WO2017215534A1 - 安全芯片、生物特征识别方法和生物特征模板注册方法 - Google Patents

安全芯片、生物特征识别方法和生物特征模板注册方法 Download PDF

Info

Publication number
WO2017215534A1
WO2017215534A1 PCT/CN2017/087778 CN2017087778W WO2017215534A1 WO 2017215534 A1 WO2017215534 A1 WO 2017215534A1 CN 2017087778 W CN2017087778 W CN 2017087778W WO 2017215534 A1 WO2017215534 A1 WO 2017215534A1
Authority
WO
WIPO (PCT)
Prior art keywords
biometric
security chip
template
information
feature
Prior art date
Application number
PCT/CN2017/087778
Other languages
English (en)
French (fr)
Inventor
李坤
徐东
樊磊
张晋芳
Original Assignee
北京集创北方科技股份有限公司
北京集创北方系统技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京集创北方科技股份有限公司, 北京集创北方系统技术有限公司 filed Critical 北京集创北方科技股份有限公司
Priority to JP2018555813A priority Critical patent/JP6687758B2/ja
Priority to KR1020187018542A priority patent/KR102070636B1/ko
Priority to US16/309,255 priority patent/US20190332755A1/en
Publication of WO2017215534A1 publication Critical patent/WO2017215534A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/32—User authentication using biometric data, e.g. fingerprints, iris scans or voiceprints
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/33—User authentication using certificates
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06T—IMAGE DATA PROCESSING OR GENERATION, IN GENERAL
    • G06T7/00—Image analysis
    • G06T7/10—Segmentation; Edge detection
    • G06T7/11—Region-based segmentation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V20/00—Scenes; Scene-specific elements
    • G06V20/60—Type of objects
    • G06V20/69—Microscopic objects, e.g. biological cells or cellular parts
    • G06V20/695—Preprocessing, e.g. image segmentation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V40/00—Recognition of biometric, human-related or animal-related patterns in image or video data
    • G06V40/10—Human or animal bodies, e.g. vehicle occupants or pedestrians; Body parts, e.g. hands
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V40/00—Recognition of biometric, human-related or animal-related patterns in image or video data
    • G06V40/10—Human or animal bodies, e.g. vehicle occupants or pedestrians; Body parts, e.g. hands
    • G06V40/12—Fingerprints or palmprints
    • G06V40/13—Sensors therefor
    • G06V40/1318—Sensors therefor using electro-optical elements or layers, e.g. electroluminescent sensing
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V40/00—Recognition of biometric, human-related or animal-related patterns in image or video data
    • G06V40/50—Maintenance of biometric data or enrolment thereof
    • G06V40/55—Performing matching on a personal external card, e.g. to avoid submitting reference information

Definitions

  • the present invention relates to the field of biometric identification technologies, and more particularly, to a security chip, a biometric identification method, and a biometric template registration method.
  • Biometrics such as fingerprints, irises, and faces are gradually being widely used in the field of identity authentication because of their uniqueness, privacy, and non-changeability.
  • the stored biometric template contains a large amount of biometric original information, and even some templates are biometric images.
  • the intruder can directly use the information contained in the biometric template to pass the biometric template. Verification, cross-validation can also be performed between databases of different applications.
  • the fingerprint template information stolen from the fingerprint access control system can be used to invade the corresponding personal bank account of the fingerprint authentication.
  • Some can even forge a corresponding biometric sample directly from the biometric template, for example, the corresponding fingerprint can be forged from the fingerprint detail point template.
  • the biometrics are immutable, once the original information is revealed, the harm will be permanent and extensive. Therefore, the safety protection of biometric templates in biometrics is at an important position.
  • Trust Zone security technology (or Secure Enclave) is commonly used in computing devices such as smartphones and tablets that currently use iOS and Android systems. It logically divides the system environment into secure and non-secure areas in the security zone. Perform biometric registration and identification operations. However, since the division of the security zone and the non-security zone is a purely logical division, the information related to the biometrics is easily stolen during transmission, storage and calculation, and the overall security strength of the biometric identification is insufficient.
  • Embodiments of the present invention provide a security chip, a biometric identification method, and a biometric template registration method for improving the security of biometric identification.
  • An aspect of the present invention provides a security chip, including: a sensor for sensing biometric information; a memory for storing a biometric template; and a processor for acquiring biometric information from the sensor, performing image preprocessing and feature extraction on the acquired biometric information, and performing feature matching with the biometric template stored in the memory to determine a biometric template generated by the processor during the registration phase by acquiring biometric information from the sensor and performing image preprocessing and feature extraction on the acquired biometric information, wherein the sensor, memory, and processing The device is integrated in the security chip.
  • the processor includes: an image acquisition module, configured to acquire biometric information from the sensor sense; and an image preprocessing module configured to preprocess the biometric information acquired by the image acquisition module to obtain biometric features. a grayscale map; a feature extraction module, configured to extract feature points of the biometrics from the grayscale image obtained by the image preprocessing module to obtain biometric data related to the feature points of the biometrics; and a feature comparison module for The biometric data obtained by the feature extraction module is compared with the biometric template stored in the memory. If the biometric data matches the biometric template, the biometric recognition result is determined to pass, otherwise the biometric recognition result is determined to be unpassed.
  • the processor further includes a signature module for digitally signing the biometric result.
  • the security chip is a Secure Element (SE).
  • SE Secure Element
  • the security chip is installed in a computing device and is physically isolated from the host system environment of the computing device.
  • the system environment of the computing device is divided into a secure zone and a non-secure zone, and the security chip transmits biometric identification results to the computing device through the secure zone or non-secure zone.
  • the biometrics include fingerprints
  • the biometric information includes image information of the fingerprints
  • the biometric data includes feature point data of the fingerprints
  • the biometric templates include fingerprint feature templates
  • Another aspect of the present invention provides a biometric recognition method comprising: performing, in a single security chip, sensing biometric information according to biometric identification instructions; acquiring sensed biometric information; The feature information is subjected to image preprocessing and feature extraction to obtain biometric data; and the biometric data is compared with the biometric template stored in the security chip to determine the biometric recognition result.
  • the biometric method further comprises digitally signing biometric results in a security chip.
  • biometric template registration method comprising: performing a following operation in a single security chip: sensing biometric information according to a biometric template registration instruction; acquiring the sensed biometric information; Biometric information for image preprocessing and feature extraction to obtain biometric data; And storing the biometric data as a biometric template in the security chip.
  • FIG. 1 shows a block diagram of a security chip in accordance with an embodiment of the present invention.
  • FIG. 2 shows a block diagram of a security chip in accordance with an embodiment of the present invention.
  • FIG. 3 shows a diagram of a biometric recognition method in accordance with an embodiment of the present invention.
  • FIG. 4 shows a diagram of a biometric template registration method in accordance with an embodiment of the present invention.
  • FIG. 1 shows a block diagram of a security chip 100 in accordance with an embodiment of the present invention.
  • the security chip 100 includes a sensor 110, a memory 120, and a processor 130.
  • the sensor 110, the memory 120, and the processor 130 are integrated in the security chip.
  • the sensor 110 is for sensing biometric information.
  • the memory 120 is used to store a biometric template.
  • the processor 130 is configured to acquire biometric information from the sensor 110, perform image preprocessing and feature extraction on the acquired biometric information, and perform feature comparison with the biometric template stored in the memory 120 to determine a biometric recognition result.
  • the biometric template is generated by the processor 130 during the registration phase by acquiring biometric information from the sensor 110 and performing image preprocessing and feature extraction on the acquired biometric information.
  • the processor 130 may include an image acquisition module for acquiring biometric information from the sensor 110, and an image preprocessing module for preprocessing the biometric information acquired by the image acquisition module to obtain biometrics. a grayscale image; a feature extraction module, configured to extract feature points of the biometric from the grayscale image obtained by the image preprocessing module to obtain biometric data related to the feature points of the biometric feature; and a feature comparison module for Comparing the biometric data obtained by the feature extraction module with the biometric template stored in the memory 120, if the biometric data matches the biometric template, determining that the biometric recognition result is passed, otherwise determining that the biometric recognition result is failed .
  • the processor 130 can also include a signature module for digitally signing the biometric identification result.
  • the security chip 100 can be a secure element SE.
  • the security chip 100 can be installed in a computing device and physically isolated from the host system environment of the computing device.
  • the system environment of the computing device can be divided into a secure zone and a non-secure zone through which the security chip 100 transmits biometric identification results to the computing device.
  • the biometrics can include fingerprints
  • the biometric information can include image information of the fingerprints
  • the biometric data can include feature point data for the fingerprints
  • the biometric templates can include fingerprint feature templates.
  • Embodiments of the invention may be applicable to the identification of one or more biometric features including, but not limited to, texture (including fingerprints, palm prints, veins and related ancillary features such as sweat holes, etc.), biofilms (eg, Iris, retina, etc., face, ear canal, voice, body shape, personal habits (such as the strength and frequency of typing on the keyboard, signature, gait).
  • biometric can be, for example, a fingerprint.
  • the security chip 200 includes a sensor 210, a memory 220, and a processor 230.
  • the sensor 210, the memory 220, and the processor 230 are integrated in the security chip 200.
  • the security chip 200 can be an SE.
  • the sensor 210 is for sensing biometric information.
  • Biometric information can include, for example, textures (including fingerprints, palm prints, veins and related ancillary features such as sweat holes, etc.), biofilms (eg, iris, retina, etc.), faces, ear canals, voice, body shape, personal habits (eg Information related to one or more biometric features such as the strength and frequency of the keyboard, signature, and gait.
  • the biometric information may include image information of the fingerprint.
  • sensor 210 may be an optical sensor, a semiconductor sensor, an ultrasonic sensor, a radio frequency identification sensor, or any sensor that can sense biometric information.
  • the memory 220 is used to store a biometric template.
  • the biometric template may be generated by the processor 230 during the registration phase by acquiring biometric information from the sensor 210 and performing image preprocessing and feature extraction on the acquired biometric information.
  • the memory module 220 may be a non-volatile memory such as a flash memory, an electrically erasable programmable read only memory EEPROM, an erasable programmable read only memory EPROM, a programmable read only memory PROM or the like.
  • a magnetic and electrical storage medium that retains data in the event of a power outage.
  • the processor 230 is configured to acquire biometric information from the sensor 210 and perform an image on the acquired biometric information.
  • the pre-processing and feature extraction are performed and compared with the biometric template stored in the memory 220 to determine the biometric recognition result.
  • the processor 230 can include an image acquisition module 2301, an image pre-processing module 2302, a feature extraction module 2303, and a feature comparison module 2304.
  • the processor 230 may further include a signature module 2305.
  • the image acquisition module 2301 is configured to acquire biometric information from the sensor 210.
  • the image acquisition module 2201 may acquire the image information of the fingerprint from the sensor sense 210 one or more times in a sliding acquisition manner or a compression acquisition manner.
  • the image pre-processing module 2302 is configured to pre-process the biometric information acquired by the image acquisition module image acquisition module 2301 to obtain a grayscale image of the biometric feature.
  • pre-processing may include, for example, image normalization, fingerprint effective area segmentation processing, fingerprint pattern processing, fingerprint enhancement processing, fingerprint binarization processing, and fingerprint refinement processing, and the like.
  • the feature extraction module 2303 is configured to extract feature points of the biometric from the grayscale image obtained by the image preprocessing module 2302 to obtain biometric data related to the feature points of the biometric.
  • the biometric data may include feature point data of the fingerprint.
  • the generated biometric data is stored in the memory 1201 as a biometric template.
  • the feature comparison module 2304 is configured to compare the biometric data obtained by the feature extraction module 2303 with the biometric template stored in the memory 220, and if the biometric data matches the biometric template, determine that the biometric recognition result is passed, otherwise Determine that the biometric result is not passed.
  • the signature module 2305 is for digitally signing the biometric identification result.
  • the digital signature can include: generating a key pair including the public key and the private key after the biometric template registration is successful, storing the private key in the security chip 200 (eg, stored in the memory 220), and The public key is sent to the outside of the security chip 200, and the biometric result is digitally signed using the private key after determining the biometric result.
  • the security chip 200 may generate a key pair after the template is successfully registered, and save the private key in the security chip 200, via an application terminal where the security chip 200 is located, for example, a smart phone or a tablet with the security chip 200 installed. Send the public key to the application server.
  • the security chip 200 can sign the biometric identification result with its saved private key, and send the signed biometric recognition result to the application server via the application terminal where it is located.
  • the application server verifies the legitimacy of the signed biometric result using the corresponding public key.
  • the security chip 200 can be installed on a computing such as a smart phone or tablet. In the device, and physically isolated from the system environment of the computing device.
  • the system environment of the computing device can be divided into a security zone and a non-security zone (for example, a smartphone or tablet using a Trust Zone security technology (or Secure Enclave)), and the biometric identification result provided by the security chip 200 can be
  • the transfer in the non-secure zone of the computing device simplifies the operation and can also be transmitted in the secure zone to further improve security.
  • the security chip 200 can also be installed in a computing device that does not have a secure zone and a non-secure zone. It can be seen that the embodiments of the present invention are applicable to various existing computing devices such as smart phones or tablet computers, and have high compatibility.
  • FIG. 3 shows a diagram of a biometric identification method 300 in accordance with an embodiment of the present invention.
  • the entire method 300 can be performed in a single security chip, such as the security chips 100 and 200 described above.
  • the security chip can be installed in a computing device such as a smartphone, tablet, and physically isolated from the system environment of the computing device.
  • biometric information such as image information of the fingerprint
  • Biometric instructions can come from computing devices such as smartphones, tablets, and the like.
  • the sensed biometric information is acquired.
  • step S330 image preprocessing and feature extraction are performed on the acquired biometric information to obtain biometric data.
  • the acquired biometric information may be preprocessed (for example, image normalization, fingerprint effective region segmentation processing, fingerprint pattern processing, fingerprint enhancement processing, fingerprint binarization processing, fingerprint refinement processing, etc.) to obtain A grayscale image of the biometric, extracting feature points of the biometric from the obtained grayscale image to obtain biometric data (eg, feature point data of the fingerprint) related to the feature points of the biometric.
  • biometric data eg, feature point data of the fingerprint
  • the biometric data is compared to a biometric template (eg, a fingerprint feature template) stored in the security chip to determine a biometric result. For example, if the biometric data matches the biometric template, the biometric recognition result is determined to pass, otherwise the biometric recognition result is determined to be unpassed.
  • a biometric template eg, a fingerprint feature template
  • a biometric template such as a fingerprint feature template may be generated by the processor of the security chip during the registration phase through steps S320 and S330, and stored in a memory of the security chip, such as non-easy Loss of memory.
  • non-volatile memory including, but not limited to, flash Flash, electrically erasable programmable read only memory EEPROM, erasable programmable read only memory EPROM, programmable read only memory PROM, or the like can continue to be retained in the event of a power outage Magnetic and electrical storage media for data.
  • method 300 can also include digitally signing biometric results through a security chip, such as the digital signatures described above.
  • method 300 can also include transmitting biometric recognition results to the computing device.
  • biometrics can be accessed through the processor's secure or non-secure zone of the computing device.
  • the recognition result (unsigned or signed) is sent to the computing device.
  • FIG. 4 shows a diagram of a biometric template registration method 400 in accordance with an embodiment of the present invention.
  • the entire method 400 can be performed in a single security chip, such as the security chips 100 and 200 described above.
  • the security chip can be installed in a computing device such as a smartphone, tablet, and physically isolated from the system environment of the computing device.
  • biometric information such as image information of the fingerprint
  • the biometric template registration instructions can come from computing devices such as smartphones, tablets, and the like.
  • the sensed biometric information is acquired.
  • step S430 image bioprocessing and feature extraction are performed on the acquired biometric information to obtain biometric data.
  • the biometric information may be preprocessed (eg, image normalization, fingerprint effective region segmentation processing, fingerprint pattern processing, fingerprint enhancement processing, fingerprint binarization processing, fingerprint refinement processing, etc.) to obtain biometrics.
  • the grayscale image extracts feature points of the biometric from the obtained grayscale image to obtain biometric data (for example, feature point data of the fingerprint) related to the feature points of the biometric.
  • biometric data is stored as a biometric template in the security chip.
  • biometric data can be stored as a biometric template in a memory in a secure chip, such as a non-volatile memory.
  • non-volatile memory including, but not limited to, flash Flash, electrically erasable programmable read only memory EEPROM, erasable programmable read only memory EPROM, programmable read only memory PROM, or the like can continue to be retained in the event of a power outage Magnetic and electrical storage media for data.
  • Embodiments of the present invention also provide a computer readable storage medium storing instructions for performing the above method.
  • the biometric-related information is processed independently by a security chip integrated with sensors, memory and processor, from the beginning of the sensing to the completion of the identification, such as a smartphone or tablet.
  • a security chip integrated with sensors, memory and processor, from the beginning of the sensing to the completion of the identification, such as a smartphone or tablet.
  • the system environment of the computing device is physically isolated, and the security is greatly improved compared to the traditional logical isolation.
  • the security chip size of the final package is relative to the system in package (SiP). It has great advantages.
  • Embodiments of the present invention may provide biometric identification results directly in clear text (eg, in a highly secure system environment), or may provide digitally signed biometric recognition results to prevent in an open application environment. Trojan or virus tampering with the biometric identification output of the security chip, making the fingerprint not passed The act of the card is authorized to pass. It can be seen that the embodiments of the present invention have flexible implementations and can be configured to suit different security levels of the system environment as needed.
  • the biometric device of the embodiment of the present invention can be installed in various computing devices, such as a smartphone or tablet using Trust Zone security technology (or Secure Enclave).
  • the biometric identification result provided by the security chip can be transmitted in the non-secure area of the computing device (for example, if the security of the system environment is high, or if the biometric identification result has been signed), of course, Transfer in the safe area to further improve security.
  • the biometric identification device of the embodiments of the present invention may also be installed in a computing device that does not divide the security zone and the non-secure zone. It can be seen that the embodiments of the present invention are applicable to various existing computing devices such as smart phones or tablet computers, and have high compatibility.

Abstract

一种安全芯片、生物特征识别方法以及生物特征模板注册方法，安全芯片包括：传感器，用于感测生物特征信息；存储器，用于存储生物特征模板；以及处理器，用于从传感器获取生物特征信息、对获取的生物特信息进行图像预处理和特征提取并与存储器存储的生物特征模板进行特征比对，以确定生物特征识别结果，所述生物特征模板是在注册阶段由处理器通过从传感器获取生物特征信息并对获取的生物特征信息进行图像预处理和特征提取而生成的，其中所述传感器、存储器和处理器集成在所述安全芯片中。与生物特征有关的信息的感测、存储和处理均在安全芯片中进行，与系统环境的物理隔离，相比于传统的逻辑隔离，安全性大大提高。

Description

安全芯片、生物特征识别方法和生物特征模板注册方法
本申请要求了2016年6月12日提交的、申请号为201610412982.4、发明名称为“安全芯片、生物特征识别方法和生物特征模板注册方法”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及生物特征识别技术领域，更具体地，涉及安全芯片、生物特征识别方法以及生物特征模板注册方法。
背景技术
诸如指纹、虹膜和脸之类的生物特征由于具有唯一性、隐私性、不可更改性等特性，在身份鉴别领域逐步被广泛应用。传统生物特征识别方案中，存储的生物特征模板含有大量生物特征原始信息，甚至有些模板就是生物特征图像，一旦生物特征模板丢失或被盗取，入侵者可以直接用生物特征模板中包含的信息通过验证，还可以在不同应用的数据库间进行交叉验证，如可以用指纹门禁系统里盗取的指纹模板信息，入侵其对应的指纹认证的个人银行账户。有的甚至可以从生物特征模板直接伪造出对应生物特征样本，如可以从指纹细节点模板伪造出对应指纹。同时，由于生物特征具有不可更改性，一旦原始信息泄露，造成的危害将会是永久性和广泛性的。因此，生物特征识别中生物特征模板的安全保护处于重要位置。
目前使用iOS和Android系统的诸如智能手机、平板电脑之类的计算设备普遍采用Trust Zone安全技术(或Secure Enclave)，其将系统环境在逻辑上分为安全区和非安全区，在安全区中进行生物特征的注册和识别操作。但是由于安全区和非安全区的划分是纯粹的逻辑划分，与生物特征有关的信息在传输、存储和计算时容易被窃取，生物特征识别的整体安全强度不足。
发明内容
本发明的实施例提供了安全芯片、生物特征识别方法以及生物特征模板注册方法，用于提高生物特征识别的安全性。
本发明的一方面提供了一种安全芯片，包括：传感器，用于感测生物特征信息； 存储器，用于存储生物特征模板；以及处理器，用于从传感器获取生物特征信息、对获取的生物特信息进行图像预处理和特征提取并与存储器存储的生物特征模板进行特征比对，以确定生物特征识别结果，所述生物特征模板是在注册阶段由处理器通过从传感器获取生物特征信息并对获取的生物特征信息进行图像预处理和特征提取而生成的，其中所述传感器、存储器和处理器集成在所述安全芯片中。
在一些实施例中，所述处理器包括：图像采集模块，用于从传感器感获取生物特征信息；图像预处理模块，用于对图像采集模块获取的生物特征信息进行预处理以获得生物特征的灰度图；特征提取模块，用于从图像预处理模块获得的灰度图中提取生物特征的特征点以获得与生物特征的特征点有关的生物特征数据；以及特征比对模块，用于将特征提取模块获得的生物特征数据与存储器中存储的生物特征模板相比较，如果生物特征数据与生物特征模板相匹配，则确定生物特征识别结果为通过，否则确定生物特征识别结果为未通过。
在一些实施例中，所述处理器还包括：签名模块，用于对生物特征识别结果进行数字签名。
在一些实施例中，所述安全芯片为安全元件(Secure Element，SE)。
在一些实施例中，所述安全芯片安装在计算设备中，并与计算设备的主机系统环境物理隔离。
在一些实施例中，所述计算设备的系统环境划分为安全区和非安全区，所述安全芯片通过所述安全区或非安全区向所述计算设备发送生物特征识别结果。
在一些实施例中，所述生物特征包括指纹，所述生物特征信息包括指纹的图像信息，所述生物特征数据包括指纹的特征点数据，所述生物特征模板包括指纹特征模板。
本发明的另一方面提供了一种生物特征识别方法，包括在单个安全芯片中执行以下操作：按照生物特征识别指令，感测生物特征信息；获取感测到的生物特征信息；对获取的生物特征信息进行图像预处理和特征提取以获得生物特征数据；以及将生物特征数据与安全芯片中存储的生物特征模板相比较，以确定生物特征识别结果。
在一些实施例中，所述生物特征识别方法还包括：在安全芯片中对生物特征识别结果进行数字签名。
本发明的又一方面提供了一种生物特征模板注册方法，包括在单个安全芯片中执行以下操作：按照生物特征模板注册指令，感测生物特征信息；获取感测到的生物特征信息；对获取的生物特征信息进行图像预处理和特征提取以获得生物特征数据；以 及将生物特征数据作为生物特征模板存储在安全芯片中。
附图说明
为了更清楚地说明本发明实施例的技术方案，下面将对实施例的附图作简单介绍，显而易见地，下面的描述中的附图仅涉及本发明的一些实施例，而非对本发明的限制。
图1示出了根据本发明的实施例的安全芯片的框图。
图2示出了根据本发明的实施例的安全芯片的框图。
图3示出了根据本发明的实施例的生物特征识别方法的图。
图4示出了根据本发明的实施例的生物特征模板注册方法的图。
具体实施方式
为使本发明实施例的目的、技术方案和优点更加清楚，下面将结合本发明实施例的附图，对本发明实施例的技术方案进行清楚、完整的描述。显然所描述的实施例是本发明的一部分实施例，而不是全部的实施例。基于所描述的本发明的实施例，本领域普通技术人员在无需创造性劳动的前提下所获得的所有其他实施例，都属于本发明保护的范围。
图1示出了根据本发明的实施例的安全芯片100的框图。如图1所示，安全芯片100包括传感器110、存储器120和处理器130。传感器110、存储器120和处理器130集成在所述安全芯片中。传感器110用于感测生物特征信息。存储器120用于存储生物特征模板。处理器130用于从传感器110获取生物特征信息、对获取的生物特信息进行图像预处理和特征提取并与存储器120存储的生物特征模板进行特征比对，以确定生物特征识别结果。所述生物特征模板是在注册阶段由处理器130通过从传感器110获取生物特征信息并对获取的生物特征信息进行图像预处理和特征提取而生成的。
在一些实施例中，处理器130可以包括：图像采集模块，用于从传感器110感获取生物特征信息；图像预处理模块，用于对图像采集模块获取的生物特征信息进行预处理以获得生物特征的灰度图；特征提取模块，用于从图像预处理模块获得的灰度图中提取生物特征的特征点以获得与生物特征的特征点有关的生物特征数据；以及特征比对模块，用于将特征提取模块获得的生物特征数据与存储器120中存储的生物特征模板相比较，如果生物特征数据与生物特征模板相匹配，则确定生物特征识别结果为通过，否则确定生物特征识别结果为未通过。
在一些实施例中，处理器130还可以包括：签名模块，用于对生物特征识别结果进行数字签名。
在一些实施例中，安全芯片100可以为安全元件SE。
在一些实施例中，安全芯片100可以安装在计算设备中，并与计算设备的主机系统环境物理隔离。
在一些实施例中，所述计算设备的系统环境可以划分为安全区和非安全区，安全芯片100通过所述安全区或非安全区向所述计算设备发送生物特征识别结果。
在一些实施例中，所述生物特征可以包括指纹，所述生物特征信息可以包括指纹的图像信息，所述生物特征数据可以包括指纹的特征点数据，所述生物特征模板可以包括指纹特征模板。
图2示出了根据本发明的实施例的安全芯片的框图。本发明的实施例可以适用于一种或多种生物特征的识别，生物特征的示例包括但不限于纹理(包括指纹、掌纹、静脉及相关附属特征，如汗孔等)、生物膜(如虹膜、视网膜等)、面孔、耳道、语音、体形、个人习惯(例如敲击键盘的力度和频率、签字、步态)等。在本实施例中，生物特征可以例如是指纹。
如图2所示，安全芯片200包括传感器210、存储器220和处理器230。传感器210、存储器220和处理器230集成在所述安全芯片200中。在一些实施例中，安全芯片200可以为SE。
传感器210用于感测生物特征信息。生物特征信息可以包括与诸如纹理(包括指纹、掌纹、静脉及相关附属特征，如汗孔等)、生物膜(如虹膜、视网膜等)、面孔、耳道、语音、体形、个人习惯(例如敲击键盘的力度和频率、签字、步态)等一种或多种生物特征有关的信息。例如对于指纹识别，所述生物特征信息可以包括指纹的图像信息。在本发明的实施例中，传感器210可以是光学传感器、半导体传感器、超声波传感器、射频识别传感器或可以感测生物特征信息的任何传感器。
存储器220用于存储生物特征模板。生物特征模板可以是在注册阶段由处理器230通过从传感器210获取生物特征信息并对获取的生物特征信息进行图像预处理和特征提取而生成的。在本发明的实施例中，存储模块220可以为非易失性存储器，例如闪存Flash、电可擦可编程只读存储器EEPROM、可擦可编程只读存储器EPROM、可编程只读存储器PROM或其他的在断电情况下能继续保留数据的磁、电存储介质。
处理器230用于从传感器210获取生物特征信息、对获取的生物特信息进行图像 预处理和特征提取并与存储器220存储的生物特征模板进行特征比对，以确定生物特征识别结果。
在一些实施例中，处理器230可以包括图像采集模块2301、图像预处理模块2302、特征提取模块2303和特征比对模块2304。可选地，处理器230还可以包括签名模块2305。
图像采集模块2301用于从传感器210感获取生物特征信息。例如，对于指纹，图像采集模块2201可以按照滑动采集方式或按压采集方式一次或多次从传感器感210获取指纹的图像信息。
图像预处理模块2302用于对图像采集模块图像采集模块2301获取的生物特征信息进行预处理以获得生物特征的灰度图。例如，对于指纹图像，预处理可以包括例如图像归一化、指纹有效区域分割处理、指纹方向图处理、指纹增强处理、指纹二值化处理和指纹细化处理等等。
特征提取模块2303用于从图像预处理模块2302获得的灰度图中提取生物特征的特征点以获得与生物特征的特征点有关的生物特征数据。例如，生物特征数据可以包括指纹的特征点数据。在生物特征模板的注册阶段，生成的生物特征数据作为生物特征模板存储在存储器1201中。
特征比对模块2304用于将特征提取模块2303获得的生物特征数据与存储器220中存储的生物特征模板相比较，如果生物特征数据与生物特征模板相匹配，则确定生物特征识别结果为通过，否则确定生物特征识别结果为未通过。
签名模块2305用于对生物特征识别结果进行数字签名。在一些实施例中，数字签名可以包括：在生物特征模板注册成功后生成包括公钥和私钥的密钥对，将私钥存储在安全芯片200中(例如，存储在存储器220中)，并将公钥发送至安全芯片200外部，以及在确定生物特征识别结果后利用私钥对生物特征识别结果进行数字签名。举例来说，安全芯片200可以在模板注册成功后生成密钥对，将私钥保存在安全芯片200中，经由安全芯片200所在的应用终端，例如安装有安全芯片200的智能电话或平板电脑，将公钥发送至应用服务器。安全芯片200在确定了生物特征识别结果之后，可以利用其保存的私钥对生物特征识别结果签名，并经由其所在的应用终端将经过签名的生物特征识别结果发送至应用服务器。应用服务器利用对应的公钥来验证该经过签名的生物特征识别结果的合法性。
在一些实施例中，安全芯片200可以安装在诸如智能电话或平板电脑之类的计算 设备中，并与计算设备的系统环境物理隔离。所述计算设备的系统环境可以划分为安全区和非安全区(例如，采用Trust Zone安全技术(或Secure Enclave)的智能手机或平板电脑)，安全芯片200提供的生物特征识别结果可以在所述计算设备的非安全区中传送以简化操作，也可以在安全区中传送以进一步提高安全性。当然，安全芯片200也可以安装在并未划分安全区和非安全区的计算设备中。可见，本发明的实施例适用于各种现有的智能手机或平板电脑等计算设备，具有较高的兼容性。
图3示出了根据本发明的实施例的生物特征识别方法300的图。整个方法300可以在单个安全芯片中进行，例如以上描述的安全芯片100和200。安全芯片可以安装在如智能手机、平板电脑之类的计算设备中，并且与计算设备的系统环境物理隔离。
在步骤S310，按照生物特征模板注册指令，感测生物特征信息，例如指纹的图像信息。生物特征识别指令可以来自诸如智能手机、平板电脑之类的计算设备。
在步骤S320，获取感测到的生物特征信息。
在步骤S330，对获取的生物特征信息进行图像预处理和特征提取以获得生物特征数据。例如，可以对获取的生物特征信息进行预处理(例如，图像归一化、指纹有效区域分割处理、指纹方向图处理、指纹增强处理、指纹二值化处理和指纹细化处理等等)以获得生物特征的灰度图，从获得的灰度图中提取生物特征的特征点以获得与生物特征的特征点有关的生物特征数据(例如，指纹的特征点数据)。
在步骤S340，将生物特征数据与安全芯片中存储的生物特征模板(例如，指纹特征模板)相比较，以确定生物特征识别结果。例如，如果生物特征数据与生物特征模板相匹配，则确定生物特征识别结果为通过，否则确定生物特征识别结果为未通过。
在一些实施例中，诸如指纹特征模板之类的生物特征模板可以是在注册阶段由安全芯片的处理器通过步骤S320和步骤S330而生成的，并且被存储在安全芯片的存储器中，例如非易失性存储器。非易失性存储器的示例包括但不限于闪存Flash、电可擦可编程只读存储器EEPROM、可擦可编程只读存储器EPROM、可编程只读存储器PROM或其他的在断电情况下能继续保留数据的磁、电存储介质。
在一些实施例中，方法300还可以包括通过安全芯片对生物特征识别结果进行数字签名，例如，以上描述的数字签名。
在一些实施例中，方法300还可以包括向所述计算设备传送生物特征识别结果。作为示例，对于采用Trust Zone安全技术(或Secure Enclave)的诸如智能手机、平板电脑之类的计算设备，可以通过计算设备的处理器安全区或非安全区将生物特征 识别结果(未签名的或已签名的)发送给该计算设备。
图4示出了根据本发明的实施例的生物特征模板注册方法400的图。整个方法400可以在单个安全芯片中进行，例如以上描述的安全芯片100和200。安全芯片可以安装在如智能手机、平板电脑之类的计算设备中，并且与计算设备的系统环境物理隔离。
在步骤S410，按照生物特征模板注册指令，感测生物特征信息，例如指纹的图像信息。生物特征模板注册指令可以来自诸如智能手机、平板电脑之类的计算设备。
在步骤S420，获取感测到的生物特征信息。
在步骤S430，对获取的生物特征信息进行图像预处理和特征提取以获得生物特征数据。例如，可以对生物特征信息进行预处理(例如图像归一化、指纹有效区域分割处理、指纹方向图处理、指纹增强处理、指纹二值化处理和指纹细化处理等等)以获得生物特征的灰度图，从获得的灰度图中提取生物特征的特征点以获得与生物特征的特征点有关的生物特征数据(例如，指纹的特征点数据)。
在步骤S440，将生物特征数据作为生物特征模板存储在安全芯片中。例如，可以将生物特征数据作为生物特征模板存储在安全芯片中的存储器中，例如非易失性存储器。非易失性存储器的示例包括但不限于闪存Flash、电可擦可编程只读存储器EEPROM、可擦可编程只读存储器EPROM、可编程只读存储器PROM或其他的在断电情况下能继续保留数据的磁、电存储介质。
本发明的实施例还提供了一种计算机可读存储介质，其存储有用于执行上述方法的指令。
在本发明的实施例中，从感测开始一直到识别完成，与生物特征有关的信息均由一个集成了传感器、存储器和处理器的安全芯片来独立处理，与诸如智能手机或平板电脑之类的计算设备的系统环境物理隔离，相比于传统的逻辑隔离，安全性大大提高。
在本发明的数量中，通过在安全芯片中集成传感器、存储器和处理器，提升了产品的集成度，从而降低成本和减少合封后的封装尺寸。而且，安全芯片相对于传感器的面积比例较小，将传感器集成在安全芯片中扩展安全芯片的功能性对整体面积影响不大，最终封装的安全芯片尺寸相对系统级封装(System in Package，SiP)来说具有很大的优势。
本发明的实施例可以直接以明文的方式提供生物特征识别结果(例如，在安全性较高的系统环境中)，也可以提供经过数字签名的生物特征识别结果，以防止开放式应用环境中的木马或病毒篡改安全芯片输出的生物特征识别结果，使得未通过指纹验 证的行为被授权通过。可见，本发明的实施例具有灵活的实现方式，可以根据需要而配置成适合不同安全等级的系统环境。
本发明实施例的生物特征识别装置可以安装在各种计算设备中，例如采用Trust Zone安全技术(或Secure Enclave)的智能手机或平板电脑等。安全芯片提供的生物特征识别结果可以在计算设备的非安全区中传送(例如在系统环境的安全性较高的情况下，或者在生物特征识别结果已被签名的情况下)，当然也可以在安全区中传送以进一步提高安全性。本发明实施例的生物特征识别装置也可以安装在并未划分安全区和非安全区的计算设备中。可见，本发明的实施例适用于各种现有的智能手机或平板电脑等计算设备，具有较高的兼容性。
以上所述仅是本发明的示范性实施方式，而非用于限制本发明的保护范围，本发明的保护范围由所附的权利要求确定。

Claims (10)

  1. 一种安全芯片，包括：
    传感器，用于感测生物特征信息；
    存储器，用于存储生物特征模板；以及
    处理器，用于从传感器获取生物特征信息、对获取的生物特信息进行图像预处理和特征提取并与存储器存储的生物特征模板进行特征比对，以确定生物特征识别结果，所述生物特征模板是在注册阶段由处理器通过从传感器获取生物特征信息并对获取的生物特征信息进行图像预处理和特征提取而生成的，
    其中所述传感器、存储器和处理器集成在所述安全芯片中。
  2. 根据权利要求1所述的安全芯片，其中，所述处理器包括：
    图像采集模块，用于从传感器感获取生物特征信息；
    图像预处理模块，用于对图像采集模块获取的生物特征信息进行预处理以获得生物特征的灰度图；
    特征提取模块，用于从图像预处理模块获得的灰度图中提取生物特征的特征点以获得与生物特征的特征点有关的生物特征数据；以及
    特征比对模块，用于将特征提取模块获得的生物特征数据与存储器中存储的生物特征模板相比较，如果生物特征数据与生物特征模板相匹配，则确定生物特征识别结果为通过，否则确定生物特征识别结果为未通过。
  3. 根据权利要求2所述的安全芯片，其中，所述处理器还包括：签名模块，用于对生物特征识别结果进行数字签名。
  4. 根据权利要求1所述的安全芯片，其中，所述安全芯片为安全元件SE。
  5. 根据权利要求1所述的安全芯片，其中，所述安全芯片安装在计算设备中，并与计算设备的主机系统环境物理隔离。
  6. 根据权利要求1所述的安全芯片，其中，所述计算设备的系统环境划分为安全区和非安全区，所述安全芯片通过所述安全区或非安全区向所述计算设备发送生物特征识别结果。
  7. 根据权利要求1至6中任一项所述的安全芯片，其中，所述生物特征包括指纹，所述生物特征信息包括指纹的图像信息，所述生物特征数据包括指纹的特征点数据，所述生物特征模板包括指纹特征模板。
  8. 一种生物特征识别方法，包括在单个安全芯片中执行以下操作：
    按照生物特征识别指令，感测生物特征信息；
    获取感测到的生物特征信息；
    对获取的生物特征信息进行图像预处理和特征提取以获得生物特征数据；以及
    将生物特征数据与安全芯片中存储的生物特征模板相比较，以确定生物特征识别结果。
  9. 根据权利要求8所述的方法，还包括：在安全芯片中对生物特征识别结果进行数字签名。
  10. 一种生物特征模板注册方法，包括在单个安全芯片中执行以下操作：
    按照生物特征模板注册指令，感测生物特征信息；
    获取感测到的生物特征信息；
    对获取的生物特征信息进行图像预处理和特征提取以获得生物特征数据；以及
    将生物特征数据作为生物特征模板存储在安全芯片中。
PCT/CN2017/087778 2016-06-12 2017-06-09 安全芯片、生物特征识别方法和生物特征模板注册方法 WO2017215534A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
JP2018555813A JP6687758B2 (ja) 2016-06-12 2017-06-09 セキュリティチップ、生体特徴識別方法及び生体特徴テンプレート登録方法
KR1020187018542A KR102070636B1 (ko) 2016-06-12 2017-06-09 컴퓨팅 장치, 생물학적 특징 인식 방법 및 생물학적 특징 템플릿 등록 방법
US16/309,255 US20190332755A1 (en) 2016-06-12 2017-06-09 Secure chip, biological feature identification method, and biological feature template registration method

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610412982.4 2016-06-12
CN201610412982.4A CN105975838A (zh) 2016-06-12 2016-06-12 安全芯片、生物特征识别方法和生物特征模板注册方法

Publications (1)

Publication Number Publication Date
WO2017215534A1 true WO2017215534A1 (zh) 2017-12-21

Family

ID=57011313

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/087778 WO2017215534A1 (zh) 2016-06-12 2017-06-09 安全芯片、生物特征识别方法和生物特征模板注册方法

Country Status (5)

Country Link
US (1) US20190332755A1 (zh)
JP (1) JP6687758B2 (zh)
KR (1) KR102070636B1 (zh)
CN (1) CN105975838A (zh)
WO (1) WO2017215534A1 (zh)

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105975838A (zh) * 2016-06-12 2016-09-28 北京集创北方科技股份有限公司 安全芯片、生物特征识别方法和生物特征模板注册方法
CN106599786A (zh) * 2016-11-15 2017-04-26 大唐微电子技术有限公司 一种传感器芯片
CN109214233B (zh) * 2017-06-29 2024-04-09 深圳荆虹科技有限公司 单层嵌入式生物识别算法的图像感测器芯片及终端设备
US10740494B2 (en) * 2017-09-06 2020-08-11 Google Llc Central and delegate security processors for a computing device
CN111259692A (zh) * 2018-11-30 2020-06-09 上海耕岩智能科技有限公司 一种生物特征分析方法、存储介质及神经网络
CN109840487B (zh) * 2019-01-24 2021-03-23 易保互联医疗信息科技（北京）有限公司 基于指纹信息的区块链电子钱包的私钥生成方法及系统
TWI743588B (zh) 2019-11-08 2021-10-21 緯創資通股份有限公司 電子裝置與生物辨識的特徵獲得方法
CN114629837A (zh) * 2022-03-18 2022-06-14 澜途集思(深圳)数字科技有限公司 基于NoC算法的生态生物识别方法

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1885315A (zh) * 2006-05-26 2006-12-27 上海一维科技有限公司 嵌入式单安全芯片生物指纹识别系统及其方法
CN101276384A (zh) * 2007-03-30 2008-10-01 成都方程式电子有限公司 一种安全控制芯片及其实现方法
CN105354466A (zh) * 2015-10-26 2016-02-24 维沃移动通信有限公司 一种指纹识别方法及移动终端
CN105373924A (zh) * 2015-10-10 2016-03-02 北京思比科微电子技术股份有限公司 一种面向终端设备提供安全支付功能的系统
CN105975838A (zh) * 2016-06-12 2016-09-28 北京集创北方科技股份有限公司 安全芯片、生物特征识别方法和生物特征模板注册方法
CN206162538U (zh) * 2016-06-12 2017-05-10 北京集创北方科技股份有限公司 安全芯片

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2004172865A (ja) * 2002-11-19 2004-06-17 Casio Comput Co Ltd 電子機器及び認証システム
JP2011035739A (ja) * 2009-08-03 2011-02-17 Sony Corp 生体認証装置および生体認証方法
RS54229B1 (en) * 2012-06-14 2015-12-31 Vlatacom D.O.O. BIOMETRIC ACCESS CONTROL SYSTEM AND PROCEDURE
EP2696306A1 (en) * 2012-07-30 2014-02-12 Eka A/S System and device for authenticating a user
CN102916968B (zh) * 2012-10-29 2016-01-27 北京天诚盛业科技有限公司 身份认证方法、身份认证服务器和身份认证装置
JP6222692B2 (ja) * 2013-09-26 2017-11-01 国立大学法人東京工業大学 機密生体サーバー認証
JP5664759B2 (ja) * 2013-12-26 2015-02-04 富士通株式会社 情報処理装置、認証システム、認証方法、認証装置及びプログラム
US9646146B2 (en) * 2014-03-10 2017-05-09 Bio-Key International, Inc. Utilization of biometric data
CN103870819B (zh) * 2014-04-04 2016-03-09 苏州思源科安信息技术有限公司 移动终端安全身份认证的虹膜识别光学成像模组及使用法

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1885315A (zh) * 2006-05-26 2006-12-27 上海一维科技有限公司 嵌入式单安全芯片生物指纹识别系统及其方法
CN101276384A (zh) * 2007-03-30 2008-10-01 成都方程式电子有限公司 一种安全控制芯片及其实现方法
CN105373924A (zh) * 2015-10-10 2016-03-02 北京思比科微电子技术股份有限公司 一种面向终端设备提供安全支付功能的系统
CN105354466A (zh) * 2015-10-26 2016-02-24 维沃移动通信有限公司 一种指纹识别方法及移动终端
CN105975838A (zh) * 2016-06-12 2016-09-28 北京集创北方科技股份有限公司 安全芯片、生物特征识别方法和生物特征模板注册方法
CN206162538U (zh) * 2016-06-12 2017-05-10 北京集创北方科技股份有限公司 安全芯片

Also Published As

Publication number Publication date
CN105975838A (zh) 2016-09-28
JP6687758B2 (ja) 2020-04-28
KR20180088715A (ko) 2018-08-06
US20190332755A1 (en) 2019-10-31
KR102070636B1 (ko) 2020-01-29
JP2019507451A (ja) 2019-03-14

Similar Documents

Publication Publication Date Title
WO2017215534A1 (zh) 安全芯片、生物特征识别方法和生物特征模板注册方法
WO2017215532A1 (zh) 一种生物特征识别装置和方法以及生物特征模板注册方法
WO2017215533A1 (zh) 生物特征识别装置和方法以及生物特征模板注册方法
EP3848790A1 (en) Registration and verification of biometric modalities using encryption techniques in a deep neural network
US9639839B2 (en) Fingerprint recognition control methods for payment and non-payment applications
US10963552B2 (en) Method and electronic device for authenticating a user
US20120087550A1 (en) Robust biometric feature extraction with and without reference point
US11552944B2 (en) Server, method for controlling server, and terminal device
US11790069B2 (en) Biometric system
KR101853270B1 (ko) 지문인식방법을 채용한 휴대용 보안인증기의 보안 인증방법
CN206162537U (zh) 一种生物特征识别装置
KR101853266B1 (ko) 지문인식방법을 채용한 휴대용 보안인증기
CN206162538U (zh) 安全芯片
CN206162536U (zh) 生物特征识别装置
KR101783369B1 (ko) 복수개의 보안 정보를 이용한 인증, 접근, 및 위변조를 통합 관리하는 방법
Kil et al. A study on the portable secure authenticator using fingerprint
KR200311558Y1 (ko) 지문을 이용한 생체인증 유에스비 토큰 시스템
Sinduja et al. Twin Layer Iris Certification for Confidential Archive by Conceiving Shares (ICCA-CS)

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 20187018542

Country of ref document: KR

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2018555813

Country of ref document: JP

Kind code of ref document: A

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17812645

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17812645

Country of ref document: EP

Kind code of ref document: A1