WO2019205888A1

WO2019205888A1 - Image processing method and apparatus, electronic device, and storage medium

Info

Publication number: WO2019205888A1
Application number: PCT/CN2019/080556
Authority: WO
Inventors: 郭子青; 周海涛
Original assignee: Oppo广东移动通信有限公司
Priority date: 2018-04-28
Filing date: 2019-03-29
Publication date: 2019-10-31
Also published as: CN108763895A; CN108763895B

Abstract

An image processing method, an apparatus, an electronic device, and a storage medium. The method comprises: obtaining a request for a biometric information entry (302); receiving an authorization tag transmitted from a first application and an authorization tag transmitted from a second application according to the request (304); and comparing the authorization tag transmitted from the first application with the authorization tag transmitted from the second application and obtaining a comparison result (306).

Description

Image processing method and device, electronic device, storage medium

Priority information

Priority is claimed on Japanese Patent Application No. 201810401358.3, the entire disclosure of which is hereby incorporated by reference.

Technical field

The present application relates to the field of computer technology, and in particular, to an image processing method and apparatus, an electronic device, and a computer readable storage medium.

Background technique

With the development of computer technology, it is more and more common to enter biometric information for authentication. The identity verification mainly collects the biological information, detects the biological information and extracts the features, and compares the extracted features with the features in the database. Existing authentication methods are used for access control attendance, payment, and image recognition.

Summary of the invention

The embodiment of the present application provides an image processing method, device, electronic device, and computer readable storage medium, which can improve the security of identity verification.

An image processing method comprising:

Obtaining a request instruction for biometric information entry;

Receiving an authorization flag transmitted from the first application according to the request instruction, and receiving an authorization flag transmitted from the second application;

Comparing the authorization token transmitted by the first application with the authorization token transmitted by the second application to obtain a comparison result.

An image processing apparatus comprising:

An instruction acquisition module, configured to acquire a request instruction for biometric information entry;

An authorization mark receiving module, configured to receive an authorization mark transmitted from the first application according to the request instruction, and receive an authorization mark transmitted from the second application;

The authorization mark comparison module is configured to compare the authorization mark transmitted by the first application with the authorization mark transmitted by the second application to obtain a comparison result.

An electronic device includes a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the following steps:

Obtaining a request instruction for biometric information entry;

A computer readable storage medium having stored thereon a computer program, the computer program being executed by a processor to implement the following steps:

Obtaining a request instruction for biometric information entry;

DRAWINGS

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings to be used in the embodiments or the prior art description will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present application, and other drawings can be obtained according to the drawings without any creative work for those skilled in the art.

1 is an application environment diagram of an image processing method in an embodiment;

2 is a diagram showing the internal structure of an electronic device in an embodiment;

3 is a flow chart of an image processing method in an embodiment;

4 is a flow chart of a method for generating an authorization token in an embodiment;

FIG. 5 is a flowchart of a method for prompting abnormal information in an embodiment; FIG.

6 is a flow chart of a method for verifying face information entry in an embodiment;

7 is a software architecture diagram of an image processing method in an embodiment;

Figure 8 is a block diagram showing the structure of an image processing apparatus in an embodiment;

FIG. 9 is a partial structural block diagram of a mobile phone in an embodiment.

detailed description

In order to make the objects, technical solutions, and advantages of the present application more comprehensible, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the application and are not intended to be limiting.

It will be understood that the terms "first", "second" and the like, as used herein, may be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish one element from another. For example, a first client may be referred to as a second client, and similarly, a second client may be referred to as a first client, without departing from the scope of the present application. Both the first client and the second client are clients, but they are not the same client.

In an embodiment, an image processing method is provided to be applied to the above electronic device for illustration. As shown in FIG. 3, the method includes the following steps:

Step 302: Acquire a request instruction for biometric information entry.

Step 304: Receive an authorization token transmitted from the first application according to the request instruction, and receive an authorization token transmitted from the second application.

Step 306: Compare the authorization mark transmitted by the first application with the authorization mark transmitted by the second application to obtain a comparison result.

As shown in FIG. 4, in an embodiment, an image processing method provided may further include a process of generating an authorization mark, and the specific steps include:

Step 402: Obtain a configured password and a first timestamp when the request instruction is obtained.

Step 404: Randomly generate a security identifier according to the password and the first timestamp.

Step 406: Generate an authorization token according to the security identifier.

In an embodiment, as shown in FIG. 5, an image processing method provided may further include a process of prompting abnormal information, and the specific steps include:

Step 502: Obtain an interval duration between the current time and the first timestamp.

Step 504: When the interval duration exceeds the preset duration, the abnormal information is prompted.

In an embodiment, an image processing method may further include: a process of obtaining a comparison result, specifically: determining whether an interval duration exceeds a pre-determination when an authorization flag transmitted by the first application is the same as an authorization flag transmitted by the second application. Set the duration. When the interval duration does not exceed the preset duration, the comparison result of the verification success is obtained.

In an embodiment, an image processing method provided may further include receiving a process of transmitting an authorization flag from the first application and the second application, specifically: receiving, according to the request instruction, the first application by using an untrusted operation mode and authenticating An authorization token for the shared memory transfer of the run mode, and an authorization token for receiving the shared memory transfer of the second application through the untrusted mode of operation and the trusted mode of operation.

In an embodiment, in an image processing method, an authorization mark transmitted by a first application and an authorization mark transmitted by a second application are authorization marks processed by a digital signature.

As shown in FIG. 6, in an embodiment, an image processing method provided may further include a process of verifying face information input, and the specific steps include:

Step 602: Acquire a request instruction for inputting face information.

Step 604: Receive an authorization mark for the face application transmission in the trusted operation mode according to the request instruction, and receive an authorization mark transmitted by the key management application in the trusted operation mode.

Step 606: compare the authorization mark transmitted by the face application with the authorization mark transmitted by the key management application. If the same, the face information is entered.

In one embodiment, as shown in FIG. 8, an image processing apparatus is provided, including: an instruction acquisition module 810, an authorization mark receiving module 820, and an authorization mark comparison module 830, wherein:

The instruction acquisition module 810 is configured to acquire a request instruction for biometric information entry.

The authorization mark receiving module 820 is configured to receive the authorization mark transmitted from the first application according to the request instruction, and receive the authorization mark transmitted from the second application.

The authorization mark comparison module 830 is configured to compare the authorization mark transmitted by the first application with the authorization mark transmitted by the second application to obtain a comparison result.

The embodiment of the present application also provides a computer readable storage medium. One or more non-transitory computer readable storage media containing computer executable instructions that, when executed by one or more processors, cause the processor to perform the following steps:

Step 302: Acquire a request instruction for biometric information entry;

Step 304: Receive an authorization mark transmitted from the first application according to the request instruction, and receive an authorization mark transmitted from the second application;

Step 306: Compare an authorization mark transmitted by the first application with an authorization mark transmitted by the second application, to obtain a comparison result.

Step 406: Generate an authorization token according to the security identifier.

Step 504: When the interval duration exceeds a preset duration, the abnormal information is prompted;

When the authorization flag transmitted by the first application is the same as the authorization flag transmitted by the second application, it is determined whether the interval duration exceeds the preset duration, and when the interval duration does not exceed the preset duration, the comparison result of the verification success is obtained;

Receiving, according to the request instruction, an authorization token transmitted by the first application through the shared memory of the untrusted operation mode and the trusted operation mode, and receiving an authorization token transmitted by the second application through the shared memory of the non-trusted operation mode and the trusted operation mode, The authorization mark transmitted by the first application and the authorization mark transmitted by the second application are authorization marks processed by the digital signature;

Step 602: Acquire a request instruction for entering a face information.

Step 604: Receive, according to the request instruction, an authorization mark transmitted by the face application in the trusted operation mode, and receive an authorization mark transmitted by the key management application in the trusted operation mode;

Referring to FIG. 9, in the embodiment of the present application, the processor 980 included in the electronic device implements the following steps when executing the computer program stored in the memory 920:

Step 302: Acquire a request instruction for biometric information entry;

Step 406: Generate an authorization token according to the security identifier.

Step 602: Acquire a request instruction for entering a face information.

FIG. 1 is a schematic diagram of an application environment of an image processing method in an embodiment. As shown in FIG. 1 , the application environment includes an electronic device 200. The electronic device 200 can acquire a request instruction for biometric information input, and respectively receive an authorization mark transmitted from the first application and the second application according to the request instruction, and compare the authorization tags. The electronic device 200 can obtain a comparison result. The electronic device 200 can be a smartphone, a tablet, a personal digital assistant, a wearable device, or the like.

2 is a block diagram showing the internal structure of an electronic device 200 in one embodiment. As shown in FIG. 2, the electronic device 200 can include a camera module 210, a first processing unit 220, a second processing unit 230, a security processing unit 240, and the like. The first processing unit 220 is connected to the camera module 210, the second processing unit 230, and the security processing unit 240, respectively.

The camera module 210 can include a first image collector, a first projector, a second image collector, and a second projector. The first image collector, the first projector, and the second projector are respectively coupled to the first processing unit 220. The second image collector can be coupled to the first processing unit 220 or the second processor 230. The first image capture device can be a laser camera 212. The first projector can be a floodlight 214. The second image capture device can be an RGB (Red/Green/Blue, red/green/blue color mode) camera 216. The second projector can be a laser light 218. Both the laser camera 212 and the RGB camera 216 may include elements such as lenses and image sensors. The image sensor is generally a Complementary Metal Oxide Semiconductor (CMOS) or a charge coupled device (CCD). The surface of the image sensor in the laser camera 212 is configured to provide intensity extraction of light of different wavelengths by providing filters corresponding to the pixels one by one, so that the laser camera 212 can collect invisible light images of different wavelengths. The filter may allow the wavelength of light to pass to coincide with the wavelength of light emitted by the laser lamp 218, such as infrared light, ultraviolet light, or the like. The RGB camera 216 can use Bayer filters to acquire light intensity information of three channels (R/G/B), and collect color images of the target object. The floodlight 214 can be a laser diode, an LED, or the like. The illuminating wavelength of the floodlight 214 is the same as the wavelength of the laser 218. The second projector may include a light source, a lens, and a structured light pattern generator, wherein the light source may be a surface emitting laser, a Vertical Cavity Surface Emitting Laser (VCSEL) array, and the structured light pattern generator may be frosted glass. Diffractive Optical Elements (DOE) or a combination of both.

The first processing unit 220 can be an MCU (Microcontroller Unit). The MCU may include PWM (Pulse Width Modulation) 222, SPI/I2C (Serial Peripheral Interface/Inter-Integrated Circuit) 224, RAM (Random Access Memory, Random access memory) 226 and Depth Engine 228. The MCU can be synchronized by the PWM control floodlight 214 and the laser camera 212. The floodlight 214 emits floodlight to the target object, and the floodlight image is collected by the laser camera 212. If the floodlight 214 emits infrared light, the infrared light is collected. image. The MCU is synchronized with the laser camera 218 by the PWM control laser 218, and the laser lamp 218 projects the structured light pattern to the target object, and the laser camera 212 acquires the target speckle image.

In one embodiment, the laser light 218 pre-projects a structured light pattern (a pattern with speckle particles) onto a reference plane at a known distance from the electronic device 200, which is captured by the laser camera 212 as a reference speckle image, and The memory stored in the memory of the first processing unit 220 may be stored in the memory of the second processing unit 230 or may be stored in the memory of the security processing unit 240. This memory is a non-volatile memory.

The second processing unit 230 can be a CPU processor. The second processing unit 230 includes a CPU core running under a TEE (Trusted execution environment) and a CPU core running under a REE (Rich Execution Environment). Both TEE and REE are operating modes of ARM modules (Advanced RISC Machines, Advanced Reduced Instruction Set Processor). Generally, the safer operation behavior of the electronic device 200 needs to be performed under the TEE, and other operation behaviors can be performed under the REE. In the embodiment of the present application, when the second processing unit 230 receives the face information acquisition request of the application, for example, when the application requires face information to be unlocked, and the application requires face information to perform payment, the CPU running under the TEE The kernel can send a face acquisition command to the SPI/I2C interface 224 of the first processing unit 220 through the SECURE SPI/I2C bus 250, and can acquire the infrared image by using the PWM 222 to transmit the pulse wave control camera module 210 to turn on the floodlight 214. The laser light 218 in the control camera module 210 is turned on to collect the target speckle image. The camera module 210 can transmit the acquired infrared image and the target speckle image to the depth engine 228 in the first processing unit 220 for processing. The depth engine 228 may calculate the acquired target speckle image and the reference speckle image to obtain a parallax image with offset information of the corresponding point in the target speckle image and the reference speckle image, and process the parallax image to obtain a depth image. .

The first processing unit 220 performs face recognition according to the acquired infrared image, and detects whether there is a human face in the infrared image and whether the detected face matches the stored face. Of course, the face recognition according to the infrared image may also be implemented by the security processing unit 240. The first processing unit 220 may send the acquired infrared image to the security processing unit 240, and the security processing unit 240 detects whether there is a human face in the infrared image and The detected face matches the stored face. If the face recognition passes, the first processing unit 220 performs the living body detection according to the infrared image and the depth image to detect whether the human face has biological activity. In one embodiment, the living body detection may be performed first, then the face recognition may be performed, or the face recognition and the living body detection may be performed simultaneously. For example, the first processing unit 220 performs the living body detection and then performs the face recognition; or the first processing unit 220 performs the living body detection first, and the security processing unit 240 performs the face recognition again; or the first processing unit 220 performs the face recognition and the same. The living body detection; or the first processing unit 220 performs the living body detection while the security processing unit 240 performs face recognition. The first processing unit 220 may transmit intermediate information (eg, a parallax image) of the infrared image and the depth image described above to the security processing unit 240, as the face recognition passes and the detected face is biologically active. The security processing unit 240 calculates the depth information of the face according to the intermediate information of the infrared image and the depth image, and transmits the depth information to the CPU core under the TEE.

In another embodiment, the camera module 210 can transmit the acquired infrared image and the target speckle image to the depth engine 228 in the first processing unit 220 for processing. The depth engine 228 can calculate the acquired target speckle image and the reference speckle image to obtain a disparity image with offset information of the corresponding point in the target speckle image and the reference speckle image, and the first processing unit 220 can convert the disparity. The image is transmitted to the security processing unit 240 through a Mobile Industry Processor Interface (MIPI), and the security processing unit 240 processes the parallax image to obtain a depth image. Specifically, the first processing unit 220 performs face recognition according to the acquired infrared image, and detects whether there is a human face in the infrared image and whether the detected face matches the stored face. Of course, the face recognition according to the infrared image may also be implemented by the security processing unit 240. The first processing unit 220 may send the acquired infrared image to the security processing unit 240, and the security processing unit 240 detects whether there is a human face in the infrared image and The detected face matches the stored face. If the face recognition passes, the security processing unit 240 performs the living body detection according to the infrared image and the depth image to detect whether the human face has biological activity. In one embodiment, the living body detection may be performed first, then the face recognition may be performed, or the face recognition and the living body detection may be performed simultaneously. For example, the security processing unit 240 performs the living body detection first, and the first processing unit 220 performs the face recognition again; or the security processing unit 240 performs the living body detection first, and then performs the face recognition; or the first processing unit 220 performs the face recognition. The security processing unit 240 performs a living body detection; or the security processing unit 240 performs face recognition and living body detection simultaneously. As such, the parallax image can be processed by the security processing unit 240 to obtain a depth image, thereby reducing the amount of data processing required by the first processing unit 220, thereby improving the processing efficiency and processing capability of the electronic device 200.

The security processing unit 240 may be a separate processor or a security area formed by using hardware and software isolation in the second processing unit 230. For example, the second processing unit 230 may be a multi-core processor, and one of the cores is processed. The device is defined as a security processing unit for calculating depth information of a face, matching of the acquired infrared image with the stored infrared image, matching of the calculated depth image with the stored depth image, and the like. The security processing unit 240 can perform parallel processing or serial processing on the data.

Step 302: Acquire a request instruction for biometric information entry.

The biological information may be information unique to a living body such as a face, a fingerprint, or a palm print. Biometric information can be entered via devices on the electronic device. For example, when the biological information is a human face, the face image can be collected by the camera module on the electronic device, and the CPU module controls the camera module to work, thereby realizing the input of the face information. The request command may be an instruction issued by a device on the electronic device to request entry of the biometric information. For example, when the camera module needs to capture a face image, the camera module can send a request instruction for inputting a face image to the electronic device.

When the device for recording biometric information on the electronic device is turned on, the electronic device can acquire the request instruction for biometric information input through the opened device.

The authorization mark is a mark generated when the electronic device acquires a request instruction for inputting biological information, and is used to verify whether the entered information is legal. The first application may be an application in a trusted operating environment, for example, the first application may be a face application, and the face application may be an application for collecting a face image. The second application may also be an application in a trusted operating environment. For example, the second application may be a key management application. The channel of the first application transmission authorization flag is different from the channel of the second application transmission authorization flag.

After receiving the request instruction, the electronic device may control the first application and the second application to transmit the authorization flag. The transmission channel of the first application transmission authorization mark is different from the transmission channel of the second application transmission authorization mark. The electronic device can receive the authorization mark transmitted by the first application in the trusted running environment or the non-trusted running environment, and the electronic device can also receive the second application transmission in the trusted running environment or the non-trusted running environment. Authorization mark.

The electronic device can receive the authorization token transmitted by the first application and the authorization token transmitted by the second application. The authorization mark is generated when the electronic device obtains the request instruction for inputting the biological information, and after the different transmission channels, the electronic device can compare the authorization mark transmitted by the first application with the authorization mark transmitted by the second application, and the first The authorization flag transmitted by the application is the same as or different from the authorization flag transmitted by the second application.

The traditional authentication method only compares the characteristics of the extracted biological information with the features in the database, and has a problem of low security.

The embodiment of the present application transmits the authorization token transmitted from the first application according to the request instruction, and receives the authorization token transmitted from the second application according to the request instruction, and transmits the authorization token transmitted by the first application to the second application. The authorization tokens are compared and the comparison results are obtained. The security of biometric information entry can be improved by receiving authorization tokens transmitted by different applications and comparing the received authorization tokens transmitted by different applications.

The configured password can be configured by the user through the display of the electronic device, and the configured password can be a digital password or a pattern password. A timestamp is a sequence of characters used to identify a certain time.

The electronic device can obtain a password configured through the display. The electronic device may also acquire a first timestamp when the request instruction is acquired, and the first timestamp is a sequence of time characters when the request instruction is acquired.

Among them, Security Identifiers are unique numbers that identify users, groups, and computers. After obtaining the password and the first timestamp, the electronic device may randomly generate a security identifier according to the password and the first timestamp, and the security identifier may be a 64-bit identifier. The security identifier can also be bound to a password.

Step 406: Generate an authorization token according to the security identifier.

The electronic device can generate an authorization token based on the security identifier. The generated authorization token can be a password set, and the generated authorization token can contain multiple key factors such as a timestamp, a security identifier, and a hardware-related hash check code.

The security token is randomly generated according to the password and the first timestamp by obtaining the configured password and the first timestamp when the request instruction is obtained, and the authorization token is generated according to the security identifier. The electronic device generates a security identifier based on the password and the first timestamp. Since the authorization token is generated based on the security identifier, the security of the information entry can be improved.

The electronic device can obtain the current time when it is in working state. The electronic device may further calculate a time difference according to the obtained current time and the first timestamp, where the time difference is an interval time between the current time and the first timestamp.

The preset duration can be a preset period of time. For example, the preset duration can be 3 seconds. The electronic device can obtain the current time when the working state is at any time, and then calculate the interval time according to the acquired time. The electronic device can also compare the acquired interval duration with the preset duration. When the interval duration exceeds the preset duration, the electronic device can prompt the abnormal information. Specifically, the electronic device can prompt an abnormality by shaking, sending information, ringing, and the like.

By obtaining the interval between the current time and the first timestamp, when the interval duration exceeds the preset duration, the abnormal information is prompted. The electronic device can control the working time by acquiring the interval duration, and prompt the abnormal information when the interval duration exceeds the preset duration, thereby ensuring the safe working time of the electronic device.

The electronic device may determine whether the authorization mark transmitted by the first application is the same as the authorization mark transmitted by the second application, and when the electronic device determines that the authorization mark transmitted by the first application is the same as the authorization mark transmitted by the second application, the electronic device may also Whether the interval duration exceeds the preset duration for further judgment. When the electronic device determines that the interval duration does not exceed the preset duration, the electronic device may obtain a comparison result of successful verification.

When the authorization flag transmitted by the first application is the same as the authorization flag transmitted by the second application, it is determined whether the interval duration exceeds the preset duration, and when the interval duration does not exceed the preset duration, the comparison result of the verification success is obtained. Only when the authorization mark transmitted by the first application is the same as the authorization mark transmitted by the second application, and the interval duration does not exceed the preset duration, the electronic device obtains the comparison result of the verification success, and improves the accuracy of the electronic device to obtain the comparison result. .

Data can be transferred between the trusted operating mode and the untrusted operating mode through shared memory, that is, the untrusted operating mode can transfer data to the trusted operating mode through the shared memory. The electronic device may separately receive the authorization mark transmitted by the first application and the second application according to the request instruction, and the first application and the second application may transmit the authorization mark in a trusted operation mode, and the trusted operation mode may transmit the authorization mark to the shared memory through the shared memory. In the untrusted operation mode, the electronic device can compare the received authorization tags of the first application and the second application in the untrusted operation mode, and obtain a comparison result. The first application and the second application may also transmit the authorization token through the untrusted operation mode, and the non-trusted operation mode may transmit the authorization token to the trusted operation mode through the shared memory, and the electronic device may receive the trusted operation mode. The first application is compared with the authorization flag of the second application, and the comparison result is obtained.

And receiving, according to the request instruction, an authorization token transmitted by the first application through the shared memory of the untrusted operation mode and the trusted operation mode, and an authorization token transmitted by the shared memory of the second application through the non-trusted operation mode and the trusted operation mode. The electronic device can compare the received authorization tags in the trusted operation mode or the non-trust mode, thereby improving the security of the authorization tag transmission and the accuracy of the comparison result.

Digital signature refers to a digital string that cannot be forged by using public key encryption technology. Digital signature is an encryption process. Authorization tokens can be encrypted using digital signatures. The authorization mark transmitted by the first application and the authorization mark transmitted by the second application received by the electronic device are all authorized identifiers encrypted by using a digital signature.

Since the authorization mark transmitted by the first application and the authorization mark transmitted by the second application are both authorized signatures processed by the digital signature, the security of the authorization mark transmission is improved.

Step 602: Acquire a request instruction for inputting face information.

The electronic device can turn on the camera module to collect the face image. When the camera module is turned on, the camera module can send a request instruction for acquiring face information input to the electronic device. That is, the electronic device can acquire a request instruction for inputting face information through the camera module.

After receiving the request instruction, the electronic device can control the face application and the key management application to transmit the authorization mark. The face application and key management application is an application in the trusted mode of operation. Among them, an application for a face application for collecting a face image. The face application and the key management application can use a digital signature method to encrypt the authorization label transmitted by the face application and the authorization token transmitted by the key management application. The electronic device can simultaneously receive the authorization mark transmitted by the decrypted face application and the key management application.

After receiving the authorization mark transmitted by the face application and the authorization mark transmitted by the key management application, the electronic device may decrypt the authorization mark transmitted by the received face application and the authorization mark transmitted by the key management application. The electronic device may also compare the authorization mark transmitted by the decrypted face application with the authorization mark transmitted by the decrypted key management application, when the authorization mark transmitted by the face application is exactly the same as the authorization mark transmitted by the key management application. , face information is entered.

Receiving the request instruction of the face information input, receiving the authorization mark of the face application transmission in the trusted operation mode according to the request instruction, and receiving the authorization mark transmitted by the key management application in the trusted operation mode, and transmitting the face application The authorization token is compared with the authorization token transmitted by the key management application. If the same, the face information is entered. By comparing the authorization flag to verify whether the face information is legally verified, the security of face information entry can be improved.

FIG. 7 is a schematic diagram of a software architecture of an image processing method in an embodiment. As shown in FIG. 7, the software architecture includes an application layer 710, an operating system 720, and a trusted operating environment 730. Among them, the module in the trusted operating environment 730 includes a security service module 734. The hardware layer includes a floodlight & laser 731, an infrared camera 732, a micro control unit 733, and the like. The micro control unit 733 can ensure the security of the data by controlling its input and output. The micro control unit 733 can collect the safe infrared image and the target speckle image by controlling the floodlight & laser 731 and the infrared camera 732, and then transmit and transmit the infrared image and the target speckle image to the security service module of the trusted operating environment 730. 734. The operating system 720 includes a security management module 721, a face management module 722, a camera driver 723, and a camera frame 724. The application layer 710 includes an application 711. The application 711 can initiate an image acquisition command, and the electronic device can drive the floodlight & laser 731 and the infrared camera 732 to operate through the image acquisition command. For example, when performing a payment, unlocking, beauty, etc. operation by collecting a face, the application initiates an image acquisition instruction for collecting a face image. After the camera acquires the infrared image and the target speckle image, it determines whether the currently acquired image is for a secure application operation or a non-secure application operation according to the image acquisition instruction. When the acquired depth image is for security application operation, the acquired infrared image and the target speckle image are sent to the micro control unit 733 through the secure channel, and the micro control unit 733 performs the target speckle image and the reference speckle image according to the target image. The parallax image is calculated, and the depth image is calculated according to the parallax image, and the calculated depth image and infrared image are sent to the security service module 734. It can be understood that the process of calculating the depth image from the target speckle image can also be performed in the security service module 734. The security service module 734 sends the infrared image and the depth image to the security management module 721. Generally, different applications 711 have corresponding security management modules 721, and the security management module 721 sends the depth images and infrared images to the corresponding face management module 722. The face management module 722 performs face detection, recognition, verification, and the like according to the infrared image and the depth image, and then sends the processing result to the upper application 711, and the application 711 performs the security application operation according to the processing result. When the acquired depth image is used for non-secure applications such as beauty, AR (Augmented Reality), the infrared image and the target speckle image collected by the infrared camera 732 can be directly sent to the camera driver 723 through the non-secure channel. The camera driver 723 can calculate a parallax image from the target speckle pattern and calculate a depth image from the parallax image. The camera driver 723 can transmit the infrared image and the depth image to the camera frame 724, and then to the face management module 722 or the application 711 by the camera frame 724. The switching between the secure channel and the non-secure channel is performed by the micro control unit 733.

In one embodiment, an image processing method is provided, and the specific steps of implementing the method are as follows:

First, the electronic device can obtain a request instruction for biometric information entry. The biological information may be information unique to a living body such as a face, a fingerprint, or a palm print. Biometric information can be entered via devices on the electronic device. The request command may be an instruction issued by a device on the electronic device to request entry of the biometric information. When the device for recording biometric information on the electronic device is turned on, the electronic device can acquire the request instruction for biometric information input through the opened device.

Then, the electronic device can also obtain the configured password and the first time stamp when the request instruction is obtained. The electronic device can obtain a password configured through the display. The electronic device may also acquire a first timestamp when the request instruction is acquired, and the first timestamp is a sequence of time characters when the request instruction is acquired. The electronic device can also randomly generate a security identifier based on the password and the first timestamp. After obtaining the password and the first timestamp, the electronic device may randomly generate a security identifier according to the password and the first timestamp, and the security identifier may be a 64-bit identifier. The security identifier can also be bound to a password. The electronic device can also generate an authorization token based on the security identifier. The electronic device can generate an authorization token based on the security identifier. The generated authorization token can be a password set, and the generated authorization token can contain multiple key factors such as a timestamp, a security identifier, and a hardware-related hash check code.

Then, the electronic device can receive the authorization flag transmitted from the first application according to the request instruction, and receive the authorization flag transmitted from the second application. After receiving the request instruction, the electronic device may control the first application and the second application to transmit the authorization flag. The transmission channel of the first application transmission authorization mark is different from the transmission channel of the second application transmission authorization mark. The electronic device can receive the authorization mark transmitted by the first application in the trusted running environment or the non-trusted running environment, and the electronic device can also receive the second application transmission in the trusted running environment or the non-trusted running environment. Authorization mark.

The electronic device may further receive, according to the request instruction, an authorization mark transmitted by the first application through the shared memory of the untrusted operation mode and the trusted operation mode, and receive the shared memory of the second application through the untrusted operation mode and the trusted operation mode. Authorization token.

Then, the electronic device may further compare the authorization mark transmitted by the first application with the authorization mark transmitted by the second application to obtain a comparison result. The electronic device can receive the authorization token transmitted by the first application and the authorization token transmitted by the second application. The authorization mark is generated when the electronic device obtains the request instruction for inputting the biological information, and after the different transmission channels, the electronic device can compare the authorization mark transmitted by the first application with the authorization mark transmitted by the second application, and the first The authorization flag transmitted by the application is the same as or different from the authorization flag transmitted by the second application. When the authorization flag transmitted by the first application is the same as the authorization flag transmitted by the second application, the electronic device may determine whether the interval duration exceeds a preset duration. When the interval duration does not exceed the preset duration, the electronic device may obtain a comparison result of successful verification. .

The electronic device can obtain the interval duration between the current time and the first time stamp. The electronic device can obtain the current time when it is in working state. The electronic device may further calculate a time difference according to the obtained current time and the first timestamp, where the time difference is an interval time between the current time and the first timestamp. When the interval duration exceeds the preset duration, the electronic device can prompt the abnormality information.

The authorization mark transmitted by the first application and the authorization mark transmitted by the second application are all authorized tokens processed by the digital signature.

It should be understood that although the various steps in the above-described flowcharts are sequentially displayed as indicated by the arrows, these steps are not necessarily performed in the order indicated by the arrows. Except as explicitly stated herein, the execution of these steps is not strictly limited, and the steps may be performed in other orders. Moreover, at least some of the steps in the above flow chart may include a plurality of sub-steps or stages, which are not necessarily performed at the same time, but may be executed at different times, and these sub-steps or stages The order of execution is not necessarily performed sequentially, but may be performed alternately or alternately with at least a portion of other steps or sub-steps or stages of other steps.

In one embodiment, as shown in FIG. 8, an image processing apparatus is provided, including: an instruction acquisition module 810, an authorization flag receiving module 820, and an authorization flag comparison module 830, wherein:

In an embodiment, the instruction obtaining module 810 is further configured to obtain the configured password and the first timestamp when the request instruction is obtained, randomly generate the security identifier according to the password and the first timestamp, and generate the authorization token according to the security identifier.

In an embodiment, the instruction acquisition module 810 is further configured to obtain an interval duration between the current time and the first timestamp, and when the interval duration exceeds the preset duration, the abnormality information is prompted.

In an embodiment, the authorization flag comparison module 830 is further configured to: when the authorization flag transmitted by the first application is the same as the authorization flag transmitted by the second application, determine whether the interval duration exceeds a preset duration, when the interval duration does not exceed the preset duration. When the duration is long, the comparison result of the verification success is obtained.

In an embodiment, the authorization mark receiving module 820 is further configured to receive, according to the request instruction, an authorization mark transmitted by the first application through the shared memory of the untrusted operation mode and the trusted operation mode, and receive the second application by using the non-trusted Authorization token for shared memory transfers in Run mode and Trusted Run mode.

In one embodiment, the authorization token transmitted by the first application and the authorization token transmitted by the second application are both authorized tokens processed by the digital signature.

In one embodiment, the biometric information entry is a face information entry, and the instruction acquisition module 810 is further configured to obtain a request instruction for the face information input.

The authorization mark receiving module 820 is further configured to receive the authorization mark transmitted by the face application in the trusted operation mode according to the request instruction, and receive the authorization mark transmitted by the key management application in the trusted operation mode.

The authorization mark comparison module 830 can also be used to compare the authorization mark transmitted by the face application with the authorization mark transmitted by the key management application. If the same, the face information is entered.

The division of each module in the above image processing apparatus is for illustrative purposes only. In other embodiments, the image processing apparatus may be divided into different modules as needed to complete all or part of the functions of the image processing apparatus.

For the specific definition of the image processing apparatus, reference may be made to the definition of the image processing method in the above, and details are not described herein again. The various modules in the image processing apparatus described above may be implemented in whole or in part by software, hardware, and combinations thereof. Each of the above modules may be embedded in or independent of the processor in the computer device, or may be stored in a memory in the computer device in a software form, so that the processor invokes the operations corresponding to the above modules.

The implementation of each module in the image processing apparatus provided in the embodiments of the present application may be in the form of a computer program. The computer program can run on a terminal or server. The program modules of the computer program can be stored on the memory of the terminal or server. When the computer program is executed by the processor, the steps of the method described in the embodiments of the present application are implemented.

The embodiment of the present application also provides a computer readable storage medium. One or more non-transitory computer readable storage media containing computer executable instructions that, when executed by one or more processors, cause the processor to perform the steps of the image processing method.

A computer program product comprising instructions that, when executed on a computer, cause the computer to perform an image processing method.

An embodiment of the present application also provides an electronic device. As shown in FIG. 9 , for the convenience of description, only the parts related to the embodiments of the present application are shown. If the specific technical details are not disclosed, please refer to the method part of the embodiment of the present application. The electronic device may be any terminal device including a mobile phone, a tablet computer, a PDA (Personal Digital Assistant), a POS (Point of Sales), a vehicle-mounted computer, a wearable device, and the like, and the electronic device is used as a mobile phone. :

FIG. 9 is a block diagram showing a partial structure of a mobile phone related to an electronic device according to an embodiment of the present application. Referring to FIG. 9, the mobile phone includes: a radio frequency (RF) circuit 910, a memory 920, an input unit 930, a display unit 940, a sensor 950, an audio circuit 960, a wireless fidelity (WiFi) module 970, and a processor 980. And power supply 990 and other components. It will be understood by those skilled in the art that the structure of the handset shown in FIG. 9 does not constitute a limitation to the handset, and may include more or less components than those illustrated, or some components may be combined, or different component arrangements.

The RF circuit 910 can be used for receiving and transmitting signals during the transmission and reception of information or during a call. The downlink information of the base station can be received and processed by the processor 980. The uplink data can also be sent to the base station. Generally, RF circuits include, but are not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a Low Noise Amplifier (LNA), a duplexer, and the like. In addition, RF circuitry 910 can also communicate with the network and other devices via wireless communication. The above wireless communication may use any communication standard or protocol, including but not limited to Global System of Mobile communication (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (Code Division). Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE), e-mail, Short Messaging Service (SMS), and the like.

The memory 920 can be used to store software programs and modules, and the processor 980 executes various functional applications and data processing of the mobile phone by running software programs and modules stored in the memory 920. The memory 920 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as an application of a sound playing function, an application of an image playing function, etc.); The data storage area can store data (such as audio data, address book, etc.) created according to the use of the mobile phone. Moreover, memory 920 can include high speed random access memory, and can also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device.

The input unit 930 can be configured to receive input numeric or character information and to generate key signal inputs related to user settings and function control of the handset 900. Specifically, the input unit 930 may include a touch panel 931 and other input devices 932. The touch panel 931, also referred to as a touch screen, can collect touch operations on or near the user (such as the user using a finger, a stylus, or the like on the touch panel 931 or near the touch panel 931. Operation) and drive the corresponding connection device according to a preset program. In one embodiment, the touch panel 931 can include two portions of a touch detection device and a touch controller. Wherein, the touch detection device detects the touch orientation of the user, and detects a signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts the touch information into contact coordinates, and sends the touch information. The processor 980 is provided and can receive commands from the processor 980 and execute them. In addition, the touch panel 931 can be implemented in various types such as resistive, capacitive, infrared, and surface acoustic waves. In addition to the touch panel 931, the input unit 930 may also include other input devices 932. Specifically, other input devices 932 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control buttons, switch buttons, etc.).

The display unit 940 can be used to display information input by the user or information provided to the user as well as various menus of the mobile phone. The display unit 940 can include a display panel 941. In one embodiment, the display panel 941 may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like. In one embodiment, the touch panel 931 can cover the display panel 941. When the touch panel 931 detects a touch operation on or near it, the touch panel 931 transmits to the processor 980 to determine the type of the touch event, and then the processor 980 is The type of touch event provides a corresponding visual output on display panel 941. Although the touch panel 931 and the display panel 941 are used as two independent components to implement the input and input functions of the mobile phone in FIG. 9, in some embodiments, the touch panel 931 and the display panel 941 may be integrated. Realize the input and output functions of the phone.

The handset 900 can also include at least one type of sensor 950, such as a light sensor, motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel 941 according to the brightness of the ambient light, and the proximity sensor may close the display panel 941 and/or when the mobile phone moves to the ear. Or backlight. The motion sensor may include an acceleration sensor, and the acceleration sensor can detect the magnitude of the acceleration in each direction, and the magnitude and direction of the gravity can be detected at rest, and can be used to identify the gesture of the mobile phone (such as horizontal and vertical screen switching), and vibration recognition related functions (such as Pedometer, tapping, etc.; in addition, the phone can also be equipped with gyroscopes, barometers, hygrometers, thermometers, infrared sensors and other sensors.

Audio circuitry 960, speaker 961, and microphone 962 can provide an audio interface between the user and the handset. The audio circuit 960 can transmit the converted electrical data of the received audio data to the speaker 961, and convert it into a sound signal output by the speaker 961. On the other hand, the microphone 962 converts the collected sound signal into an electrical signal, and the audio circuit 960 After receiving, it is converted into audio data, and after being processed by the audio data output processor 980, it can be sent to another mobile phone via the RF circuit 910, or the audio data can be output to the memory 920 for subsequent processing.

WiFi is a short-range wireless transmission technology, and the mobile phone can help users to send and receive emails, browse web pages, and access streaming media through the WiFi module 970, which provides users with wireless broadband Internet access. Although FIG. 9 shows the WiFi module 970, it can be understood that it does not belong to the essential configuration of the mobile phone 900 and can be omitted as needed.

The processor 980 is the control center of the handset, which connects various portions of the entire handset using various interfaces and lines, by executing or executing software programs and/or modules stored in the memory 920, and invoking data stored in the memory 920, executing The phone's various functions and processing data, so that the overall monitoring of the phone. In one embodiment, processor 980 can include one or more processing units. In one embodiment, the processor 980 can integrate an application processor and a modem processor, wherein the application processor primarily processes an operating system, a user interface, an application, and the like; the modem processor primarily processes wireless communications. It will be appreciated that the above described modem processor may also not be integrated into the processor 980.

The mobile phone 900 also includes a power source 990 (such as a battery) that supplies power to various components. Preferably, the power source can be logically coupled to the processor 980 through a power management system to manage functions such as charging, discharging, and power management through the power management system.

In one embodiment, the handset 900 can also include a camera, a Bluetooth module, and the like.

In the embodiment of the present application, the processor 980 included in the electronic device implements the steps of the image processing method when executing the computer program stored in the memory.

Any reference to a memory, storage, database or other medium used herein may include non-volatile and/or volatile memory. Non-volatile memory can include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM), which acts as an external cache. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronization. Link (Synchlink) DRAM (SLDRAM), Memory Bus (Rambus) Direct RAM (RDRAM), Direct Memory Bus Dynamic RAM (DRDRAM), and Memory Bus Dynamic RAM (RDRAM).

The above-mentioned embodiments are merely illustrative of several embodiments of the present application, and the description thereof is more specific and detailed, but is not to be construed as limiting the scope of the claims. It should be noted that a number of variations and modifications may be made by those skilled in the art without departing from the spirit and scope of the present application. Therefore, the scope of the invention should be determined by the appended claims.

Claims

An image processing method, comprising:

Obtaining a request instruction for biometric information entry;

Receiving an authorization flag transmitted from the first application according to the request instruction, and receiving an authorization flag transmitted from the second application;

Comparing the authorization token transmitted by the first application with the authorization token transmitted by the second application to obtain a comparison result.
The method according to claim 1, wherein after obtaining the biometric request request, the method further comprises:

Obtaining a configured password and a first timestamp when the request instruction is obtained;

Generating a security identifier randomly according to the password and the first timestamp;

An authorization token is generated based on the security identifier.
The method of claim 2, wherein the method further comprises:

Obtaining an interval between the current time and the first timestamp;

When the interval duration exceeds the preset duration, an exception message is presented.
The method according to claim 3, wherein the comparing the authorization mark transmitted by the first application with the authorization mark transmitted by the second application to obtain a comparison result, comprising:

When the authorization flag transmitted by the first application is the same as the authorization flag transmitted by the second application, determining whether the interval duration exceeds a preset duration;

When the interval duration does not exceed the preset duration, a comparison result of successful verification is obtained.
The method according to claim 1, wherein the receiving the authorization flag transmitted from the first application according to the request instruction, and receiving the authorization flag transmitted from the second application, comprises:

Receiving, according to the request instruction, an authorization flag of the shared memory transmitted by the first application through the non-trusted operation mode and the trusted operation mode, and receiving the authorization of the second application to transmit through the shared memory of the untrusted operation mode and the trusted operation mode mark.
The method according to claim 1, wherein the authorization mark transmitted by the first application and the authorization mark transmitted by the second application are authorization marks processed by using a digital signature.
The method according to any one of claims 1 to 6, wherein the biometric information entry is face information entry; the method further comprises:

Obtaining a request instruction for entering face information;

Receiving, according to the request instruction, an authorization mark transmitted by the face application in the trusted operation mode, and receiving an authorization mark transmitted by the key management application in the trusted operation mode;

The authorization mark transmitted by the face application is compared with the authorization mark transmitted by the key management application, and if the same, the face information is entered.
An image processing apparatus, comprising:

An instruction acquisition module, configured to acquire a request instruction for biometric information entry;

An authorization mark receiving module, configured to receive an authorization mark transmitted from the first application according to the request instruction, and receive an authorization mark transmitted from the second application;

The authorization mark comparison module is configured to compare the authorization mark transmitted by the first application with the authorization mark transmitted by the second application to obtain a comparison result.
An electronic device comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes:

Obtaining a request instruction for biometric information entry;

Receiving an authorization flag transmitted from the first application according to the request instruction, and receiving an authorization flag transmitted from the second application;

Comparing the authorization token transmitted by the first application with the authorization token transmitted by the second application to obtain a comparison result.
The electronic device of claim 9 wherein said computer program, when executed by said processor, causes said processor to:

Obtaining a configured password and a first timestamp when the request instruction is obtained;

Generating a security identifier randomly according to the password and the first timestamp;

An authorization token is generated based on the security identifier.
The electronic device of claim 10 wherein said computer program, when executed by said processor, causes said processor to:

Obtaining an interval between the current time and the first timestamp;

When the interval duration exceeds the preset duration, an exception message is presented.
The electronic device of claim 11 wherein said computer program, when executed by said processor, causes said processor to:

When the authorization flag transmitted by the first application is the same as the authorization flag transmitted by the second application, determining whether the interval duration exceeds a preset duration;

When the interval duration does not exceed the preset duration, a comparison result of successful verification is obtained.
The electronic device of claim 9 wherein said computer program, when executed by said processor, causes said processor to:

Receiving, according to the request instruction, an authorization flag of the shared memory transmitted by the first application through the non-trusted operation mode and the trusted operation mode, and receiving the authorization of the second application to transmit through the shared memory of the untrusted operation mode and the trusted operation mode mark.
The electronic device according to claim 9, wherein the authorization mark transmitted by the first application and the authorization mark transmitted by the second application are authorization marks processed by using a digital signature.
The electronic device according to any one of claims 9 to 14, wherein the biometric information is entered as face information; and when the computer program is executed by the processor, the processor executes:

Obtaining a request instruction for entering face information;

Receiving, according to the request instruction, an authorization mark transmitted by the face application in the trusted operation mode, and receiving an authorization mark transmitted by the key management application in the trusted operation mode;

The authorization mark transmitted by the face application is compared with the authorization mark transmitted by the key management application, and if the same, the face information is entered.
A computer readable storage medium having stored thereon a computer program, wherein the computer program is executed by a processor to:

Obtaining a request instruction for biometric information entry;

Receiving an authorization flag transmitted from the first application according to the request instruction, and receiving an authorization flag transmitted from the second application;

Comparing the authorization token transmitted by the first application with the authorization token transmitted by the second application to obtain a comparison result.
The computer readable storage medium of claim 16 wherein said computer program is executed by a processor to:

Obtaining a configured password and a first timestamp when the request instruction is obtained;

Generating a security identifier randomly according to the password and the first timestamp;

An authorization token is generated based on the security identifier.
The computer readable storage medium of claim 17, wherein the computer program is implemented by a processor to:

Obtaining an interval between the current time and the first timestamp;

When the interval duration exceeds the preset duration, an exception message is presented.
The computer readable storage medium of claim 18, wherein the computer program is implemented by a processor to:

When the authorization flag transmitted by the first application is the same as the authorization flag transmitted by the second application, determining whether the interval duration exceeds a preset duration;

When the interval duration does not exceed the preset duration, a comparison result of successful verification is obtained.
The computer readable storage medium of claim 16 wherein said computer program is executed by a processor to:

Receiving, according to the request instruction, an authorization flag of the shared memory transmitted by the first application through the non-trusted operation mode and the trusted operation mode, and receiving the authorization of the second application to transmit through the shared memory of the untrusted operation mode and the trusted operation mode mark.
The computer readable storage medium according to claim 16, wherein the authorization mark transmitted by the first application and the authorization mark transmitted by the second application are authorization marks processed by using a digital signature.
The computer readable storage medium according to any one of claims 16 to 21, wherein the biometric information entry is face information entry; and the computer program is executed by the processor to:

Obtaining a request instruction for entering face information;

Receiving, according to the request instruction, an authorization mark transmitted by the face application in the trusted operation mode, and receiving an authorization mark transmitted by the key management application in the trusted operation mode;

The authorization mark transmitted by the face application is compared with the authorization mark transmitted by the key management application, and if the same, the face information is entered.