WO2018165811A1 - Procédé de sauvegarde et de vérification de modèle biométrique, et appareil et terminal de reconnaissance biométrique - Google Patents

Procédé de sauvegarde et de vérification de modèle biométrique, et appareil et terminal de reconnaissance biométrique Download PDF

Info

Publication number
WO2018165811A1
WO2018165811A1 PCT/CN2017/076403 CN2017076403W WO2018165811A1 WO 2018165811 A1 WO2018165811 A1 WO 2018165811A1 CN 2017076403 W CN2017076403 W CN 2017076403W WO 2018165811 A1 WO2018165811 A1 WO 2018165811A1
Authority
WO
WIPO (PCT)
Prior art keywords
biometric
template
data
encryption
verification
Prior art date
Application number
PCT/CN2017/076403
Other languages
English (en)
Chinese (zh)
Inventor
左勇
Original Assignee
深圳市汇顶科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市汇顶科技股份有限公司 filed Critical 深圳市汇顶科技股份有限公司
Priority to CN201780000185.8A priority Critical patent/CN107113170B/zh
Priority to PCT/CN2017/076403 priority patent/WO2018165811A1/fr
Publication of WO2018165811A1 publication Critical patent/WO2018165811A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0866—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/32—User authentication using biometric data, e.g. fingerprints, iris scans or voiceprints
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/78—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions

Definitions

  • the embodiments of the present invention relate to the field of biometric identification technologies, and in particular, to a biometric template storage and verification method, a biometric identification device, and a terminal.
  • the biological characteristics of the human body such as fingerprints, palm prints, lip lines and irises are unique, they can be used for identity verification, etc., to meet the security and confidentiality requirements of different application scenarios. For example, when a laptop, a mobile phone, or a tablet is turned on, or enters a critical location, it is necessary to collect the fingerprint of the user for authentication.
  • biometrics As an authentication method, as shown in Figure 1a, it is common practice to first process the biometric raw data into a biometric template, ie, a registration template, and then save the biometric template as a whole in a relatively secure storage area.
  • a biometric template ie, a registration template
  • EMMC embedded Multi Media Card
  • TEE Trusted Execution Environment
  • biometric template Since the biometric template is stored in a storage area that is not very secure, if the storage area is attacked, the biometric template will be leaked as a whole, which will bring a larger application to the biometric template. Security risks.
  • biometric template storage and verification method the biometric identification device, and the terminal provided by the embodiments of the present application are used to solve at least the above problems in the prior art.
  • a first aspect of the embodiments of the present application provides a biometric template saving method, where the biometric template saving method includes:
  • the M group biometric encryption template data is stored in the N storage areas, and at least one set of biometric encryption template data exists in each storage area after storage, 1 ⁇ N ⁇ M.
  • At least one of the N storage areas is a storage area of a chip-level security environment.
  • the processing, by the biometric encryption template generated by the biometric template includes: performing a splitting process on the biometric encryption template.
  • the biometric encryption template generated according to the biometric template encryption is processed, and before the obtaining the M biometric encryption template data, the method further includes: encrypting the biometric encryption according to the biometric template.
  • the key used in the template is placed anywhere in the biometric encryption template.
  • the key is placed into a start position or an end position of the biometric encryption template.
  • the method further includes:
  • the biometric template containing the verification data is encrypted to generate the biometric encryption template.
  • the consistency check is a hash check
  • the obtained check data is a hash check value
  • the hash check value is placed. Before or after the start position of the biometric template.
  • the method further includes:
  • biometric and/or image feature extraction on the collected biometric raw data to obtain a plurality of biometric data
  • the biometric original data is fingerprint feature original data or fingerprint image data
  • the biometric data is fingerprint feature point data or fingerprint feature image extremum data
  • Performing biometric and/or image feature extraction on the collected biometric raw data to obtain a plurality of biometric data includes: extracting fingerprint feature points from the collected fingerprint feature point original data, and obtaining multiple fingerprint feature point data. And/or, performing fingerprint feature image extraction on the collected fingerprint feature raw data to obtain a plurality of fingerprint feature image extremum data.
  • a second aspect of the embodiments of the present application provides a biometric template verification method, including:
  • biometric template to be verified obtained according to the biometric encryption template. If the verification is passed, determining that the biometric template to be verified is consistent with the original biometric template.
  • the N storage areas include at least one storage area of a chip-level security environment.
  • the performing verification verification of the biometric template to be verified according to the biometric encryption template includes: generating a consistency check of the biometric template to be verified. The first verification data is compared with the second verification data obtained from the biometric verification template to be verified;
  • the verification is considered to pass.
  • performing consistency check on the biometric template to be verified includes: performing hash check on the biometric template to be verified.
  • the second check data is extracted from a header or a tail of the to-be-verified biometric template.
  • the obtaining a biometric template to be verified according to the biometric encryption template includes:
  • a third aspect of the embodiments of the present application provides a biometric identification device, which includes a biometrics collection module, a biometric data processing chip, and a storage module.
  • the biometric collection module is configured to collect biometric information of the user
  • the biometric data processing chip is configured to perform feature extraction on the biometric information, obtain biometric data and combine the biometric template into a biometric template, and perform encryption processing on the biometric template to generate a biometric encryption template;
  • the biometric template generated by the biometric template encryption is processed to obtain the M group biometric encryption template data, M ⁇ 2;
  • the storage module is configured to store the M sets of biometric encryption template data, where the storage module includes N storage areas, and the M sets of biometric encryption template data are stored in the storage module, and at least in each storage area There is a set of biometric encryption template data, 1 ⁇ N ⁇ M.
  • a template generating unit and a template processing unit are included;
  • the template generating unit is configured to perform feature extraction on the biometric information, obtain biometric data and combine the biometric template into a biometric template, and perform encryption processing on the biometric template to generate a biometric encryption template.
  • the template processing unit is configured to process the biometric encryption template generated according to the biometric template encryption to obtain M sets of biometric encryption template data.
  • the biometric data processing chip further includes: a template data acquiring unit, a template restoring unit, and a template verifying unit;
  • the template data acquiring unit is configured to acquire M sets of biometric encryption template data associated with each other from the N storage areas of the storage module;
  • the template restoring unit is configured to recombine the M group biometric encryption template data to obtain a biometric encryption template
  • the decryption verification unit is configured to decrypt the biometric encryption template to obtain a biometric template to be verified, and determine the biometric to be verified by performing consistency verification on the biometric template to be verified. Whether the template is consistent with the original biometric template.
  • a fourth aspect of the embodiments of the present application provides a terminal comprising the biometric identification device according to any one of claims 16 to 18.
  • the embodiment of the present application processes the biometric encryption template into, for example, split into multiple sets of biometric encryption template data, and then stores the plurality of biometric encryption template data in at least two storage areas. , so that multiple sets of biometric encryption template data are dispersed There are a plurality of storage areas.
  • the biometric template is stored in a storage area as a whole, and the probability of attacking multiple sets of biometric encryption template data dispersed in multiple storage areas is less.
  • the probability of being leaked as a whole is also lower, so that the large security risks brought by the prior art to the application of the biometric template can be effectively eliminated.
  • FIG. 1a is a schematic diagram of a prior art biometric template storage.
  • FIG. 1b is a flowchart of a biometric template saving method according to Embodiment 1 of the present application.
  • FIG. 2 is a flowchart of a biometric template saving method according to Embodiment 2 of the present application.
  • FIG. 3 is a flowchart of a biometric template saving method according to Embodiment 3 of the present application.
  • FIG. 4 is a flowchart of a biometric template verification method according to Embodiment 4 of the present application.
  • FIG. 5 is a structural diagram of a biometric identification device according to Embodiment 5 of the present application.
  • FIG. 1b is a flowchart of a biometric template saving method according to Embodiment 1 of the present application. As shown in FIG. 1b, the biometric template saving method includes:
  • the biometric template may be generated by combining a plurality of biometric data, that is, combining the plurality of biometric data to generate a biometric template.
  • the biometric data may be obtained by performing fingerprint feature extraction and/or image feature extraction processing on the collected biometric raw data.
  • the biometric encryption template is generated according to the biometric template encryption, and the biometric template may be encrypted by using an AES (128-bit or 256-bit) encryption algorithm to generate a biometric encryption template.
  • AES 128-bit or 256-bit
  • the AES256-CBC algorithm can be specifically employed.
  • the biometric template may be first divided into a plurality of cipher blocks to be encrypted (equivalent to plaintext blocks), and then each cipher block to be encrypted is encrypted according to the following method:
  • the second ciphertext to be encrypted is XORed with the first ciphertext, and then encrypted by the encryption key to generate a second ciphertext;
  • the AES256-CBC algorithm performs an exclusive OR operation with the previous ciphertext for the plaintext block (starting from the second one), the generated biometric encryption template is more complicated, so AES256-CBC is adopted.
  • the biometric encryption template generated by the algorithm has the advantages of difficulty in cracking and difficulty in active attack.
  • the AES128-CBC (encryption key is 128-bit) algorithm may be used for the encryption processing, and the processing method thereof is similar to the AES256-CBC algorithm, and details are not described herein again.
  • the biometric encryption template may be split and processed to form the M group biometric encryption template data.
  • the splitting process can also be processed by other splitting algorithms to meet the problem of splitting the biometric encryption template into M sets of biometric encryption template data.
  • the amount of data in each group of the M group biometric encrypted data may be the same, for example, 5 KB, or may be partially the same. Some are different, but they can also be different from each other, depending on actual needs.
  • S12 The M group biometric encryption template data is stored in the N storage areas, and at least one set of biometric encryption template data is stored in each of the stored storage areas, where 1 ⁇ N ⁇ M.
  • the biometric encryption template is processed into, for example, split into multiple sets of biometric encryption template data, and then the plurality of biometric encryption template data are dispersed and stored in at least two storage areas, so that multiple sets of biometric encryption are performed.
  • the template data is dispersed and stored in a plurality of storage areas, and the plurality of sets of biometric encryption template data dispersed in the plurality of storage areas are simultaneously attacked compared with the prior art in which the biometric templates are integrally stored in one storage area.
  • the probability is smaller, and the probability of being leaked by the whole is lower, which can effectively eliminate the large security risks brought by the prior art to the application of the biometric template. That is to say, the embodiment benefits from the feature of the decentralized storage of the biometric template data.
  • biometric encrypted data If it is attacked, the problem of the overall leakage of the feature template data is not easy to occur, and it is of course not excluded that some biometric encrypted data is leaked. Possibility, but since the biometric template can be decrypted only when the M group biometric template encrypted data is acquired as a whole, it is difficult to be restored to the biometric template even if part of the biometric encrypted data is leaked. Further, even if the plurality of sets of biometric encryption template data are illegally acquired, it is difficult to generate a corresponding organism because the corresponding processing method (such as the combined processing method is obviously unknown to the illegal acquirer) cannot be known. Feature encryption template. At the same time, since the biometric encryption template is encrypted data, it is also difficult to perform illegal decryption.
  • At least one of the N storage areas is a storage area of a chip-level security environment such as an SE (Secure Element).
  • a chip-level security environment such as an SE (Secure Element). Since the chip-level security environment is a hardware-level security environment, the possibility of successful attack is extremely low, and its data security protection, etc. The level is higher than the software-level and semi-software-level security environment, so it is difficult to leak the biometric encryption module data stored in the storage area of the chip-level security environment.
  • the biometric encryption template data stored in the storage area of the chip level security environment is hard to be leaked, thereby making the M group biometric template Encrypted data is difficult to be leaked as a whole, which can effectively eliminate the large security risks caused by the application of the biometric template in the prior art. Therefore, by using a storage area of a chip-level security environment to store at least one set of biometric encryption template data, the requirements for distributed preservation can be satisfied, and the requirements for biometric encrypted data to avoid overall leakage can be satisfied.
  • Biometric encryption template data when the total amount of data of the M group biometric encryption template data is large, the storage area of the chip level security environment is difficult to save one or more groups with a large amount of data due to a small total storage capacity.
  • Biometric encryption template data optionally, one or more sets of biometric encryption template data in the M group biometric encryption template data may be stored in a storage area of the chip level security environment, and the remaining one is Group or groups of biometric encryption template data with large data volume are stored in software-level or semi-software-level security environments with large total storage capacity such as TEE (Trusted Execution Environment), TrustZone (trust zone), SGX (Software Guard Extensions) , software protection extension instructions) or Rich OS (rich operating system) and other storage areas such as external storage media: EMMC memory, SD card, disk and so on.
  • TEE Trust Execution Environment
  • TrustZone trust zone
  • SGX Software Guard Extensions
  • Rich OS Rich operating system
  • FIG. 2 is a flowchart of a biometric template saving method according to Embodiment 2 of the present application. As shown in FIG. 2, on the basis of the first embodiment of the present application, the biometric template saving method includes:
  • the key used to generate the biometric encryption template according to the biometric template encryption is placed in any position in the biometric encryption template.
  • the biometric encryption template is essentially a data sequence having a certain length, whereby any position placed in the biometric encryption template may be placed in the biometric encryption template, ie, the data sequence. Before the first data, between any two data in the data sequence, after the last data of the data sequence. The location at which the key is placed can be recorded so that the key can be accurately extracted during subsequent applications, such as decryption.
  • the key is placed before the first data of the data sequence, That is, before the start position of the biometric encryption template, or after the key is placed after the last data of the data sequence, that is, after the end position of the biometric encryption template.
  • the key is included in the biometric encryption template.
  • the key belongs to a symmetric key, and may be randomly generated by a random number generating function of the system, or may be set in advance (such as writing in program code).
  • step S22 is consistent with the step S11 in the first embodiment of the present application, and the implementation principle is similar, and details are not described herein again. It should be noted that the key is already included in the bio-encryption template in this step.
  • S23 The M group biometric encryption template data is stored in the N storage areas, and at least one set of biometric encryption template data is stored in each of the stored storage areas, where 1 ⁇ N ⁇ M.
  • the key is usually the key to encryption and decryption, in order to make the key more difficult to be leaked, the key may also be stored in the storage area of the chip-level security environment, for example, including A set of biometric encryption template data (such as not less than 64 Bytes of data) of the key is stored in a storage area of the chip level security environment.
  • the biometric encryption template can be decrypted by the key in the subsequent application, so as to obtain the original biometric template (ie, the biometric encryption template is generated by encryption). Feature template).
  • FIG. 3 is a flowchart of a biometric template saving method according to Embodiment 3 of the present application. As shown in FIG. 3, based on the first embodiment of the present application, the biometric template saving method includes:
  • the verification data obtained by performing consistency check on the biometric template is placed in any position in the biometric template.
  • the biometric template may be generated by combining a plurality of biometric data, that is, combining the plurality of biometric data to generate a biometric template.
  • the biometric data refers to fingerprint feature extraction and/or image feature extraction processing on the collected biometric raw data.
  • the obtained data that is, the biometric and/or image feature extraction of the collected biometric raw data, can obtain a plurality of biometric data.
  • biometric feature data can be collected multiple times, and then the biometric feature extraction and/or image feature extraction of the collected biometric raw data can be performed to obtain more biometric data.
  • biometric raw data may include fingerprints, palm prints, lip lines, and iris feature raw data.
  • the fingerprint feature original data may include fingerprint valley ridge original data or fingerprint image original data.
  • the fingerprint feature data is generally fingerprint feature point data or fingerprint feature image extremum data.
  • the biometric feature and/or image feature extraction is performed on the collected biometric raw data, and obtaining the plurality of biometric data specifically includes: extracting fingerprint feature points from the collected fingerprint feature point original data, such as fingerprint valley data. Obtaining a plurality of fingerprint feature point data, and/or performing fingerprint feature image extraction on the collected fingerprint feature original data, such as fingerprint image data, to obtain a plurality of fingerprint feature image extremum data.
  • the fingerprint data collected by the fingerprint module of a larger size (such as the fingerprint valley data) has a larger number and the fingerprint included.
  • the feature raw data is relatively complete. Therefore, the fingerprint feature point extraction method can be used to extract the fingerprint feature original data to obtain multiple fingerprint feature data.
  • the fingerprint image feature extraction method is generally used to extract the extreme value data of the plurality of fingerprint feature images, thereby obtaining multiple fingerprint feature data. .
  • both the original data of the fingerprint feature and the original data of the fingerprint image are collected, and then the fingerprint feature original data is extracted by fingerprint feature point extraction and extracted based on the fingerprint image feature.
  • the fingerprint feature template obtained on the basis of the fingerprint feature template may be a fingerprint feature template obtained based on the fingerprint valley data, may be a fingerprint feature template obtained based on the fingerprint image data, or may be based on fingerprint valley data and fingerprint image data.
  • the fingerprint feature template obtained by the combination may be a fingerprint feature template obtained based on the fingerprint valley data, or may be based on fingerprint valley data and fingerprint image data.
  • the fingerprint feature point data may include a fingerprint endpoint, a bifurcation point, a bifurcation point, and an isolated Point, ring point and/or short grain data.
  • a typical process for obtaining a fingerprint feature template is as follows:
  • the system prompts the user to press the fingerprint module through the interface
  • the system collects user fingerprint feature original data such as fingerprint valley data and/or fingerprint image data through the fingerprint module;
  • fingerprint feature extraction algorithm extraction for example, by fingerprint feature extraction algorithm extraction and/or fingerprint image feature extraction, to obtain multiple fingerprint feature data
  • the fingerprint feature template can be obtained through the fingerprint original feature data, but the reverse process is irreversible, that is, the fingerprint feature template cannot restore the fingerprint original feature data, because the fingerprint feature extraction algorithm extracts only the fingerprint feature.
  • the data of the point does not save all the texture information of the fingerprint, so there is a problem that part of the fingerprint texture information is lost, so the original data of the fingerprint feature cannot be restored by the fingerprint template.
  • the verification data may be placed in any position in the biometric encryption template, and the verification data may be determined to be obtained. Whether the biometric template is identical to the original biometric template. For example, the same hash check is performed on the acquired biometric template to be verified to obtain a hash check value that can be used as the check data, and the hash check value is obtained simultaneously with the biometric template to be verified. Obtaining another check data (such as another hash check value) for comparison. If the two hash check values are the same, it may be determined that the biometric template to be verified is completely consistent with the original biometric template, otherwise The biometric template to be verified may be determined to be an illegal biometric template.
  • the verification data for example, the location where the hash check value is placed in the biometric template can be freely selected, and is generally not limited. More commonly, the check data, for example the hash check value, can be placed before or after the start of the biometric template. In use, the location is usually recorded so that in the subsequent application, when the acquired biometric template needs to be consistently verified, the phase can be accurately extracted according to the location where the record is saved.
  • the verification data should be. Obviously, the verification data is placed in the biometric template, which is equivalent to the biometric template containing the verification data.
  • the biometric template or the biometric template to be verified may be hashed by the SHA-256 algorithm, and the corresponding hash check value obtained as the check data is obtained accordingly.
  • the encryption in this step may adopt the AES256-CBC algorithm in the first embodiment of the present application.
  • other encryption algorithms can also be used.
  • S34 The M group biometric encryption template data is stored in the N storage areas, and at least one set of biometric encryption template data exists in each storage area after the storage, 1 ⁇ N ⁇ M.
  • the biometric encryption template may be a biometric encryption template generated by encrypting the biometric template containing the verification data.
  • Steps S33 and S34 are respectively consistent with steps S11 and S12 in the first embodiment of the present application, and the implementation principle is similar to that of S11 and S12, and details are not described herein again.
  • the biometric template obtained by the verification data can be consistently verified in the subsequent application to ensure the acquired biometric template and the original creature.
  • the feature templates are identical.
  • the biometric template verification method includes:
  • the operation of acquiring the M sets of associated biometric encrypted data from the N storage areas of the N storage areas may specifically be related to the M related entities stored in the M group.
  • the corresponding inverse operation when the feature encrypts the data That is, the M group biometric encryption template data is stored in the N storage areas according to the deposit method, and then the M group biometric encryption template data is also acquired in a manner corresponding to the original deposit mode. Taken from the N storage areas.
  • the way to deposit is: 3 sets of biometric models
  • the board encryption data is stored in two storage areas, wherein the first group and the second group biometric encryption template data are stored in the first storage area, and the third group biometric encryption template data is stored in the second storage area;
  • the acquisition method is: taking out the first group and the second group of biometric encryption template data from the first storage area, and extracting the third group biometric encryption template data from the second storage area.
  • the processing of obtaining the biometric encryption template from the M group associated biometric encryption template data and the processing of obtaining the M group biometric encryption template data from the biometric encryption template may be a pair of reciprocal operations.
  • the process of obtaining the M group biometric encryption template data from the biometric encryption template is a splitting process, and then the process of obtaining the biometric encryption template from the M group associated biometric encryption template data is corresponding to the splitting process.
  • the process of obtaining the biometric template to be verified according to the biometric encryption template and the process of encrypting and generating the biometric encryption template according to the original biometric template are used to perform a pair of reciprocal operations.
  • the process of generating the biometric encryption template according to the original biometric template is to use the AES256-CBC algorithm to encrypt the original biometric template to generate the biometric template, and then the biometric template to be verified according to the biometric encryption template is utilized.
  • the inverse algorithm corresponding to the AES256-CBC algorithm decrypts the biometric encryption template to obtain a biometric template to be verified.
  • the method for obtaining the biometric template to be verified according to the biometric encryption template includes: decrypting the biometric encryption template according to the key obtained from the biometric encryption template to obtain a biometric template to be verified.
  • the method may be: extracting a key from an agreed position of the biometric encryption template, such as a header or a tail; and decrypting the biometric encryption template according to the key to obtain a biometric template to be verified.
  • the agreed location may be derived from a record holding a location of the key in the biometric encryption template.
  • the consistency check verification performed on the biometric template to be verified is consistent with the consistency check on the original biometric template. That is to verify the biometric template and pair
  • the consistency check processing performed by the original biometric template is the same.
  • the consistency check performed may be the same hash check as the SHA-256 check.
  • the process of obtaining the biometric template to be verified and the consistency verification verification of the biometric template to be verified may include:
  • the check data here can be regarded as the check data generated by the original biometric template through the same hash check.
  • the biometric template verification method provided in the fourth embodiment processes the M-type associated biometric encryption template data obtained from the N storage areas to obtain the biometric encryption template, and then obtains the biometric encryption template to be verified.
  • the biometric template is subjected to consistency verification, so as to determine whether the biometric template to be verified is consistent with the original biometric template, that is, whether the biometric template to be verified is legal.
  • biometric template saving method and the biometric template verification method provided in the above embodiments may be used in combination.
  • biometric template verification method provided in the above embodiments.
  • the data capacity of the set of biometric encryption template data containing the first key should be greater than or equal to 64 Bytes and less than or equal to 10 KB. Setting the capacity to 64 Bytes or more is to completely include the first key (such as 256 bits) in the data of the group, and setting it to not more than 10 KB is based on the consideration that the total capacity of the SE storage area is small.
  • FIG. 5 is a structural diagram of a biometric identification device according to Embodiment 5 of the present application.
  • the biometric device is a device including a biometrics acquisition module 1 (such as a fingerprint acquisition chip, a fingerprint sensor, etc.), a biometric data processing chip 2 (such as a microprocessor), and a storage module 3.
  • the biometric device may be applied to a mobile terminal (such as a smart phone, a tablet, etc.) or other electronic device for performing the biometric template saving method and/or the biometric template verification method as described in the above embodiments. .
  • the biometric collection module 1 is configured to collect biometric information of the user during the biometric registration phase.
  • the biometric collection module 1 may be specifically a biometric sensor (such as a fingerprint sensor) for collecting biometric information.
  • the biometric information may be specifically biometric raw data (such as fingerprint raw data).
  • the biometric data processing chip 2 is configured to perform feature extraction on the biometric information collected by the biometric collection module 1 to obtain biometric data and combine the biometric templates into a biometric template, and encrypt the biometric template to generate a biometric a feature encryption template; and processing the biometric encryption template generated according to the biometric template encryption to obtain the M group biometric encryption template data, M ⁇ 2, for example, the biometric data processing chip 2 can be decomposed by default The sub-algorithm splits the biometric encryption template into the M sets of biometric encryption template data.
  • the biometric data processing chip 2 includes: a template generating unit and a template processing unit.
  • the template generating unit is configured to perform feature extraction on the biometric information collected by the biometric feature collection module 1 to obtain biometric data and combine the biometric template into a biometric template, and encrypt the biometric template to generate a biometric Feature encryption template.
  • the template processing unit is configured to process the biometric encryption template generated by the biometric template encryption to obtain the M group biometric encryption template data, where M ⁇ 2.
  • the template processing unit may adopt a preset splitting algorithm. And dividing the biometric encryption template into the M group biometric encryption template data.
  • the template generating unit may be further configured to process the biometric encryption template in the template processing unit and obtain M sets of biometric encryption template data.
  • the key used to generate the biometric encryption template based on the biometric template encryption is placed in any location in the biometric encryption template.
  • the template generating unit may be further configured to: before the template processing unit processes the biometric encryption template and obtain M sets of biometric encryption template data, The template performs consistency check, and the verification data obtained by performing consistency check on the biometric template is placed in any position in the biometric template.
  • the template generating unit may specifically generate the biometric encryption template by encrypting the biometric template containing the verification data.
  • the storage module 3 is configured to store the M sets of biometric encryption template data.
  • the storage module 3 may include N storage areas, and after the M sets of biometric encryption template data are stored in the storage module, at least one set of biometric encryption template data exists in each storage area. 1 ⁇ N ⁇ M.
  • At least one of the M storage areas of the storage module is a storage area of a chip-level security environment such as an SE (Secure Element).
  • the biometric data processing chip may further include: a template data acquiring unit, a template restoring unit, and a template verifying unit.
  • the template data acquiring unit is configured to acquire M sets of biometric encryption template data associated with each other from the N storage areas of the storage module;
  • the template restoring unit is configured to recombine the M group biometric encryption template data to obtain a biometric encryption template
  • the decryption verification unit is configured to decrypt the biometric encryption template to obtain a biometric template to be verified, and determine the biometric to be verified by performing consistency verification on the biometric template to be verified. Whether the template is consistent with the original biometric template.
  • the decryption verification unit is specifically configured to: use the first verification data generated by performing consistency check on the biometric template to be verified, and the second verification data obtained from the to-be-verified biometric verification template. Verifying the data for comparison verification. If the first verification data is the same as the second verification data, the verification passes and may determine that the biometric template to be verified is consistent with the original biometric template; otherwise The verification fails and may determine that the biometric template to be verified does not match the original biometric template.
  • the biometric device may be used to perform the corresponding method or step in the first to fourth embodiments of the present application, or may further perform the corresponding method in the first to fourth embodiments of the present application by using the included module (unit) or the like. step.
  • the implementation principle is similar to the first to fourth embodiments of the present application, and details are not described herein again.
  • the biometric data processing chip in this embodiment may multiplex the CPU chip of the mobile terminal or other electronic device, and does not necessarily have to be a dedicated CPU chip (for example, a dedicated CPU integrated in the biometric module). That is, in the form of a reusable CPU chip, the processing power of the reusable CPU chip can be further exerted.
  • Embodiment 6 of the present application provides a terminal.
  • the terminal includes the biometric device as described in Embodiment 5 of the present application.
  • the terminal may be a mobile phone, a tablet, a personal computer, a server, a network device, or other electronic device, etc., including the biometric device as described in Embodiment 5 of the present application.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Collating Specific Patterns (AREA)

Abstract

L'invention concerne un procédé de sauvegarde et de vérification d'un modèle biométrique, et un appareil et un terminal de reconnaissance biométrique, appartenant au domaine technique de la reconnaissance biologique. Le procédé de sauvegarde d'un modèle biométrique comprend : le traitement d'un modèle chiffré biométrique généré au moyen d'un chiffrement de modèle biométrique, de façon à obtenir M groupes de données de modèle chiffrées biométriques, M ≥ 2 (S11, S33); et sauvegarder les M groupes de données de modèle chiffrées biométriques dans N régions de stockage, de telle sorte qu'au moins un groupe de données de modèle chiffrées biométriques est sauvegardé dans chacune des régions de stockage après une opération de sauvegarde, où 1 < N ≤ M (S12, S34). Au moyen du traitement d'un modèle chiffré biométrique en de multiples groupes de données de modèle chiffrées biométriques puis de la sauvegarde séparée des multiples éléments de données de modèle chiffrées biométriques dans au moins deux régions de stockage, les multiples groupes de données de modèle chiffrées biométriques sont sauvegardés séparément dans les multiples régions de stockage et ne seront donc pas facilement divulgués, de sorte que les risques importants en termes de sécurité présents dans l'état antérieur de la technique pour l'application d'un modèle biométrique soient efficacement éliminés.
PCT/CN2017/076403 2017-03-13 2017-03-13 Procédé de sauvegarde et de vérification de modèle biométrique, et appareil et terminal de reconnaissance biométrique WO2018165811A1 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN201780000185.8A CN107113170B (zh) 2017-03-13 2017-03-13 生物特征模板保存、验证方法及生物特征识别装置、终端
PCT/CN2017/076403 WO2018165811A1 (fr) 2017-03-13 2017-03-13 Procédé de sauvegarde et de vérification de modèle biométrique, et appareil et terminal de reconnaissance biométrique

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2017/076403 WO2018165811A1 (fr) 2017-03-13 2017-03-13 Procédé de sauvegarde et de vérification de modèle biométrique, et appareil et terminal de reconnaissance biométrique

Publications (1)

Publication Number Publication Date
WO2018165811A1 true WO2018165811A1 (fr) 2018-09-20

Family

ID=59663552

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/076403 WO2018165811A1 (fr) 2017-03-13 2017-03-13 Procédé de sauvegarde et de vérification de modèle biométrique, et appareil et terminal de reconnaissance biométrique

Country Status (2)

Country Link
CN (1) CN107113170B (fr)
WO (1) WO2018165811A1 (fr)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP4116849A1 (fr) * 2021-07-07 2023-01-11 iCognize GmbH Procédé mis en uvre par ordinateur permettant de gérer un ensemble de données comprenant des informations relatives à la sécurité

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2019148397A1 (fr) * 2018-01-31 2019-08-08 华为技术有限公司 Stockage de données sensibles décomposées dans différents environnements d'application
CN109703571A (zh) * 2018-12-24 2019-05-03 北京长城华冠汽车技术开发有限公司 一种基于人脸识别的车载娱乐系统登陆系统及登陆方法
CN111989693A (zh) * 2019-03-22 2020-11-24 华为技术有限公司 生物识别方法及装置
WO2020220212A1 (fr) * 2019-04-29 2020-11-05 深圳市汇顶科技股份有限公司 Procédé de reconnaissance de caractéristique biologique et dispositif électronique
CN110162951B (zh) * 2019-05-28 2022-09-09 吉林无罔生物识别科技有限公司 虹膜信息注册与验证方法、系统及计算机可读存储介质
CN110400223B (zh) * 2019-07-26 2022-05-17 中国工商银行股份有限公司 基于区块链的交互日志加密、调取、防窃取方法、装置
CN112464261A (zh) * 2020-11-26 2021-03-09 深圳市迪安杰智能识别科技有限公司 指纹数据的加密方法、指纹芯片及智能终端
CN112926041B (zh) * 2021-02-08 2022-09-09 西安电子科技大学 一种基于生物特征的远程身份认证系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2005149093A (ja) * 2003-11-14 2005-06-09 Toppan Printing Co Ltd アクセス権制御機能付記憶装置、アクセス権制御機能付記憶装置の制御プログラム、アクセス権制御方法
CN101478541A (zh) * 2008-10-21 2009-07-08 刘洪利 一种生物特征认证方法,以及一种生物特征认证系统
CN102223233A (zh) * 2011-06-15 2011-10-19 刘洪利 一种生物密码认证系统，以及一种生物密码认证方法
CN105160316A (zh) * 2015-08-31 2015-12-16 宇龙计算机通信科技(深圳)有限公司 一种移动终端的指纹特征模板加密存储方法及系统
CN105608355A (zh) * 2015-07-08 2016-05-25 宇龙计算机通信科技(深圳)有限公司 生物信息验证方法、生物信息验证系统和终端

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP4919744B2 (ja) * 2006-09-12 2012-04-18 富士通株式会社 生体認証装置及び生体認証方法
CN101815063A (zh) * 2009-12-04 2010-08-25 强敏 一种应用于网络的文件安全管理系统及其管理方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2005149093A (ja) * 2003-11-14 2005-06-09 Toppan Printing Co Ltd アクセス権制御機能付記憶装置、アクセス権制御機能付記憶装置の制御プログラム、アクセス権制御方法
CN101478541A (zh) * 2008-10-21 2009-07-08 刘洪利 一种生物特征认证方法,以及一种生物特征认证系统
CN102223233A (zh) * 2011-06-15 2011-10-19 刘洪利 一种生物密码认证系统，以及一种生物密码认证方法
CN105608355A (zh) * 2015-07-08 2016-05-25 宇龙计算机通信科技(深圳)有限公司 生物信息验证方法、生物信息验证系统和终端
CN105160316A (zh) * 2015-08-31 2015-12-16 宇龙计算机通信科技(深圳)有限公司 一种移动终端的指纹特征模板加密存储方法及系统

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP4116849A1 (fr) * 2021-07-07 2023-01-11 iCognize GmbH Procédé mis en uvre par ordinateur permettant de gérer un ensemble de données comprenant des informations relatives à la sécurité

Also Published As

Publication number Publication date
CN107113170B (zh) 2019-01-29
CN107113170A (zh) 2017-08-29

Similar Documents

Publication Publication Date Title
WO2018165811A1 (fr) Procédé de sauvegarde et de vérification de modèle biométrique, et appareil et terminal de reconnaissance biométrique
US10594688B2 (en) Privacy-enhanced biometrics-secret binding scheme
JP5816750B2 (ja) 生体イメージ情報を含む使い捨てパスワードを用いた認証方法及び装置
CN105960775B (zh) 用于迁移密钥的方法和装置
Barman et al. Fingerprint-based crypto-biometric system for network security
JP4938678B2 (ja) 類似性指標のセキュアな計算
US7805615B2 (en) Asymmetric cryptography with user authentication
US9935947B1 (en) Secure and reliable protection and matching of biometric templates across multiple devices using secret sharing
US9813246B2 (en) Encryption using biometric image-based key
TWI675308B (zh) 驗證生物特徵圖像的可用性的方法和裝置
CN110969431B (zh) 区块链数字币私钥的安全托管方法、设备和系统
CN106452770B (zh) 一种数据加密方法、解密方法、装置和系统
CN112948795B (zh) 保护隐私的身份认证方法及装置
CN111541713A (zh) 基于区块链和用户签名的身份认证方法及装置
KR20190001177A (ko) 바이오메트릭을 이용한 사용자의 인증 방법 및 장치
WO2018166484A1 (fr) Procédés et appareils de chiffrement et de déchiffrement de données, dispositif électronique, et support de stockage lisible
CN105337742B (zh) 基于人脸图像特征和gps信息的lfsr文件加密及解密方法
CN116405211B (zh) 基于生物特征的多重加密方法、装置、设备及存储介质
CN111475690B (zh) 字符串的匹配方法和装置、数据检测方法、服务器
CN112800477A (zh) 一种基于生物特征值的数据加解密系统及方法
US11308190B2 (en) Biometric template handling
JP7024709B2 (ja) 暗号化情報照合装置、暗号化情報照合方法、及び、暗号化情報照合プログラム
Sarkar et al. RSA key generation from cancelable fingerprint biometrics
KR102210620B1 (ko) 서버에의 비밀 정보 저장 방법 및 복구 방법
JP7383275B2 (ja) データ処理装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17900738

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17900738

Country of ref document: EP

Kind code of ref document: A1