WO2019114813A1 - Système et procédé d'authentification biométrique - Google Patents

Système et procédé d'authentification biométrique Download PDF

Info

Publication number
WO2019114813A1
WO2019114813A1 PCT/CN2018/121086 CN2018121086W WO2019114813A1 WO 2019114813 A1 WO2019114813 A1 WO 2019114813A1 CN 2018121086 W CN2018121086 W CN 2018121086W WO 2019114813 A1 WO2019114813 A1 WO 2019114813A1
Authority
WO
WIPO (PCT)
Prior art keywords
template
password
biometric
encryption
matching
Prior art date
Application number
PCT/CN2018/121086
Other languages
English (en)
Chinese (zh)
Inventor
杨骅
来诺依德⋅康斯维奇
凯文⋅霍罗维兹
Original Assignee
红石生物特征科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from CN201811528719.7A external-priority patent/CN109961291A/zh
Application filed by 红石生物特征科技有限公司 filed Critical 红石生物特征科技有限公司
Priority to US16/954,179 priority Critical patent/US20210160076A1/en
Publication of WO2019114813A1 publication Critical patent/WO2019114813A1/fr

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists

Definitions

  • the present invention relates to a biometric authentication system and method.
  • biometrics technology With the continuous development of biometrics technology, people began to apply biometric technology to financial fields such as bank deposit/deposit, mobile payment, etc., such as establishing communication between mobile phones, banks, and merchants, and authenticating corresponding biometrics and other identity information. To achieve online payment operations.
  • biometric information encryption there are still many security vulnerabilities in the prior art online payment and offline access and payment systems such as ATM machines.
  • the existing encryption methods cannot guarantee the absolute security of user information.
  • the biometric identification/authentication system generally compares the biometric template pre-stored by the user with the biometric feature collected by the user when the user authenticates. If the two match, the user passes the system authentication, and the existing biometric identification system is in the biometric template. There are three main ways to store:
  • Biometric templates can be stored in cards such as ID cards, bank cards, etc. that can be used to tag users.
  • the memory chips of such cards are usually read-only and have hardware encryption functions as creatures.
  • the storage medium of the feature template has high security.
  • the special ID card increases the production cost.
  • the use of a special ID card requires a specific reading device, which limits the user's use of the biometric template.
  • Biometric templates can be centrally stored on a networked server.
  • the advantage of this approach is that user authentication can be done on all terminal devices connected to the server.
  • servers that store biometric templates become the focus of hackers. Once the server is stolen, it will lead to the leakage of a large number of biometric templates, and the protection of user privacy is seriously harmed.
  • the biometric template can be stored on the user's personal device.
  • the personal device usually has various communication modules, and the user can directly connect to the server or the terminal device through the network or near field communication to perform identity. Authentication, at the same time, distributed storage also reduces the possibility of hacking, but personal devices are vulnerable to physical theft, and the security of individual devices is not as good as the server.
  • CN201510063624.2 discloses a payment method and system based on Bluetooth technology and biometric identification, and proposes to use Bluetooth search to limit the user range to improve recognition efficiency. And a scheme for encrypting the collected user biometrics, but it needs to match the current payer's biometrics with all potential payers, resulting in a large amount of matching operations, and the biometric template pre-stored on the server is not encrypted or solved. Passwords and encryption templates may be stored on the server, which may cause serious security problems; CN107196765A, discloses a remote biometric identity authentication method that enhances privacy protection, and improves the encryption of biometric templates and the encryption algorithm of data transmission process. .
  • the present invention discloses a biometric authentication system, which includes mutually independent template end and password end, and the template end is used for storing an encryption template generated by biometric template encryption, and the password end is used. And storing a decryption code that can decrypt the encrypted template.
  • the template end is one of a personal device and a server, and correspondingly, the password end is the other of the personal device and the server.
  • the biometric authentication system further includes an acquisition end, the collection end is the personal device, or the collection end is a terminal device connected to the server.
  • the biometric authentication system further includes a matching end for matching the biometric template and the biometric feature, and the matching end acquiring the solution from the password end.
  • a password the encryption template is obtained from the template end, and the encryption template is decoded according to the decryption code to obtain the biometric template; the matching end further acquires a biometric from the collection end.
  • the matching end is the personal device, the server, or the terminal device.
  • the collecting end is the same device as the template end, or the collecting end and the password end are the same device.
  • the matching end is the same device as the template end, or the matching end and the password end are the same device.
  • the matching end is the same device as the collecting end.
  • a biometric authentication method using the biometric authentication system according to the first aspect of the present invention wherein the registration phase comprises the steps of:
  • the identification code is generated by the encryption template, and the identification code uniquely corresponds to the encryption template.
  • the identification code is the same as the encryption code.
  • the data transfer between the ends is performed in an asymmetrically encrypted manner.
  • a biometrics authentication method using the biometrics authentication system of the first aspect of the present invention wherein the authentication phase comprises the steps of:
  • the collecting end collects a biometric feature, and the template end determines an encryption template that needs to be matched according to the identification code, and the password end determines, according to the identification code, a decryption code that needs to be matched;
  • the matching end obtains the encryption template, the decryption code, and the biometric feature from the template end, the password end, and the collection end, respectively, and the matching end decodes the encryption template by decoding the password and matches the biometric with the biometric feature.
  • the matching result is transmitted to the terminal device;
  • the data transfer between the ends is performed in an asymmetrically encrypted manner.
  • the acquiring the biometric feature at the collecting end refers to acquiring the biometric image or the biometric code using the collecting end.
  • the biometric feature is one or more of the following: (1) palm print; (2) human face; (3) eye print; (4) iris.
  • a fourth aspect of the present invention provides a biometric authentication method using the biometric authentication system according to the first aspect of the present invention, including a user registration phase, where the user registration phase includes the following steps:
  • the password end generates a pair of passwords, including adding a password, decrypting the password, and generating an identification code;
  • the password end sends the identification code to the template end, and sends the encryption code to the collection end directly or through a template end.
  • S173 The collecting end collects a biometric as an original template, and encrypts the biometric with the encryption code to form an encryption template.
  • S174 The collecting end sends the encryption template to the template end.
  • the collection end and the template end are the same device.
  • the collecting end and the password end are the same device.
  • a biometric authentication method using the biometric authentication system according to the first aspect of the present invention comprising a user authentication phase, the user authentication phase comprising the steps of:
  • the personal device sends the identification code to the server. If the personal device is the template end, the server uses the identification code to find the corresponding decryption password as the password end. If the personal device is the password end, the server uses the identification code to find the corresponding encryption. template;
  • S202 The template end sends the encryption template to the matching end, and the password end sends the decryption password to the matching end;
  • S203 The matching end decodes the encrypted template stored by the template end by using the decryption code
  • S204 The collecting end collects a biometric feature and sends the biometric feature to the matching end.
  • S207 The matching end deletes data acquired from other ends
  • the collection end is the same device as the template end or the password end.
  • the matching end is the same device as the template end or the password end.
  • the matching end is the same device as the collecting end.
  • step S204 further includes:
  • S2041 Generate a second password pair, including a second encryption password and a second decryption password, for encrypted transmission of biometrics;
  • S2042 Send the second encryption password to the collection end, and send the second decryption password to the matching end;
  • the collecting end encrypts the biometric feature to form an encryption feature by using the second encryption code, and sends the encryption feature to a matching end;
  • the matching end uses the second decryption code to decode the encryption feature to obtain the biometric feature.
  • the matching end further comprises a matching end, the matching end has a computing capability, can decrypt the encryption model, and matches the decrypted template with a biometric image, and the matching result can be used for identity authentication. After the matching is completed, the matching end will delete the encryption. And the decrypted template and the decryption code.
  • the collecting end is further provided with a biometric collecting hardware, such as a camera, and collecting hardware features of the user by using the collecting hardware to generate a biometric image or a feature code, if the template end, the password end, and the matching end have
  • a biometric collecting hardware such as a camera
  • collecting hardware features of the user by using the collecting hardware to generate a biometric image or a feature code, if the template end, the password end, and the matching end have
  • the hardware for collecting biometrics can also be the same device as the acquisition end.
  • the invention proposes a system scheme for safely storing a biometric template, that is, encrypting the biometric template immediately after the biometric template is generated, and storing the encrypted template and the decrypted password separately on the server and the personal device, only when the user is connected by the server.
  • the terminal device collects the decrypted password and the encrypted template in one place, and generates a template that can be used for matching. After the matching is completed, the decrypted password and the encrypted and decrypted template are immediately cleared. In this way, when the personal device or the server is stolen unilaterally, only the password or the encryption template is leaked, and the stealer cannot obtain the biometric information of the stolen user through them.
  • FIG. 1(a) and 1(b) are schematic diagrams showing the generation of an identification code and an encryption template in a biometric authentication method and system provided by the present invention
  • FIGS. 2(a) and 2(b) are schematic diagrams showing the encryption, decryption and storage locations in the biometric authentication method and system provided by the present invention
  • FIG. 3 is a schematic diagram of a user registration process in a biometric authentication method and system provided by the present invention.
  • FIG. 4 is a second schematic diagram of a user registration process in the biometric authentication method and system provided by the present invention.
  • FIG. 5 is a third schematic diagram of a user registration process in the biometric authentication method and system provided by the present invention.
  • FIG. 6 is a fourth schematic diagram of a user registration process in the biometric authentication method and system provided by the present invention.
  • FIG. 7 is a schematic diagram of a user authentication process in a biometric authentication method and system provided by the present invention.
  • FIG. 8 is a second schematic diagram of a user authentication process in the biometric authentication method and system provided by the present invention.
  • FIG. 9 is a third schematic diagram of a user authentication process in the biometric authentication method and system provided by the present invention.
  • FIG. 10 is a fourth schematic diagram of a user authentication process in the biometric authentication method and system provided by the present invention.
  • FIG. 11 is a fifth schematic diagram of a user authentication process in the biometric authentication method and system provided by the present invention.
  • FIG. 12 is a sixth schematic diagram of a user authentication process in a biometric authentication method and system provided by the present invention.
  • FIG. 13 is a schematic diagram of a user authentication process in the biometric authentication method and system provided by the present invention.
  • FIG. 14 is a schematic diagram of a user authentication process in the biometric authentication method and system provided by the present invention.
  • biometric template refers to a biometric of a pre-stored user during registration, and the pre-existing biometrics will be matched or compared with the biometrics collected at the time of authentication for identity authentication;
  • biological characteristics refers to physiological characteristics inherent in the human body, such as fingerprints, palm prints, irises, facial phases, DNA, etc.;
  • biometric image refers to image data such as pictures, videos, and the like of a biometric image captured by a camera or an image capture device;
  • biometric code refers to a mathematically-formed data or computer code of a vector, matrix, or the like of a biometric obtained directly in a form other than a biometric image, or obtained by processing a biometric image;
  • encryption template refers to a biometric template in which a biometric image or biometric code is encrypted
  • a "personal device” may be a personal device such as a mobile phone, a tablet, a computer, a smart watch or the like that is privately owned or used by the user;
  • a “server” may be a server used by an authentication service provider or a payment service provider to store, provide a network or communication connection, or may be a computer node in a network;
  • the "terminal device” may be an ATM device, a counter, a self-service server, or the like, which is set by an authentication service provider or a payment service provider;
  • the "collection end”, the “matching end”, the “password end”, and the “template end” are concepts defined according to the roles played by the personal device, the server, and the terminal device in the registration process or the authentication process.
  • the correspondence between each end and each device changes with the change of the solution. According to the actual situation, each end will have a coincidence.
  • the collection end and the matching end are both personal devices (registration method embodiment 1), the collection end and the matching.
  • the terminals are all terminal devices (the first embodiment of the authentication method). For the various cases, please refer to the following examples.
  • asymmetric encryption is a type of key algorithm, which is characterized in that a ciphering code and a ciphering code are generated in pairs, and the code values of the two are different, and the cryptographic calculation cannot be used to calculate the solution under the achievable calculation amount.
  • the password encrypted by the encryption code, can be decrypted by decrypting the password.
  • the biometric authentication method and system of the present invention separately store the biometric encryption template and the decryption password in two places, one for the personal device, including the mobile phone, the computer, the tablet computer, and the virtual reality helmet.
  • the other is a server connected to the terminal device, so that even if the server is compromised, it is still difficult for the hacker to pass the authentication of the authentication system because one of the decryption password or the encryption template is saved on the personal device.
  • the decryption password is stored in the personal device
  • the encryption template is stored in the server.
  • the personal device is the password end, and the server is the template end; (2) the encryption template is stored in the personal device, and the decryption code is stored. On the server, the personal device is the template end and the server is the password end.
  • the above solution password can be in the form of an asymmetric key.
  • Embodiment 1 of the registration method uses a personal device camera to collect a template, and the encryption template is stored in the personal device, and the decryption code is stored in the server, and the specific steps include: (FIG. 3):
  • Step1 The personal device establishes a connection with the server
  • Step 2 The server generates a pair of asymmetric passwords, plus password A and solution password B, and an identification code C.
  • Step 3 The server sends the encryption code A and the identification code C to the personal device;
  • Step4 The user uses the personal device camera to collect the biometrics to create an original template, and encrypts it with the encryption code A to generate an encryption template;
  • Step5 The personal device sends a confirmation to the server
  • Step 6 The server saves the records of the decryption password B and the identification code C;
  • Step 7 The personal device saves the encryption template and the identification code C, and clears the original template
  • the terminal device such as near field communication
  • the personal device is a collection end, and is also a template end, and the server is a password end.
  • the principle of other embodiments is similar, but the coincidence of each end and the correspondence between each end and each device may be different. .
  • the terminal device is used to collect the template, the encryption template is stored in the server, and the decrypted password is stored in the personal device.
  • the specific steps include: (FIG. 4):
  • Step1 The personal device establishes a connection with the terminal device and the server;
  • Step 2 The personal device generates a pair of asymmetric passwords, plus password A and solution password B, and an identification code C.
  • Step3 The personal device sends the encryption code A and the identification code C to the server;
  • Step4 The user uses the terminal device camera to collect biometrics to create an original template
  • Step 5 The terminal device obtains the encryption password A from the server, and encrypts the original template with the encryption password A to form an encryption template, and transmits the encryption template to the server;
  • Step6 The server sends a confirmation to the personal device
  • Step 7 The personal device saves the record of the decryption password B and the identification code C;
  • Step 8 The server saves the encryption template and the identification code C, and clears the original template.
  • the third embodiment of the registration method uses a personal device camera to collect a template, the encryption template is stored in the server, and the decryption code is stored in the personal device, and the specific steps include: (FIG. 5):
  • Step1 The personal device establishes a connection with the server
  • Step 2 The personal device generates a pair of asymmetric passwords, plus password A and solution password B, and an identification code C.
  • Step3 The user uses the personal device camera to collect the user biometrics to create an original template
  • Step 4 The personal device encrypts the original template with the encryption code A to form an encryption template, and transmits the encryption template and the identification code C to the server;
  • Step 5 The server sends a confirmation to the personal device
  • Step 6 The personal device saves the records of the decryption password B and the identification code C, and clears the original and the encryption template;
  • Step7 The server saves the encryption template and the identification code C;
  • the terminal device is used to collect the template, the encryption template is stored in the personal device, and the decrypted password is stored in the server.
  • the specific steps include: (FIG. 6):
  • Step1 The personal device establishes a connection with the terminal device and the server;
  • Step2 The server generates a pair of asymmetric passwords, plus password A and solution password B, and an identification code C;
  • Step3 The user creates an original template using the terminal device camera
  • Step 4 The terminal device obtains the encryption password A from the server, encrypts the original template with the encryption password A, and transmits the encryption template to the server;
  • Step 5 The server transmits the encryption template and the identification code C to the personal device;
  • Step6 The personal device sends a confirmation to the server
  • Step 7 The server saves the records of the decryption password B and the identification code C, and clears the original and the encryption template;
  • Step8 The personal device saves the encryption template and C;
  • Step 4 the terminal device can send the original template to the server, and the server encrypts the template.
  • the biometric authentication system can be used for authentication.
  • Embodiment 1 of the authentication method uses a terminal device camera to collect user biometrics, and the matching is completed in the terminal device, the encryption template is stored in the personal device, and the decryption password is stored in the server, and the specific steps include: (FIG. 7):
  • Step1 The personal device establishes a connection with the server and the terminal device;
  • Step 2 The personal device transmits the encryption template to the terminal device directly or through the server;
  • Step 3 The personal device transmits the identification code C to the server directly or through the terminal device;
  • Step 4 The server finds the decryption password B through the identification code C, and transmits the decryption password B to the terminal device;
  • Step 5 The terminal device decrypts the encryption template and opens the camera
  • Step 6 The terminal device camera collects the user biometrics, and the terminal device matches the decrypted template to complete the identity authentication;
  • Step 7 The terminal device clears the decryption password, the encryption template, and the decrypted template, and completes the subsequent operations according to the identity authentication result.
  • part of the steps may be replaced by the following means: in the case that the connection between the terminal device and the server is secure and trusted, for example, the two are the same device or connected through a secure intranet, the terminal device may send the collection to the server.
  • the biometrics are templated by the server and the identity authentication results are passed to the terminal device.
  • the terminal device is a collection end, and is also a matching end
  • the personal device is a template end
  • the server is a password end.
  • the principle of other embodiments is similar, but the coincidence of each end and the corresponding relationship between each end and each device may have The difference is not repeated here.
  • the template for encrypting the biometric information and the decryption code for decryption are stored in different devices separately, for example, the encryption template is stored in the personal device, and the decryption password is stored in the bank server, and the subsequent biometric identification system is needed. Verification, the terminal device must obtain both the encryption template stored in the personal device and the decryption code stored in the server, that is, separate storage and dual authentication are realized. Further, the matching process is performed by a terminal device other than the server and the personal device, and the terminal device can be randomly selected by the user (for example, an ATM machine is randomly selected), and at the same time, after the biometric identification system is verified, the terminal device is completed. The stored template and decryption password will be deleted immediately.
  • the second embodiment of the authentication method uses a personal device camera to collect user biometrics, the matching is completed in the terminal device, the encryption template is stored in the personal device, and the decryption password is stored in the server, and the specific steps include: (FIG. 8):
  • Step1 The personal device establishes a connection with the server and the terminal device;
  • Step 2 The personal device transmits the encryption template to the terminal device directly or through the server;
  • Step 3 The personal device transmits the identification code C to the server directly or through the terminal device;
  • Step 4 The server finds the decryption password B through the identification code C, and transmits the decryption password B to the terminal device;
  • Step 5 The server generates a pair of new asymmetric passwords, plus password A' and solution password B';
  • Step 6 The server sends the encryption code A' to the personal device, and sends the decryption code B' to the terminal device.
  • Step7 The user collects biometrics through the camera of the personal device
  • Step 8 The personal device encrypts the biometric with A' to become an encrypted biometric, and transmits the encrypted biometric and the encrypted template to the terminal device directly or through a server;
  • Step 9 The terminal device decrypts the template by using the decryption code B, decrypts the biometric feature with the decryption password B', and matches the two to complete the identity authentication;
  • Step 10 The terminal device clears the decryption password, the encryption template, the decrypted template, the encrypted biometrics, and the decrypted biometrics, and completes the subsequent operations according to the identity authentication result.
  • part of the steps may be replaced by the following means: in the case that the connection between the terminal device and the server is secure and trusted, for example, the two are the same device or connected through a secure intranet, the terminal device may send the collection to the server.
  • the biometrics are templated by the server and the identity authentication results are passed to the terminal device.
  • the third embodiment of the authentication method uses the terminal device camera to collect the user biometrics, the matching is completed in the personal device, the encrypted template is stored in the personal device, and the decrypted password is stored in the server, and the specific steps include: (FIG. 9):
  • Step1 The personal device establishes a connection with the server and the terminal device;
  • Step 2 The personal device transmits the identification code C to the server directly or through the terminal device;
  • Step3 The server finds the decryption password B through the identification code C, and transmits the decryption password B to the personal device;
  • Step4 The server generates a pair of new asymmetric passwords, plus a password A' and a decryption password B';
  • Step 5 The server sends a password A' to the terminal device, and sends a decryption code B' to the personal device;
  • Step 6 The user collects the user biometrics through the camera of the terminal device
  • Step 7 The terminal device encrypts the biometric feature with A' to form an encrypted biometric feature, and transmits the encrypted feature to the personal device directly or through a server;
  • Step 8 The personal device decrypts the template by using the decryption code B, decrypts the biometric feature with the decryption password B', and matches the two to complete the identity authentication;
  • Step 9 The personal device transmits the identity authentication result directly or through the server to the terminal device, and then clears the decryption password B, the decryption password B', the encrypted biometric feature, the decrypted biometric feature, the decrypted template, and only retains the original identification.
  • Code C and encryption template
  • Step 10 The terminal device completes the subsequent operations according to the authentication result.
  • the fourth embodiment of the authentication method uses a personal device camera to collect user biometrics.
  • the matching is completed in the personal device, the encrypted template is stored in the personal device, and the decrypted password is stored in the server.
  • the specific steps include: (FIG. 10):
  • Step1 The personal device establishes a connection with the server and the terminal device;
  • Step 2 The personal device transmits the identification code C to the server directly or through the terminal device;
  • Step 3 The server finds the decryption password B through the identification code C, and transmits the decryption password B to the personal device directly or through the terminal device;
  • Step4 The personal device decrypts the template with the decryption code B, and opens the camera;
  • Step 5 The personal device camera collects the user biometrics, and matches the decrypted template to complete the identity authentication on the personal device;
  • Step 6 The personal device transmits the identity authentication result to the terminal device directly or through the server, and then clears the decryption password B, the decrypted template, and the collected user biometrics, and only retains the original identification code C and the encryption template;
  • Step 7 The terminal device completes the subsequent operations according to the authentication result.
  • Embodiment 5 of the authentication method uses a personal device camera to collect user biometrics, the matching is completed in the personal device, the encrypted template is stored in the server, and the decrypted password is stored in the personal device, and the specific steps include: (FIG. 11):
  • Step1 The personal device establishes a connection with the server and the terminal device;
  • Step 2 The personal device transmits the identification code C to the server directly or through the terminal device;
  • Step 3 The server finds the encryption template through the identification code C, and transmits the encryption template to the personal device directly or through the terminal device;
  • Step4 The personal device uses the decryption B decryption template to open the camera;
  • Step 5 The personal device camera collects the user biometrics, matches them with the template, and completes identity authentication on the personal device;
  • Step 6 The personal device transmits the identity authentication result to the terminal device directly or through the server, and then clears the encryption template, the decrypted template, and the collected user biometrics, and only retains the original identification code C and the decryption password;
  • Embodiment 6 of the authentication method uses a personal device camera to collect user biometrics, the matching is completed in the terminal device, the encryption template is stored in the server, and the decrypted password is stored in the personal device, and the specific steps include: (FIG. 12):
  • Step1 The personal device establishes a connection with the server and the terminal device;
  • Step 2 The personal device transmits the identification code C to the server directly or through the terminal device;
  • Step 3 The server finds the encryption template through the identification code C and transmits it to the terminal device;
  • Step4 The server generates a pair of new asymmetric passwords, plus a password A' and a decryption password B';
  • Step 5 The server sends the encryption code A' to the personal device, and sends the decryption code B' to the terminal device;
  • Step6 The camera of the personal device collects biometrics
  • Step 7 The personal device encrypts the biometrics with A' to form an encrypted biometric, and transmits the encryption feature and the decryption password B directly or through the server to the terminal device;
  • Step 8 The terminal device decrypts the template by using the decryption code B, decrypts the biometric feature with the decryption password B', and matches the two to complete the identity authentication;
  • Step 9 The terminal device clears the decryption password, the encryption template, the decrypted template, the encrypted biometrics, and the decrypted biometrics, and completes the subsequent operations according to the identity authentication result.
  • part of the steps may be replaced by the following means: in the case that the connection between the terminal device and the server is secure and trusted, for example, the two are the same device or connected through a secure intranet, the terminal device may send the collection to the server.
  • the biometrics are templated by the server and the identity authentication results are passed to the terminal device.
  • Embodiment 7 of the authentication method uses the terminal device camera to collect the user biometrics, the matching is completed in the personal device, the encryption template is stored in the server, and the decrypted password is stored in the personal device, and the specific steps include: (FIG. 13):
  • Step1 The personal device establishes a connection with the server and the terminal device;
  • Step 2 The personal device transmits the identification code C to the server directly or through the terminal device;
  • Step3 The server finds the encryption template through the identification code C and transmits it to the personal device;
  • Step4 The server generates a pair of new asymmetric passwords, plus a password A' and a decryption password B';
  • Step 5 The server sends a password A' to the terminal device, and sends a decryption code B' to the personal device;
  • Step 6 The user collects biometrics through the camera of the terminal device
  • Step 7 The terminal device encrypts the biometrics with A' to form an encrypted biometric, and transmits the encrypted biometrics to the personal device directly or through a server;
  • Step 8 The personal device decrypts the template by using the decryption code B, decrypts the biometric feature with the decryption password B', and matches the two to complete the identity authentication;
  • Step 9 The personal device transmits the identity authentication result directly or through the server to the terminal device, and then clears the encryption template, the decrypted password B', the encrypted biometric feature, and the decrypted biometric feature, and only retains the original identification code C and the decryption password B;
  • Step 10 The terminal device completes the subsequent operations according to the authentication result.
  • the eighth embodiment of the authentication method uses the terminal device camera to collect the user biometrics, the matching is completed in the terminal device, the encryption template is stored in the server, and the decryption password is stored in the personal device, and the specific steps include: (FIG. 14):
  • Step1 The personal device establishes a connection with the server and the terminal device;
  • Step 2 the personal device transmits the decryption password B to the terminal device directly or through the server;
  • Step 3 The personal device transmits the identification code C to the server directly or through the terminal device;
  • Step 4 The server finds the encryption template through the identification code C, and transmits the encryption template to the terminal device;
  • Step 5 The terminal device decrypts the template by decrypting the password B, and opens the camera;
  • Step 6 The terminal device camera collects the user biometrics, matches the decrypted template, and completes the identity authentication in the terminal device.
  • Step 7 The terminal device clears the decrypted password and the original and decrypted encryption template, and completes the subsequent operations according to the identity authentication result.
  • part of the steps may be replaced by the following means: in the case that the connection between the terminal device and the server is secure and trusted, for example, the two are the same device or connected through a secure intranet, the terminal device may send the collection to the server. The image is compared by the server and the identity authentication result is passed to the terminal device.

Landscapes

  • Business, Economics & Management (AREA)
  • Engineering & Computer Science (AREA)
  • Accounting & Taxation (AREA)
  • Computer Security & Cryptography (AREA)
  • Finance (AREA)
  • Strategic Management (AREA)
  • Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Collating Specific Patterns (AREA)

Abstract

La présente invention concerne un système d'authentification biométrique, comprenant une extrémité de modèle et une extrémité de mot de passe, qui sont indépendantes l'une de l'autre, l'extrémité de modèle étant utilisée pour mémoriser un modèle chiffré généré par chiffrement d'un modèle biométrique et l'extrémité de mot de passe étant destinée à mémoriser un code de déchiffrement. Le système comprend en outre une extrémité de mise en correspondance, l'extrémité de mise en correspondance acquérant le code de déchiffrement à partir de l'extrémité de mot de passe et acquérant le modèle chiffré à partir de l'extrémité de modèle, déchiffre le modèle chiffré selon le code de déchiffrement et exécute une mise en correspondance du modèle et achève l'authentification d'identité. Le système agence et mémorise séparément un modèle chiffré et un code de déchiffrement et combine les deux seulement au moment de la mise en correspondance et élimine immédiatement les deux après que la mise en correspondance est finie, ce qui permet de réaliser une sécurité élevée et de résoudre le problème de paiement en ligne existant et de dépôt hors ligne et de systèmes de retrait et de paiement, tels qu'un guichet automatique bancaire, présentant de nombreuses vulnérabilités de sécurité.
PCT/CN2018/121086 2017-12-14 2018-12-14 Système et procédé d'authentification biométrique WO2019114813A1 (fr)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US16/954,179 US20210160076A1 (en) 2017-12-14 2018-12-14 System and method for secure biometric authentication

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN201711341533 2017-12-14
CN201711341533.6 2017-12-14
CN201811528719.7 2018-12-13
CN201811528719.7A CN109961291A (zh) 2017-12-14 2018-12-13 一种生物特征认证系统及方法

Publications (1)

Publication Number Publication Date
WO2019114813A1 true WO2019114813A1 (fr) 2019-06-20

Family

ID=66819571

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/121086 WO2019114813A1 (fr) 2017-12-14 2018-12-14 Système et procédé d'authentification biométrique

Country Status (1)

Country Link
WO (1) WO2019114813A1 (fr)

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020026574A1 (en) * 2000-08-31 2002-02-28 Sony Corporation Person authentication system, person authentication method , information processing apparatus, and program providing medium
CN201181472Y (zh) * 2008-02-29 2009-01-14 北京华大恒泰科技有限责任公司 硬件密钥装置和移动存储系统
CN101458750A (zh) * 2008-11-21 2009-06-17 东莞市智盾电子技术有限公司 数据安全处理方法和数据安全存储设备
CN105808998A (zh) * 2014-12-31 2016-07-27 北京华大智宝电子系统有限公司 一种指纹识别装置
CN106789096A (zh) * 2017-03-30 2017-05-31 山东超越数控电子有限公司 一种生物特征密码认证方法和装置
CN107292152A (zh) * 2017-05-24 2017-10-24 舒翔 一种生物特征认证系统及生物特征认证方法

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020026574A1 (en) * 2000-08-31 2002-02-28 Sony Corporation Person authentication system, person authentication method , information processing apparatus, and program providing medium
CN201181472Y (zh) * 2008-02-29 2009-01-14 北京华大恒泰科技有限责任公司 硬件密钥装置和移动存储系统
CN101458750A (zh) * 2008-11-21 2009-06-17 东莞市智盾电子技术有限公司 数据安全处理方法和数据安全存储设备
CN105808998A (zh) * 2014-12-31 2016-07-27 北京华大智宝电子系统有限公司 一种指纹识别装置
CN106789096A (zh) * 2017-03-30 2017-05-31 山东超越数控电子有限公司 一种生物特征密码认证方法和装置
CN107292152A (zh) * 2017-05-24 2017-10-24 舒翔 一种生物特征认证系统及生物特征认证方法

Similar Documents

Publication Publication Date Title
US12022282B2 (en) Anonymous authentication and remote wireless token access
US12113792B2 (en) Authenticator centralization and protection including selection of authenticator type based on authentication policy
US10681025B2 (en) Systems and methods for securely managing biometric data
CN104321777B (zh) 生成公共标识以验证携带识别对象的个人的方法
JP6381833B2 (ja) ユビキタス環境での認証
US20160012272A1 (en) Fingerprint authentication system and a fingerprint authentication method based on nfc
WO2017032179A1 (fr) Module d'élément de sécurité (se) d'empreinte digitale et procédé de vérification de paiement
JP2006107406A (ja) 生体認証装置及び端末
CN110290134A (zh) 一种身份认证方法、装置、存储介质及处理器
CN105791277A (zh) 一种身份认证的方法
ArunPrakash et al. Biometric encoding and biometric authentication (BEBA) protocol for secure cloud in m-commerce environment
KR101468192B1 (ko) 스마트워크 환경에서의 얼굴인식기반 사용자인증 기법
JP2019004475A (ja) ユビキタス環境での認証
CN104835039A (zh) 一种数据标签生成方法
US20210160076A1 (en) System and method for secure biometric authentication
US20240022404A1 (en) Non-hackable digital identity
WO2019114813A1 (fr) Système et procédé d'authentification biométrique
US20180253573A1 (en) Systems and Methods for Utilizing Magnetic Fingerprints Obtained Using Magnetic Stripe Card Readers to Derive Transaction Tokens
CN108075887B (zh) 用于cpu卡加密认证的方法、云平台、用户设备和系统
Maheshwari et al. Secure authentication using biometric templates in Kerberos
CN109005158B (zh) 基于模糊保险箱的动态手势认证系统的认证方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18889775

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18889775

Country of ref document: EP

Kind code of ref document: A1