WO2018076163A1 - 指纹算法库与指纹传感器的绑定认证方法及指纹识别系统 - Google Patents

指纹算法库与指纹传感器的绑定认证方法及指纹识别系统 Download PDF

Info

Publication number
WO2018076163A1
WO2018076163A1 PCT/CN2016/103192 CN2016103192W WO2018076163A1 WO 2018076163 A1 WO2018076163 A1 WO 2018076163A1 CN 2016103192 W CN2016103192 W CN 2016103192W WO 2018076163 A1 WO2018076163 A1 WO 2018076163A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
fingerprint
fingerprint sensor
random
random data
Prior art date
Application number
PCT/CN2016/103192
Other languages
English (en)
French (fr)
Inventor
胡荣英
Original Assignee
深圳市汇顶科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市汇顶科技股份有限公司 filed Critical 深圳市汇顶科技股份有限公司
Priority to PCT/CN2016/103192 priority Critical patent/WO2018076163A1/zh
Priority to CN201680001815.9A priority patent/CN109075974B/zh
Publication of WO2018076163A1 publication Critical patent/WO2018076163A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Definitions

  • the invention relates to the field of fingerprint recognition technology, in particular to a fingerprint authentication method and a fingerprint sensor binding authentication method and a fingerprint identification system.
  • the fingerprint recognition system is basically composed of HOST end, fingerprint application unit, fingerprint algorithm library and fingerprint sensor.
  • the fingerprint sensor is responsible for collecting fingerprint data;
  • the HOST terminal is a host using a fingerprint application such as a mobile phone;
  • the underlying driver of the HOST terminal is responsible for interacting with the fingerprint sensor through the interface driver and reading the fingerprint data collected by the fingerprint sensor;
  • the fingerprint algorithm library provides fingerprint features.
  • the operation functions such as extraction, template registration, and fingerprint recognition are core units; the fingerprint application unit calls functions in the fingerprint algorithm library to perform corresponding operations.
  • fingerprint sensor manufacturers will develop their own fingerprint algorithm library, and the fingerprint sensor and fingerprint algorithm library will be sold together. Due to different research and development strengths, the performance of the algorithm and fingerprint sensor will be different, so there will be some fingerprint sensor manufacturers speculating and putting themselves The sensor output data is modeled as being consistent with the sensors of the sensor manufacturer with high performance, thereby stealing a library of high performance fingerprint algorithms.
  • the present invention provides a binding authentication method for a fingerprint algorithm library and a fingerprint sensor, and the invention also provides a fingerprint identification system.
  • the present invention provides a binding authentication method for a fingerprint algorithm library and a fingerprint sensor, comprising: generating, by a host, random data; acquiring, by the fingerprint sensor, the random data, and encrypting the random data to obtain encrypted data; The host side reads the encrypted data from the fingerprint sensor, and decrypts the encrypted data to obtain decrypted data; the host side compares whether the random data and the decrypted data are consistent, and judges when the two are consistent The binding authentication between the fingerprint algorithm library and the fingerprint sensor is successful.
  • the host end directly transmits the random data in the plaintext manner to the Fingerprint sensor.
  • the method further includes: the host end encrypts the random data generated by using the first encryption key to obtain the first encrypted data; The host end transmits the first encrypted data to the fingerprint sensor through a data interface between the host and the fingerprint sensor.
  • the fingerprint sensor acquiring the random data includes: the fingerprint sensor receiving the first encrypted data transmitted by the host end, and utilizing The first decryption key decrypts the first encrypted data to obtain first decrypted data, wherein the first decrypted data obtained by the fingerprint sensor decryption is the random data.
  • the first encryption key and the first decryption key are part or all of the identification number of the fingerprint sensor.
  • the fingerprint sensor encrypts the acquired random data by using the second encryption key, and the obtained encrypted data is the second encryption.
  • the second encryption key and the second decryption key are both part of the identification number of the fingerprint sensor or All are used as keys, and data obtained by encrypting the random data.
  • An improvement of the binding authentication method of the fingerprint algorithm library and the fingerprint sensor provided by the present invention further comprising: determining, between the fingerprint algorithm library and the fingerprint sensor, when the random data and the decrypted data are inconsistent The binding authentication failed and returned for loop authentication.
  • the operation of the host side is implemented in an algorithm initialization function of the fingerprint algorithm library, and the random data and the decrypted data are
  • the function in the fingerprint algorithm library is allowed to be used in the same phase. When the two are inconsistent, the algorithm is directly exited, and the function in the fingerprint algorithm library is not allowed to be called.
  • the operation of the host side is implemented when a function call is performed in the fingerprint algorithm library, and the random data and the decrypted data are The library function is executed correctly when the phase is consistent. When the two are inconsistent, the library function is exited and an error is returned.
  • the present invention further provides a fingerprint identification system, including a host end and a fingerprint sensor, wherein the host end and the fingerprint sensor perform data transmission through a data interface; wherein the fingerprint sensor is configured to acquire the Random data generated by the host side, and encrypting the random data to obtain encrypted data; the host end is configured to generate the random data, read the encrypted data from the fingerprint sensor, and perform the encrypted data Decrypting the decrypted data; and comparing whether the random data and the decrypted data are consistent, and determining that the binding authentication between the fingerprint algorithm library and the fingerprint sensor is successful when the two are consistent.
  • a fingerprint identification system including a host end and a fingerprint sensor, wherein the host end and the fingerprint sensor perform data transmission through a data interface; wherein the fingerprint sensor is configured to acquire the Random data generated by the host side, and encrypting the random data to obtain encrypted data; the host end is configured to generate the random data, read the encrypted data from the fingerprint sensor, and perform the encrypted data Decrypting the decrypted data; and comparing whether the
  • the host side includes: a random data generating unit, configured to generate the random data; a first communication unit, configured to pass the host end and the fingerprint sensor
  • the inter-data interface transmits the random data directly to the fingerprint sensor in clear text.
  • the host side includes: a random data generating unit, configured to generate the random data; and a first encrypting unit, configured to use the first encryption key to pair the random data Performing encryption to obtain first encrypted data; and a first communication unit, configured to transmit the first encrypted data to the fingerprint sensor by using a data interface between the host end and the fingerprint sensor.
  • the fingerprint sensor includes: a second communication unit, configured to receive first encrypted data transmitted by the host end through the data interface; and a first decryption unit, configured to: Decrypting the first encrypted data by using the first decryption key to obtain first decrypted data, wherein the first decrypted data obtained by the first decryption unit is the random data.
  • the first encryption key and the first decryption key are the fingerprint sensing Part or all of the identification number of the device.
  • the fingerprint sensor further includes a second encryption unit, configured to encrypt the acquired random data by using the second encryption key, and obtain the encrypted data as the second encryption.
  • the second communication unit is further configured to provide the second encrypted data to the host by using the data interface;
  • the first communication unit of the host is further configured to receive the The second encrypted data is provided by the fingerprint sensor, and the host end further includes a second decrypting unit, configured to perform decryption processing on the second encrypted data by using the second decryption key, and the obtained decrypted data is the second decrypted data.
  • the second encryption key and the second decryption key are both part or all of the identification number of the fingerprint sensor as a key, and The random data is subjected to encryption processing.
  • the host end further includes: a comparing unit, configured to compare whether the random data and the decrypted data are consistent; and a fingerprint identifying unit, configured to: in the random data and When the decrypted data is consistent, it is determined that the binding authentication between the fingerprint algorithm library and the fingerprint sensor is successful, and when the random data and the decrypted data are inconsistent, the fingerprint algorithm library and the fingerprint are determined. Binding authentication between sensors fails and returns to loop authentication.
  • the operation of the host side is implemented in an algorithm initialization function of the fingerprint algorithm library, and the fingerprint identification unit is configured to be consistent between the random data and the decrypted data.
  • the functions in the fingerprint algorithm library are allowed to be used in phase, and when the two are inconsistent, the algorithm is directly exited, and the functions in the fingerprint algorithm library are not allowed to be called.
  • the operation of the host side is implemented when a function call is performed in the fingerprint algorithm library, and the fingerprint identification unit is configured to be consistent between the random data and the decrypted data.
  • the library function is executed correctly at the same time, and when the two are inconsistent, the library function is exited and an error is returned.
  • the fingerprint authentication algorithm and the fingerprint sensor binding authentication method enable the same manufacturer's fingerprint algorithm library to be used with its own fingerprint sensor, otherwise the algorithm cannot be used normally by using its own algorithm and other manufacturers' fingerprint sensors to avoid theft. Every time the authentication, the random data RandomH generated by HOST is different, which is uncertain and difficult to crack;
  • the random data Random1 and the encryption and decryption keys used for authentication are also different each time, which is uncertain and difficult to crack.
  • the ID of the unique fingerprint sensor is used as the key to encrypt the random data Random1 as the encryption and decryption key. Increased the security of data encryption and decryption;
  • the HOST authentication is implemented inside the fingerprint algorithm library, and the fingerprint algorithm library is a library file, which is not open source and has high security.
  • FIG. 1 is a schematic block diagram of an embodiment of a method for binding authentication of a fingerprint algorithm library and a fingerprint sensor according to the present invention
  • FIG. 2 is a schematic block diagram of another embodiment of a method for binding authentication of a fingerprint algorithm library and a fingerprint sensor according to the present invention
  • FIG. 3 is a schematic block diagram of a method for binding authentication of a fingerprint algorithm library and a fingerprint sensor according to Embodiment 1 of the present invention
  • FIG. 4 is a schematic flowchart of a method for binding authentication of a fingerprint algorithm library and a fingerprint sensor according to Embodiment 1 of the present invention
  • FIG. 5 is a schematic block diagram of a method for binding authentication of a fingerprint algorithm library and a fingerprint sensor according to Embodiment 2 of the present invention
  • FIG. 6 is a schematic flowchart of a method for binding authentication of a fingerprint algorithm library and a fingerprint sensor according to Embodiment 2 of the present invention
  • FIG. 7 is a structural block diagram of a fingerprint identification system in Embodiment 3 of the present invention.
  • Figure 8 is a block diagram showing the structure of a fingerprint recognition system in Embodiment 4 of the present invention.
  • the present invention provides a binding authentication method for a fingerprint algorithm library and a fingerprint sensor.
  • the fingerprint algorithm library is stored at the HOST end, and the HOST end is communicatively connected with the fingerprint sensor, as shown in FIG.
  • the binding authentication method of the fingerprint algorithm library and the fingerprint sensor includes the following steps:
  • Step 1 each time the authentication, the host (HOST) generates random data Random1;
  • Step 2 the fingerprint sensor acquires the random data Random1 and encrypts it with the second encryption key KEY_En2 to obtain the second encrypted data Random_En2;
  • Step 3 the HOST end reads back the second encrypted data Random_En2 from the fingerprint sensor, and decrypts with the second decryption key KEY_De2 to obtain the second decrypted data Random2;
  • Step 4 Compare the random data Random1 with the second decrypted data Random2. If the two are consistent, the authentication succeeds, and the function in the fingerprint algorithm library can be used; if the two are inconsistent, the authentication fails, and the process returns to step 1 to perform the loop authentication.
  • the operation of the HOST terminal is completed in the fingerprint algorithm library, for example, in the algorithm initialization function of the fingerprint algorithm library, or when the function call is performed in the fingerprint algorithm library; wherein the main functions of the algorithm include fingerprint feature extraction and template registration , fingerprint recognition and other operational functions.
  • the functions of the fingerprint algorithm library can be used if the two (random data Random1 and second decrypted data Random2) are the same, If the same, the algorithm is directly exited, and the function in the fingerprint algorithm library is not allowed to be called.
  • the two (the random data Random1 and the second decrypted data Random2) are the same, the fingerprint algorithm library function is correctly executed, and the library function is exited differently, and an error is returned, the function function Execution is not normal.
  • the data transmitted by the HOST terminal to the fingerprint sensor through the data interface (such as the data communication interface between the HOST terminal and the fingerprint sensor) is plaintext, that is, unencrypted random data Random1,
  • the random data Random1 can also be encrypted on the HOST side, so that the random data transmitted by the HOST terminal to the fingerprint sensor through the above data interface is converted into the first encrypted data.
  • the following steps are further included between step 1 and step 2:
  • the HOST end encrypts the random data Random1 by the first encryption key KEY_En1 to obtain the first encrypted data Random_En1, and then sends the first encrypted data Random_En1 to the fingerprint sensor through the above data interface; the fingerprint sensor receives the first encrypted data Random_En1 to pass the first decryption
  • the key KEY_De1 decrypts the first encrypted data Random_En1 to obtain first decrypted data Random1.
  • the number of times of binding authentication of the fingerprint algorithm library and the fingerprint sensor may be set to multiple times, for example, it is preferably set to three times, and the authentication fails after three consecutive times of binding authentication failure.
  • the maximum number of authentication times is not limited, and it can be set more times.
  • the fingerprint algorithm library and the fingerprint sensor encryption and decryption algorithm in this embodiment may use a symmetric algorithm or an asymmetric algorithm.
  • the symmetric algorithm is employed, the first encryption key KEY_En1 and the second decryption key KEY_De1 are the same, and the second encryption key KEY_En2 and the second decryption key KEY_De2 are the same.
  • the first encryption key KEY_En1 is different from the first decryption key KEY_De1 when an asymmetric algorithm is employed, for example, one uses a public key and the other uses a private key; similarly, the second encryption key KEY_En2 and the second decryption key
  • the key KEY_De2 is different, such as one using a public key and the other using a private key.
  • the key for performing data encryption and decryption in the present invention may be a string Data, for example, using an identification number (ID) stored in a storage unit inside the fingerprint sensor as a key, each fingerprint sensor randomly writing its own ID at the time of production, the ID of the fingerprint sensor being unique, ie The ID of each fingerprint sensor is different.
  • the storage unit may be a non-volatile storage medium such as Flash or OTP.
  • the above-mentioned key may also be encrypted data encrypted using the data, for example, encrypted data KEY obtained by using the ID as a key and encrypting the random data Random1 as data.
  • the fingerprint authentication algorithm and the fingerprint sensor binding authentication method enable the same manufacturer's fingerprint algorithm library to be used with its own fingerprint sensor, otherwise the algorithm cannot be used normally by using its own algorithm and other manufacturers' fingerprint sensors to avoid theft. And, at each authentication time, the random data Random1 generated by the HOST side is different, which is uncertain and difficult to crack; therefore, the random data Random1 and the encrypted data KEY used for authentication are different each time, with uncertainty.
  • the ID of the fingerprint sensor (each fingerprint sensor has an ID for identifying the identity, the ID is unique) as a key to encrypt the random data Random1 data as the encrypted data KEY, which is used for The encryption and decryption key increases the security of data encryption and decryption;
  • the authentication of the HOST side is implemented inside the fingerprint algorithm library, and the fingerprint algorithm library is a library file, which is not open source and has high security.
  • FIG. 3 is a schematic diagram of a first embodiment of a fingerprint authentication method and a fingerprint sensor binding authentication method provided by the present invention
  • FIG. 4 is a binding authentication method shown in FIG. 3 .
  • the binding authentication method of the fingerprint algorithm library and the fingerprint sensor includes the following steps:
  • the HOST terminal generates random data Random1.
  • the random data Random1 can be generated according to parameters such as time, which is not limited in this embodiment;
  • S12, HOST end uses the first encryption key KEY_En1 to encrypt the random data Random1 to obtain the first encrypted data Random_En1;
  • the fingerprint algorithm library of the HOST terminal may perform the first encryption process on the random data Random1 generated in step S11 by using the first first encryption unit and the preset first encryption function to obtain the first encrypted data Random_En1;
  • the first encryption key KEY_En1 employed may be an identification number (ID) of the fingerprint sensor read from the fingerprint sensor, and the ID of the fingerprint sensor may be pre-stored in a storage unit inside the fingerprint sensor. Each fingerprint sensor generates a unique random number as an ID and writes to its internal storage unit. The ID of each fingerprint sensor is different.
  • the storage unit may be a non-volatile storage such as Flash or OTP. medium.
  • the fingerprint algorithm library of the HOST side reads the identification number (ID) from the fingerprint sensor and uses it as the first encryption key KEY_En1 for performing the first encryption process on the random data Random1.
  • the HOST terminal sends the first encrypted data Random_En1 to the fingerprint sensor through a data interface.
  • the HOST terminal After encrypting the random data Random1 to obtain the first encrypted data Random_En1, the HOST terminal writes the first encrypted data Random_En1 to the fingerprint sensor through the data interface, and the fingerprint sensor can further receive the first encrypted data Random_En1 provided by the HOST terminal through the data interface.
  • the fingerprint sensor decrypts the first encrypted data Random_En1 by using the first decryption key KEY_De1 to obtain the first decrypted data Random1;
  • the fingerprint sensor may perform the first decryption process on the first encrypted data Random_En1 received from the HOST terminal by using the first decryption unit therein and using a preset first decryption function, where the first decryption function is step S12.
  • the first decryption key KEY_De1 employed by the fingerprint sensor may also be the identification number (ID) of the fingerprint sensor. Since the first encrypted data Random_En1 is obtained by encrypting the random data Random1, the first decrypted data Random1 obtained by the fingerprint sensor in the successful decryption process on the first encrypted data Random_En1 in step S14 is the random data Random1.
  • the fingerprint sensor uses the second encryption key KEY_En2 to encrypt the first decrypted data Random1 to obtain the second encrypted data Random_En2;
  • the fingerprint sensor may perform the second encryption process on the first decrypted data Random1 obtained in step S14 by using the second encryption unit and the preset second encryption function, wherein the fingerprint sensor is in the process.
  • the second encryption key KEY_En2 used in the secondary encryption process can be obtained by:
  • the fingerprint sensor passes a part of the first decrypted data Random1 or the first decrypted data Random1 (that is, part or all of the first decrypted data Random1) by using a third encryption unit and using a preset third encryption function. Encryption processing is performed, wherein the key used by the encryption processing may be specifically an identification number (ID) of the fingerprint sensor.
  • the third encrypted data obtained by the encryption process is used as the second encryption key KEY_En2.
  • the fingerprint sensor sends the second encrypted data Random_En2 to the HOST terminal through the data interface;
  • the fingerprint sensor After the second decryption data Random1 is processed to obtain the second encrypted data Random_En2, the fingerprint sensor provides the second encrypted data Random_En2 to the HOST terminal through the data interface between the fingerprint and the HOST terminal; the HOST terminal can further pass the data interface. The second encrypted data Random_En2 is read.
  • the HOST side decrypts the second encrypted data Random_En2 by using the second decryption key KEY_De2 to obtain a second decrypted number. According to Random2;
  • the HOST terminal may perform a second decryption process on the second encrypted data Random_En2 read from the fingerprint sensor by using a second decryption unit therein and using a preset second decryption function, wherein the step is performed.
  • the second decryption function of the middle HOST terminal may be the inverse function of the second encryption function employed in step S16.
  • the second decryption key KEY_De2 used by the HOST terminal for the second decryption process can be obtained by:
  • the HOST terminal encrypts a part of the random data Random1 or the random data Random1 (that is, part or all of the random data Random1) by using the internal fourth encryption unit and using a preset fourth encryption function, wherein the encryption processing is performed.
  • the key can also be specific to the identity number (ID) of the fingerprint sensor.
  • the encryption process of the encrypted data in this step is completed in the HOST terminal fingerprint algorithm library; wherein the fourth encryption function adopted by the HOST terminal may be the same as or different from the third encryption function used by the fingerprint sensor.
  • the HOST terminal compares the random data Random1 with the second decrypted data Random2. If the two are consistent, the authentication succeeds, and the function in the fingerprint algorithm library can be used; if the two are inconsistent, the authentication fails, and the process returns to step S11 for cyclic authentication.
  • the operation of the HOST terminal is specifically implemented in an algorithm initialization function of the fingerprint algorithm library.
  • the function in the fingerprint algorithm library may be used, and if not, the direct exit is performed.
  • Algorithm does not allow calling functions in the fingerprint algorithm library;
  • the operation of the HOST terminal is implemented when a function call is performed in the fingerprint algorithm library. If the random data Random1 and the second decrypted data Random2 are the same, the library function is correctly executed, and the library function is exited differently, and An error was returned and the function was not functioning properly.
  • the present embodiment may return to the step S11 after the authentication failure occurs. Certification.
  • the number of times of the round robin authentication may be preferably set to three times, that is, the authentication fails after three consecutive failures.
  • the length of the random data, the first encryption/decryption key, the first encryption/decryption data, the second encryption/decryption data, the second encryption/decryption key, and the like are determined by an encryption and decryption algorithm. It is decided that different lengths of different algorithms may be different.
  • FIG. 5 is a schematic diagram of a second embodiment of a fingerprint authentication method and a fingerprint sensor binding authentication method provided by the present invention
  • FIG. 6 is a binding authentication method illustrated in FIG. 5 .
  • the main difference of the embodiment 2 is that the HOST terminal directly supplies the random data Random1 generated by the HOST terminal to the fingerprint sensor without performing the first encryption processing on the random data Random1 data, that is, the HOST terminal is in the same with the fingerprint sensor.
  • the data written between the data interfaces is plain text.
  • the method for binding authentication of the fingerprint algorithm library and the fingerprint sensor provided in this embodiment includes the following steps:
  • the HOST terminal sends the random data Random1 to the fingerprint sensor through a data interface.
  • the fingerprint sensor encrypts the random data Random1 by using the second encryption key KEY_En2 to obtain the second encrypted data. Random_En2;
  • the fingerprint sensor may perform encryption processing by using the second encryption unit therein and using the preset second encryption function to receive the random data Random1 received from the HOST terminal, wherein the fingerprint sensor is used in the encryption process in this step.
  • the second encryption key KEY_En2 can be obtained by:
  • S23-1 The fingerprint sensor encrypts part or all of the random data Random1 by using a third encryption unit and using a preset third encryption function, where the key used in the encryption process may be specifically The identification number (ID) of the fingerprint sensor.
  • the encrypted data obtained by the encryption process of the third encryption unit is used as the second encryption key KEY_En2.
  • the fingerprint sensor sends the second encrypted data Random_En2 to the HOST terminal through the data interface.
  • the HOST side uses the second decryption key KEY_De2 to decrypt the second encrypted data Random_En2, to obtain the second decrypted data Random2;
  • the HOST terminal may perform a second decryption process on the second encrypted data Random_En2 read from the fingerprint sensor by using a second decryption unit therein and using a preset second decryption function, where the HOST terminal is in this step.
  • the second decryption function may be the inverse of the second encryption function employed in step S24.
  • the second decryption key KEY_De2 used by the HOST terminal for the second decryption process can be obtained by:
  • the HOST terminal performs encryption processing on part or all of the random data Random1 through the internal fourth encryption unit and using a preset fourth encryption function, wherein the key used in the encryption processing may also be specifically The identification number (ID) of the fingerprint sensor.
  • the encryption process of the encrypted data in this step is completed in the HOST terminal fingerprint algorithm library; wherein the fourth encryption function adopted by the HOST terminal may be the same as or different from the third encryption function used by the fingerprint sensor.
  • the HOST terminal compares the random data Random1 with the second decrypted data Random2. If the two are consistent, the authentication succeeds, and the function in the fingerprint algorithm library can be used; if the two are inconsistent, the authentication fails, and the process returns to step S21 for cyclic authentication.
  • step S26 and the subsequent steps refer to the related description of step S18, and details are not described herein again.
  • the present invention further provides a fingerprint identification system that can be applied to the binding authentication method of the fingerprint algorithm library and the fingerprint sensor.
  • the fingerprint identification system includes a host end and a fingerprint sensor, wherein the host end and the fingerprint sensor perform data transmission through a data interface; the fingerprint sensor is configured to acquire random data generated by the host end, and Encrypting the random data to obtain the encrypted data; the host end is configured to generate the random data, read the encrypted data from the fingerprint sensor, and decrypt the encrypted data to obtain decrypted data; and compare the random data Whether the data and the decrypted data are consistent, and when the two are consistent, it is determined that the binding authentication between the fingerprint algorithm library and the fingerprint sensor is successful.
  • the fingerprint recognition system provided by the present invention will be described below by using Embodiment 3 and Embodiment 4, respectively.
  • the embodiment further provides a fingerprint identification system, where the fingerprint identification system corresponds to Embodiment 1 of the binding authentication method between the fingerprint algorithm library and the fingerprint sensor, and includes HOST. End 710 and fingerprint sensor 720, the HOST end 710 And the fingerprint sensor 720 is connected to each other through a data interface between the two and performs data transmission. among them,
  • the HOST terminal 710 includes:
  • a first encryption unit 712 configured to encrypt the random data Random1 by using the first encryption key KEY_En1 to obtain first encrypted data Random_En1; wherein the first encryption unit 712 can be configured by using a preset first encryption function
  • the random data Random1 is subjected to encryption processing.
  • the first communication unit 713 is configured to transmit the first encrypted data Random_En1 to the fingerprint sensor 720 through a data interface between the HOST terminal 710 and the fingerprint sensor 720.
  • the fingerprint sensor 720 includes:
  • the second communication unit 721 is configured to receive the first encrypted data Random_En1 that is transmitted by the HOST terminal 710 through the data interface;
  • the first decryption unit 722 is configured to decrypt the first encrypted data Random_En1 by using the first decryption key KEY_De1 to obtain first decrypted data, wherein the first decryption unit 722 can pass the preset first decryption function. Decrypting the first encrypted data Random_En1, and the first decryption function is an inverse function of the first encryption function. Since the first encrypted data Random_En1 is obtained by encrypting the random data Random1 by the first encryption key KEY_En1, the first decryption unit 722 decrypts the first encrypted data Random_En1. The first decrypted data is the random data Random1.
  • the first encryption key KEY_En1 adopted by the first encryption unit 712 of the HOST terminal 710 and the first decryption key KEY_De1 adopted by the first decryption unit 722 of the fingerprint sensor 720 It may be part or all of the identification number (ID) of the fingerprint sensor 720, respectively.
  • the ID of the fingerprint sensor 720 may be a string of data randomly written and saved to the fingerprint sensor 720 at the time of production, which is unique.
  • the HOST terminal 710 can read the ID from the fingerprint sensor 710 and save it for the first encryption unit 712 to use the ID as the first encryption key KEY_En1.
  • the first decrypted data 722 of the fingerprint sensor 720 may use the ID as the first decryption key KEY_De1.
  • the HOST terminal 710 and the fingerprint sensor 720 may further include a first storage unit 714 and a second storage unit 724, respectively, for storing the identity of the fingerprint sensor 720.
  • the fingerprint sensor 720 may further include:
  • the second encryption unit 725 is configured to perform encryption processing on the random data Random1 (that is, the first decrypted data) obtained by using the second encryption key KEY_En2 to obtain the encrypted data as the second encrypted data Random_En2;
  • the second encryption unit 725 can perform the above encryption processing by using a preset second encryption function.
  • the second communication unit 721 is further configured to provide the second encrypted data Random_En2 to the HOST terminal 710 through the data interface.
  • the first communication unit 713 of the HOST terminal 710 is further configured to receive the second encrypted data Random_En2 provided by the fingerprint sensor 720 through the data interface, and the host end 710 further includes a second decryption unit 715, configured to utilize The second decryption key KEY_De2 decrypts the second encrypted data Random_En2, and the obtained decrypted data is the second decrypted data Random2.
  • the second decryption unit 715 can perform the above decryption process by using a preset second decryption function.
  • the second encryption unit 725 adopts the second encryption key KEY_En2 and the second decryption key KEY_De2 adopted by the second decryption unit 715 can respectively be the part of the identification number (ID) of the fingerprint sensor 720. Or all of them as a key, and data obtained by encrypting the random data Random1 (or the first decrypted data).
  • the fingerprint sensor 720 may further include an encryption key generating module, configured to use an identity identification number (ID) of the fingerprint sensor 720 and the first decrypted data (ie, the random data Random1) Generating the second encryption key.
  • the encryption key generation module may be implemented by the following third encryption unit 726.
  • the third encryption unit 726 is configured to use the part or all of the identity identification number (ID) of the fingerprint sensor 720 as a key to decrypt the first decrypted data obtained by the first decryption unit 722 (ie, the The random data Random1) is subjected to encryption processing, and the obtained data is taken as the second encryption key KEY_En2.
  • the HOST terminal 710 may further include a decryption key generation module configured to generate the second decryption key according to the identity identification number (ID) of the fingerprint sensor 720 and the random data Random1.
  • the decryption key generation module may be implemented by the following fourth encryption unit 716.
  • the fourth encryption unit 716 is configured to encrypt the random data Random1 generated by the random data generating module 711 by using part or all of the identity identification number (ID) of the fingerprint sensor 720 as a key, and The obtained data is taken as the second decryption key KEY_De2.
  • the HOST terminal 710 may further include:
  • the determining unit 717 is configured to compare whether the random data Random1 generated by the random data generating module 711 and the second decrypted data Random2 obtained by the second decrypting module 715 are consistent;
  • the fingerprint identification unit 718 is configured to determine, when the random data Random1 and the second decrypted data Random2 are identical, that the binding authentication between the fingerprint algorithm library and the fingerprint sensor 720 is successful, and the random data is When Random1 and the decrypted data Random2 do not coincide, it is determined that the binding authentication between the fingerprint algorithm library and the fingerprint sensor 720 fails and returns to perform loop authentication.
  • the operation of the HOST terminal 710 may be implemented in an algorithm initialization function of the fingerprint algorithm library, and the fingerprint identification unit 718 is configured to allow use when the random data Random1 and the decrypted data Random2 are in phase.
  • the function in the fingerprint algorithm library directly exits the algorithm when the two are inconsistent, and does not allow the function in the fingerprint algorithm library to be called.
  • the operation of the HOST terminal 710 can also be implemented when a function call is performed in the fingerprint algorithm library, and the fingerprint identification unit 718 is configured to perform correctly when the random data Random1 and the decrypted data Random2 are in phase.
  • the library function when the two are inconsistent, exits the library function and returns an error.
  • the fingerprint sensor 720 may further include a fingerprint collection unit 728 for collection. Fingerprint data entered by the user.
  • the first storage unit 714 of the HOST terminal 710 may be used to store the random data Random1 and the first encryption function in addition to the identity identification number (ID) read from the fingerprint sensor 720.
  • the second storage unit 724 of the fingerprint sensor 720 is configured to store the first decryption function, the second encryption function, and the second, in addition to the identification number (ID) of the fingerprint sensor 720.
  • the random number generating unit 711, the first encrypting unit 712, the second decrypting unit 715, the fourth encrypting unit 716, the comparing unit 717, and the fingerprint identifying unit 718 of the HOST terminal 710 may pass through the HOST terminal.
  • the CPU in 710 runs the program module implementation stored in the first storage unit 714.
  • the first decryption unit 722, the second encryption unit 725, and the third encryption unit 726 of the fingerprint sensor 720 may be implemented by a CPU in the fingerprint sensor 720 running a program module stored in the second storage unit 724.
  • the first communication unit 713 and the second communication unit 721 can be implemented by a data transmitting circuit and a data receiving circuit.
  • the functions of unit 722, second encryption unit 725, and third encryption unit 726 can also be implemented using hardware circuitry.
  • this embodiment further provides another fingerprint identification system, where the fingerprint identification system corresponds to Embodiment 2 of the binding authentication method between the fingerprint algorithm library and the fingerprint sensor, which includes The HOST terminal 810 of the communication connection and the fingerprint sensor 820, the HOST terminal 810 and the fingerprint sensor 820 are connected to each other through a data interface therebetween for data transmission.
  • the main difference between the fingerprint identification system of the present embodiment and the previous embodiment is that the HOST terminal 810 directly transmits the random data Random1 generated by the HOST terminal 810 to the fingerprint sensor 820 without being encrypted.
  • the HOST terminal 810 includes:
  • a random number generating unit 811 configured to generate random data Random1;
  • the first communication unit 813 is configured to directly transmit the random data Random1 to the fingerprint sensor 820 in a clear text manner through a data interface between the HOST terminal 810 and the fingerprint sensor 820.
  • the fingerprint sensor 820 includes:
  • the second communication unit 821 is configured to receive the random data Random1 transmitted by the HOST terminal 810 through the data interface;
  • the second encryption unit 825 is configured to perform encryption processing on the random data Random1 received by the second communication unit 821 by using the second encryption key KEY_En2, to obtain the encrypted data as the second encrypted data Random_En2.
  • the second communication unit 821 is further configured to provide the second encrypted data Random_En2 to the HOST terminal 810 through the data interface.
  • the HOST terminal 810 and the fingerprint sensor 820 may further include a first storage unit 814 and a second storage unit 824, respectively, for storing the fingerprint sensor 820.
  • Identification number ID
  • the host end 810 further includes a second decryption unit 815, configured to decrypt the second encrypted data Random_En2 by using the second decryption key KEY_De2, and the obtained decrypted data is the second decrypted data Random2.
  • a second decryption unit 815 configured to decrypt the second encrypted data Random_En2 by using the second decryption key KEY_De2, and the obtained decrypted data is the second decrypted data Random2.
  • the second encryption unit 825 adopts the second encryption key KEY_En2 and the second decryption key KEY_De2 adopted by the second decryption unit 815, respectively, may be the part of the identification number (ID) of the fingerprint sensor 720. Or all of them as keys and data obtained by encrypting the random data Random1.
  • the fingerprint sensor 820 may further include an encryption key generation module, which may be implemented by the third encryption unit 826.
  • the third encryption unit 826 is configured to use the part or all of the identity identification number (ID) of the fingerprint sensor 820 as a key to receive random data from the HOST terminal 810 by the second communication unit 821. Random1 performs encryption processing and uses the obtained data as the second encryption key KEY_En2.
  • the HOST terminal 810 may further include a decryption key generation module, and the decryption key generation module may be implemented by the fourth encryption unit 816.
  • the fourth encryption unit 816 is configured to encrypt the random data Random1 generated by the random data generating module 811 by using part or all of the identity identification number (ID) of the fingerprint sensor 820 as a key, and The obtained data is taken as the second decryption key KEY_De2.
  • the HOST terminal 810 may further include:
  • the determining unit 817 is configured to compare whether the random data Random1 generated by the random data generating module 811 and the second decrypted data Random2 obtained by the second decrypting module 815 are consistent;
  • the fingerprint identification unit 818 is configured to determine, when the random data Random1 and the second decrypted data Random2 are identical, that the binding authentication between the fingerprint algorithm library and the fingerprint sensor 820 is successful, and the random data is When Random1 and the decrypted data Random2 do not coincide, it is determined that the binding authentication between the fingerprint algorithm library and the fingerprint sensor 820 fails and returns to perform loop authentication.
  • HOST Host devices that use fingerprint sensors to implement fingerprint recognition functions, such as mobile phones, notebooks, and PADs.
  • Fingerprint sensor responsible for converting fingerprints into quantifiable data, including capacitive fingerprint sensors, optical fingerprint sensors, ultrasonic fingerprint sensors, etc.
  • Flash Flash memory, a type of memory device that can store data for a long time without current, that is, data can be maintained after power off.
  • OTP One time program, one-time programmable, data can be maintained after power off.
  • Non-volatile storage medium It can save data for a long time without current, that is, the data can be maintained after power off, and the original data can be read after power-on.
  • Symmetric algorithm The same encryption and decryption algorithm as the encryption key and the decryption key.
  • Asymmetric algorithm encryption and decryption algorithm with different encryption key and decryption key
  • ESD Electrostatic discharge.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Collating Specific Patterns (AREA)
  • Measurement Of The Respiration, Hearing Ability, Form, And Blood Characteristics Of Living Organisms (AREA)

Abstract

一种指纹算法库与指纹传感器的绑定认证方法及指纹识别系统，该指纹算法库与指纹传感器的绑定认证方法包括以下步骤：主机端生成随机数据；指纹传感器获取所述随机数据，并对所述随机数据进行加密得到加密数据；所述主机端从所述指纹传感器读取所述加密数据，并对所述加密数据进行解密得到解密数据；所述主机端比较所述随机数据和所述解密数据是否一致，并在二者一致时判断出所述指纹算法库和所述指纹传感器之间的绑定认证成功。上述指纹算法库与指纹传感器的绑定认证方法，使同一厂家的指纹算法库必须配合自己的指纹传感器才能使用，否则使用自己的算法搭配别的厂商的指纹传感器则算法无法正常工作，避免被盗用。

Description

指纹算法库与指纹传感器的绑定认证方法及指纹识别系统 技术领域
本发明涉及指纹识别技术领域，特别是涉及了一种指纹算法库与指纹传感器的绑定认证方法及指纹识别系统。
背景技术
随着指纹识别技术的不断发展，指纹识别技术在智能手机等行业应用得越来越广泛，指纹识别系统基本都是由HOST端、指纹应用单元、指纹算法库、指纹传感器组成。其中，指纹传感器负责采集指纹数据；HOST端如手机等使用指纹应用的主机；HOST端的底层驱动，负责通过接口驱动和指纹传感器进行交互，读取指纹传感器采集的指纹数据；指纹算法库提供指纹特征提取、模板注册、指纹识别等操作函数，为核心单元；指纹应用单元会调用指纹算法库中的函数进行相应的操作。
大部分指纹传感器厂商都会研发自己的指纹算法库，并且指纹传感器和指纹算法库配套销售，由于研发实力的不同，算法和指纹传感器性能会存在差异，这样就会存在有些指纹传感器厂商投机倒把，把自己的传感器输出数据模仿成和算法性能高的传感器厂商的传感器一致，从而盗用性能高的指纹算法库。
发明内容
为了解决上述现有技术的不足，本发明提供了一种指纹算法库与指纹传感器的绑定认证方法，本发明还提供了一种指纹识别系统。
一方面，本发明提供一种指纹算法库与指纹传感器的绑定认证方法，包括：主机端生成随机数据；指纹传感器获取所述随机数据，并对所述随机数据进行加密得到加密数据；所述主机端从所述指纹传感器读取所述加密数据，并对所述加密数据进行解密得到解密数据；所述主机端比较所述随机数据和所述解密数据是否一致，并在二者一致时判断出所述指纹算法库和所述指纹传感器之间的绑定认证成功。
作为本发明提供的指纹算法库与指纹传感器的绑定认证方法的一种改进，所述主机端通过其与所述指纹传感器之间的数据接口将所述随机数据以明文方式直接传输给所述指纹传感器。
作为本发明提供的指纹算法库与指纹传感器的绑定认证方法的一种改进，还包括：所述主机端利用第一加密密钥对其生成的随机数据进行加密，得到第一加密数据；所述主机端通过其与所述指纹传感器之间的数据接口将所述第一加密数据传输给所述指纹传感器。
作为本发明提供的指纹算法库与指纹传感器的绑定认证方法的一种改进，所述指纹传感器获取所述随机数据包括：所述指纹传感器接收所述主机端传输的第一加密数据，并利用第一解密密钥对所述第一加密数据进行解密，得到第一解密数据，其中所述指纹传感器解密得到的所述第一解密数据为所述随机数据。
作为本发明提供的指纹算法库与指纹传感器的绑定认证方法的一种改进，所述第一加密密钥和所述第一解密密钥为所述指纹传感器的身份识别号码的部分或全部。
作为本发明提供的指纹算法库与指纹传感器的绑定认证方法的一种改进，所述指纹传感器利用第二加密密钥对获取到的随机数据进行加密处理，且得到的加密数据为第二加密数据；所述主机端利用第二解密密钥对所述第二加密数据进行解密处理，且得到的解密数据为第二解密数据。
作为本发明提供的指纹算法库与指纹传感器的绑定认证方法的一种改进，所述第二加密密钥和所述第二解密密钥均为以所述指纹传感器的身份识别号码的部分或者全部作为密钥，并对将所述随机数据进行加密处理得到的数据。
作为本发明提供的指纹算法库与指纹传感器的绑定认证方法的一种改进，还包括：在所述随机数据和所述解密数据不一致时判断出所述指纹算法库和所述指纹传感器之间的绑定认证失败，并返回进行循环认证。
作为本发明提供的指纹算法库与指纹传感器的绑定认证方法的一种改进，所述主机端的操作在所述指纹算法库的算法初始化函数中实现，且在所述随机数据和所述解密数据一致相时允许使用所述指纹算法库中的函数，在二者不一致时则直接退出算法，不允许调用所述指纹算法库中函数。
作为本发明提供的指纹算法库与指纹传感器的绑定认证方法的一种改进，所述主机端的操作在所述指纹算法库中进行函数调用时实现，且在所述随机数据和所述解密数据一致相时正确执行库函数，在二者不一致时同则退出所述库函数并返回错误。
另一方面，本发明还提供一种指纹识别系统，包括主机端和指纹传感器，所述主机端和所述指纹传感器之间通过数据接口进行数据传输；其中，所述指纹传感器用于获取所述主机端生成的随机数据，并对所述随机数据进行加密得到加密数据；所述主机端用于生成所述随机数据，从所述指纹传感器读取所述加密数据，并对所述加密数据进行解密得到解密数据；并且，比较所述随机数据和所述解密数据是否一致，并在二者一致时判断出指纹算法库和所述指纹传感器之间的绑定认证成功。
作为本发明提供的指纹识别系统的一种改进，所述主机端包括：随机数据生成单元，用于生成所述随机数据；第一通信单元，用于通过所述主机端与所述指纹传感器之间的数据接口将所述随机数据以明文方式直接传输给所述指纹传感器。
作为本发明提供的指纹识别系统的一种改进，所述主机端包括：随机数据生成单元，用于生成所述随机数据；第一加密单元，用于利用第一加密密钥对所述随机数据进行加密，得到第一加密数据；第一通信单元，用于通过所述主机端与所述指纹传感器之间的数据接口将所述第一加密数据传输给所述指纹传感器。
作为本发明提供的指纹识别系统的一种改进，所述指纹传感器包括：第二通信单元，用于接收所述主机端通过所述数据接口传输的第一加密数据；第一解密单元，用于利用第一解密密钥对所述第一加密数据进行解密，得到第一解密数据，其中所述第一解密单元解密得到的所述第一解密数据为所述随机数据。
作为本发明提供的指纹识别系统的一种改进，所述第一加密密钥和所述第一解密密钥为所述指纹传感 器的身份识别号码的部分或全部。
作为本发明提供的指纹识别系统的一种改进，所述指纹传感器还包括第二加密单元，用于利用第二加密密钥对获取到的随机数据进行加密处理，得到的加密数据为第二加密数据；且所述第二通信单元还用于通过所述数据接口将所述第二加密数据提供给所述主机端；所述主机端的第一通信单元还用于通过所述数据接口接收所述指纹传感器提供的第二加密数据，且所述主机端还包括第二解密单元，用于利用第二解密密钥对所述第二加密数据进行解密处理，得到的解密数据为第二解密数据。
作为本发明提供的指纹识别系统的一种改进，所述第二加密密钥和所述第二解密密钥均为以所述指纹传感器的身份识别号码的部分或者全部作为密钥，并对将所述随机数据进行加密处理得到的数据。
作为本发明提供的指纹识别系统的一种改进，所述主机端还包括：比较单元，用于比较所述随机数据和所述解密数据是否一致；指纹识别单元，用于在所述随机数据和所述解密数据一致时判断出所述指纹算法库和所述指纹传感器之间的绑定认证成功，而在所述随机数据和所述解密数据不一致时判断出所述指纹算法库和所述指纹传感器之间的绑定认证失败并返回进行循环认证。
作为本发明提供的指纹识别系统的一种改进，所述主机端的操作在所述指纹算法库的算法初始化函数中实现，且所述指纹识别单元用于在所述随机数据和所述解密数据一致相时允许使用所述指纹算法库中的函数，在二者不一致时则直接退出算法，不允许调用所述指纹算法库中函数。
作为本发明提供的指纹识别系统的一种改进，所述主机端的操作在所述指纹算法库中进行函数调用时实现，且所述指纹识别单元用于在所述随机数据和所述解密数据一致相时正确执行库函数，在二者不一致时同则退出所述库函数并返回错误。
本发明具有如下有益效果：
本指纹算法库与指纹传感器的绑定认证方法，使同一厂家的指纹算法库必须配合自己的指纹传感器才能使用，否则使用自己的算法搭配别的厂商的指纹传感器则算法无法正常工作，避免被盗用；每一次认证的时候HOST产生的随机数据Random1都不相同，具有不确定性，难以破解；
认证用的随机数据Random1和加解密密钥也是每次不同的，具有不确定性，难以破解；采用具有唯一性的指纹传感器的ID作为密钥对随机数据Random1进行加密作为加解密密钥，这样增加了数据加解密的安全性；
HOST端的认证都在指纹算法库内部实现，并且指纹算法库都是库文件，不会开放源码，安全性较高。
附图说明
图1是本发明指纹算法库与指纹传感器的绑定认证方法一种实施例的原理框图；
图2是本发明指纹算法库与指纹传感器的绑定认证方法另一种实施例的原理框图；
图3是本发明实施例1中指纹算法库与指纹传感器的绑定认证方法的原理框图；
图4是本发明实施例1中指纹算法库与指纹传感器的绑定认证方法的流程示意图；
图5是本发明实施例2中指纹算法库与指纹传感器的绑定认证方法的原理框图；
图6是本发明实施例2中指纹算法库与指纹传感器的绑定认证方法的流程示意图；
图7是本发明实施例3中指纹识别系统的结构框图；
图8是本发明实施例4中指纹识别系统的结构框图。
具体实施方式
下面结合附图和实施例对本发明进行详细的说明。
针对背景技术所描述的缺陷，本发明提供了一种指纹算法库与指纹传感器的绑定认证方法，该指纹算法库储存在HOST端，HOST端与指纹传感器通信连接，如图1所示，该指纹算法库与指纹传感器的绑定认证方法包括以下步骤：
步骤1、每次认证时，主机(HOST)生成随机数据Random1；
步骤2、指纹传感器获取随机数据Random1并利用第二加密密钥KEY_En2对其进行加密得到第二加密数据Random_En2；
步骤3、HOST端从指纹传感器读回第二加密数据Random_En2读回，并利用第二解密密钥KEY_De2进行解密，得到第二解密数据Random2；
步骤4、将随机数据Random1和第二解密数据Random2进行比较，若两者一致则认证成功，即可使用指纹算法库中的函数；若两者不一致则认证失败，返回步骤1进行循环认证。
具体实现时，HOST端的操作在指纹算法库中完成，比如在指纹算法库的算法初始化函数中实现，或是在指纹算法库中进行函数调用时实现；其中算法主要函数包括指纹特征提取、模板注册、指纹识别等操作函数。在将随机数据Random1和第二解密数据Random2进行比较时，在算法初始化函数中实现的情况下，两者(随机数据Random1和第二解密数据Random2)相同则可以使用指纹算法库中的函数，不相同则直接退出算法，不允许调用指纹算法库中函数。在指纹算法库中进行函数调用时实现的情况下，两者(随机数据Random1和第二解密数据Random2)相同则正确执行该指纹算法库函数，不同则退出该库函数，并返回错误，函数功能执行不正常。
在上述指纹算法库与指纹传感器的绑定认证方法中，HOST端通过数据接口(比如HOST端与指纹传感器之间数据通信接口)向指纹传感器传输的数据为明文，即未加密的随机数据Random1，但在HOST端也可以对随机数据Random1进行加密，使HOST端通过上述数据接口向指纹传感器传输的随机数据转换为第一加密数据。如图2所示，即步骤1和步骤2之间还包括以下步骤：
HOST端通过第一加密密钥KEY_En1对随机数据Random1进行加密得到第一加密数据Random_En1，然后再通过上述数据接口将其发送给到指纹传感器；指纹传感器收到第一加密数据Random_En1对通过第一解密密钥KEY_De1对所述第一加密数据Random_En1进行解密得到第一解密数据Random1。
为了防止在认证的时候由于ESD(静电放电)或者其他问题导致接口数据传输出错进而导致认证出错， 具体实现时，指纹算法库与指纹传感器的绑定认证次数可以设置为多次，比如优选设置为3次，在连续3次绑定认证都出现失败才认为认证失败。认证次数上限不做限制，也可设置更多次。
另一方面，本实施例中的指纹算法库和指纹传感器的加解密算法可以采用对称算法也可以是非对称算法。在采用对称算法时，第一加密密钥KEY_En1和第二解密密钥KEY_De1相同，第二加密密钥KEY_En2和第二解密密钥KEY_De2相同。在采用非对称算法时第一加密密钥KEY_En1和第一解密密钥KEY_De1不同，比如，其中一个使用公钥而另一个使用私钥；相类似地，第二加密密钥KEY_En2和第二解密密钥KEY_De2不同，比如其中一个使用公钥而另一个使用私钥。
本发明中的用于进行数据加密和解密的密钥(即所述第一加密密钥KEY_En1、第二加密密钥KEY_En2、第一解密密钥KEY_De1和第二解密密钥KEY_De2)可以是一串数据，例如使用保存在指纹传感器内部的存储单元中的身份识别号码(ID)作为密钥，每个指纹传感器在生产时随机写入其自身的ID，所述指纹传感器的ID具有唯一性，即是每个指纹传感器的ID都不一样，该存储单元可以是Flash、OTP等不易挥发性存储介质。
在一种替代实施例中，上述密钥也可以是使用数据经过加密后的加密数据，例如使用ID作为密钥，并将随机数据Random1作为数据进行加密得到的加密数据KEY。
本指纹算法库与指纹传感器的绑定认证方法，使同一厂家的指纹算法库必须配合自己的指纹传感器才能使用，否则使用自己的算法搭配别的厂商的指纹传感器则算法无法正常工作，避免被盗用；并且，在每一次认证的时候HOST端产生的随机数据Random1都不相同，具有不确定性，难以破解；因此，认证用的随机数据Random1和加密数据KEY也是每次不同的，具有不确定性，难以破解；另外，由指纹传感器的ID(每个指纹传感器都有一个用于识别身份的ID，该ID具有唯一性)作为密钥对随机数据Random1数据进行加密作为加密数据KEY，其用于加解密的密钥，这样增加了数据加解密的安全性；HOST端的认证都在指纹算法库内部实现，并且指纹算法库都是库文件，不会开放源码，安全性较高。
实施例1
请参阅图3和图4，其中图3是本发明提供的一种指纹算法库与指纹传感器的绑定认证方法第一个实施例的原理图，图4是图3所示的绑定认证方法的流程示意图。所述指纹算法库与指纹传感器的绑定认证方法包括以下步骤：
S11，每次认证时，HOST端生成随机数据Random1。所述随机数据Random1可以根据时间等参数生成，本实施例对此不作限制；
S12、HOST端利用第一加密密钥KEY_En1对随机数据Random1进行加密，得到第一加密数据Random_En1；
具体地，HOST端的指纹算法库可以通过其内部的第一加密单元并采用预设的第一加密函数对步骤S11生成的随机数据Random1进行第一次加密处理，得到第一加密数据Random_En1；其中所述第一次加密处 理采用的第一加密密钥KEY_En1可以为从指纹传感器读取的指纹传感器的身份识别号码(ID)，所述指纹传感器的ID可以预先保存在指纹传感器内部的存储单元中。每个指纹传感器在生产时产生具有唯一性的随机数作为ID并写入其内部的存储单元，每个指纹传感器的ID都不一样，其中所述存储单元可以是Flash、OTP等不易挥发性存储介质。HOST端的指纹算法库会从指纹传感器读取所述身份识别号码(ID)，并将其作为对随机数据Random1进行第一次加密处理的第一加密密钥KEY_En1。
S13，HOST端通过数据接口将第一加密数据Random_En1发送给指纹传感器；
HOST端在将随机数据Random1加密得到第一加密数据Random_En1之后，通过数据接口将第一加密数据Random_En1写入到指纹传感器，指纹传感器可以进一步通过数据接口接收到HOST端提供的第一加密数据Random_En1。
S14，指纹传感器利用第一解密密钥KEY_De1对第一加密数据Random_En1进行解密，得到第一解密数据Random1；
具体地，指纹传感器可以通过其内部的第一解密单元并采用预设的第一解密函数对从HOST端接收到的第一加密数据Random_En1进行第一次解密处理，其中第一解密函数是步骤S12采用的第一加密函数的反函数。并且，在步骤S14中，指纹传感器采用的第一解密密钥KEY_De1可以同样是所述指纹传感器的身份识别号码(ID)。由于第一加密数据Random_En1是由随机数据Random1加密得到，因此在步骤S14中指纹传感器在对第一加密数据Random_En1进行成功进行解密处理得到的第一解密数据Random1便是所述随机数据Random1。
S15，指纹传感器利用第二加密密钥KEY_En2对第一解密数据Random1进行加密，得到第二加密数据Random_En2；
具体地，指纹传感器可以通过其内部的第二加密单元并采用预设的第二加密函数对步骤S14得到的第一解密数据Random1进行第二次加密处理，其中，本步骤中指纹传感器在进行第二次加密处理所采用的第二加密密钥KEY_En2可以通过以下方式得到：
S15-1，指纹传感器通过内部的第三加密单元并采用预设的第三加密函数对所述第一解密数据Random1或第一解密数据Random1的一部分(即第一解密数据Random1的部分或全部)进行加密处理，其中所述加密处理所采用的密钥可以具体为所述指纹传感器的身份识别号码(ID)。其中，所述加密处理得到的第三加密数据作为所述第二加密密钥KEY_En2。
S16，指纹传感器通过数据接口将第二加密数据Random_En2发送给HOST端；
指纹传感器在将第一解密数据Random1进行第二次加密处理得到第二加密数据Random_En2之后，通过其与HOST端之间数据接口将第二加密数据Random_En2提供给HOST端；HOST端可以进一步通过数据接口读取到第二加密数据Random_En2。
S17，HOST端利用第二解密密钥KEY_De2对第二加密数据Random_En2进行解密，得到第二解密数 据Random2；
S17-1，具体地，HOST端可以通过其内部的第二解密单元并采用预设的第二解密函数对从指纹传感器读取的第二加密数据Random_En2进行第二次解密处理，其中，本步骤中HOST端的第二解密函数可以为步骤S16采用的第二加密函数的反函数。并且，HOST端进行第二次解密处理所采用的第二解密密钥KEY_De2可以通过以下方式得到：
HOST端通过内部的第四加密单元并采用预设的第四加密函数对随机数据Random1或随机数据Random1的一部分(即随机数据Random1的部分或全部)进行加密处理，其中所述加密处理所采用的密钥同样可以具体为所述指纹传感器的身份识别号码(ID)。本步骤的加密数据的加密过程在HOST端指纹算法库中完成；其中HOST端采用的第四加密函数可与指纹传感器采用的第三加密函数相同或不同。
S18、HOST端将随机数据Random1和第二解密数据Random2进行比较，若两者一致则认证成功，即可使用指纹算法库中的函数；若两者不一致则认证失败，返回步骤S11进行循环认证。
在一种实施例中，HOST端的操作具体在指纹算法库的算法初始化函数中实现，此时如果随机数据Random1和第二解密数据Random2相同则可以使用指纹算法库中的函数，不相同则直接退出算法，不允许调用指纹算法库中函数；
在另一种实施例中，HOST端的操作在指纹算法库中进行函数调用时实现，此时如果随机数据Random1和第二解密数据Random2相同则正确执行该库函数，不同则退出该库函数，并返回错误，函数功能执行不正常。
另一方面，在步骤S18出现认证失败的情况下，为了防止在认证的时候由于ESD干扰或者其他问题导致接口数据传输出错进而导致认证出错，本实施例可以在出现认证失败之后返回步骤S11进行循环认证。其中，所述循环认证次数可以优选设置为3次，即在连续3次都出现失败才认为认证失败。
需要注意的是，在本实施例中，随机数据、第一加密/解密密钥、第一加密/解密数据、第二加密/解密数据、第二加密/解密密钥等的长度由加解密算法决定，不同的算法这些长度可能不一样。
实施例2
请参阅图5和图6，其中图5是本发明提供的一种指纹算法库与指纹传感器的绑定认证方法第二个实施例的原理图，图6是图5所示的绑定认证方法的流程示意图。与实施例1相比，实施例2的主要区别在于HOST端直接将其生成的随机数据Random1提供给指纹传感器，而没有对随机数据Random1数据进行第一加密处理，即HOST端在其与指纹传感器之间的数据接口写上的数据为明文。如图7和图8所示，本实施例提供的指纹算法库与指纹传感器的绑定认证方法，其包括以下步骤：
S21，每次认证时，HOST端生成随机数据Random1。
S22，HOST端通过数据接口将随机数据Random1发送给到指纹传感器。
S23，指纹传感器利用第二加密密钥KEY_En2对随机数据Random1进行加密，得到第二加密数据 Random_En2；
具体地，指纹传感器可以通过其内部的第二加密单元并采用预设的第二加密函数从HOST端接收到的随机数据Random1进行加密处理，其中，本步骤中指纹传感器在进行加密处理所采用的第二加密密钥KEY_En2可以通过以下方式得到：
S23-1，指纹传感器通过内部的第三加密单元并采用预设的第三加密函数对所述随机数据Random1的部分或全部进行加密处理，其中所述加密处理所采用的密钥可以具体为所述指纹传感器的身份识别号码(ID)。其中，所述第三加密单元的加密处理得到的加密数据作为所述第二加密密钥KEY_En2。
S24，指纹传感器通过数据接口将第二加密数据Random_En2发送给到HOST端。
S25，HOST端利用第二解密密钥KEY_De2对第二加密数据Random_En2进行解密，得到第二解密数据Random2；
具体地，HOST端可以通过其内部的第二解密单元并采用预设的第二解密函数对从指纹传感器读取的第二加密数据Random_En2进行第二次解密处理，其中，本步骤中HOST端的第二解密函数可以为步骤S24采用的第二加密函数的反函数。并且，HOST端进行第二次解密处理所采用的第二解密密钥KEY_De2可以通过以下方式得到：
S25-1，HOST端通过内部的第四加密单元并采用预设的第四加密函数对随机数据Random1的部分或全部进行加密处理，其中所述加密处理所采用的密钥同样可以具体为所述指纹传感器的身份识别号码(ID)。本步骤的加密数据的加密过程在HOST端指纹算法库中完成；其中HOST端采用的第四加密函数可与指纹传感器采用的第三加密函数相同或不同。
S26、HOST端将随机数据Random1和第二解密数据Random2进行比较，若两者一致则认证成功，即可使用指纹算法库中的函数；若两者不一致则认证失败，返回步骤S21进行循环认证。
步骤S26及其后续步骤可以具体参阅步骤S18的相关描述，此处不再赘述
基于上述指纹算法库与指纹传感器的绑定认证方法的两个实施例，本发明还进一步提供一种可以适用于上述指纹算法库与指纹传感器的绑定认证方法的指纹识别系统。所述指纹识别系统包括主机端和指纹传感器，所述主机端和所述指纹传感器之间通过数据接口进行数据传输；所述指纹传感器用于获取所述主机端生成的随机数据，并对所述随机数据进行加密得到加密数据；所述主机端用于生成所述随机数据，从所述指纹传感器读取所述加密数据，并对所述加密数据进行解密得到解密数据；并且，比较所述随机数据和所述解密数据是否一致，并在二者一致时判断出指纹算法库和所述指纹传感器之间的绑定认证成功。以下分别通过实施例3和实施例4对本发明提供的指纹识别系统进行说明。
实施例3
如图7所示，本实施例还提供了一种指纹识别系统，所述指纹识别系统对应于所述指纹算法库和所述指纹传感器之间的绑定认证方法的实施例1，其包括HOST端710和指纹传感器720，所述HOST端710 和所述指纹传感器720通过二者之间的数据接口相互连接并进行数据传输。其中，
所述HOST端710包括：
随机数生成单元711，其用于生成随机数据Random1；
第一加密单元712，其用于利用第一加密密钥KEY_En1对所述随机数据Random1进行加密，得到第一加密数据Random_En1；其中所述第一加密单元712可以通过预设的第一加密函数来对所述随机数据Random1进行加密处理。
第一通信单元713，用于通过所述HOST端710与所述指纹传感器720之间的数据接口将所述第一加密数据Random_En1传输给所述指纹传感器720。
所述指纹传感器720包括：
第二通信单元721，用于接收所述HOST端710通过所述数据接口传输的第一加密数据Random_En1；
第一解密单元722，用于利用第一解密密钥KEY_De1对所述第一加密数据Random_En1进行解密，得到第一解密数据，其中，所述第一解密单元722可以通过预设的第一解密函数对所述第一加密数据Random_En1进行解密处理，且所述第一解密函数为所述第一加密函数的反函数。由于所述第一加密数据Random_En1为所述随机数据Random1通过所述第一加密密钥KEY_En1进行加密得到的，因此所述第一解密单元722对所述第一加密数据Random_En1进行解密得到的所述第一解密数据便为所述随机数据Random1。
进一步地，在本实施例中，所述HOST端710的第一加密单元712所采用的第一加密密钥KEY_En1和所述指纹传感器720的第一解密单元722所采用的第一解密密钥KEY_De1可以分别为所述指纹传感器720的身份识别号码(ID)的部分或全部。
其中，所述指纹传感器720的ID可以是在生产时随机写入并保存到所述指纹传感器720的一串数据，其具有唯一性。所述HOST端710可以从所述指纹传感器710读取所述ID并进行保存，以供所述第一加密单元712将所述ID作为第一加密密钥KEY_En1。所述指纹传感器720的第一解密数据722可以将所述ID作为所述第一解密密钥KEY_De1。
相对应地，在具体实施例中，所述HOST端710和所述指纹传感器720还可以分别包括第一存储单元714和第二存储单元724，二者用于存储所述指纹传感器720的身份识别号码(ID)；其中，所述第一存储单元714和所述第二存储单元724可以具体是Flash、OTP等不易挥发性存储介质。
在本实施例中，所述指纹传感器720还可以进一步包括：
第二加密单元725，用于利用第二加密密钥KEY_En2对其获取到的随机数据Random1(即所述第一解密数据)进行加密处理，得到加密数据为第二加密数据Random_En2；其中所述第二加密单元725可以通过预设的第二加密函数进行上述加密处理。所述第二通信单元721还用于通过所述数据接口将所述第二加密数据Random_En2提供给所述HOST端710。
所述HOST端710的第一通信单元713还用于通过所述数据接口接收所述指纹传感器720提供的第二加密数据Random_En2，且所述主机端710还包括第二解密单元715，用于利用第二解密密钥KEY_De2对所述第二加密数据Random_En2进行解密处理，得到的解密数据为第二解密数据Random2。其中，所述第二解密单元715可以通过预设的第二解密函数来进行上述解密处理。
其中，所述第二加密单元725采用第二加密密钥KEY_En2和所述第二解密单元715采用的第二解密密钥KEY_De2可以分别为以所述指纹传感器720的身份识别号码(ID)的部分或者全部作为密钥，并对将所述随机数据Random1(或所述第一解密数据)进行加密处理得到的数据。
在本实施例中，所述指纹传感器720可以进一步包括加密密钥生成模块，用于根据所述指纹传感器720的身份识别号码(ID)和所述第一解密数据(即所述随机数据Random1)生成所述第二加密密钥。其中，所述加密密钥生成模块可以通过以下第三加密单元726来实现。所述第三加密单元726，用于采用所述指纹传感器720的身份识别号码(ID)的部分或全部作为密钥，对所述第一解密单元722解密得到的第一解密数据(即所述随机数据Random1)进行加密处理，并将得到的数据作为所述第二加密密钥KEY_En2。
相对应地，所述HOST端710可以进一步包括解密密钥生成模块，用于根据所述指纹传感器720的身份识别号码(ID)和所述随机数据Random1生成所述第二解密密钥。其中，所述解密密钥生成模块可以通过以下第四加密单元716来实现。所述第四加密单元716，用于采用所述指纹传感器720的身份识别号码(ID)的部分或全部作为密钥，对所述随机数据生成模块711生成的随机数据Random1进行加密处理，并将得到的数据作为所述第二解密密钥KEY_De2。
进一步地，所述HOST端710还可以包括：
判断单元717，用于比较所述随机数据生成模块711生成的随机数据Random1和所述第二解密模块715得到的第二解密数据Random2是否一致；
指纹识别单元718，用于在所述随机数据Random1和所述第二解密数据Random2一致时判断出所述指纹算法库和所述指纹传感器720之间的绑定认证成功，而在所述随机数据Random1和所述解密数据Random2不一致时判断出所述指纹算法库和所述指纹传感器720之间的绑定认证失败并返回进行循环认证。
具体地，所述HOST端710的操作可以在所述指纹算法库的算法初始化函数中实现，且所述指纹识别单元718用于在所述随机数据Random1和所述解密数据Random2一致相时允许使用所述指纹算法库中的函数，在二者不一致时则直接退出算法，不允许调用所述指纹算法库中函数。或者，所述HOST端710的操作也可以在所述指纹算法库中进行函数调用时实现，且所述指纹识别单元718用于在所述随机数据Random1和所述解密数据Random2一致相时正确执行库函数，在二者不一致时同则退出所述库函数并返回错误。
另一方面，在具体实施例中，所述指纹传感器720还可以进一步包括指纹采集单元728，用于采集用 户输入的指纹数据。所述HOST端710的第一存储单元714除了用于储存从所述指纹传感器720读取的身份识别号码(ID)之外，还可以用于存储所述随机数据Random1、所述第一加密函数、所述第二解密函数、所述第四加密函数及指纹算法函数等。所述指纹传感器720的第二存储单元724除了用于存储所述指纹传感器720的身份识别号码(ID)以外，还用于储存所述第一解密函数、所述第二加密函数、所述第三加密函数和所述指纹数据等。
另外，在具体实施例中，所述HOST端710的随机数生成单元711、第一加密单元712、第二解密单元715、第四加密单元716、比较单元717和指纹识别单元718可以通过HOST端710中的CPU运行所述第一存储单元714中存储的程序模块实现。所述指纹传感器720的第一解密单元722、第二加密单元725和第三加密单元726可以通过所述指纹传感器720中的CPU运行所述第二存储单元724中存储的程序模块实现。另外，所述第一通信单元713和所述第二通信单元721可以通过数据发送电路和数据接收电路来实现。可替代地，在另一种实施例中，所述随机数生成单元711、第一加密单元712、第二解密单元715、第四加密单元716、比较单元717、指纹识别单元718、第一解密单元722、第二加密单元725和第三加密单元726的功能也可以采用硬件电路来实现。
实施例4
如图8所示，本实施例还提供了另一种指纹识别系统，所述指纹识别系统对应于所述指纹算法库和所述指纹传感器之间的绑定认证方法的实施例2，其包括通信连接的HOST端810和指纹传感器820，所述HOST端810和所述指纹传感器820通过二者之间的数据接口相互连接并进行数据传输。其中，本实施例的指纹识别系统与上一实施例的主要区别在于所述HOST端810将其生成的随机数据Random1不经过加密处理而直接传输给所述指纹传感器820。
具体地，所述HOST端810包括：
随机数生成单元811，其用于生成随机数据Random1；
第一通信单元813，用于通过所述HOST端810与所述指纹传感器820之间的数据接口将所述随机数据Random1以明文方式直接传输给所述指纹传感器820。
所述指纹传感器820包括：
第二通信单元821，用于接收所述HOST端810通过所述数据接口传输的随机数据Random1；
第二加密单元825，用于利用第二加密密钥KEY_En2对所述第二通信单元821接收到的随机数据Random1进行加密处理，得到加密数据为第二加密数据Random_En2。
并且，所述第二通信单元821还用于通过所述数据接口将所述第二加密数据Random_En2提供给所述HOST端810。
与实施例3相类似，在具体实施例中，所述HOST端810和所述指纹传感器820还可以分别包括第一存储单元814和第二存储单元824，二者用于存储所述指纹传感器820的身份识别号码(ID)。
所述主机端810还包括第二解密单元815，用于利用第二解密密钥KEY_De2对所述第二加密数据Random_En2进行解密处理，得到的解密数据为第二解密数据Random2。
其中，所述第二加密单元825采用第二加密密钥KEY_En2和所述第二解密单元815采用的第二解密密钥KEY_De2可以分别为以所述指纹传感器720的身份识别号码(ID)的部分或者全部作为密钥，并对将所述随机数据Random1进行加密处理得到的数据。
相类似地，在本实施例中，所述指纹传感器820可以进一步包括加密密钥生成模块，其可以通过第三加密单元826来实现。所述第三加密单元826，用于采用所述指纹传感器820的身份识别号码(ID)的部分或全部作为密钥，对所述第二通信单元821从所述HOST端810接收到的随机数据Random1进行加密处理，并将得到的数据作为所述第二加密密钥KEY_En2。所述HOST端810可以进一步包括解密密钥生成模块，所述解密密钥生成模块可以通过第四加密单元816来实现。所述第四加密单元816，用于采用所述指纹传感器820的身份识别号码(ID)的部分或全部作为密钥，对所述随机数据生成模块811生成的随机数据Random1进行加密处理，并将得到的数据作为所述第二解密密钥KEY_De2。
进一步地，所述HOST端810还可以包括：
判断单元817，用于比较所述随机数据生成模块811生成的随机数据Random1和所述第二解密模块815得到的第二解密数据Random2是否一致；
指纹识别单元818，用于在所述随机数据Random1和所述第二解密数据Random2一致时判断出所述指纹算法库和所述指纹传感器820之间的绑定认证成功，而在所述随机数据Random1和所述解密数据Random2不一致时判断出所述指纹算法库和所述指纹传感器820之间的绑定认证失败并返回进行循环认证。
需要说明的是，本发明所涉及到的专业术语描述如下：
HOST端：使用指纹传感器实现指纹识别功能的主机设备，如手机、笔记本、PAD等。
指纹传感器：负责把指纹转换成可以量化的数据，包括电容式指纹传感器，光学指纹传感器，超声波指纹传感器等。
Flash：闪存，内存器件的一种，在没有电流的情况下也能长久的保存数据，即断电之后数据还可以保持。
OTP：One time Program，一次性可编程，断电之后数据也可以保持。
不易挥发性存储介质：在没有电流的情况下也能长久的保存数据，即断电之后数据还可以保持，上电之后还可以读到原来的数据。
对称算法：加密密钥和解密密钥相同的加解密算法。
非对称算法：加密密钥和解密密钥不相同的加解密算法
ESD：静电放电。
以上所述实施例仅表达了本发明的实施方式，其描述较为具体和详细，但并不能因此而理解为对本发明专利范围的限制，但凡采用等同替换或等效变换的形式所获得的技术方案，均应落在本发明的保护范围之内。

Claims (20)

  1. 一种指纹算法库与指纹传感器的绑定认证方法，包括：
    主机端生成随机数据；
    指纹传感器获取所述随机数据，并对所述随机数据进行加密得到加密数据；
    所述主机端从所述指纹传感器读取所述加密数据，并对所述加密数据进行解密得到解密数据；
    所述主机端比较所述随机数据和所述解密数据是否一致，并在二者一致时判断出所述指纹算法库和所述指纹传感器之间的绑定认证成功。
  2. 根据权利要求1所述的方法，其特征在于，还包括：所述主机端通过其与所述指纹传感器之间的数据接口将所述随机数据以明文方式直接传输给所述指纹传感器。
  3. 根据权利要求1所述的方法，其特征在于，还包括：
    所述主机端利用第一加密密钥对其生成的随机数据进行加密，得到第一加密数据；
    所述主机端通过其与所述指纹传感器之间的数据接口将所述第一加密数据传输给所述指纹传感器。
  4. 根据权利要求3所述的方法，其特征在于，所述指纹传感器获取所述随机数据包括：
    所述指纹传感器接收所述主机端传输的第一加密数据，并利用第一解密密钥对所述第一加密数据进行解密，得到第一解密数据，其中所述指纹传感器解密得到的所述第一解密数据为所述随机数据。
  5. 根据权利要求4所述的方法，其特征在于，所述第一加密密钥和所述第一解密密钥为所述指纹传感器的身份识别号码的部分或全部。
  6. 根据权利要求1至5中任一项所述的方法，其特征在于，所述指纹传感器利用第二加密密钥对获取到的随机数据进行加密处理，且得到的加密数据为第二加密数据；所述主机端利用第二解密密钥对所述第二加密数据进行解密处理，且得到的解密数据为第二解密数据。
  7. 根据权利要求6所述的方法，其特征在于，所述第二加密密钥和所述第二解密密钥均为以所述指纹传感器的身份识别号码的部分或者全部作为密钥，并对将所述随机数据进行加密处理得到的数据。
  8. 根据权利要求1所述的方法，其特征在于，还包括：在所述随机数据和所述解密数据不一致时判断出所述指纹算法库和所述指纹传感器之间的绑定认证失败，并返回进行循环认证。
  9. 根据权利要求8所述的方法，其特征在于，所述主机端的操作在所述指纹算法库的算法初始化函数中实现，且在所述随机数据和所述解密数据一致相时允许使用所述指纹算法库中的函数，在二者不一致时则直接退出算法，不允许调用所述指纹算法库中函数。
  10. 根据权利要求8所述的方法，其特征在于，所述主机端的操作在所述指纹算法库中进行函数调用时实现，且在所述随机数据和所述解密数据一致相时正确执行库函数，在二者不一致时同则退出所述库函数并返回错误。
  11. 一种指纹识别系统，其特征在于，包括主机端和指纹传感器，所述主机端和所述指纹传感器之间 通过数据接口进行数据传输；
    其中，所述指纹传感器用于获取所述主机端生成的随机数据，并对所述随机数据进行加密得到加密数据；
    所述主机端用于生成所述随机数据，从所述指纹传感器读取所述加密数据，并对所述加密数据进行解密得到解密数据；并且，比较所述随机数据和所述解密数据是否一致，并在二者一致时判断出指纹算法库和所述指纹传感器之间的绑定认证成功。
  12. 根据权利要求11所述的指纹识别系统，其特征在于，所述主机端包括：
    随机数据生成单元，用于生成所述随机数据；
    第一通信单元，用于通过所述主机端与所述指纹传感器之间的数据接口将所述随机数据以明文方式直接传输给所述指纹传感器。
  13. 根据权利要求11所述的指纹识别系统，其特征在于，所述主机端包括：
    随机数据生成单元，用于生成所述随机数据；
    第一加密单元，用于利用第一加密密钥对所述随机数据进行加密，得到第一加密数据；
    第一通信单元，用于通过所述主机端与所述指纹传感器之间的数据接口将所述第一加密数据传输给所述指纹传感器。
  14. 根据权利要求13所述的指纹识别系统，其特征在于，所述指纹传感器包括：
    第二通信单元，用于接收所述主机端通过所述数据接口传输的第一加密数据；
    第一解密单元，用于利用第一解密密钥对所述第一加密数据进行解密，得到第一解密数据，其中所述第一解密单元解密得到的所述第一解密数据为所述随机数据。
  15. 根据权利要求13所述的指纹识别系统，其特征在于，所述第一加密密钥和所述第一解密密钥为所述指纹传感器的身份识别号码的部分或全部。
  16. 根据权利要求11至15中任一项所述的指纹识别系统，其特征在于，
    所述指纹传感器还包括第二加密单元，用于利用第二加密密钥对获取到的随机数据进行加密处理，得到的加密数据为第二加密数据；且所述第二通信单元还用于通过所述数据接口将所述第二加密数据提供给所述主机端；
    所述主机端的第一通信单元还用于通过所述数据接口接收所述指纹传感器提供的第二加密数据，且所述主机端还包括第二解密单元，用于利用第二解密密钥对所述第二加密数据进行解密处理，得到的解密数据为第二解密数据。
  17. 根据权利要求16所述的指纹识别系统，其特征在于，所述第二加密密钥和所述第二解密密钥均为以所述指纹传感器的身份识别号码的部分或者全部作为密钥，并对将所述随机数据进行加密处理得到的数据。
  18. 根据权利要求11所述的指纹识别系统，其特征在于，所述主机端还包括：
    比较单元，用于比较所述随机数据和所述解密数据是否一致；
    指纹识别单元，用于在所述随机数据和所述解密数据一致时判断出所述指纹算法库和所述指纹传感器之间的绑定认证成功，而在所述随机数据和所述解密数据不一致时判断出所述指纹算法库和所述指纹传感器之间的绑定认证失败并返回进行循环认证。
  19. 根据权利要求18所述的指纹识别系统，其特征在于，所述主机端的操作在所述指纹算法库的算法初始化函数中实现，且所述指纹识别单元用于在所述随机数据和所述解密数据一致相时允许使用所述指纹算法库中的函数，在二者不一致时则直接退出算法，不允许调用所述指纹算法库中函数。
  20. 根据权利要求18所述的指纹识别系统，其特征在于，所述主机端的操作在所述指纹算法库中进行函数调用时实现，且所述指纹识别单元用于在所述随机数据和所述解密数据一致相时正确执行库函数，在二者不一致时则退出所述库函数并返回错误。
PCT/CN2016/103192 2016-10-25 2016-10-25 指纹算法库与指纹传感器的绑定认证方法及指纹识别系统 WO2018076163A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2016/103192 WO2018076163A1 (zh) 2016-10-25 2016-10-25 指纹算法库与指纹传感器的绑定认证方法及指纹识别系统
CN201680001815.9A CN109075974B (zh) 2016-10-25 2016-10-25 指纹算法库与指纹传感器的绑定认证方法及指纹识别系统

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/103192 WO2018076163A1 (zh) 2016-10-25 2016-10-25 指纹算法库与指纹传感器的绑定认证方法及指纹识别系统

Publications (1)

Publication Number Publication Date
WO2018076163A1 true WO2018076163A1 (zh) 2018-05-03

Family

ID=62024219

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/103192 WO2018076163A1 (zh) 2016-10-25 2016-10-25 指纹算法库与指纹传感器的绑定认证方法及指纹识别系统

Country Status (2)

Country Link
CN (1) CN109075974B (zh)
WO (1) WO2018076163A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110390746A (zh) * 2019-06-16 2019-10-29 广州智慧城市发展研究院 一种指纹防盗门禁的实现方法
CN110544098A (zh) * 2019-08-01 2019-12-06 张桓 一种应用静脉识别的新型支付方法和装置
CN115086032A (zh) * 2022-06-15 2022-09-20 上海领雾软件科技有限公司 一种传感器数据保护系统及方法

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101017462A (zh) * 2006-02-09 2007-08-15 邱立国 具生物数据保护机制的可携式储存装置及其保护方法
CN103020493A (zh) * 2012-12-28 2013-04-03 杭州晟元芯片技术有限公司 一种防拷贝的软件保护与运行装置及方法
CN103475475A (zh) * 2003-11-21 2013-12-25 菲尼萨公司 具认证控制器的收发器

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2000276445A (ja) * 1999-03-23 2000-10-06 Nec Corp バイオメトリクス識別を用いた認証方法、装置、認証実行機、認証プログラムを記録した記録媒体
US6681034B1 (en) * 1999-07-15 2004-01-20 Precise Biometrics Method and system for fingerprint template matching
CN1991800A (zh) * 2005-12-31 2007-07-04 联想(北京)有限公司 一种指纹识别存储设备及指纹识别方法
KR20130140948A (ko) * 2012-05-17 2013-12-26 삼성전자주식회사 저장 장치의 식별자에 기반한 컨텐츠의 암복호화 장치 및 방법
CN103532713B (zh) * 2012-07-04 2018-03-23 中国移动通信集团公司 传感器认证和共享密钥产生方法和系统以及传感器
CN102769531A (zh) * 2012-08-13 2012-11-07 鹤山世达光电科技有限公司 身份认证装置及其方法
CN105550552B (zh) * 2015-06-30 2019-01-15 宇龙计算机通信科技(深圳)有限公司 一种移动终端的保护方法及装置
CN105553932A (zh) * 2015-11-30 2016-05-04 青岛海尔智能家电科技有限公司 智能家电设备的远程控制安全绑定方法、装置和系统

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103475475A (zh) * 2003-11-21 2013-12-25 菲尼萨公司 具认证控制器的收发器
CN101017462A (zh) * 2006-02-09 2007-08-15 邱立国 具生物数据保护机制的可携式储存装置及其保护方法
CN103020493A (zh) * 2012-12-28 2013-04-03 杭州晟元芯片技术有限公司 一种防拷贝的软件保护与运行装置及方法

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110390746A (zh) * 2019-06-16 2019-10-29 广州智慧城市发展研究院 一种指纹防盗门禁的实现方法
CN110544098A (zh) * 2019-08-01 2019-12-06 张桓 一种应用静脉识别的新型支付方法和装置
CN115086032A (zh) * 2022-06-15 2022-09-20 上海领雾软件科技有限公司 一种传感器数据保护系统及方法
CN115086032B (zh) * 2022-06-15 2024-05-10 上海领雾软件科技有限公司 一种传感器数据保护系统及方法

Also Published As

Publication number Publication date
CN109075974A (zh) 2018-12-21
CN109075974B (zh) 2021-12-21

Similar Documents

Publication Publication Date Title
US20210192090A1 (en) Secure data storage device with security function implemented in a data security bridge
AU2018390325B2 (en) Systems and methods for provisioning digital identities to authenticate users
KR102168984B1 (ko) 보안 디바이스 페어링
KR101727660B1 (ko) 하나의 장치를 이용하여 다른 장치를 언로크하는 방법
JP6030925B2 (ja) 半導体装置及び情報処理システム
US9218473B2 (en) Creation and authentication of biometric information
US8477940B2 (en) Symmetric cryptography with user authentication
CN101291224B (zh) 在通信系统中处理数据的方法和系统
US20100241867A1 (en) System and method for encrypted smart card pin entry
WO2018090763A1 (zh) 一种终端主密钥的设置方法和装置
US20180247313A1 (en) Fingerprint security element (se) module and payment verification method
JP6927981B2 (ja) パスコード検証のためのフォワードセキュア型暗号技術を使用した方法、システム、及び装置。
WO2017035898A1 (zh) 一种移动终端的指纹特征模板加密存储方法及系统
US8918844B1 (en) Device presence validation
WO2004073252A1 (ja) 認証処理装置及びセキュリティ処理方法
CN102163267A (zh) 固态硬盘安全访问控制方法、装置和固态硬盘
CN111884814B (zh) 一种用于智能终端防伪造的方法和系统
WO2018076163A1 (zh) 指纹算法库与指纹传感器的绑定认证方法及指纹识别系统
TW202137199A (zh) 生物支付設備的認證方法、裝置、電腦設備和儲存媒體
WO2015168878A1 (zh) 支付方法和装置以及支付要素处理方法和装置
US11308190B2 (en) Biometric template handling
CN106603237B (zh) 一种安全支付方法及装置
JP2015026892A (ja) 情報処理システム
WO2017054294A1 (zh) 一种基于TrustZone的域空间切换系统及方法
CN114667713A (zh) 基于存储在非接触式卡中的护照数据的安全认证

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16919788

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16919788

Country of ref document: EP

Kind code of ref document: A1