the terminal At the same time, it effectively prevents the leakage of iris characteristic information.
  • the iris recognition device may be a user terminal or a software program running on a user terminal, and the user terminal may include a mobile phone, a notebook computer, a tablet computer, On-board computer, POS (Point Of Sales) machine, etc.
  • the device as shown may include:
  • the iris acquisition module 410 is configured to acquire iris feature information of the user.
  • the iris acquisition module 410 may first acquire the eye image of the user through a terminal camera or other imaging device, and then collect the iris feature information from the eye image, or directly collect the iris feature of the user. information.
  • the iris feature information includes a plurality of iris feature point information, and the iris feature point information further includes information such as coordinates, angles, positions, and the like of the feature points that reflect the iris characteristics of the user.
  • the feature points of the iris feature acquired and acquired are preset by the iris acquisition module 410.
  • the iris acquisition module 410 presets feature points for collecting iris and pupil boundaries, iris and iris.
  • the iris acquisition module 410 obtains a total of 20 iris feature point information, and if one of the iris feature point information is represented by a triplet (x 11 , y 11 , ⁇ 11 ), where (x , y) represents the position of the plane coordinate of the iris feature point, and ⁇ represents the direction of the iris feature point, and the iris characteristic information is (x 11 , y 11 , ⁇ 11 ) to (x 2020 , y 2020 , ⁇ A set of said iris feature point information of 2020 ).
  • the iris acquisition module 410 may prompt the user to align the eye to the camera for eye image acquisition. If the collected eye image is complete and the detail information is clear, the iris feature information is collected; If the image of the eye is incomplete or the detail information is not clear enough, the iris acquisition module 410 needs to acquire the eye image of the user again until the eye image of the user is complete and the detail information is clear. After obtaining a clear eye image, the iris acquisition module 410 needs to preprocess the eye image.
  • the iris acquisition module 410 can refer to the position of the iris to extract the iris feature information of the user; finally, the iris feature information is normalized, that is, the iris feature information is adjusted to the iris recognition system. a preset fixed size to ensure accurate identification of the iris feature information; the iris feature information after normalization may be enhanced, for example, adjusting brightness, contrast, and smoothness, etc., to improve The recognition rate of iris feature information.
  • the iris acquisition module 410 is further configured to: obtain verification iris feature information of the authorized user.
  • the iris acquisition module 410 may first acquire an eye image of the authorized user through a terminal camera or other imaging device, and then collect the iris feature information from the eye image, or directly collect the iris of the user.
  • Feature information includes a plurality of verification iris feature point information
  • the verification iris feature point information further includes information indicating coordinates, an angle, a position, and the like of the feature points of the authorized user iris feature.
  • the feature points of the acquired iris feature acquired and acquired are preset by the iris acquisition module 410.
  • the device presets to collect feature points of the iris and the pupil boundary, and the iris and iris boundaries.
  • the iris recognition system acquires a total of 20 pieces of the verification iris feature point information, and if one of the verification iris feature point information is represented by a triplet (x 1 , y 1 , ⁇ 1 ), where x, y) represents the position of the plane coordinate of the verification iris feature point, and ⁇ represents the direction of the verification iris feature point, and the verification iris feature information is (x 1 , y 1 , ⁇ 1 ) to (x 20 , a set of the verification iris feature point information of y 20 , ⁇ 20 ).
  • the vault value reading module 412 is configured to read a pre-generated vault value, which is calculated in advance according to the iris feature information of the authorized user and the preset encryption key.
  • the fuzzy vault algorithm can combine the biometric and cryptographic systems to complete the function of using the biometric template to lock the key, and a lock value can be obtained after locking.
  • the vault value read here is the vault value generated by using the fuzzy vault algorithm according to the iris feature information of the authorized user and the preset encryption key.
  • the terminal can calculate the decryption key by using the decryption key module 414.
  • the decryption key module 414 is configured to calculate a decryption key according to the iris feature information of the user and the vault value.
  • the iris recognition device generates the vault value according to the iris feature information of the authorized user and the preset encryption key by using a fuzzy vault algorithm, so the decryption determination method of the fuzzy vault algorithm may be used here. Describe the decryption key.
  • a decryption polynomial function may be constructed according to the iris feature information of the user and the vault value, and then the decryption key is determined according to the decryption polynomial function.
  • the decryption key module 414 includes a decryption polynomial unit 414a and a decryption key determination unit 414b, as shown in FIG.
  • the decryption polynomial unit 414a is configured to construct a decryption polynomial function according to the iris feature information of the user and the vault value.
  • the feature value of the iris feature point information after the (x, y) coordinate cascade may be calculated, and then according to the feature. a value, searching for the point matching the feature value as the candidate point in the obtained vault value, if the user is an authorized user, this step will filter out a large number of hash point pairs; and then, in the search
  • the decryption polynomial function is constructed using the Lagrange interpolation method in the candidate points.
  • y 11 ) may be obtained by cascading the horizontal and vertical coordinates; then, searching a candidate point pair ⁇ (x 11
  • the iris acquisition module 410 acquires a total of four of the iris feature point information (x 11 , y 11 , ⁇ 11 ) to (x 44 , y 44 , ⁇ 44 ), and calculates the characteristic value of the user.
  • the set is ⁇ -1, -2, 2, 4 ⁇
  • the vault value read by the vault value reading module 412 is ⁇ (-1, 2), (-2, 7), (2, 11), (4,37), (0,2), (2,0), (1,1) ⁇
  • the candidate point pair is ⁇ (-1,4), (-2,11), (2,7), (4,29) ⁇
  • the decryption polynomial function constructed by the Lagrange interpolation method is 2X 2 + X+1.
  • the decryption key determining unit 414b is configured to determine the decryption key according to the decryption polynomial function.
  • the decryption polynomial function constructed in the decryption polynomial unit 414a may determine the decryption key by a decryption key recovery rule preset by the device.
  • the decryption key recovery rule is a mathematical method of converting the decryption polynomial function into the decryption key. For example, assuming that the decryption key recovery rule is to use the coefficient of the decryption polynomial function as the decryption key, then when the decryption polynomial function is 2X 2 + X+1, the coefficient is 2, 1 1, assuming that the device is implemented on the operation domain GF (2 8 ), then the decryption key is 000000100000000100000001.
  • the device may first determine the verification code by using the decryption polynomial function in this step.
  • the decryption key is further determined by using the error correction code technique, and finally the decryption key is determined.
  • the key matching module 416 is configured to determine whether the calculated decryption key matches the preset encryption key.
  • the key matching module 416 determines whether the decryption key is correct by determining whether the decryption key matches the encryption key, that is, whether the iris feature information of the user is the authorization. User's iris feature information.
  • the key matching module 416 may further include: an identifier obtaining unit 416a, a decryption hash value unit 416b, and a hash value matching unit 416c, as shown in FIG. 6.
  • the identifier obtaining unit 416a is configured to acquire device identification information of the terminal.
  • the device identification information is a unique identification number representing each terminal, and is generally printed on the outside of the terminal or stored in the terminal.
  • the identifier obtaining unit 416a may obtain its IMEI (International Mobile Equipment Identity); if the terminal is a personal computer, the identifier obtaining unit 416a can obtain its MAC (Media Access Control) address. Because of the stated The IMEI or the MAC address has a unique one-to-one correspondence with the mobile terminal or the personal computer.
  • the decryption hash value unit 416b is configured to substitute the device identification information and the decryption key into a pre-configured cryptographic hash function to calculate a decrypted hash value.
  • the decryption hash value unit 416b may substitute the device identification information and the decryption key according to the pre-configured cryptographic hash function, and calculate the decrypted hash value.
  • the hash value matching unit 416c is configured to determine whether the decrypted hash value matches the encrypted hash value, where the encrypted hash value is the device identification information and the encryption key is substituted into the encrypted hash function. owned.
  • the device obtains the encrypted hash value according to the cryptographic hash function in the encryption setting phase, and the hash value matching unit 416c determines whether the decrypted hash value matches the encrypted hash value. It can be determined whether the decryption key is correct, that is, whether the iris feature information of the user is the iris feature information of the authorized user.
  • the identification confirmation module 418 is configured to confirm that the iris recognition is successful if the calculated decryption key matches the preset encryption key.
  • the decryption key matches the encryption key, it indicates that the user is the authorized user, and then the iris recognition is successful, and the corresponding authorization function or interface may be further opened for the user. It should be noted that the decryption key and the encryption key are not necessarily identical, and a certain range of values may be allowed between them.
  • the decryption hash value matches the cryptographic hash value, indicating that the user is the authorized user, confirming that the iris recognition is successful, and further opening the corresponding authorization function for the user. Or interface. It should be noted that the decrypted hash value and the encrypted hash value are not necessarily identical, and a certain range of values may be allowed to be between them.
  • the device further includes:
  • the encryption key module 420 is configured to acquire the preset encryption key.
  • the preset encryption key may be that the iris recognition device is already set at the time of shipment, or may be set or changed by the authorized user, or may be obtained by extracting the iris feature information. Obtained by approximately uniformly distributed random data. Therefore, the encryption key module 420 only needs to directly acquire the encryption key for the vault value module 422. For example, if the encryption key is 000010010000001100000001, assuming that the device is implemented on the operation domain GF(2 8 ), the encryption key is (00001001), (00000011), (00000001), and converted into decimal It is 9, 3, 1.
  • the vault value module 422 is configured to generate and store the vault value according to the verification iris feature information of the authorized user and the encryption key.
  • the fuzzy vault algorithm can combine the biometric and cryptographic systems to complete the function of using the biometric template to lock the key, and a lock value can be obtained after locking.
  • the vault value module 422 is configured to generate the vault value according to the iris feature information of the authorized user and the preset encryption key by using a fuzzy vault algorithm.
  • the encryption key may be used as a coefficient to construct an cryptographic polynomial function, and then the vault value is generated according to the verification iris feature information and the cryptographic polynomial function.
  • the vault value module 422 includes an encryption polynomial unit 422a and a vault value generation unit 422b, as shown in FIG.
  • An encryption polynomial unit 422a is configured to construct an encryption polynomial function from the encryption key.
  • the cryptographic polynomial unit 422a may construct the cryptographic polynomial function according to the cryptographic polynomial function construction rule preset by the cryptographic polynomial unit 422a according to the encryption key acquired in the encryption key module 420.
  • the cryptographic polynomial function construction rule is a mathematical method of converting the encryption key into the cryptographic polynomial.
  • the cryptographic polynomial function construction rule is to use the encryption key as a coefficient of the cryptographic polynomial function and construct a power polynomial function with x as a variable
  • the encryption key is 000000100000000100000001
  • the device is implemented on the operation domain GF(2 8 ), and the encryption key is (00000010), (00000001), (00000001), and converted into decimal, ie, 2, 1, 1 can be used as the cryptographic polynomial.
  • the coefficient one of the cryptographic polynomial functions can be constructed: 2X 2 + X+1.
  • the cryptographic polynomial unit 422a may further process the encryption key by using a preset encryption error correction code technology, and after the encryption key is connected to the error correction code technology.
  • the check code forms an encryption key with a check code, and then constructs the encrypted polynomial function using the encryption key with the check code.
  • the vault value generating unit 422b is configured to generate and store the vault value according to the verification iris feature information and the cryptographic polynomial function.
  • the vault value generation unit 422b may calculate the verification iris feature point information after the (x, y) coordinate cascade Verifying the feature value, then calculating a mapping point of the verification feature value on the cryptographic polynomial function and composing a point pair with the corresponding feature value, and then randomly adding a series of hash point pairs to insert the mapping point pair, and finally The vault value is obtained and stored in the terminal.
  • the hash point pair requirement is not on the cryptographic polynomial function and is spaced apart from the feature point of the verification iris feature information.
  • one of the verification iris feature point information is represented by a triplet (x 1 , y 1 , ⁇ 1 ), and the cryptographic polynomial function is P, and the eigenvalue can be obtained by cascading the horizontal and vertical coordinates (x). 1
  • the iris acquisition module 410 acquires a total of four of the verification iris feature point information (x 1 , y 1 , ⁇ 1 ) to (x 4 , y 4 , ⁇ 4 ), and calculates the feature.
  • Y) is ⁇ -1, -2, 2 , 4 ⁇
  • the cryptographic polynomial P is 2X 2 + X + 1
  • Y) ⁇ is ⁇ (-1,2),(-2,7),(2,11),(4,37) ⁇
  • the resulting vault value is ⁇ (-1,2), (-2,7), (2,11), (4,37), (0,2), (2,0), (1,1) ⁇ .
  • the deleting module 424 is configured to delete the verification iris feature information of the authorized user.
  • the deleting module 424 can completely delete the verification iris feature information of the authorized user. . Doing so will ensure that even if someone else steals or invades the end At the end, the authentication iris feature information of the authorized user cannot be obtained, which effectively prevents the security problem caused by the iris template being leaked and stolen.
  • the deleting module is configured to: delete the verification iris feature information of the authorized user and the encryption key.
  • the deleting module 424 can The iris feature information is verified and the encryption key is completely deleted.
  • the device further includes:
  • the cryptographic hash function module 426 is configured to obtain the cryptographic hash function that is pre-configured.
  • the cryptographic hash function may be that the device is already set at the time of shipment, or may be automatically set or updated by the device, or may be selected after the device program is randomly generated.
  • the cryptographic hash function is one of a hash function, and the function of the hash function is to perform a one-time encryption process on a password or a password to form a hash string, and the encryption process is irreversible, that is, That is to say, even if the terminal is hacked or stolen, only a hash string can be obtained, and the original password or password cannot be restored by the hash string.
  • the cryptographic hash value module 428 is configured to substitute the device identification information and the encryption key into the cryptographic hash function, and calculate and store the cryptographic hash value.
  • the cryptographic hash value can be calculated by substituting the device identification information and the encryption key according to the pre-configured cryptographic hash function obtained in the cryptographic hash function module 426.
  • the cryptographic hash function is to avoid the security risk caused by the loss of the encryption key, and then the hash function is encrypted, so that the encryption cannot be recovered even if the obtained cryptographic hash value is obtained by another person. Key.
  • the cryptographic hash function adopts a direct remainder method, that is, the remainder obtained by dividing the device identification information of the device with the encryption key is the cryptographic hash.
  • the device identification information of the device is 35
  • the encrypted hash value is 11.
  • the embodiment of the present invention obtains the iris feature information of the user, and reads the pre-generated vault value, which is calculated in advance according to the iris feature information of the authorized user and the preset encryption key. Calculating a decryption key according to the iris characteristic information of the user and the vault value; determining whether the calculated decryption key matches the preset encryption key; if yes, confirming that the iris recognition is successful, The encryption protection of the terminal is realized, and the leakage of the iris characteristic information is effectively prevented.
  • the storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Health & Medical Sciences (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Bioethics (AREA)
  • Ophthalmology & Optometry (AREA)
  • Human Computer Interaction (AREA)
  • Multimedia (AREA)
  • Collating Specific Patterns (AREA)
  • Measurement Of The Respiration, Hearing Ability, Form, And Blood Characteristics Of Living Organisms (AREA)

Abstract

一种虹膜识别方法和装置，所述方法包括：获取用户的虹膜特征信息（S201）；读取预先生成的vault值，所述vault值是预先根据授权用户的虹膜特征信息与预设的加密密钥计算得到的（S202）；根据所述用户的虹膜特征信息以及所述vault值，计算解密密钥（S203）；判断所述计算得到的解密密钥与所述预设的加密密钥是否匹配（S204）；若是，则确认虹膜识别成功（S205）。采用上述方法和装置，可以在对终端进行加密保护的同时，有效防止虹膜特征信息的泄漏。

Description

一种虹膜识别方法及装置
本申请要求于2015年07月08日提交中国专利局、申请号为201510399063.3、发明名称为“一种虹膜识别方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及一种电子技术领域，尤其涉及一种虹膜识别方法及装置。
背景技术
随着电子终端使用场景与功能越来越广泛，越来越多的个人隐私信息都开始保存在电子终端中，因此对电子终端的安全性和私密性也有了越来越高的要求，虹膜识别就是目前很受追捧的一种身份识别方式。但是由于虹膜的唯一性和不变性，一旦用户的虹膜模板泄露带来的安全风险是不可逆的，即用户无法使用类似于“更换密码”的方法来更换虹膜。而同时，电子终端由于体积小、轻便，容易被盗，因此在电子终端上应用虹膜识别方案时，如何保证所存储虹膜模板的安全性是非常关键的问题。目前主要的方案是直接存储虹膜模板在终端内，或者是通过用户设置一个密码对虹膜模板进行加密保存，但是由于密码加密的可逆性(即存在解密方法可以恢复原始数据)，还是存在攻击者拿到加密虹膜模板后成功解密，从而泄露虹膜模板的可能性。
发明内容
本发明实施例所要解决的技术问题在于，提供一种虹膜识别方法及装置，可以有效解决终端泄露虹膜特征信息造成的安全隐患。
为了解决上述技术问题，本发明实施例提供了一种虹膜识别方法，所述方法包括：
获取用户的虹膜特征信息；
读取预先生成的vault值，所述vault值是预先根据授权用户的虹膜特征信息与预设的加密密钥计算得到的；
根据所述用户的虹膜特征信息以及所述vault值，计算解密密钥；
判断所述计算得到的解密密钥与所述预设的加密密钥是否匹配；
若是，则确认虹膜识别成功。
相应地，本发明实施例还提供了一种虹膜识别装置，所述装置包括：
虹膜获取模块，用于获取用户的虹膜特征信息；
vault值读取模块，用于读取预先生成的vault值，所述vault值是预先根据授权用户的虹膜特征信息与预设的加密密钥计算得到的；
解密密钥模块，用于根据所述用户的虹膜特征信息以及所述vault值，计算解密密钥；
密钥匹配模块，用于判断所述计算得到的解密密钥与所述预设的加密密钥是否匹配；
识别确认模块，用于若所述计算得到的解密密钥与所述预设的加密密钥匹配时，确认虹膜识别成功。
本发明实施例通过获取用户的虹膜特征信息；读取预先生成的vault值，所述vault值是预先根据授权用户的虹膜特征信息与预设的加密密钥计算得到的；根据所述用户的虹膜特征信息以及所述vault值，计算解密密钥；判断所述计算得到的解密密钥与所述预设的加密密钥是否匹配；若是，则确认虹膜识别成功，实现对终端进行加密保护的同时，有效防止虹膜特征信息的泄漏。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本发明实施例中虹膜识别设置方法的流程示意图；
图2是本发明实施例中一种虹膜识别方法的流程示意图；
图3是本发明另一实施例中虹膜识别方法的流程示意图；
图4是本发明实施例中一种虹膜识别装置的组成结构示意图；
图5是本发明实施例中图4的解密密钥模块组成结构图；
图6是本发明实施例中图4的密钥匹配模块组成结构图；
图7是本发明实施例中图4的vault值模块组成结构图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
图1是本发明实施例中虹膜识别设置方法的流程示意图，本方法流程可以由虹膜识别装置实施，所述虹膜识别装置可以为用户虹膜识别装置或运行在用户虹膜识别装置的软件程序，所述用户虹膜识别装置可以包括手机、笔记本电脑、平板电脑、车载电脑、POS(Point Of Sales，销售点)机等。如图所述本实施例的方法可以包括：
步骤S101，获取授权用户的验证虹膜特征信息。
具体的，所述虹膜识别装置可以先通过虹膜识别装置摄像头或者其他摄像设备获取所述授权用户的眼部图像，再从所述眼部图像中采集所述验证虹膜特征信息，也可以直接采集所述授权用户的验证虹膜特征信息。所述的验证虹膜特征信息中包括多个验证虹膜特征点信息，所述验证虹膜特征点信息又包含了能反映所述授权用户虹膜特征的特征点的坐标、角度、位置等信息。需要说明的是，获取和采集的所述验证虹膜特征的特征点是由所述装置预设的，例如所述装置预设要采集虹膜与瞳孔边界的特征点、虹膜与虹膜边界的特征点、虹膜与眼球中心距离相同的特征点等等。举例来说，所述虹膜识别系统总共获取了20个所述验证虹膜特征点信息，若设一个所述验证虹膜特征点信息用三元组(x1，y1，θ1)表示，其中(x，y)表示验证虹膜特征点所在平面坐标的位置，θ表示所述验证虹膜特征点的方向，则所述验证虹膜特征信息即为(x1，y1，θ1)～(x20，y20，θ20)的所述验证虹膜特征点信息的集合。具体实施中，虹膜识别装置可以提示所述授权用户将眼部对准摄像头进行眼部图像采集，获取到清晰的眼部图像之后，虹膜识别装置需要对所述眼部图像进行预处理。首先，需要检测眼部图像中虹膜与瞳孔的边界、虹膜与巩膜的边界、虹膜与上眼皮的边界以及虹膜与下眼皮的边界这几项特征的位置，以确定所述眼部图像中虹膜的位置；之后，虹膜识别装置就可以参照所述虹膜的位置，提取 所述授权用户的验证虹膜特征信息；最后将所述验证虹膜特征信息进行归一化处理，即将所述验证虹膜特征信息调整到虹膜识别系统预设的固定尺寸，以保证对所述虹膜特征信息的精确识别；归一化之后的所述验证虹膜特征信息可以进行增强处理，例如调节亮度、对比度和平滑度等等指标，以提高对所述验证虹膜特征信息的识别率。
步骤S102，获取所述预设的加密密钥。
具体的，所述预设的加密密钥可以是所述虹膜识别装置出厂时已经设置好的，也可以是所述授权用户自己设置或者更改的，还可以是通过提取所述虹膜特征信息中的近似均匀分布的随机数据得到的。因此，虹膜识别装置只需要直接获取所述加密密钥用于步骤S103即可。例如，若所述加密密钥为000010010000001100000001，假设所述装置在运算域GF(28)上实现，则所述加密密钥即为(00001001)，(00000011)，(00000001)，转化成十进制即为9，3，1。
步骤S103，根据所述授权用户的验证虹膜特征信息以及所述加密密钥，生成所述vault值并存储。
具体的，fuzzy vault算法可以将生物特征和密码学系统结合在一起，完成使用生物特征模板锁定密钥的功能，锁定后可以得到一个vault值。这里所述虹膜识别装置就是利用fuzzy vault算法根据所述授权用户的虹膜特征信息与所述预设的加密密钥生成所述vault值的。具体实施中，可以将所述加密密钥作为系数构造一个加密多项式函数，然后再根据所述验证虹膜特征信息以及所述加密多项式函数，生成所述vault值。
步骤S104，删除所述授权用户的验证虹膜特征信息。
具体的，在解密所述终端时，不需要再用到所述授权用户的验证虹膜特征信息，因此在执行完上述步骤S101～步骤S103之后，即可把所述授权用户的验证虹膜特征信息彻底删除。这样做就可以保证即使其他人盗取或者入侵所述终端时，也无法获得所述授权用户的验证虹膜特征信息，这样就有效的防止了因虹膜模板被泄露以及盗用而产生的安全问题。
本发明实施例通过获取授权用户的验证虹膜特征信息，获取所述预设的加 密密钥，根据所述授权用户的验证虹膜特征信息以及所述加密密钥，生成所述vault值并存储，删除所述授权用户的验证虹膜特征信息以及所述加密密钥，实现了对装置进行加密保护的设置，有效防止虹膜特征信息的泄漏。
图2是本发明实施例中一种虹膜识别方法的流程示意图。如图所述本实施例的方法可以包括：
步骤S201，获取用户的虹膜特征信息。
具体的，所述虹膜识别装置可以先通过虹膜识别装置摄像头或者其他摄像设备获取所述用户的眼部图像，再从所述眼部图像中采集所述虹膜特征信息，也可以直接采集所述用户的虹膜特征信息。所述的虹膜特征信息中包括多个虹膜特征点信息，所述虹膜特征点信息又包含了能反映所述用户虹膜特征的特征点的坐标、角度、位置等信息。需要说明的是，获取和采集的所述虹膜特征的特征点是由所述装置预设的，例如所述装置预设要采集虹膜与瞳孔边界的特征点、虹膜与虹膜边界的特征点、虹膜与眼球中心距离相同的特征点等等。举例来说，所述虹膜识别系统总共获取了20个所述虹膜特征点信息，若设一个所述虹膜特征点信息用三元组(x11，y11，θ11)表示，其中(x，y)表示虹膜特征点所在平面坐标的位置，θ表示所述虹膜特征点的方向，则所述虹膜特征信息即为(x11，y11，θ11)～(x2020，y2020，θ2020)的所述虹膜特征点信息的集合。具体实施方法可以参见步骤S101。
步骤S202，读取预先生成的vault值，所述vault值是预先根据授权用户的虹膜特征信息与预设的加密密钥计算得到的。
具体的，fuzzy vault算法可以将生物特征和密码学系统结合在一起，完成使用生物特征模板锁定密钥的功能，锁定后可以得到一个vault值。这里读取的所述vault值，就是步骤S103利用fuzzy vault算法根据所述授权用户的虹膜特征信息与所述预设的加密密钥生成的所述vault值的。读取所述vault值后，终端就可以通过执行步骤S203计算出所述解密密钥。
步骤S203，根据所述用户的虹膜特征信息以及所述vault值，计算解密密钥。
具体的，由于所述虹膜识别装置是利用fuzzy vault算法根据所述授权用户的虹膜特征信息与所述预设的加密密钥生成所述vault值的，因此这里可以采用fuzzy vault算法的解密算法确定所述解密密钥。具体实施中，可以根据所述用户的虹膜特征信息以及所述vault值，构造解密多项式函数，然后再根据所述解密多项式函数，确定所述解密密钥。
步骤S204，判断所述计算得到的解密密钥与所述预设的加密密钥是否匹配。
具体的，判断所述解密密钥与所述加密密钥是否匹配，就可以确定所述步骤S203中确定的所述解密密钥是否正确，也即所述用户的虹膜特征信息是否即为所述授权用户的虹膜特征信息。
步骤S205，若是，则确认虹膜识别成功。
具体的，若所述解密密钥与所述加密密钥匹配，则表示所述用户即为所述授权用户，则确认虹膜识别成功，进一步的可以为所述用户开启相应的授权功能或界面。需要说明的是，所述解密密钥与所述加密密钥不一定是完全一致的，可以允许它们之间有一定数值范围的误差。
本发明实施例通过获取用户的虹膜特征信息，读取预先生成的vault值，所述vault值是预先根据授权用户的虹膜特征信息与预设的加密密钥计算得到的，根据所述用户的虹膜特征信息以及所述vault值，计算解密密钥，判断所述计算得到的解密密钥与所述预设的加密密钥是否匹配，若是，则确认虹膜识别成功，实现了对终端进行加密保护的同时，有效防止虹膜特征信息的泄漏。
图3是本发明另一实施例中虹膜识别方法的流程示意图。如图所述本实施例的方法可以包括：
步骤S301，获取授权用户的验证虹膜特征信息。
具体方法参考步骤S101。
步骤S302，获取所述预设的加密密钥。
具体方法参考步骤S102。
步骤S303，根据所述加密密钥构造加密多项式函数。
具体的，所述装置可以根据在步骤S302中获取到的所述加密密钥，采用所述装置预设的加密多项式函数构造规则，构造出所述加密多项式函数。所述加密多项式函数构造规则就是将所述加密密钥转化成所述加密多项式的一种数学方法。例如，假设所述加密多项式函数构造规则为将所述加密密钥作为所述加密多项式函数的系数，以x为变量构造幂次多项式函数，那么当所述加密密钥为000000100000000100000001时，假设所述装置在运算域GF(28)上实现，则所述加密密钥即为(00000010)，(00000001)，(00000001)，转化成十进制即为2，1，1就可以作为所述加密多项式的系数，则可以构造一个所述加密多项式函数：2X2+X+1。进一步可选的，所述装置还可以使用预设的加密纠错码技术对所述加密密钥进行处理，并在所述加密密钥的后面接上所述纠错码技术产生的检验码，形成带检验码的加密密钥，然后使用所述带检验码的加密密钥构造所述加密多项式函数。
步骤S304，根据所述验证虹膜特征信息以及所述加密多项式函数，生成所述vault值并存储。
具体的，根据步骤S301中所述验证虹膜特征信息中的所述验证虹膜特征点信息，可以计算所述验证虹膜特征点信息经过(x，y)坐标级联之后的验证特征数值，然后计算所述验证特征数值在所述加密多项式函数上的映射点并与对应的特征数值组成映射点点对，然后再随机添加一系列杂凑点点对插入所述映射点点对中，最终得到所述vault值并存储在终端内。需要说明的是，所述杂凑点点对要求都不在所述加密多项式函数上并且要与所述验证虹膜特征信息的特征点有一定距离间隔。具体实施中，设一个所述验证虹膜特征点信息用三元组(x1，y1，θ1)表示，所述加密多项式函数为P，则可以先级联横纵坐标得到特征数值(x1|y1)，然后计算(x1|y1)在所述加密多项式函数P上的映射点P(x1|y1)，则所述映射点点对即为{(x1|y1)，P(x1|y1)}；之后，再随机添加一系列杂凑点点对插入所述映射点点对中，最终就可以得到所述vault值。举例来说，所述虹膜识别系统总共获取了4个所述验证虹膜特征点信息(x1，y1，θ1)～(x4，y4，θ4)，并计算出所述特征数值(X|Y)的集合为{-1，-2，2，4}，所述加密多项式P为2X2+X+1，那么所述映射点点对的集合 {(X|Y)，P(X|Y)}即为{(-1，2)，(-2，7)，(2，11)，(4，37)}，再插入三个所述杂凑点点对{(0，2)，(2，0)，(1，1)}，则最终得到的vault值即为{(-1，2)，(-2，7)，(2，11)，(4，37)，(0，2)，(2，0)，(1，1)}。
步骤S305，获取预先构造的所述加密哈希函数。
具体的，所述加密哈希函数是可以是所述装置出厂时已经设置好的，也可以是所述装置自动设置或者更新的，还可以是所述装置程序随机产生后选取的。所述加密哈希函数是哈希函数中的一种，所述哈希函数的功能是对口令或密码进行一次性的加密处理而形成杂凑字符串，并且这个加密的过程是不可逆的，也就是说，即便所述终端被入侵或是偷盗，也只能获得杂凑字符串，并且通过所述杂凑字符串是无法还原出原来的口令或密码的。
步骤S306，获取所述终端的设备标识信息。
具体的，所述设备标识信息是代表每个所述虹膜识别装置的唯一识别号码，一般是印在所述装置的外部或者存储在终端内。例如，若所述装置是移动终端(手机、ipad)，则可以获取它的IMEI(International Mobile Equipment Identity，移动设备国际识别码)；若所述装置是个人电脑，则可以获取它的MAC(Media Access Control，媒体访问控制)地址。因为所述IMEI或者所述MAC地址都是与移动终端或者个人电脑存在唯一的一一对应关系的。
步骤S307，将所述设备标识信息和所述加密密钥代入所述加密哈希函数，计算并存储所述加密哈希值。
具体的，根据步骤S305中获取到的预先构造的所述加密哈希函数，将所述设备标识信息和所述加密密钥代入，就可以计算得到所述加密哈希值。在这里，所述加密哈希函数就是为了避免所述加密密钥丢失造成安全隐患，因而再对其进行哈希函数加密，这样即使他人获取了所述加密哈希值也无法恢复出所述加密密钥。以最简单常见的哈希函数为例，若所述加密哈希函数采用直接取余法，即所述装置的设备标识信息与所述加密密钥进行除法后所得的余数就是所述加密哈希值，那么设所述装置的设备标识信息为35，所述加密密钥为24，那么hash(35，24)＝11，所述加密哈希值即为11。当有人获取到所述加密哈希值11后，也是无法通过所述加密哈希值11知道所述加密密钥是24的。
步骤S308，删除所述授权用户的验证虹膜特征信息以及所述加密密钥。
具体的，因为在解密所述装置时，可以不需要再用到所述授权用户的验证虹膜特征信息以及所述加密密钥，只需要通过对比所述加密哈希值和所述解密哈希值是否匹配即可，因此在执行完上述步骤S301～步骤307之后，就可以把所述授权用户的验证虹膜特征信息以及所述加密密钥彻底删除。这样做就可以保证即使其他人盗取或者入侵所述终端时，也是无法获得所述授权用户的验证虹膜特征信息的，这样就有效的防止了因虹膜模板被泄露以及盗用而产生的安全问题。
步骤S309，获取用户的虹膜特征信息。
具体方法可以参考步骤S201。
步骤S310，读取预先生成的vault值，所述vault值是预先根据授权用户的虹膜特征信息与预设的加密密钥计算得到的。
具体方法可以参考步骤S202。
步骤S311，根据所述用户的虹膜特征信息以及所述vault值，构造解密多项式函数。
具体的，根据步骤S309中所述虹膜特征信息中的所述虹膜特征点信息，可以计算所述虹膜特征点信息经过(x，y)坐标级联之后的特征数值，然后根据所述特征数值，在获取到的所述vault值中搜索与所述特征数值匹配的点作为候选点，如果所述用户为授权用户，这一步将会过滤掉大量的杂凑点点对；然后，在搜索到的所述候选点中使用Lagrange插值方法构造所述解密多项式函数。具体实施中，设一个所述虹膜特征点信息用三元组(x11，y11，θ11)表示，则可以先级联横纵坐标得到特征数值(x11|y11)；然后，搜索所述vault值中和所述特征数值(x11|y11)匹配的候选点点对{(x11|y11)，B(x11|y11)}，最后使用Lagrange插值方法构造相应的所述解密多项式函数。例如，所述虹膜识别系统总共获取了4个所述虹膜特征点信息(x11，y11，θ11)～(x44，y44，θ44)，并计算出所述用户的特征数值集合为{-1，-2，2，4}，在步骤S310中读取的所述vault值为{(-1，2)，(-2，7)，(2，11)，(4，37)，(0，2)，(2，0)，(1，1)}，则可以得出所述候选点点对为{(-1， 4)，(-2，11)，(2，7)，(4，29)}，通过Lagrange插值方法构造出的所述解密多项式函数即为2X2+X+1。
步骤S312，根据所述解密多项式函数，确定所述解密密钥。
具体的，在步骤S311中构造的所述解密多项式函数可以通过所述装置预设的解密密钥恢复规则，确定出所述解密密钥。所述解密密钥恢复规则就是将所述解密多项式函数转化成所述解密密钥的一种数学方法。例如，假设所述解密密钥恢复规则为将所述解密多项式函数的系数作为所述解密密钥，那么当所述解密多项式函数为2X2+X+1时，所述系数即为2，1，1，假设所述装置在运算域GF(28)上实现，那么所述解密密钥即为000000100000000100000001。进一步可选的，若在加密设置阶段所述装置使用预设的纠错码技术对所述加密密钥进行处理，那么在这一步骤中，装置可以先通过所述解密多项式函数确定带检验码的解密密钥，再通过使用所述纠错码技术来确定所述检验码，最后确定所述解密密钥。
步骤S313，获取终端的设备标识信息。
具体方法可以参考步骤S306。
步骤S314，将所述设备标识信息和所述解密密钥代入预先构造的加密哈希函数，计算解密哈希值。
具体的，可以根据预先构造的所述加密哈希函数，将所述设备标识信息和所述解密密钥代入，计算得到所述解密哈希值。以最简单常见的哈希函数为例，若所述加密哈希函数采用直接取余法，即所述装置的设备标识信息与所述解密密钥进行除法后所得的余数就是所述解密哈希值，那么设所述装置的设备标识信息为35，所述解密密钥为24，那么hash(35，24)＝11，所述解密哈希值即为11。
步骤S315，判断所述解密哈希值与加密哈希值是否匹配，所述加密哈希值是所述设备标识信息和所述加密密钥代入所述加密哈希函数计算得到的。
具体的，所述装置根据步骤S307得到的所述加密哈希值以及步骤S314得到的所述解密哈希值，判断所述解密哈希值与加密哈希值是否匹配，就可以确定所述步骤S312中确定的所述解密密钥是否正确，也即所述用户的虹膜特 征信息是否即为所述授权用户的虹膜特征信息。
步骤S316，若是，则确认虹膜识别成功。
具体的，若所述解密哈希值与所述加密哈希值匹配，则表示所述用户即为所述授权用户，则确认虹膜识别成功，进一步的可以为所述用户开启相应的授权功能或界面。需要说明的是，所述解密哈希值与所述加密哈希值不一定是完全一致的，可以允许它们之间有一定数值范围的误差。
本发明实施例通过获取用户的虹膜特征信息；读取预先生成的vault值，所述vault值是预先根据授权用户的虹膜特征信息与预设的加密密钥计算得到的；根据所述用户的虹膜特征信息以及所述vault值，计算解密密钥；判断所述计算得到的解密密钥与所述预设的加密密钥是否匹配；若是，则确认虹膜识别成功，实现了对终端进行加密保护的同时，有效防止虹膜特征信息的泄漏。
图4是本发明实施例中一种虹膜识别装置的组成结构示意图，所述虹膜识别装置可以为用户终端或运行在用户终端的软件程序，所述用户终端可以包括手机、笔记本电脑、平板电脑、车载电脑、POS(Point Of Sales，销售点)机等。如图所示所述装置可以包括：
虹膜获取模块410，用于获取用户的虹膜特征信息。
具体的，虹膜获取模块410可以先通过终端摄像头或者其他摄像设备获取所述用户的眼部图像，再从所述眼部图像中采集所述虹膜特征信息，也可以直接采集所述用户的虹膜特征信息。所述的虹膜特征信息中包括多个虹膜特征点信息，所述虹膜特征点信息又包含了能反映所述用户虹膜特征的特征点的坐标、角度、位置等信息。需要说明的是，获取和采集的所述虹膜特征的特征点是由所述虹膜获取模块410预设的，例如所述虹膜获取模块410预设要采集虹膜与瞳孔边界的特征点、虹膜与虹膜边界的特征点、虹膜与眼球中心距离相同的特征点等等。举例来说，所述虹膜获取模块410总共获取了20个所述虹膜特征点信息，若设一个所述虹膜特征点信息用三元组(x11，y11，θ11)表示，其中(x，y)表示虹膜特征点所在平面坐标的位置，θ表示所述虹膜特征点的方向，则所述虹膜特征信息即为(x11，y11，θ11)～(x2020，y2020，θ2020) 的所述虹膜特征点信息的集合。具体实施中，虹膜获取模块410可以提示所述用户将眼部对准摄像头进行眼部图像采集，若采集到的所述眼部图像完整且细节信息清晰，则对虹膜特征信息进行采集；若采集到的所述眼部图像不完整或细节信息不够清晰，则虹膜获取模块410需要再次获取所述用户的眼部图像，直到所述用户的眼部图像完整且细节信息清晰。获取到清晰的眼部图像之后，虹膜获取模块410需要对所述眼部图像进行预处理。首先，需要检测眼部图像中虹膜与瞳孔的边界、虹膜与巩膜的边界、虹膜与上眼皮的边界以及虹膜与下眼皮的边界这几项特征的位置，以确定所述眼部图像中虹膜的位置；之后，虹膜获取模块410就可以参照所述虹膜的位置，提取所述用户的虹膜特征信息；最后将所述虹膜特征信息进行归一化处理，即将所述虹膜特征信息调整到虹膜识别系统预设的固定尺寸，以保证对所述虹膜特征信息的精确识别；归一化之后的所述虹膜特征信息可以进行增强处理，例如调节亮度、对比度和平滑度等等指标，以提高对所述虹膜特征信息的识别率。
所述虹膜获取模块410还用于：获取授权用户的验证虹膜特征信息。
具体的，虹膜获取模块410可以先通过终端摄像头或者其他摄像设备获取所述授权用户的眼部图像，再从所述眼部图像中采集所述虹膜特征信息，也可以直接采集所述用户的虹膜特征信息。所述的验证虹膜特征信息中包括多个验证虹膜特征点信息，所述验证虹膜特征点信息又包含了能反映所述授权用户虹膜特征的特征点的坐标、角度、位置等信息。需要说明的是，获取和采集的所述验证虹膜特征的特征点是由所述虹膜获取模块410预设的，例如所述装置预设要采集虹膜与瞳孔边界的特征点、虹膜与虹膜边界的特征点、虹膜与眼球中心距离相同的特征点等等。举例来说，所述虹膜识别系统总共获取了20个所述验证虹膜特征点信息，若设一个所述验证虹膜特征点信息用三元组(x1，y1，θ1)表示，其中(x，y)表示验证虹膜特征点所在平面坐标的位置，θ表示所述验证虹膜特征点的方向，则所述验证虹膜特征信息即为(x1，y1，θ1)～(x20，y20，θ20)的所述验证虹膜特征点信息的集合。
vault值读取模块412，用于读取预先生成的vault值，所述vault值是预先根据授权用户的虹膜特征信息与预设的加密密钥计算得到的。
具体的，fuzzy vault算法可以将生物特征和密码学系统结合在一起，完成使用生物特征模板锁定密钥的功能，锁定后可以得到一个vault值。这里读取的所述vault值，就是利用fuzzy vault算法根据所述授权用户的虹膜特征信息与所述预设的加密密钥生成的所述vault值。vault值读取模块412读取所述vault值后，终端就可以通过解密密钥模块414计算出所述解密密钥。
解密密钥模块414，用于根据所述用户的虹膜特征信息以及所述vault值，计算解密密钥。
具体的，由于所述虹膜识别装置是利用fuzzy vault算法根据所述授权用户的虹膜特征信息与所述预设的加密密钥生成所述vault值的，因此这里可以采用fuzzy vault算法的解密确定所述解密密钥。具体实施中，可以根据所述用户的虹膜特征信息以及所述vault值，构造解密多项式函数，然后再根据所述解密多项式函数，确定所述解密密钥。
所述解密密钥模块414包括：解密多项式单元414a和解密密钥确定单元414b，如图5所示。
解密多项式单元414a，用于根据所述用户的虹膜特征信息以及所述vault值，构造解密多项式函数。
具体的，根据虹膜获取模块410中所述虹膜特征信息中的所述虹膜特征点信息，可以计算所述虹膜特征点信息经过(x，y)坐标级联之后的特征数值，然后根据所述特征数值，在获取到的所述vault值中搜索与所述特征数值匹配的点作为候选点，如果所述用户为授权用户，这一步将会过滤掉大量的杂凑点点对；然后，在搜索到的所述候选点中使用Lagrange插值方法构造所述解密多项式函数。具体实施中，设一个所述虹膜特征点信息用三元组(x11，y11，θ11)表示，则可以先级联横纵坐标得到特征数值(x11|y11)；然后，搜索所述vault值中和所述特征数值(x11|y11)匹配的候选点点对{(x11|y11)，B(x11|y11)}，最后使用Lagrange插值方法构造相应的所述解密多项式函数。例如，所述虹膜获取模块410总共获取了4个所述虹膜特征点信息(x11，y11，θ11)～(x44，y44，θ44)，并计算出所述用户的特征数值集合为{-1，-2，2，4}，在vault值读取模块412读取的所述vault值为{(-1，2)，(-2， 7)，(2，11)，(4，37)，(0，2)，(2，0)，(1，1)}，则可以得出所述候选点点对为{(-1，4)，(-2，11)，(2，7)，(4，29)}，通过Lagrange插值方法构造出的所述解密多项式函数即为2X2+X+1。
解密密钥确定单元414b，用于根据所述解密多项式函数，确定所述解密密钥。
具体的，在解密多项式单元414a中构造的所述解密多项式函数可以通过所述装置预设的解密密钥恢复规则，确定出所述解密密钥。所述解密密钥恢复规则就是将所述解密多项式函数转化成所述解密密钥的一种数学方法。例如，假设所述解密密钥恢复规则为将所述解密多项式函数的系数作为所述解密密钥，那么当所述解密多项式函数为2X2+X+1时，所述系数即为2，1，1，假设所述装置在运算域GF(28)上实现，那么所述解密密钥即为000000100000000100000001。进一步可选的，若在加密设置阶段所述装置使用预设的纠错码技术对所述加密密钥进行处理，那么在这一步骤中，装置可以先通过所述解密多项式函数确定带检验码的解密密钥，再通过使用所述纠错码技术来确定所述检验码，最后确定所述解密密钥。
密钥匹配模块416，用于判断所述计算得到的解密密钥与所述预设的加密密钥是否匹配。
具体的，密钥匹配模块416通过判断所述解密密钥与所述加密密钥是否匹配，就可以确定所述解密密钥是否正确，也即所述用户的虹膜特征信息是否即为所述授权用户的虹膜特征信息。
进一步可选的，所述密钥匹配模块416还可以包括：标识获取单元416a、解密哈希值单元416b和哈希值匹配单元416c，如图6所示。
标识获取单元416a，用于获取终端的设备标识信息。
具体的，所述设备标识信息是代表每个终端的唯一识别号码，一般是印在终端的外部或者存储在终端内。例如，若所述终端是移动终端(手机、ipad)，则标识获取单元416a可以获取它的IMEI(International Mobile Equipment Identity，移动设备国际识别码)；若所述终端是个人电脑，则标识获取单元416a可以获取它的MAC(Media Access Control，媒体访问控制)地址。因为所述 IMEI或者所述MAC地址都是与移动终端或者个人电脑存在唯一的一一对应关系的。
解密哈希值单元416b，用于将所述设备标识信息和所述解密密钥代入预先构造的加密哈希函数，计算解密哈希值。
具体的，解密哈希值单元416b可以根据预先构造的所述加密哈希函数，将所述设备标识信息和所述解密密钥代入，计算得到所述解密哈希值。以最简单常见的哈希函数为例，若所述加密哈希函数采用直接取余法，即所述装置的设备标识信息与所述解密密钥进行除法后所得的余数就是所述解密哈希值，那么设所述装置的设备标识信息为35，所述解密密钥为24，那么hash(35，24)＝11，所述解密哈希值即为11。
哈希值匹配单元416c，用于判断所述解密哈希值与加密哈希值是否匹配，所述加密哈希值是所述设备标识信息和所述加密密钥代入所述加密哈希函数计算得到的。
具体的，所述装置在加密设置阶段已经根据所述加密哈希函数得到了所述加密哈希值，则哈希值匹配单元416c通过判断所述解密哈希值与加密哈希值是否匹配，就可以确定所述解密密钥是否正确，也即所述用户的虹膜特征信息是否即为所述授权用户的虹膜特征信息。
识别确认模块418，用于若所述计算得到的解密密钥与所述预设的加密密钥匹配时，确认虹膜识别成功。
具体的，若所述解密密钥与所述加密密钥匹配，则表示所述用户即为所述授权用户，则确认虹膜识别成功，进一步的可以为所述用户开启相应的授权功能或界面。需要说明的是，所述解密密钥与所述加密密钥不一定是完全一致的，可以允许它们之间有一定数值范围的误差。
可选的，若所述解密哈希值与所述加密哈希值匹配，则表示所述用户即为所述授权用户，则确认虹膜识别成功，进一步的可以为所述用户开启相应的授权功能或界面。需要说明的是，所述解密哈希值与所述加密哈希值不一定是完全一致的，可以允许它们之间有一定数值范围的误差。
进一步的，所述装置还包括：
加密密钥模块420，用于获取所述预设的加密密钥。
具体的，所述预设的加密密钥可以是所述虹膜识别装置出厂时已经设置好的，也可以是所述授权用户自己设置或者更改的，还可以是通过提取所述虹膜特征信息中的近似均匀分布的随机数据得到的。因此，加密密钥模块420只需要直接获取所述加密密钥用于vault值模块422即可。例如，若所述加密密钥为000010010000001100000001，假设所述装置在运算域GF(28)上实现，则所述加密密钥即为(00001001)，(00000011)，(00000001)，转化成十进制即为9，3，1。
vault值模块422，用于根据所述授权用户的验证虹膜特征信息以及所述加密密钥，生成所述vault值并存储。
具体的，fuzzy vault算法可以将生物特征和密码学系统结合在一起，完成使用生物特征模板锁定密钥的功能，锁定后可以得到一个vault值。这里所述vault值模块422就是利用fuzzy vault算法根据所述授权用户的虹膜特征信息与所述预设的加密密钥生成所述vault值的。具体实施中，可以将所述加密密钥作为系数构造一个加密多项式函数，然后再根据所述验证虹膜特征信息以及所述加密多项式函数，生成所述vault值。
所述vault值模块422包括：加密多项式单元422a和vault值生成单元422b，如图7所示。
加密多项式单元422a，用于根据所述加密密钥构造加密多项式函数。
具体的，加密多项式单元422a可以根据在加密密钥模块420中获取到的所述加密密钥，采用所述加密多项式单元422a预设的加密多项式函数构造规则，构造出所述加密多项式函数。所述加密多项式函数构造规则就是将所述加密密钥转化成所述加密多项式的一种数学方法。例如，假设所述加密多项式函数构造规则为将所述加密密钥作为所述加密多项式函数的系数，以x为变量构造幂次多项式函数，那么当所述加密密钥为000000100000000100000001时，假设所述装置在运算域GF(28)上实现，则所述加密密钥即为(00000010)，(00000001)，(00000001)，转化成十进制即为2，1，1就可以作为所述加密多项式的系数，则可以构造一个所述加密多项式函数：2X2+X+1。进一步 可选的，所述加密多项式单元422a还可以使用预设的加密纠错码技术对所述加密密钥进行处理，并在所述加密密钥的后面接上所述纠错码技术产生的检验码，形成带检验码的加密密钥，然后使用所述带检验码的加密密钥构造所述加密多项式函数。
vault值生成单元422b，用于根据所述验证虹膜特征信息以及所述加密多项式函数，生成所述vault值并存储。
具体的，根据虹膜获取模块410中所述验证虹膜特征信息中的所述验证虹膜特征点信息，vault值生成单元422b可以计算所述验证虹膜特征点信息经过(x，y)坐标级联之后的验证特征数值，然后计算所述验证特征数值在所述加密多项式函数上的映射点并与对应的特征数值组成映射点点对，然后再随机添加一系列杂凑点点对插入所述映射点点对中，最终得到所述vault值并存储在终端内。需要说明的是，所述杂凑点点对要求都不在所述加密多项式函数上并且要与所述验证虹膜特征信息的特征点有一定距离间隔。具体实施中，设一个所述验证虹膜特征点信息用三元组(x1，y1，θ1)表示，所述加密多项式函数为P，则可以先级联横纵坐标得到特征数值(x1|y1)，然后计算(x1|y1)在所述加密多项式函数P上的映射点P(x1|y1)，则所述映射点点对即为{(x1|y1)，P(x1|y1)}；之后，再随机添加一系列杂凑点点对插入所述映射点点对中，最终就可以得到所述vault值。举例来说，所述虹膜获取模块410总共获取了4个所述验证虹膜特征点信息(x1，y1，θ1)～(x4，y4，θ4)，并计算出所述特征数值(X|Y)的集合为{-1，-2，2，4}，所述加密多项式P为2X2+X+1，那么所述映射点点对的集合{(X|Y)，P(X|Y)}即为{(-1，2)，(-2，7)，(2，11)，(4，37)}，再插入三个所述杂凑点点对{(0，2)，(2，0)，(1，1)}，则最终得到的vault值即为{(-1，2)，(-2，7)，(2，11)，(4，37)，(0，2)，(2，0)，(1，1)}。
删除模块424，用于删除所述授权用户的验证虹膜特征信息。
具体的，在解密所述终端时，不需要再用到所述授权用户的验证虹膜特征信息，因此在加密设置阶段完成之后，删除模块424即可把所述授权用户的验证虹膜特征信息彻底删除。这样做就可以保证即使其他人盗取或者入侵所述终 端时，也无法获得所述授权用户的验证虹膜特征信息，这样就有效的防止了因虹膜模板被泄露以及盗用而产生的安全问题。
可选的，所述删除模块用于：删除所述授权用户的验证虹膜特征信息以及所述加密密钥。
具体的，在解密所述终端时，不需要再用到所述授权用户的验证虹膜特征信息以及所述加密密钥，因此在加密设置阶段完成之后，删除模块424即可把所述授权用户的验证虹膜特征信息以及所述加密密钥彻底删除。
进一步可选的，所述装置还包括：
加密哈希函数模块426，用于获取预先构造的所述加密哈希函数。
具体的，所述加密哈希函数是可以是所述装置出厂时已经设置好的，也可以是所述装置自动设置或者更新的，还可以是所述装置程序随机产生后选取的。所述加密哈希函数是哈希函数中的一种，所述哈希函数的功能是对口令或密码进行一次性的加密处理而形成杂凑字符串，并且这个加密的过程是不可逆的，也就是说，即便所述终端被入侵或是偷盗，也只能获得杂凑字符串，并且通过所述杂凑字符串是无法还原出原来的口令或密码的。
加密哈希值模块428，用于将所述设备标识信息和所述加密密钥代入所述加密哈希函数，计算并存储所述加密哈希值。
根据加密哈希函数模块426中获取到的预先构造的所述加密哈希函数，将所述设备标识信息和所述加密密钥代入，就可以计算得到所述加密哈希值。在这里，所述加密哈希函数就是为了避免所述加密密钥丢失造成安全隐患，因而再对其进行哈希函数加密，这样即使他人获取了所述加密哈希值也无法恢复出所述加密密钥。以最简单常见的哈希函数为例，若所述加密哈希函数采用直接取余法，即所述装置的设备标识信息与所述加密密钥进行除法后所得的余数就是所述加密哈希值，那么设所述装置的设备标识信息为35，所述加密密钥为24，那么hash(35，24)＝11，所述加密哈希值即为11。当有人获取到所述加密哈希值11后，也是无法通过所述加密哈希值11知道所述加密密钥是24的。
本发明实施例通过获取用户的虹膜特征信息；读取预先生成的vault值，所述vault值是预先根据授权用户的虹膜特征信息与预设的加密密钥计算得到 的；根据所述用户的虹膜特征信息以及所述vault值，计算解密密钥；判断所述计算得到的解密密钥与所述预设的加密密钥是否匹配；若是，则确认虹膜识别成功，实现了对终端进行加密保护的同时，有效防止虹膜特征信息的泄漏。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，是可以通过计算机程序来指令相关的硬件来完成，所述的程序可存储于一计算机可读取存储介质中，该程序在执行时，可包括如上述各方法的实施例的流程。其中，所述的存储介质可为磁碟、光盘、只读存储记忆体(Read-Only Memory，ROM)或随机存储记忆体(Random Access Memory，RAM)等。
以上所揭露的仅为本发明较佳实施例而已，当然不能以此来限定本发明之权利范围，因此依本发明权利要求所作的等同变化，仍属本发明所涵盖的范围。

Claims (12)

  1. 一种虹膜识别方法，其特征在于，所述方法包括：
    获取用户的虹膜特征信息；
    读取预先生成的vault值，所述vault值是预先根据授权用户的虹膜特征信息与预设的加密密钥计算得到的；
    根据所述用户的虹膜特征信息以及所述vault值，计算解密密钥；
    判断所述计算得到的解密密钥与所述预设的加密密钥是否匹配；
    若是，则确认虹膜识别成功。
  2. 如权利要求1所述的虹膜识别方法，其特征在于，所述判断所述计算得到的解密密钥与所述预设的加密密钥是否匹配包括：
    获取终端的设备标识信息；
    将所述设备标识信息和所述解密密钥代入预先构造的加密哈希函数，计算解密哈希值；
    判断所述解密哈希值与加密哈希值是否匹配，所述加密哈希值是所述设备标识信息和所述加密密钥代入所述加密哈希函数计算得到的。
  3. 如权利要求1所述的虹膜识别方法，其特征在于，所述根据所述用户的虹膜特征信息以及所述vault值，计算解密密钥包括：
    根据所述用户的虹膜特征信息以及所述vault值，构造解密多项式函数；
    根据所述解密多项式函数，确定所述解密密钥。
  4. 如权利要求1所述的虹膜识别方法，其特征在于，所述获取用户的虹膜特征信息之前还包括：
    获取授权用户的验证虹膜特征信息；
    获取所述预设的加密密钥；
    根据所述授权用户的验证虹膜特征信息以及所述加密密钥，生成所述vault值并存储；
    删除所述授权用户的验证虹膜特征信息。
  5. 如权利要求4所述的虹膜识别方法，其特征在于，所述根据所述授权用户的验证虹膜特征信息以及所述加密密钥，生成所述vault值并存储之后还 包括：
    获取预先构造的加密哈希函数；
    获取所述终端的设备标识信息；
    将所述设备标识信息和所述加密密钥代入所述加密哈希函数，计算并存储所述加密哈希值；
    所述删除所述授权用户的验证虹膜特征信息包括：
    删除所述授权用户的验证虹膜特征信息以及所述加密密钥。
  6. 如权利要求4所述的虹膜识别方法，其特征在于，所述根据所述授权用户的验证虹膜特征信息以及所述加密密钥，生成所述vault值并存储包括：
    根据所述加密密钥构造加密多项式函数；
    根据所述验证虹膜特征信息以及所述加密多项式函数，生成所述vault值并存储。
  7. 一种虹膜识别装置，其特征在于，所述装置包括：
    虹膜获取模块，用于获取用户的虹膜特征信息；
    vault值读取模块，用于读取预先生成的vault值，所述vault值是预先根据授权用户的虹膜特征信息与预设的加密密钥计算得到的；
    解密密钥模块，用于根据所述用户的虹膜特征信息以及所述vault值，计算解密密钥；
    密钥匹配模块，用于判断所述计算得到的解密密钥与所述预设的加密密钥是否匹配；
    识别确认模块，用于若所述计算得到的解密密钥与所述预设的加密密钥匹配时，确认虹膜识别成功。
  8. 如权利要求7所述的虹膜识别装置，其特征在于，所述密钥匹配模块包括：
    标识获取单元，用于获取终端的设备标识信息；
    解密哈希值单元，用于将所述设备标识信息和所述解密密钥代入预先构造的加密哈希函数，计算解密哈希值；
    哈希值匹配单元，用于判断所述解密哈希值与加密哈希值是否匹配，所述 加密哈希值是所述设备标识信息和所述加密密钥代入所述加密哈希函数计算得到的。
  9. 如权利要求7所述的虹膜识别装置，其特征在于，所述解密密钥模块包括：
    解密多项式单元，用于根据所述用户的虹膜特征信息以及所述vault值，构造解密多项式函数；
    解密密钥确定单元，用于根据所述解密多项式函数，确定所述解密密钥。
  10. 如权利要求7所述的虹膜识别装置，其特征在于，所述虹膜获取模块还用于：
    获取授权用户的验证虹膜特征信息；
    所述装置还包括：
    加密密钥模块，用于获取所述预设的加密密钥；
    vault值模块，用于根据所述授权用户的验证虹膜特征信息以及所述加密密钥，生成所述vault值并存储；
    删除模块，用于删除所述授权用户的验证虹膜特征信息。
  11. 如权利要求10所述的虹膜识别装置，其特征在于，所述装置还包括：
    加密哈希函数模块，用于获取预先构造的加密哈希函数；
    加密哈希值模块，用于将所述设备标识信息和所述加密密钥代入所述加密哈希函数，计算并存储所述加密哈希值；
    所述删除模块用于：
    删除所述授权用户的验证虹膜特征信息以及所述加密密钥。
  12. 如权利要求10所述的虹膜识别装置，其特征在于，所述vault值模块包括：
    加密多项式单元，用于根据所述加密密钥构造加密多项式函数；
    vault值生成单元，用于根据所述验证虹膜特征信息以及所述加密多项式函数，生成所述vault值并存储。
PCT/CN2015/095665 2015-07-08 2015-11-26 一种虹膜识别方法及装置 WO2017004926A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510399063.3A CN105550626B (zh) 2015-07-08 2015-07-08 一种虹膜识别方法及装置
CN201510399063.3 2015-07-08

Publications (1)

Publication Number Publication Date
WO2017004926A1 true WO2017004926A1 (zh) 2017-01-12

Family

ID=55829810

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/095665 WO2017004926A1 (zh) 2015-07-08 2015-11-26 一种虹膜识别方法及装置

Country Status (2)

Country Link
CN (1) CN105550626B (zh)
WO (1) WO2017004926A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109858431A (zh) * 2019-01-28 2019-06-07 深圳市力川智控科技有限公司 基于虹膜识别技术创建分区和加/解密的方法及系统
CN111967426A (zh) * 2020-08-27 2020-11-20 平安国际智慧城市科技股份有限公司 车辆重识别方法、装置、电子设备及介质
CN117240625A (zh) * 2023-11-14 2023-12-15 武汉海昌信息技术有限公司 一种涉及防篡改的数据处理方法、装置及电子设备

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107386827B (zh) * 2017-09-22 2023-06-09 贵州维讯光电科技有限公司 一种门锁用虹膜摄像头智能识别系统
CN108681698B (zh) * 2018-04-28 2021-03-16 武汉大学 一种具有隐私保护功能的大规模虹膜识别方法
CN108648307A (zh) * 2018-05-09 2018-10-12 青岛职业技术学院 一种应用电子密码的门禁系统
CN110826038B (zh) * 2019-10-18 2022-05-24 武汉虹识技术有限公司 数据加解密方法及装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1859095A (zh) * 2005-10-18 2006-11-08 华为技术有限公司 一种通过生物识别认证用户身份的方法
CN101282217A (zh) * 2007-04-05 2008-10-08 华为技术有限公司 一种生物特征数据的保护方法、装置及系统
GB2460924A (en) * 2008-06-17 2009-12-23 Lenovo Converting user identification from one type input by the user to another type for input to a system
US20110037563A1 (en) * 2009-08-17 2011-02-17 Electronics And Telecommunictions Research Institute Apparatus and method for biometric registration and authentication
CN104751042A (zh) * 2015-01-16 2015-07-01 西安电子科技大学 基于密码哈希与生物特征识别的可信性检测方法

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101369892B (zh) * 2008-08-08 2010-10-13 西安电子科技大学 一种增强指纹Fuzzy Vault系统安全性的方法
CN101777115B (zh) * 2009-11-25 2012-02-15 中国科学院自动化研究所 一种安全的指纹认证方法及系统
FR3015724B1 (fr) * 2013-12-19 2016-01-22 Morpho Elements secondaires dans un encodage de type fuzzy vault

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1859095A (zh) * 2005-10-18 2006-11-08 华为技术有限公司 一种通过生物识别认证用户身份的方法
CN101282217A (zh) * 2007-04-05 2008-10-08 华为技术有限公司 一种生物特征数据的保护方法、装置及系统
GB2460924A (en) * 2008-06-17 2009-12-23 Lenovo Converting user identification from one type input by the user to another type for input to a system
US20110037563A1 (en) * 2009-08-17 2011-02-17 Electronics And Telecommunictions Research Institute Apparatus and method for biometric registration and authentication
CN104751042A (zh) * 2015-01-16 2015-07-01 西安电子科技大学 基于密码哈希与生物特征识别的可信性检测方法

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109858431A (zh) * 2019-01-28 2019-06-07 深圳市力川智控科技有限公司 基于虹膜识别技术创建分区和加/解密的方法及系统
CN109858431B (zh) * 2019-01-28 2023-08-11 深圳市华弘智谷科技有限公司 基于虹膜识别技术创建分区和加/解密的方法及系统
CN111967426A (zh) * 2020-08-27 2020-11-20 平安国际智慧城市科技股份有限公司 车辆重识别方法、装置、电子设备及介质
CN117240625A (zh) * 2023-11-14 2023-12-15 武汉海昌信息技术有限公司 一种涉及防篡改的数据处理方法、装置及电子设备
CN117240625B (zh) * 2023-11-14 2024-01-12 武汉海昌信息技术有限公司 一种涉及防篡改的数据处理方法、装置及电子设备

Also Published As

Publication number Publication date
CN105550626A (zh) 2016-05-04
CN105550626B (zh) 2019-03-22

Similar Documents

Publication Publication Date Title
KR102328725B1 (ko) 하나의 장치를 이용하여 다른 장치를 언로크하는 방법
WO2017004926A1 (zh) 一种虹膜识别方法及装置
ES2818199T3 (es) Método de verificación de seguridad con base en una característica biométrica, un terminal de cliente y un servidor
US9218473B2 (en) Creation and authentication of biometric information
US20100138667A1 (en) Authentication using stored biometric data
US10511438B2 (en) Method, system and apparatus using forward-secure cryptography for passcode verification
JP2008538146A (ja) バイオメトリック・テンプレートのプライバシー保護のためのアーキテクチャ
CA2686801C (en) Authetication using stored biometric data
US12019719B2 (en) Method and electronic device for authenticating a user
KR102266065B1 (ko) 얼굴 이미지 매칭률 기반의 사용자 인증을 통해 보안 문서에 대한 권한을 제공하는 전자 단말 장치 및 그 동작 방법
KR102266068B1 (ko) 얼굴인식을 기반으로 한 사용자 인증을 통해 보안 문서에 대한 권한을 부여하는 문서 관리 서버 및 그 동작 방법

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15897580

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15897580

Country of ref document: EP

Kind code of ref document: A1