WO2017012175A1

WO2017012175A1 - Identity authentication method, identity authentication system, terminal and server

Info

Publication number: WO2017012175A1
Application number: PCT/CN2015/088472
Authority: WO
Inventors: 钟焰涛; 傅文治; 林荣辉
Original assignee: 宇龙计算机通信科技(深圳)有限公司
Priority date: 2015-07-23
Filing date: 2015-08-30
Publication date: 2017-01-26
Also published as: CN105635099A

Abstract

Proposed are an identity authentication method, an identity authentication system, a terminal and a server. The identity authentication method comprises: acquiring first biological characteristic information about a pre-set user; and expressing at least one piece of first attribute information of the first biological characteristic information in a vector form and carrying out homomorphic encryption processing on the at least one piece of first attribute information, which is expressed in the vector form, according to a pre-set key pair, so as to generate a first biological characteristic vector; and sending the first biological characteristic vector to the server and storing the first biological characteristic vector as a first biological characteristic template vector by the server. The solution realizes safety storage and efficient authentication of biological characteristic information about a user.

Description

Identity authentication method, identity authentication system, terminal and server

Technical field

The present invention relates to the field of biometrics, and in particular to an identity authentication method, an identity authentication system, a terminal, and a server.

Background technique

At present, biometric technology refers to the technology of using human biometrics for identity authentication. Common biometric technologies include fingerprint recognition, face recognition, and iris recognition.

Integrating biometric technology on mobile terminals (such as mobile phones) can effectively protect the security of information on mobile terminals. The storage of biometric template data is a key issue because malicious programs on mobile terminals may steal storage on mobile terminals. The biometric template data makes it easy to pass biometric authentication, leading to the leakage of important information and giving users a bad experience.

Homomorphic encryption is a special encryption technique that allows people to perform specific algebraic operations on ciphertext and obtain the same results as the plaintext. In other words, this technology allows people to operate on encrypted data to get the right results without having to decrypt the data throughout the process. However, the current homomorphic encryption technology cannot be directly applied to complex operations such as biometric template matching.

Therefore, a new identity authentication method is needed, which can combine biometric technology with homomorphic encryption technology, so that the server can perform correct biometric information matching without decryption, and can effectively avoid the prior art. The problem that the user biometric information is stored on the terminal and the server is easily maliciously stolen, and the security and reliability of the identity authentication based on the biometric information is improved, thereby improving the user experience.

Summary of the invention

The invention is based on the above problems, and proposes a new technical solution. By combining the biometric identification technology with the homomorphic encryption technology, the server can perform correct biometric information matching without decryption, and effectively avoid the present In the technology, the user biometric information is stored on the terminal. The problem of being easily stolen by malicious people realizes the secure storage of biometric information of users, improves the security and reliability of identity authentication based on biometric information, and improves the user experience.

In view of this, in a first aspect of the present invention, an identity authentication method is provided for a terminal, including: collecting first biometric information of a preset user; and at least one of the first biometric information is first The attribute information is represented in a vector form, and homomorphicly encrypts the at least one first attribute information represented by a vector form according to a preset key to generate a first biometric vector; and the first biometric vector is Sending to a server for the server to store the first biometric vector as a first biometric template vector.

In the technical solution, the pre-storing process of the first biometric template vector is first performed, and specifically, the first attribute information that can be used for identity authentication in the first biometric information of the collected preset user is represented by a vector form. Wherein, the first attribute information for identity authentication has one or more items, and each first attribute information is represented by a vector form, thereby obtaining a vector group representing the first biometric information, according to the stored preset The key performs homomorphic encryption on each of the vector vectors in the vector group to obtain the first biometric vector, and then sends the first object feature vector to the server, which is stored by the server as the first biometric template vector. The preset key may be randomly generated by the terminal, or may be set according to actual needs of the user, and finally stored in the terminal, and the first biometric template vector generated by homomorphic encryption is stored in the server, and used. The decrypted preset key is stored in the terminal, and the server cannot know the preset key, so by using the biometric technology The combination of encryption technology enables the server to perform correct biometric information matching without decryption, and can effectively avoid the problem that the user biometric information is easily maliciously stolen on the terminal in the prior art, and the user creature is realized. The secure storage of feature information improves the security and reliability of identity authentication based on biometric information, thereby improving the user experience.

In the above technical solution, preferably, the method further includes: collecting second biometric information of the current user; and expressing at least one second attribute information of the second biometric information in a vector form, and according to the preset secret The key pair performs homomorphic encryption processing on the at least one second attribute information represented by the vector form to generate a second biometric vector; and sends the second biometric vector to the server for the server to Generating a first Euclidean distance from the first biometric template vector; receiving the first Euclidean distance from the server; performing homomorphic decryption processing on the first Euclidean distance Obtaining a second Euclidean distance; according to the second Euclidean The distance determines whether the second biometric information matches the first biometric information to determine whether the identity authentication is successful.

In the technical solution, the second attribute information that is available for identity authentication in the collected second biometric information of the current user is represented in a vector form, wherein the second attribute information that can be authenticated has one or more And each of the second attribute information is represented by a vector form, and a vector group representing the second biometric information is obtained, and each sub-vector in the vector group is homomorphically encrypted according to the preset key. Obtaining a second biometric vector, and then transmitting the second biometric vector to the server, so that the server calculates the first biometric vector and the first biometric template vector of the pre-stored first biometric template vector without decrypting The distance, of course, the first Euclidean distance is also encrypted, and the server cannot know the specific result of the first Euclidean distance. Thus, the server can be prevented from abusing the user's first biometric template vector, ensuring the security of the matching result.

In addition, by storing the first biometric template vector in the server, compared with the prior art, the problem that the first biometric template vector is easily maliciously stolen on the terminal is avoided, and the server will calculate the first The Euclidean distance is sent to the terminal, and is homomorphically decrypted by the terminal to obtain a second Euclidean distance, thereby determining whether the second biometric information matches the first biometric information according to the second Euclidean distance to determine whether Whether the identity authentication is successful, that is, the preset key used for the homomorphic decryption is stored in the terminal, and the server cannot know the preset key, thereby further ensuring the security and reliability of the identity authentication.

By combining biometric technology with homomorphic encryption technology, the server can perform correct biometric information matching without decryption, and can effectively avoid the prior art that the user biometric information is easily maliciously stored on the terminal. The problem of stealing realizes the secure storage of user biometric information, improves the security and reliability of identity authentication based on biometric information, and improves the user experience.

In the above technical solution, preferably, determining whether the second biometric information matches the first biometric information according to the second Euclidean distance, to determine whether the identity authentication is successful, specifically, determining: Whether the second Euclidean distance is less than or equal to the preset distance; and when it is determined that the second Euclidean distance is less than or equal to the preset distance, the second biometric information is successfully matched with the first biometric information, The identity authentication succeeds; when it is determined that the second Euclidean distance is greater than the preset distance, the second biometric information is mismatched with the first biometric information. If it fails, the identity authentication fails.

In the technical solution, whether the second biometric information matches the first biometric information is determined by the second Euclidean distance, and the second Euclidean distance and the preset distance are determined to determine whether the matching is When the second Euclidean distance is determined to be less than or equal to the preset distance, the second biometric information is successfully matched with the first biometric information, indicating that the user identity authentication is successful, otherwise, the identity authentication fails, and thus, effective The problem that the first biometric template vector is easily maliciously stolen on the terminal is avoided in the prior art, and the security and reliability of the biometric information based identity authentication are improved, thereby improving the user experience. The preset distance can be calculated according to the actual application scenario.

In the above technical solution, preferably, the first biometric information and the second biometric information include at least one of the following or a combination thereof: fingerprint image information, iris image information, and face image information.

In this technical solution, the first biometric information and the second biometric information include at least but not limited to one or a combination of the following: fingerprint image information, iris image information, and face image information, that is, the solution may be based on different creatures. The feature information is implemented, so that the server can perform correct biometric information matching without decrypting, and can effectively avoid the problem that the first biometric template vector is easily maliciously stolen on the terminal in the prior art, thereby improving The security and reliability effects of identity authentication based on biometric information further improve the applicability of identity authentication.

According to a second aspect of the present invention, an identity authentication system is provided for a terminal, comprising: an acquisition module, configured to collect first biometric information of a preset user; and an encryption module, configured to use the first biometric feature The at least one first attribute information of the information is represented in a vector form, and the at least one first attribute information represented by the vector form is homomorphicly encrypted according to the preset key to generate the first biometric vector; a sending module, configured to send the first biometric vector to a server, for the server to store the first biometric vector as a first biometric template vector.

In the technical solution, the pre-storing process of the first biometric template vector is first performed, and specifically, the first attribute information that can be used for identity authentication in the first biometric information of the collected preset user is represented by a vector form. Wherein, the first attribute information for identity authentication has one or more items, and each of the first attribute information is represented by a vector form, thereby obtaining a representation of the first biometric The vector group of the information is homomorphically encrypted according to the stored preset key, and the first biometric vector is obtained, and then the first object feature vector is sent to the server, and the server The first biometric template vector is stored as a first biometric template vector. The preset key may be randomly generated by the terminal, or may be set according to actual needs of the user, and finally stored in the terminal, and is first generated by homomorphic encryption. The biometric template vector is stored in the server, and the preset key used for decryption is stored in the terminal, and the server cannot know the preset key. Thus, by combining the biometric technology with the homomorphic encryption technology, the server is enabled. The correct biometric information matching can be performed without decryption, and the problem that the user biometric information is easily maliciously stolen in the prior art can be effectively avoided, and the safe storage of the biometric information of the user is realized and improved. The security and reliability of identity authentication based on biometric information enhances the user experience.

In the above technical solution, preferably, the collecting module is further configured to collect second biometric information of the current user; the encryption module is further configured to use at least one second attribute information of the second biometric information a vector form representation, and performing homomorphic encryption processing on the at least one second attribute information represented by a vector form according to the preset key to generate a second biometric vector; the first sending module is further used to Transmitting the second biometric vector to the server for the server to generate a first Euclidean distance from the first biometric template vector according to the second biometric vector; and the identity authentication system further The first receiving module is configured to receive the first Euclidean distance from the server, and the decrypting module is configured to perform homomorphic decryption processing on the first Euclidean distance to obtain a second Euclidean distance; And determining, according to the second Euclidean distance, whether the second biometric information matches the first biometric information to determine whether the identity authentication is successful.

In the technical solution, the second attribute information that is available for identity authentication in the collected second biometric information of the current user is represented in a vector form, wherein the second attribute information that can be authenticated has one or more And each of the second attribute information is represented by a vector form, and a vector group representing the second biometric information is obtained, and each sub-vector in the vector group is homomorphically encrypted according to the preset key. Obtaining a second biometric vector, and then transmitting the second biometric vector to the server, so that the server calculates the first biometric vector and the first biometric template vector of the pre-stored first biometric template vector without decrypting Distance, of course, the first Euclidean distance is also encrypted, and the server cannot know the specific result of the first Euclidean distance, thus preventing The server abuses the user's first biometric template vector to ensure the security of the matching results.

In the above technical solution, preferably, the determining module is specifically configured to determine whether the second Euclidean distance is less than or equal to a preset distance; and when determining that the second Euclidean distance is less than or equal to the preset distance When the second biometric information is successfully matched with the first biometric information, the identity authentication is successful; when it is determined that the second Euclidean distance is greater than the preset distance, the second biometric information is If the first biometric information fails to be matched, the identity authentication fails.

In the technical solution, whether the second biometric information matches the first biometric information is determined by the second Euclidean distance, and determining whether the second Euclidean distance and the preset distance are matched, specifically, When it is determined that the second Euclidean distance is less than or equal to the preset distance, the second biometric information is successfully matched with the first biometric information, indicating that the user identity authentication is successful, otherwise, the identity authentication fails, thus effectively avoiding the existing In the technology, the first biometric template vector is stored on the terminal and is easily maliciously stolen, thereby improving the security and reliability of the biometric information based identity authentication, thereby improving the user experience. The preset distance can be calculated according to the actual application scenario.

According to a third aspect of the present invention, an identity authentication method is provided for a server, comprising: receiving a third biometric vector from a terminal; storing the third biometric vector as the second biometric template vector The third biometric vector is obtained by the terminal performing homomorphic encryption processing on the at least one third attribute information of the collected third biometric information of the preset user.

In this technical solution, the process of storing the second biometric template vector is first performed, specifically, by storing the received third biometric vector from the terminal as the second biometric template vector, so as to smoothly carry out the subsequent matching step. Providing the necessary premise guarantee, wherein the third biometric vector is obtained by the terminal performing homomorphic encryption processing on each third attribute information for identity authentication of the third biometric information of the preset preset user, that is, It is a vector obtained by encryption processing, and the server cannot know the specific content. Therefore, the server avoids the abuse of the biometric information of the user, further improves the security and reliability of the identity authentication based on the biometric information, thereby improving the user experience. .

In the above technical solution, preferably, the method further includes: receiving a fourth biometric vector from the terminal, wherein the fourth biometric vector is the fourth biometric information of the current user acquired by the terminal Obtaining a third Euclidean distance according to the fourth biometric template vector and the second biometric template vector; and transmitting the third Euclidean distance to the terminal And determining, by the terminal, whether the fourth biometric information matches the third biometric information according to the third Euclidean distance; and the third biometric information and the fourth biometric information are at least One or a combination of the following is included: fingerprint image information, iris image information, and face image information.

In the technical solution, the third Euclidean distance calculated according to the fourth biometric vector and the second biometric template vector is sent to the terminal, so that the terminal can perform homomorphic decryption on the terminal. And determining whether the identity authentication is successful, wherein the fourth biometric vector is obtained by the terminal performing homomorphic encryption processing on each fourth attribute information of the fourth biometric information of the current user that is available for identity authentication, that is, It is a vector obtained by encryption processing, and the server cannot know its specific content. Thus, by combining biometric technology with homomorphic encryption technology, the server can perform correct biometric information matching without decryption, and can effectively avoid In the prior art, the user biometric information is stored on the terminal and is easily maliciously stolen, thereby realizing the secure storage of the biometric information of the user, avoiding the abuse of the biometric information of the user by the server, and further improving the identity based on the biometric information. The security and reliability of authentication enhances the user experience.

In addition, the third biometric information and the fourth biometric information include at least but not limited to one of the following or a combination thereof: fingerprint image information, iris image information, and face image information, that is, the solution may be implemented based on different biometric information, So that the server can perform correct biometric information matching without decryption, and can effectively avoid the problem that the second biometric template vector is easily maliciously stolen on the terminal in the prior art, thereby improving the biometric information based. The effectiveness of identity authentication and reliability further enhances the applicability of identity authentication.

According to a fourth aspect of the present invention, an identity authentication system is provided for a server, comprising: a second receiving module, configured to receive a third biometric vector from the terminal; and a storage module, configured to use the third biometric The feature vector is stored as the second biometric template vector, wherein the third biometric vector is homomorphic to the terminal for at least one third attribute information of the collected third biometric information of the preset user. Encrypted processing.

In the above technical solution, preferably, the second receiving module is further configured to receive a fourth biometric vector from the terminal, where the fourth biometric vector is the terminal pair acquisition The at least one fourth attribute information of the fourth biometric information of the current user is obtained by homomorphic encryption processing; the identity authentication system further includes: the processing module is further configured to: according to the fourth biometric vector and the second The biometric template vector obtains a third Euclidean distance; and the identity authentication system further includes: a second sending module, configured to send the third Euclidean distance to the terminal, for the terminal to be according to the Determining whether the fourth biometric information matches the third biometric information; and the third biometric information and the fourth biometric information include at least one of the following or a combination thereof: a fingerprint image Information, iris image information, and face image information.

In the technical solution, the third Euclidean distance calculated according to the fourth biometric vector and the second biometric template vector is sent to the terminal, so that the terminal performs homomorphic decryption to determine whether the identity authentication is successful. The fourth biometric vector is obtained by the terminal performing homomorphic encryption processing on each fourth attribute information of the fourth biometric information of the current user that is available for identity authentication, that is, a vector obtained by encryption processing. The server cannot know the specific content. Thus, by combining the biometric technology with the homomorphic encryption technology, the server can perform correct biometric information matching without decryption, and can effectively avoid the user in the prior art. The biometric information is stored on the terminal and is easily stolen by malicious people, which realizes the safe storage of the biometric information of the user, avoids the abuse of the biometric information of the user by the server, and further improves the security and reliability of the identity authentication based on the biometric information. , which enhances the user experience.

According to a fifth aspect of the present invention, there is provided a terminal, comprising: the identity authentication system for a terminal according to any one of the preceding claims, All the beneficial effects of the identity authentication system for the terminal are not described herein.

According to a sixth aspect of the present invention, a server is provided, comprising: the identity authentication system for a server according to any one of the preceding claims, and thus having the above technical party All the beneficial effects of the identity authentication system for the server described in any of the above are not described herein.

Through the technical solution of the invention, the biometric identification technology can be combined with the homomorphic encryption technology, so that the server can perform correct biometric information matching without decryption, and can effectively avoid the biometric information of the user in the prior art. The problem that the terminal is easily maliciously stolen on the terminal realizes the secure storage of the biometric information of the user, improves the security and reliability of the identity authentication based on the biometric information, thereby improving the user experience.

DRAWINGS

1 is a flow chart showing an identity authentication method according to an embodiment of the present invention;

2 shows a block diagram of an identity authentication system in accordance with one embodiment of the present invention;

FIG. 3 is a flow chart showing an identity authentication method according to another embodiment of the present invention; FIG.

4 shows a block diagram of an identity authentication system in accordance with another embodiment of the present invention;

Figure 5 shows a block diagram of a terminal in accordance with one embodiment of the present invention;

Figure 6 shows a block diagram of a server in accordance with one embodiment of the present invention;

FIG. 7 is a flow chart showing an identity authentication method according to still another embodiment of the present invention;

FIG. 8 is a flow chart showing a biometric information registration method according to an embodiment of the present invention.

detailed description

The above described objects, features and advantages of the present invention will become more apparent from the detailed description of the appended claims. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict.

In the following description, numerous specific details are set forth in order to provide a full understanding of the invention, but the invention may be practiced otherwise than as described herein. Limitations of the embodiments.

FIG. 1 shows a flow chart of an identity authentication method according to an embodiment of the present invention.

As shown in FIG. 1 , an identity authentication method according to an embodiment of the present invention is used for a terminal, including: Step 102: Collecting first biometric information of a preset user; Step 104: at least one of the first biometric information The item first attribute information is represented in a vector form, and performs homomorphic encryption processing on the at least one first attribute information represented by a vector form according to a preset key to generate a first biometric vector; The first biometric vector is sent to the server for the server to store the first biometric vector as a first biometric template vector.

In the above technical solution, preferably, the method further includes: collecting second biometric information of the current user; and expressing at least one second attribute information of the second biometric information in a vector form, and according to the preset secret The key pair performs homomorphic encryption processing on the at least one second attribute information represented by the vector form to generate a second biometric vector; and sends the second biometric vector to the server for the server to Generating a first Euclidean distance from the first biometric template vector; receiving the first Euclidean distance from the server; performing homomorphic decryption processing on the first Euclidean distance Obtaining a second Euclidean distance; determining, according to the second Euclidean distance, whether the second biometric information matches the first biometric information to determine whether the identity authentication is successful.

In the above technical solution, preferably, determining whether the second biometric information matches the first biometric information according to the second Euclidean distance, to determine whether the identity authentication is successful, specifically, determining: Whether the second Euclidean distance is less than or equal to the preset distance; and when it is determined that the second Euclidean distance is less than or equal to the preset distance, the second biometric information is successfully matched with the first biometric information, The identity authentication succeeds; when it is determined that the second Euclidean distance is greater than the preset distance, the second biometric information fails to match the first biometric information, and the identity authentication fails.

In the technical solution, whether the second biometric information matches the first biometric information Determined by the second Euclidean distance, by determining the second Euclidean distance and the preset distance, whether it is matched, specifically, when determining that the second Euclidean distance is less than or equal to the preset distance, the second If the biometric information is successfully matched with the first biometric information, it indicates that the user identity authentication is successful, otherwise, the identity authentication fails, so that the prior art is convenient to store the first biometric template vector on the terminal. The problem of being maliciously stolen improves the security and reliability of identity authentication based on biometric information, thereby improving the user experience. The preset distance can be calculated according to the actual application scenario.

2 shows a block diagram of an identity authentication system in accordance with one embodiment of the present invention.

As shown in FIG. 2, the identity authentication system 200 of an embodiment of the present invention is used for a terminal, and includes: an acquisition module 202, configured to collect first biometric information of a preset user; and an encryption module 204, configured to: The at least one first attribute information of the first biometric information is represented in a vector form, and the at least one first attribute information represented by the vector form is homomorphically encrypted according to the preset key to generate the first creature. And a first sending module 206, configured to send the first biometric vector to a server, where the server stores the first biometric vector as a first biometric template vector.

In the technical solution, the pre-storing process of the first biometric template vector is first performed, and specifically, the first attribute information that can be used for identity authentication in the first biometric information of the collected preset user is represented by a vector form. Wherein, the first attribute information for identity authentication has one or more items, and each first attribute information is represented by a vector form, thereby obtaining a vector group representing the first biometric information, according to the stored preset The key is the same for each of the vector vectors in the vector group State-encrypted, the first bio-feature vector is obtained, and then the first object feature vector is sent to the server, which is stored by the server as the first bio-feature template vector, wherein the preset key may be randomly generated by the terminal, It may be set according to actual needs of the user, and finally stored in the terminal, that is, the first biometric template vector generated by homomorphic encryption is stored in the server, and the preset key used for decryption is stored in the terminal, then the server This preset key cannot be known. Thus, by combining biometric technology with homomorphic encryption technology, the server can perform correct biometric information matching without decryption, and can effectively avoid the user in the prior art. The biometric information is stored on the terminal and is easily maliciously stolen. The secure storage of the biometric information of the user is realized, and the security and reliability of the identity authentication based on the biometric information are improved, thereby improving the user experience.

In the above technical solution, preferably, the collecting module 202 is further configured to collect second biometric information of the current user; the encryption module 204 is further configured to use at least one second attribute of the second biometric information. The information is represented in a vector form, and performs homomorphic encryption processing on the at least one second attribute information in a vector form according to the preset key to generate a second biometric vector; the first sending module 206 Also for transmitting the second biometric vector to the server for the server to generate a first Euclidean distance from the first biometric template vector according to the second biometric vector; and the identity The authentication system 200 further includes: a first receiving module 208, configured to receive the first Euclidean distance from the server; and a decryption module 210, configured to perform a homomorphic decryption process on the first Euclidean distance to obtain a second An Euclidean distance; a determining module 212, configured to determine, according to the second Euclidean distance, whether the second biometric information matches the first biometric information to determine an identity whether succeed.

In the above technical solution, preferably, the determining module 212 is specifically configured to determine whether the second Euclidean distance is less than or equal to a preset distance; and when determining that the second Euclidean distance is less than or equal to the preset When the distance is that the second biometric information is successfully matched with the first biometric information, the identity authentication is successful; when the second Euclidean distance is determined to be greater than the preset distance, the second biometric information is If the matching with the first biometric information fails, the identity authentication fails.

FIG. 3 is a flow chart showing an identity authentication method according to another embodiment of the present invention.

As shown in FIG. 3, an identity authentication method according to another embodiment of the present invention is used for a server, including: step 302, receiving a third biometric vector from a terminal; and step 304, storing the third biometric vector as The second biometric template vector, wherein the third biometric vector is obtained by the terminal performing homomorphic encryption processing on at least one third attribute information of the collected third biometric information of the preset user. .

4 shows a block diagram of an identity authentication system in accordance with another embodiment of the present invention.

As shown in FIG. 4, the identity authentication system 400 of another embodiment of the present invention is used for a server, including: a second receiving module 402, configured to receive a third biometric vector from a terminal; and a storage module 404, configured to The third biometric vector is stored as the second biometric template vector, wherein the third biometric vector is at least one third of the third biometric information of the collected preset user by the terminal. The attribute information is obtained by homomorphic encryption processing.

In this technical solution, the process of storing the second biometric template vector is first performed, specifically, by storing the received third biometric vector from the terminal as the second biometric template vector, so as to smoothly carry out the subsequent matching step. Providing the necessary premise guarantee, wherein the third biometric vector is obtained by the terminal performing homomorphic encryption processing on each third attribute information for identity authentication of the third biometric information of the preset preset user, that is, It is a vector obtained by encryption processing, and the server cannot know the specific content. Therefore, the server avoids the abuse of the biometric information of the user, and further improves the security and reliability of the identity authentication based on the biometric information. Thereby improving the user experience.

In the above technical solution, preferably, the second receiving module 402 is further configured to receive a fourth biometric vector from the terminal, where the fourth biometric vector is the collected current user of the terminal pair. The at least one fourth attribute information of the fourth biometric information is obtained by homomorphic encryption processing; and the identity authentication system further includes: a processing module 406, configured to use the fourth biometric vector and the second biometric The template vector obtains a third Euclidean distance; a second sending module 408 is configured to send the third Euclidean distance to the terminal, for the terminal to determine the fourth creature according to the third Euclidean distance Whether the feature information matches the third biometric information; and the third biometric information and the fourth biometric information include at least one of the following or a combination thereof: fingerprint image information, iris image information, and face image information .

Figure 5 shows a block diagram of a terminal in accordance with one embodiment of the present invention.

As shown in FIG. 5, the terminal 500 of an embodiment of the present invention includes: the identity authentication system 200 for the terminal 500 according to any one of the foregoing technical solutions, and thus has All the beneficial effects of the identity authentication system 200 for the terminal 500 described in any one of the technical solutions are not described herein again.

Figure 6 shows a block diagram of a server in accordance with one embodiment of the present invention.

As shown in FIG. 6, the server 600 of an embodiment of the present invention includes the identity authentication system 400 for the server 600 according to any one of the foregoing technical solutions, and thus has any of the foregoing technical solutions. All the beneficial effects of the identity authentication system 400 for the server 600 described in the section are not described herein again.

The technical solution of the present invention will be described in detail below with reference to FIG. 7 and FIG. 8 :

FIG. 7 is a flow chart showing an identity authentication method according to still another embodiment of the present invention.

In this embodiment, the biometric template (ie, the first biometric template vector) is represented as a vector, and each component of the vector is homomorphically encrypted, and at least one second of the second biometric information is second. The attribute information is represented in a vector form, and the at least one second attribute information represented by the vector form is homomorphically encrypted according to the preset key to generate a second biometric vector; the two vectors (ie, the second biometric vector) The similarity between the first biometric template vector and the first biometric template vector is determined by the Euclidean distance of the two vectors. When the distance between the two is less than a certain threshold (ie, the preset distance), the matching is considered successful, otherwise the matching fails. Calculate the Euclidean distance (ie, the first Euclidean distance) between the encrypted two vectors in the cloud, and after the result is sent to the mobile terminal, the mobile end decrypts the Euclidean distance between the two unencrypted vectors (ie, The second Euclidean distance) determines whether the user is authenticated successfully.

In the description of the scheme, Enc _k represents that a homomorphic encryption operation is performed with k as a key, and Dec _k represents a homomorphic decryption operation with k as a key;

The program includes two processes: biometric registration and upload process, and identity authentication process.

As shown in FIG. 7, the identity authentication method in still another embodiment of the present invention specifically includes:

Step 702: The mobile phone collects a biometric image of the user (ie, second biometric information).

Step 704, processing the biometric image, extracting the vector form to represent different features, and forming a biometric vector group, such as (t' ₁ , t' ₂ , ..., t' _n ).

Step 706: Read a key group (k ₁ , k ₂ , . . . , k _n ) stored in the mobile phone, and perform homomorphic encryption on each component in the feature vector respectively.

(ie the second biometric vector), where i = 1, 2, ..., n.

And at least one second attribute information of the second biometric information is represented in a vector form, and the at least one second attribute information represented by the vector form is homomorphicly encrypted according to the preset key to generate the second biometric vector.

Step 708, uploading (e' ₁ , e' ₂ , . . . , e' _n ) (ie, the second biometric vector) to the cloud server.

In step 710, the cloud server reads the stored encrypted biometric template (e ₁ , e ₂ , . . . , e _n ).

Step 712, the cloud server calculates the Euclidean distance of the input biometric and the registered biometric template as

That is, the server generates a first Euclidean distance from the first biometric vector according to the second biometric vector.

In step 714, the cloud server transmits the Euclidean distance (ie, the first Euclidean distance) to the mobile phone.

In step 716, the mobile phone decrypts the Euclidean distance (ie, the first Euclidean distance) result to obtain a second Euclidean distance.

Step 718: The mobile phone determines whether the user authentication is successful according to the value of the dist (ie, the second Euclidean distance). If the dist is greater than or equal to a certain threshold h, the authentication succeeds, otherwise the authentication fails.

As shown in FIG. 8, the biometric information registration method of an embodiment of the present invention includes:

Step 802: The mobile phone collects biometric features of the current user (ie, first biometric information), where the biometric data may be fingerprints, irises, faces, etc., and images of fingerprints, irises, faces, and the like are collected.

Step 804: Processing the biometric image, extracting feature data (ie, first attribute information) that can be identified, and representing different feature data in a vector form to form a vector group, such as (t ₁ , t ₂ ,... ..., t _n ).

Step 806, selecting a set of keys (ie, preset keys) such as: k ₁ , k ₂ , . . . , k _n , each component of the pair of vectors (t ₁ , t ₂ , . . . , t _n ) Homomorphic encryption is obtained separately

(ie the second biometric vector), where i = 1, 2, ..., n.

Step 808: Upload (e ₁ , e ₂ , . . . , e _n ) (ie, the first biometric vector) to the cloud server, for the server to store the first biometric vector as the second biometric template vector.

In step 810, the mobile phone stores the key set (k ₁ , k ₂ , . . . , k _n ).

The beneficial effects of this embodiment:

1. The biometric template is not stored locally in the mobile phone, and there is no risk of leakage in the local area;

2. The biometric template stored in the cloud is encrypted and will not leak;

3. Using a homomorphic encryption scheme ensures that the encrypted biometric template can perform user authentication without decryption.

In this embodiment, the mobile phone collects the biometric data of the user, forms a vector, encrypts and sends it to the cloud server (ie, the server), and with the help of the cloud server, the mobile phone calculates the collected biometric data and the registered biometric template (ie, the second biometric The Euclidean distance between the feature vector and the first biometric template vector), and based on the result, judge whether the authentication is successful.

The technical solution of the present invention is described in detail above with reference to the accompanying drawings. By combining the biometric identification technology with the homomorphic encryption technology, the server can perform correct biometric information matching without decryption, and can effectively avoid the prior art. Because the user biometric information is stored on the terminal and is easily maliciously stolen, the user's biometric information is safely stored, and the security and reliability of the biometric information based identity authentication is improved, thereby improving the user experience.

The above description is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

An identity authentication method is provided for a terminal, and the method includes:

Collecting first biometric information of the preset user;

And performing at least one first attribute information of the first biometric information in a vector form, and performing homomorphic encryption processing on the at least one first attribute information represented by a vector form according to a preset key to generate First biometric vector;

Transmitting the first biometric vector to a server for the server to store the first biometric vector as a first biometric template vector.
The identity authentication method according to claim 1, further comprising:

Collecting second biometric information of the current user;

And performing at least one second attribute information of the second biometric information in a vector form, and performing homomorphic encryption processing on the at least one second attribute information represented by a vector form according to the preset key, To generate a second biometric vector;

Transmitting the second biometric vector to the server, for the server to generate a first Euclidean distance from the first biometric template vector according to the second biometric vector;

Receiving the first Euclidean distance from the server;

Performing a homomorphic decryption process on the first Euclidean distance to obtain a second Euclidean distance;

Determining, according to the second Euclidean distance, whether the second biometric information matches the first biometric information to determine whether the identity authentication is successful.
The identity authentication method according to claim 2, wherein determining whether the second biometric information matches the first biometric information according to the second Euclidean distance, to determine whether the identity authentication is successful, include:

Determining whether the second Euclidean distance is less than or equal to a preset distance;

When it is determined that the second Euclidean distance is less than or equal to the preset distance, the second biometric information is successfully matched with the first biometric information, and the identity authentication is successful;

When it is determined that the second Euclidean distance is greater than the preset distance, the second biometric information fails to match the first biometric information, and the identity authentication fails.
The identity authentication method according to any one of claims 1 to 3, characterized in that

The first biometric information and the second biometric information include at least one of the following or a combination thereof: fingerprint image information, iris image information, and face image information.
An identity authentication system for a terminal, comprising:

An acquisition module, configured to collect first biometric information of a preset user;

An encryption module, configured to represent at least one first attribute information of the first biometric information in a vector form, and perform homomorphism on the at least one first attribute information represented by a vector form according to a preset key Encryption processing to generate a first biometric vector;

And a first sending module, configured to send the first biometric vector to a server, where the server stores the first biometric vector as a first biometric template vector.
The identity authentication system according to claim 5, characterized in that

The collection module is further configured to collect second biometric information of the current user;

The cryptographic module is further configured to represent at least one second attribute information of the second biometric information in a vector form, and according to the preset key pair, the at least one second attribute expressed in a vector form The information is homomorphic cryptographically processed to generate a second biometric vector;

The first sending module is further configured to send the second biometric vector to the server, where the server generates the first Euclidean according to the second biometric vector and the first biometric template vector. Distance;

The identity authentication system further includes:

a first receiving module, configured to receive the first Euclidean distance from the server;

a decryption module, configured to perform a homomorphic decryption process on the first Euclidean distance to obtain a second Euclidean distance;

And a determining module, configured to determine, according to the second Euclidean distance, whether the second biometric information matches the first biometric information to determine whether the identity authentication is successful.
The identity authentication system according to claim 6, wherein the determining module is specifically configured to determine whether the second Euclidean distance is less than or equal to a preset distance;

When it is determined that the second Euclidean distance is less than or equal to the preset distance, the second biometric information is successfully matched with the first biometric information, and the identity authentication is successful;

When it is determined that the second Euclidean distance is greater than the preset distance, the second biometric information fails to match the first biometric information, and the identity authentication fails.
An identity authentication system according to any one of claims 5 to 7, wherein

The first biometric information and the second biometric information include at least one of the following or a combination thereof: fingerprint image information, iris image information, and face image information.
An authentication method for a server, comprising:

Receiving a third biometric vector from the terminal;

And storing the third biometric vector as the second biometric template vector, wherein the third biometric vector is at least one of the third biometric information of the preset user that is collected by the terminal The three attribute information is obtained by homomorphic encryption processing.
The identity authentication method according to claim 9, further comprising:

Receiving a fourth biometric vector from the terminal, wherein the fourth biometric vector is configured by the terminal to perform homomorphic encryption processing on at least one fourth attribute information of the collected fourth biometric information of the current user. owned;

Obtaining a third Euclidean distance according to the fourth biometric vector and the second biometric template vector;

Transmitting the third Euclidean distance to the terminal, for the terminal to determine whether the fourth biometric information matches the third biometric information according to the third Euclidean distance;

The third biometric information and the fourth biometric information include at least one of the following or a combination thereof: fingerprint image information, iris image information, and face image information.
An identity authentication system for a server, comprising:

a second receiving module, configured to receive a third biometric vector from the terminal;

a storage module, configured to store the third biometric vector as the second biometric template vector, where the third biometric vector is the third biometric information of the preset user that is collected by the terminal At least one third attribute information is obtained by homomorphic encryption processing.
The identity authentication system according to claim 11, wherein the second receiving module is further configured to receive a fourth biometric vector from the terminal, wherein the fourth biometric vector is the terminal pair Obtaining at least one fourth attribute information of the collected fourth biometric information of the current user by homomorphic encryption processing;

The identity authentication system further includes:

a processing module, configured to obtain, according to the fourth biometric vector and the second biometric template vector To the third Euclidean distance;

a second sending module, configured to send the third Euclidean distance to the terminal, where the terminal determines the fourth biometric information and the third biometric information according to the third Euclidean distance Whether the matching; and the third biometric information and the fourth biometric information include at least one of the following or a combination thereof: fingerprint image information, iris image information, and face image information.
A terminal characterized by comprising the identity authentication system according to any one of claims 5 to 8.
A server characterized by comprising the identity authentication system according to claim 11 or 12.