WO2019114813A1

WO2019114813A1 - Biometric authentication system and method

Info

Publication number: WO2019114813A1
Application number: PCT/CN2018/121086
Authority: WO
Inventors: 杨骅; 来诺依德⋅康斯维奇; 凯文⋅霍罗维兹
Original assignee: 红石生物特征科技有限公司
Priority date: 2017-12-14
Filing date: 2018-12-14
Publication date: 2019-06-20

Abstract

Provided is a biometric authentication system, comprising a template end and a password end, which are independent of each other, wherein the template end is used for storing an encrypted template generated by encrypting a biometric template, and the password end is used for storing a decryption code. The system further comprises a matching end, wherein the matching end acquires the decryption code from the password end and acquires the encrypted template from the template end, decrypts the encrypted template according to the decryption code and carries out template matching and completes identity authentication. The system separately arranges and stores an encrypted template and a decryption code, and combines the two only at the moment of matching, and immediately removes the two after matching is finished, thus realizing high security and solving the problem of existing online payment and offline deposit and withdrawal and payment systems, such as an ATM, having many security vulnerabilities.

Description

Biometric authentication system and method

Technical field

The present invention relates to a biometric authentication system and method.

Background technique

With the continuous development of biometrics technology, people began to apply biometric technology to financial fields such as bank deposit/deposit, mobile payment, etc., such as establishing communication between mobile phones, banks, and merchants, and authenticating corresponding biometrics and other identity information. To achieve online payment operations. However, despite the use of biometric information encryption, there are still many security vulnerabilities in the prior art online payment and offline access and payment systems such as ATM machines. The existing encryption methods cannot guarantee the absolute security of user information.

The biometric identification/authentication system generally compares the biometric template pre-stored by the user with the biometric feature collected by the user when the user authenticates. If the two match, the user passes the system authentication, and the existing biometric identification system is in the biometric template. There are three main ways to store:

Deposited in a special ID card: Biometric templates can be stored in cards such as ID cards, bank cards, etc. that can be used to tag users. The memory chips of such cards are usually read-only and have hardware encryption functions as creatures. The storage medium of the feature template has high security. However, the special ID card increases the production cost. At the same time, the use of a special ID card requires a specific reading device, which limits the user's use of the biometric template.

Stored on the server: Biometric templates can be centrally stored on a networked server. The advantage of this approach is that user authentication can be done on all terminal devices connected to the server. However, servers that store biometric templates become the focus of hackers. Once the server is stolen, it will lead to the leakage of a large number of biometric templates, and the protection of user privacy is seriously harmed.

In the personal device: the biometric template can be stored on the user's personal device. Unlike the special ID card, the personal device usually has various communication modules, and the user can directly connect to the server or the terminal device through the network or near field communication to perform identity. Authentication, at the same time, distributed storage also reduces the possibility of hacking, but personal devices are vulnerable to physical theft, and the security of individual devices is not as good as the server.

The prior art has a biometrics-based payment method and system. For example, CN201510063624.2 discloses a payment method and system based on Bluetooth technology and biometric identification, and proposes to use Bluetooth search to limit the user range to improve recognition efficiency. And a scheme for encrypting the collected user biometrics, but it needs to match the current payer's biometrics with all potential payers, resulting in a large amount of matching operations, and the biometric template pre-stored on the server is not encrypted or solved. Passwords and encryption templates may be stored on the server, which may cause serious security problems; CN107196765A, discloses a remote biometric identity authentication method that enhances privacy protection, and improves the encryption of biometric templates and the encryption algorithm of data transmission process. .

In view of this, how to design a new biometric authentication system to eliminate the above-mentioned defects and deficiencies in the prior art, that is, to simplify the process of authentication matching, and to store the encryption template and the decryption password separately during registration and authentication. It is a problem that the relevant technical personnel in the industry need to solve only when the matching moments are combined in one place and cleared immediately after the matching ends, overcoming the existing online payment and the existence of many security loops in the offline access and payment system of the ATM machine. Item.

Summary of the invention

In order to achieve the above object, the present invention discloses a biometric authentication system, which includes mutually independent template end and password end, and the template end is used for storing an encryption template generated by biometric template encryption, and the password end is used. And storing a decryption code that can decrypt the encrypted template.

In another preferred embodiment, the template end is one of a personal device and a server, and correspondingly, the password end is the other of the personal device and the server.

In another preferred embodiment, the biometric authentication system further includes an acquisition end, the collection end is the personal device, or the collection end is a terminal device connected to the server.

In another preferred embodiment, the biometric authentication system further includes a matching end for matching the biometric template and the biometric feature, and the matching end acquiring the solution from the password end. a password, the encryption template is obtained from the template end, and the encryption template is decoded according to the decryption code to obtain the biometric template; the matching end further acquires a biometric from the collection end.

In another preferred embodiment, the matching end is the personal device, the server, or the terminal device.

In another preferred example, the collecting end is the same device as the template end, or the collecting end and the password end are the same device.

In another preferred example, the matching end is the same device as the template end, or the matching end and the password end are the same device.

In another preferred embodiment, the matching end is the same device as the collecting end.

According to a second aspect of the present invention, there is provided a biometric authentication method using the biometric authentication system according to the first aspect of the present invention, wherein the registration phase comprises the steps of:

(1) establishing a connection between the template end and the password end, and generating an encryption and decryption password pair and an identification code by the template end or the password end;

(2) Generating a biometric template from the biometric feature and encrypting by encrypting to form an encryption template, the encryption template uniquely corresponding to the identification code;

(3) The encryption template and the identification code are stored at the template end, and the decryption code and the identification code are stored at the password end, and all other information is cleared at each end.

In another preferred example, the identification code is generated by the encryption template, and the identification code uniquely corresponds to the encryption template.

In another preferred embodiment, the identification code is the same as the encryption code.

In another preferred embodiment, the data transfer between the ends is performed in an asymmetrically encrypted manner.

According to a third aspect of the present invention, there is provided a biometrics authentication method using the biometrics authentication system of the first aspect of the present invention, wherein the authentication phase comprises the steps of:

(a) establishing a connection between the collection end, the matching end, the template end, and the password end;

(b) The collecting end collects a biometric feature, and the template end determines an encryption template that needs to be matched according to the identification code, and the password end determines, according to the identification code, a decryption code that needs to be matched;

(c) The matching end obtains the encryption template, the decryption code, and the biometric feature from the template end, the password end, and the collection end, respectively, and the matching end decodes the encryption template by decoding the password and matches the biometric with the biometric feature. The matching result is transmitted to the terminal device;

(d) after the end of the matching, except for the encryption template and the identification code stored at the template end and the decryption code and the identification code stored at the password end, all other information is at each end Clear.

In another preferred embodiment, the acquiring the biometric feature at the collecting end refers to acquiring the biometric image or the biometric code using the collecting end.

In another preferred embodiment, the biometric feature is one or more of the following: (1) palm print; (2) human face; (3) eye print; (4) iris.

A fourth aspect of the present invention provides a biometric authentication method using the biometric authentication system according to the first aspect of the present invention, including a user registration phase, where the user registration phase includes the following steps:

S171: The password end generates a pair of passwords, including adding a password, decrypting the password, and generating an identification code;

S172: The password end sends the identification code to the template end, and sends the encryption code to the collection end directly or through a template end.

S173: The collecting end collects a biometric as an original template, and encrypts the biometric with the encryption code to form an encryption template.

S174: The collecting end sends the encryption template to the template end.

S175: Except that the template end retains the identification code and the encryption template, the password end retains the identification code and the decryption code, and each end deletes other data.

In another preferred embodiment, the collection end and the template end are the same device.

In another preferred embodiment, the collecting end and the password end are the same device.

According to a fifth aspect of the present invention, there is provided a biometric authentication method using the biometric authentication system according to the first aspect of the present invention, comprising a user authentication phase, the user authentication phase comprising the steps of:

S201: The personal device sends the identification code to the server. If the personal device is the template end, the server uses the identification code to find the corresponding decryption password as the password end. If the personal device is the password end, the server uses the identification code to find the corresponding encryption. template;

S202: The template end sends the encryption template to the matching end, and the password end sends the decryption password to the matching end;

S203: The matching end decodes the encrypted template stored by the template end by using the decryption code;

S204: The collecting end collects a biometric feature and sends the biometric feature to the matching end.

S205: The matching end matches the decoded encryption template with the biometric feature to complete authentication.

S206: The matching end transmits the identity authentication result to the terminal device.

S207: The matching end deletes data acquired from other ends;

In another preferred example, the collection end is the same device as the template end or the password end.

In another preferred example, the matching end is the same device as the template end or the password end.

In another preferred embodiment, the step S204 further includes:

S2041: Generate a second password pair, including a second encryption password and a second decryption password, for encrypted transmission of biometrics;

S2042: Send the second encryption password to the collection end, and send the second decryption password to the matching end;

S2043: The collecting end encrypts the biometric feature to form an encryption feature by using the second encryption code, and sends the encryption feature to a matching end;

S2044: The matching end uses the second decryption code to decode the encryption feature to obtain the biometric feature.

Preferably, the matching end further comprises a matching end, the matching end has a computing capability, can decrypt the encryption model, and matches the decrypted template with a biometric image, and the matching result can be used for identity authentication. After the matching is completed, the matching end will delete the encryption. And the decrypted template and the decryption code.

Preferably, the collecting end is further provided with a biometric collecting hardware, such as a camera, and collecting hardware features of the user by using the collecting hardware to generate a biometric image or a feature code, if the template end, the password end, and the matching end have The hardware for collecting biometrics can also be the same device as the acquisition end.

The invention proposes a system scheme for safely storing a biometric template, that is, encrypting the biometric template immediately after the biometric template is generated, and storing the encrypted template and the decrypted password separately on the server and the personal device, only when the user is connected by the server. In a short period of time, the terminal device collects the decrypted password and the encrypted template in one place, and generates a template that can be used for matching. After the matching is completed, the decrypted password and the encrypted and decrypted template are immediately cleared. In this way, when the personal device or the server is stolen unilaterally, only the password or the encryption template is leaked, and the stealer cannot obtain the biometric information of the stolen user through them.

DRAWINGS

1(a) and 1(b) are schematic diagrams showing the generation of an identification code and an encryption template in a biometric authentication method and system provided by the present invention;

2(a) and 2(b) are schematic diagrams showing the encryption, decryption and storage locations in the biometric authentication method and system provided by the present invention;

3 is a schematic diagram of a user registration process in a biometric authentication method and system provided by the present invention;

4 is a second schematic diagram of a user registration process in the biometric authentication method and system provided by the present invention;

FIG. 5 is a third schematic diagram of a user registration process in the biometric authentication method and system provided by the present invention; FIG.

6 is a fourth schematic diagram of a user registration process in the biometric authentication method and system provided by the present invention;

7 is a schematic diagram of a user authentication process in a biometric authentication method and system provided by the present invention;

8 is a second schematic diagram of a user authentication process in the biometric authentication method and system provided by the present invention;

9 is a third schematic diagram of a user authentication process in the biometric authentication method and system provided by the present invention;

10 is a fourth schematic diagram of a user authentication process in the biometric authentication method and system provided by the present invention;

11 is a fifth schematic diagram of a user authentication process in the biometric authentication method and system provided by the present invention;

12 is a sixth schematic diagram of a user authentication process in a biometric authentication method and system provided by the present invention;

13 is a schematic diagram of a user authentication process in the biometric authentication method and system provided by the present invention;

14 is a schematic diagram of a user authentication process in the biometric authentication method and system provided by the present invention;

Detailed ways

Explanation of terms

As used in the present invention, a "biometric template" refers to a biometric of a pre-stored user during registration, and the pre-existing biometrics will be matched or compared with the biometrics collected at the time of authentication for identity authentication;

As used herein, "biological characteristics" refers to physiological characteristics inherent in the human body, such as fingerprints, palm prints, irises, facial phases, DNA, etc.;

As used herein, "biometric image" refers to image data such as pictures, videos, and the like of a biometric image captured by a camera or an image capture device;

As used herein, "biometric code" refers to a mathematically-formed data or computer code of a vector, matrix, or the like of a biometric obtained directly in a form other than a biometric image, or obtained by processing a biometric image;

As used herein, "encryption template" refers to a biometric template in which a biometric image or biometric code is encrypted;

As used in the present invention, a "personal device" may be a personal device such as a mobile phone, a tablet, a computer, a smart watch or the like that is privately owned or used by the user;

As used in the present invention, a "server" may be a server used by an authentication service provider or a payment service provider to store, provide a network or communication connection, or may be a computer node in a network;

As used in the present invention, the "terminal device" may be an ATM device, a counter, a self-service server, or the like, which is set by an authentication service provider or a payment service provider;

As used in the present invention, the "collection end", the "matching end", the "password end", and the "template end" are concepts defined according to the roles played by the personal device, the server, and the terminal device in the registration process or the authentication process. The correspondence between each end and each device changes with the change of the solution. According to the actual situation, each end will have a coincidence. For example, the collection end and the matching end are both personal devices (registration method embodiment 1), the collection end and the matching. The terminals are all terminal devices (the first embodiment of the authentication method). For the various cases, please refer to the following examples.

As used in the present invention, "asymmetric encryption" is a type of key algorithm, which is characterized in that a ciphering code and a ciphering code are generated in pairs, and the code values of the two are different, and the cryptographic calculation cannot be used to calculate the solution under the achievable calculation amount. The password, encrypted by the encryption code, can be decrypted by decrypting the password.

Example

In order to ensure the security of the user's biometric data, the biometric authentication method and system of the present invention separately store the biometric encryption template and the decryption password in two places, one for the personal device, including the mobile phone, the computer, the tablet computer, and the virtual reality helmet. Etc., the other is a server connected to the terminal device, so that even if the server is compromised, it is still difficult for the hacker to pass the authentication of the authentication system because one of the decryption password or the encryption template is saved on the personal device. Specifically, there are two ways: (1) the decryption password is stored in the personal device, and the encryption template is stored in the server. At this time, the personal device is the password end, and the server is the template end; (2) the encryption template is stored in the personal device, and the decryption code is stored. On the server, the personal device is the template end and the server is the password end. The above solution password can be in the form of an asymmetric key.

First, the process of registering the user in the biometric authentication system introduced by the present invention is introduced:

Embodiment 1 of the registration method uses a personal device camera to collect a template, and the encryption template is stored in the personal device, and the decryption code is stored in the server, and the specific steps include: (FIG. 3):

Step1: The personal device establishes a connection with the server;

Step 2: The server generates a pair of asymmetric passwords, plus password A and solution password B, and an identification code C.

Step 3: The server sends the encryption code A and the identification code C to the personal device;

Step4: The user uses the personal device camera to collect the biometrics to create an original template, and encrypts it with the encryption code A to generate an encryption template;

Step5: The personal device sends a confirmation to the server;

Step 6: The server saves the records of the decryption password B and the identification code C;

Step 7: The personal device saves the encryption template and the identification code C, and clears the original template;

In this embodiment, some of the steps may be replaced by: (1) the password A may be directly used as the identification code, that is, A=C; (2) the password is added, the password is decrypted, and the identification code may be generated by the personal device, and Passed to the server; (3) The personal device is directly connected to the terminal device (such as near field communication) and connected to the server through the terminal device.

In this embodiment, the personal device is a collection end, and is also a template end, and the server is a password end. The principle of other embodiments is similar, but the coincidence of each end and the correspondence between each end and each device may be different. .

In the second embodiment of the registration method, the terminal device is used to collect the template, the encryption template is stored in the server, and the decrypted password is stored in the personal device. The specific steps include: (FIG. 4):

Step1: The personal device establishes a connection with the terminal device and the server;

Step 2: The personal device generates a pair of asymmetric passwords, plus password A and solution password B, and an identification code C.

Step3: The personal device sends the encryption code A and the identification code C to the server;

Step4: The user uses the terminal device camera to collect biometrics to create an original template;

Step 5: The terminal device obtains the encryption password A from the server, and encrypts the original template with the encryption password A to form an encryption template, and transmits the encryption template to the server;

Step6: The server sends a confirmation to the personal device;

Step 7: The personal device saves the record of the decryption password B and the identification code C;

Step 8: The server saves the encryption template and the identification code C, and clears the original template.

In this embodiment, part of the steps can be replaced by: (1) the password A can be directly used as the identification code A=C; (2) the password is added, the password is decrypted, and the identification code can be generated by the server and transmitted to the personal device. (3) The personal device is directly connected to the terminal device (such as near field communication) and connected to the server through the terminal device; (4) in the case where the connection between the terminal device and the server is secure and reliable, for example, the two are the same The device is connected through a secure intranet. In Step 5, the terminal device can send the original template to the server, and the server encrypts the template.

The third embodiment of the registration method uses a personal device camera to collect a template, the encryption template is stored in the server, and the decryption code is stored in the personal device, and the specific steps include: (FIG. 5):

Step1: The personal device establishes a connection with the server;

Step3: The user uses the personal device camera to collect the user biometrics to create an original template;

Step 4: The personal device encrypts the original template with the encryption code A to form an encryption template, and transmits the encryption template and the identification code C to the server;

Step 5: The server sends a confirmation to the personal device;

Step 6: The personal device saves the records of the decryption password B and the identification code C, and clears the original and the encryption template;

Step7: The server saves the encryption template and the identification code C;

In this embodiment, part of the steps can be replaced by: (1) the password A can be directly used as the identification code A=C; (2) the password is added, the password is decrypted, and the identification code can be generated by the server and transmitted to the personal device. (3) The personal device is directly connected to the terminal device (such as near field communication) and connected to the server through the terminal device.

In the fourth embodiment of the registration method, the terminal device is used to collect the template, the encryption template is stored in the personal device, and the decrypted password is stored in the server. The specific steps include: (FIG. 6):

Step2: The server generates a pair of asymmetric passwords, plus password A and solution password B, and an identification code C;

Step3: The user creates an original template using the terminal device camera;

Step 4: The terminal device obtains the encryption password A from the server, encrypts the original template with the encryption password A, and transmits the encryption template to the server;

Step 5: The server transmits the encryption template and the identification code C to the personal device;

Step6: The personal device sends a confirmation to the server;

Step 7: The server saves the records of the decryption password B and the identification code C, and clears the original and the encryption template;

Step8: The personal device saves the encryption template and C;

In this embodiment, part of the steps can be replaced by: (1) can directly use the encryption code A as the identification code A = C;

(2) Adding a password, decrypting the password, the identification code can be generated by the personal device and transmitted to the server; (3) the personal device is directly connected to the terminal device (such as near field communication) and connected to the server through the terminal device; (4) In the case where the connection between the terminal device and the server is secure and trusted, for example, the two devices are the same device or connected through a secure intranet. In Step 4, the terminal device can send the original template to the server, and the server encrypts the template.

The above is an example of a registration process. After the user completes the registration, the biometric authentication system can be used for authentication.

Embodiment 1 of the authentication method uses a terminal device camera to collect user biometrics, and the matching is completed in the terminal device, the encryption template is stored in the personal device, and the decryption password is stored in the server, and the specific steps include: (FIG. 7):

Step1: The personal device establishes a connection with the server and the terminal device;

Step 2: The personal device transmits the encryption template to the terminal device directly or through the server;

Step 3: The personal device transmits the identification code C to the server directly or through the terminal device;

Step 4: The server finds the decryption password B through the identification code C, and transmits the decryption password B to the terminal device;

Step 5: The terminal device decrypts the encryption template and opens the camera;

Step 6: The terminal device camera collects the user biometrics, and the terminal device matches the decrypted template to complete the identity authentication;

Step 7: The terminal device clears the decryption password, the encryption template, and the decrypted template, and completes the subsequent operations according to the identity authentication result.

In this embodiment, part of the steps may be replaced by the following means: in the case that the connection between the terminal device and the server is secure and trusted, for example, the two are the same device or connected through a secure intranet, the terminal device may send the collection to the server. The biometrics are templated by the server and the identity authentication results are passed to the terminal device.

In this embodiment, the terminal device is a collection end, and is also a matching end, the personal device is a template end, and the server is a password end. The principle of other embodiments is similar, but the coincidence of each end and the corresponding relationship between each end and each device may have The difference is not repeated here.

In the above manner, the template for encrypting the biometric information and the decryption code for decryption are stored in different devices separately, for example, the encryption template is stored in the personal device, and the decryption password is stored in the bank server, and the subsequent biometric identification system is needed. Verification, the terminal device must obtain both the encryption template stored in the personal device and the decryption code stored in the server, that is, separate storage and dual authentication are realized. Further, the matching process is performed by a terminal device other than the server and the personal device, and the terminal device can be randomly selected by the user (for example, an ATM machine is randomly selected), and at the same time, after the biometric identification system is verified, the terminal device is completed. The stored template and decryption password will be deleted immediately.

The second embodiment of the authentication method uses a personal device camera to collect user biometrics, the matching is completed in the terminal device, the encryption template is stored in the personal device, and the decryption password is stored in the server, and the specific steps include: (FIG. 8):

Step 5: The server generates a pair of new asymmetric passwords, plus password A' and solution password B';

Step 6: The server sends the encryption code A' to the personal device, and sends the decryption code B' to the terminal device.

Step7: The user collects biometrics through the camera of the personal device;

Step 8: The personal device encrypts the biometric with A' to become an encrypted biometric, and transmits the encrypted biometric and the encrypted template to the terminal device directly or through a server;

Step 9: The terminal device decrypts the template by using the decryption code B, decrypts the biometric feature with the decryption password B', and matches the two to complete the identity authentication;

Step 10: The terminal device clears the decryption password, the encryption template, the decrypted template, the encrypted biometrics, and the decrypted biometrics, and completes the subsequent operations according to the identity authentication result.

The third embodiment of the authentication method uses the terminal device camera to collect the user biometrics, the matching is completed in the personal device, the encrypted template is stored in the personal device, and the decrypted password is stored in the server, and the specific steps include: (FIG. 9):

Step 2: The personal device transmits the identification code C to the server directly or through the terminal device;

Step3: The server finds the decryption password B through the identification code C, and transmits the decryption password B to the personal device;

Step4: The server generates a pair of new asymmetric passwords, plus a password A' and a decryption password B';

Step 5: The server sends a password A' to the terminal device, and sends a decryption code B' to the personal device;

Step 6: The user collects the user biometrics through the camera of the terminal device;

Step 7: The terminal device encrypts the biometric feature with A' to form an encrypted biometric feature, and transmits the encrypted feature to the personal device directly or through a server;

Step 8: The personal device decrypts the template by using the decryption code B, decrypts the biometric feature with the decryption password B', and matches the two to complete the identity authentication;

Step 9: The personal device transmits the identity authentication result directly or through the server to the terminal device, and then clears the decryption password B, the decryption password B', the encrypted biometric feature, the decrypted biometric feature, the decrypted template, and only retains the original identification. Code C and encryption template;

Step 10: The terminal device completes the subsequent operations according to the authentication result.

The fourth embodiment of the authentication method uses a personal device camera to collect user biometrics. The matching is completed in the personal device, the encrypted template is stored in the personal device, and the decrypted password is stored in the server. The specific steps include: (FIG. 10):

Step 3: The server finds the decryption password B through the identification code C, and transmits the decryption password B to the personal device directly or through the terminal device;

Step4: The personal device decrypts the template with the decryption code B, and opens the camera;

Step 5: The personal device camera collects the user biometrics, and matches the decrypted template to complete the identity authentication on the personal device;

Step 6: The personal device transmits the identity authentication result to the terminal device directly or through the server, and then clears the decryption password B, the decrypted template, and the collected user biometrics, and only retains the original identification code C and the encryption template;

Step 7: The terminal device completes the subsequent operations according to the authentication result.

Embodiment 5 of the authentication method uses a personal device camera to collect user biometrics, the matching is completed in the personal device, the encrypted template is stored in the server, and the decrypted password is stored in the personal device, and the specific steps include: (FIG. 11):

Step 3: The server finds the encryption template through the identification code C, and transmits the encryption template to the personal device directly or through the terminal device;

Step4: The personal device uses the decryption B decryption template to open the camera;

Step 5: The personal device camera collects the user biometrics, matches them with the template, and completes identity authentication on the personal device;

Step 6: The personal device transmits the identity authentication result to the terminal device directly or through the server, and then clears the encryption template, the decrypted template, and the collected user biometrics, and only retains the original identification code C and the decryption password;

Embodiment 6 of the authentication method uses a personal device camera to collect user biometrics, the matching is completed in the terminal device, the encryption template is stored in the server, and the decrypted password is stored in the personal device, and the specific steps include: (FIG. 12):

Step 3: The server finds the encryption template through the identification code C and transmits it to the terminal device;

Step 5: The server sends the encryption code A' to the personal device, and sends the decryption code B' to the terminal device;

Step6: The camera of the personal device collects biometrics;

Step 7: The personal device encrypts the biometrics with A' to form an encrypted biometric, and transmits the encryption feature and the decryption password B directly or through the server to the terminal device;

Step 8: The terminal device decrypts the template by using the decryption code B, decrypts the biometric feature with the decryption password B', and matches the two to complete the identity authentication;

Step 9: The terminal device clears the decryption password, the encryption template, the decrypted template, the encrypted biometrics, and the decrypted biometrics, and completes the subsequent operations according to the identity authentication result.

Embodiment 7 of the authentication method uses the terminal device camera to collect the user biometrics, the matching is completed in the personal device, the encryption template is stored in the server, and the decrypted password is stored in the personal device, and the specific steps include: (FIG. 13):

Step3: The server finds the encryption template through the identification code C and transmits it to the personal device;

Step 6: The user collects biometrics through the camera of the terminal device;

Step 7: The terminal device encrypts the biometrics with A' to form an encrypted biometric, and transmits the encrypted biometrics to the personal device directly or through a server;

Step 9: The personal device transmits the identity authentication result directly or through the server to the terminal device, and then clears the encryption template, the decrypted password B', the encrypted biometric feature, and the decrypted biometric feature, and only retains the original identification code C and the decryption password B;

The eighth embodiment of the authentication method uses the terminal device camera to collect the user biometrics, the matching is completed in the terminal device, the encryption template is stored in the server, and the decryption password is stored in the personal device, and the specific steps include: (FIG. 14):

Step 2: the personal device transmits the decryption password B to the terminal device directly or through the server;

Step 4: The server finds the encryption template through the identification code C, and transmits the encryption template to the terminal device;

Step 5: The terminal device decrypts the template by decrypting the password B, and opens the camera;

Step 6: The terminal device camera collects the user biometrics, matches the decrypted template, and completes the identity authentication in the terminal device.

Step 7: The terminal device clears the decrypted password and the original and decrypted encryption template, and completes the subsequent operations according to the identity authentication result.

In this embodiment, part of the steps may be replaced by the following means: in the case that the connection between the terminal device and the server is secure and trusted, for example, the two are the same device or connected through a secure intranet, the terminal device may send the collection to the server. The image is compared by the server and the identity authentication result is passed to the terminal device.

The description of the present invention is only a preferred embodiment of the present invention, and the above embodiments are merely illustrative of the technical solutions of the present invention and are not intended to limit the present invention. Any technical solution that can be obtained by a person skilled in the art according to the concept of the present invention by logic analysis, reasoning or limited experimentation should be within the scope of the present invention.

Claims

A biometric authentication system, comprising: a template end and a password end independent of each other, the template end is configured to store an encryption template generated by biometric template encryption, and the password end is used for storing the decryption The solution password for the template.
The biometric authentication system according to claim 1, wherein the template end is one of a personal device and a server, and correspondingly, the password end is the other of the personal device and the server.
The biometric authentication system according to claim 1, further comprising a collecting end, wherein the collecting end is the personal device, or the collecting end is a terminal device connected to the server.
The biometric authentication system according to claim 1, further comprising a matching end and an acquisition end, wherein the matching end is configured to match the biometric template and the biometric, and the matching end is from the password The acquiring the decryption code, obtaining the encryption template from the template end, and decoding the encryption template according to the decryption code to obtain the biometric template; and the matching end further acquiring the biometric from the collection end.
The biometric authentication system according to claim 4, wherein the matching end is the personal device, the server or the terminal device.
The biometric authentication system according to claim 3, wherein the collection end and the template end are the same device, or the collection end and the password end are the same device.
The biometric authentication system according to claim 4, wherein the matching end is the same device as the template end, or the matching end and the password end are the same device.
The biometric authentication system according to claim 4, wherein the matching end and the collecting end are the same device.
A biometric authentication method using the biometric authentication system according to any one of claims 1-8, wherein the registration phase comprises the steps of:

(1) establishing a connection between the template end and the password end, and generating an encryption and decryption password pair and an identification code by the template end or the password end;

(2) generating a biometric template by using the biometric feature and encrypting by adding a password to form an encryption template, where the encryption template uniquely corresponds to the identification code;

(3) The encryption template and the identification code are stored at the template end, and the decryption code and the identification code are stored at the password end, and all other information is cleared at each end.
The biometric authentication method according to claim 9, wherein the identification code is generated by the encryption template, and the identification code uniquely corresponds to the encryption template.
The biometric authentication method according to claim 9, wherein the identification code is the same as the encryption code.
The biometric authentication method according to claim 9, wherein the data transfer between the ends is performed in an asymmetrically encrypted manner.
A biometric authentication method using the biometric authentication system according to any one of claims 4-8, wherein the authentication phase comprises the steps of:

(a) establishing a connection between the collection end, the matching end, the template end, and the password end;

(b) The collecting end collects a biometric feature, and the template end determines an encryption template that needs to be matched according to the identification code, and the password end determines, according to the identification code, a decryption code that needs to be matched;

(c) The matching end obtains the encryption template, the decryption code, and the biometric feature from the template end, the password end, and the collection end, respectively, and the matching end decodes the encryption template by decoding the password and matches the biometric with the biometric feature. The matching result is transmitted to the terminal device;

(d) after the end of the matching, except for the encryption template and the identification code stored at the template end and the decryption code and the identification code stored at the password end, all other information is at each end Clear.
The biometric authentication method according to claim 13, wherein the data transfer between the ends is performed in an asymmetric encryption manner.
The biometric authentication method according to claim 13, wherein the collecting the biometric feature refers to acquiring the biometric image or the biometric code by using the collecting end.
The biometric authentication method according to claim 9 or 13, wherein the biometric feature is one or more of the following: (1) palm print; (2) human face; (3) eye print; 4) Iris.
A biometric authentication method using the biometric authentication system according to any one of claims 4-8, comprising a user registration phase, the user registration phase comprising the steps of:

S171: The password end generates a pair of passwords, including adding a password, decrypting the password, and generating an identification code;

S172: The password end sends the identification code to the template end, and sends the encryption code to the collection end directly or through a template end.

S173: The collecting end collects a biometric as an original template, and encrypts the biometric with the encryption code to form an encryption template.

S174: The collecting end sends the encryption template to the template end.

S175: Except that the template end retains the identification code and the encryption template, the password end retains the identification code and the decryption code, and each end deletes other data.
The biometric authentication method according to claim 17, wherein the collection end and the template end are the same device.
The biometric authentication method according to claim 17, wherein the collection end and the password end are the same device.
A biometric authentication method using the biometric authentication system according to any one of claims 4-8, comprising a user authentication phase, the user authentication phase comprising the steps of:

S201: The personal device sends the identification code to the server. If the personal device is the template end, the server uses the identification code to find the corresponding decryption password as the password end. If the personal device is the password end, the server uses the identification code to find the corresponding encryption. template;

S202: The template end sends the encryption template to the matching end, and the password end sends the decryption password to the matching end;

S203: The matching end decodes the encrypted template stored by the template end by using the decryption code;

S204: The collecting end collects a biometric feature and sends the biometric feature to the matching end.

S205: The matching end matches the decoded encryption template with the biometric feature to complete authentication.

S206: The matching end transmits the identity authentication result to the terminal device.

S207: The matching end deletes data acquired from other ends;
The biometric authentication method according to claim 20, wherein the collection end is the same device as the template end or the password end.
The biometric authentication method according to claim 20, wherein the matching end is the same device as the template end or the password end.
The biometric authentication method according to claim 20, wherein the matching end and the collecting end are the same device.
The biometric authentication method according to any one of claims 20 to 22, wherein the step S204 further comprises:

S2041: Generate a second password pair, including a second encryption password and a second decryption password, for encrypted transmission of biometrics;

S2042: Send the second encryption password to the collection end, and send the second decryption password to the matching end;

S2043: The collecting end encrypts the biometric feature to form an encryption feature by using the second encryption code, and sends the encryption feature to a matching end;

S2044: The matching end uses the second decryption code to decode the encryption feature to obtain the biometric feature.