WO2020150892A1 - 生物特征识别系统、方法和终端设备 - Google Patents

生物特征识别系统、方法和终端设备 Download PDF

Info

Publication number
WO2020150892A1
WO2020150892A1 PCT/CN2019/072658 CN2019072658W WO2020150892A1 WO 2020150892 A1 WO2020150892 A1 WO 2020150892A1 CN 2019072658 W CN2019072658 W CN 2019072658W WO 2020150892 A1 WO2020150892 A1 WO 2020150892A1
Authority
WO
WIPO (PCT)
Prior art keywords
biometric
application module
biometric identification
module
secure
Prior art date
Application number
PCT/CN2019/072658
Other languages
English (en)
French (fr)
Inventor
夏贤青
王波
钟志强
Original Assignee
深圳市汇顶科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市汇顶科技股份有限公司 filed Critical 深圳市汇顶科技股份有限公司
Priority to PCT/CN2019/072658 priority Critical patent/WO2020150892A1/zh
Priority to CN201980000134.4A priority patent/CN109863491B/zh
Publication of WO2020150892A1 publication Critical patent/WO2020150892A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/32—User authentication using biometric data, e.g. fingerprints, iris scans or voiceprints

Definitions

  • This application relates to the field of biometric identification technology, and in particular to a biometric identification system, method and terminal device.
  • a dual-core synergy scheme using the master processor + slave processor is proposed in related technologies.
  • the fingerprint application on the master processor can rely on the trusted execution environment ( Trusted Execution Environment (TEE) to achieve the security of fingerprint data, but the fingerprint application on the slave processor is still in a non-secure environment (Rich Execution Environment, REE), and the transmission and processing of fingerprint data has security risks.
  • TEE Trusted Execution Environment
  • REE non-secure environment
  • the embodiments of the present application provide a biometric identification system, method, and terminal device, which can improve the security of the biometric identification application of the dual-core processor.
  • a biometric identification system in a first aspect, includes a first biometric application module, a second biometric application module, and a secure data sharing channel.
  • the first biometric application module runs on the main In the trusted execution environment TEE of the processor, the second biometric application module runs in the secure environment of the slave processor; the secure data sharing channel is used for the first biometric application module and the second Transfer data between biometric application modules.
  • the biometric application By running the biometric application on the slave processor in an independent safe environment, and through the secure data sharing channel between the first biometric application module on the master processor and the second biometric application module on the slave processor The data is transmitted, so that the data always runs in a safe environment, and the user's information security is guaranteed.
  • the secure data sharing channel is a shared memory allocated by a driver of the biometric identification system.
  • the first biometric application module and the second biometric application module are used to perform authentication and registration on the secure data sharing channel.
  • the secure data sharing channel can only be read and written by the first biometric application module and the second biometric application module, and other applications cannot access it, thereby ensuring The security of the secure data sharing channel is improved.
  • the second biometric application module is configured to run in the secure environment in a statically compiled manner.
  • the security environment of the slave processor can be registered in the operating system of the slave processor in a statically compiled manner, so that the security of the runtime library can be improved.
  • the first biometric application module and the second biometric application module are used to perform different biometric recognition operations in parallel.
  • the speed of biometric identification can be improved.
  • the system further includes a biometrics control module and a biometrics agent module, the biometrics control module runs in the rich execution environment REE of the main processor, and the biometrics agent module Run in the non-secure environment in the slave processor, the security environment is an operating environment independent of the non-secure environment, and the biometric control module is configured to control the second Biometrics application module.
  • the biometric agent module and the second biometric application module communicate through an inter-process communication IPC.
  • Using IPC to control the second biometric application module has limited communication capacity and does not involve biometric data, so that other applications cannot obtain biometric data.
  • the main processor is a central processing unit CPU
  • the slave processor is a digital signal processor DSP.
  • the fingerprint application based on DSP can make up for the slowness of CPU data processing (especially image processing). At the same time, it can realize dual-core parallel processing scheme with CPU, which enriches the recognition strategy.
  • the fingerprint application scheme based on DSP improves the unlocking speed and recognition performance from software and hardware collaborative optimization and SoC platform deep optimization.
  • a biometric identification method is provided, the method is applied to a biometric identification system, the biometric identification system includes a first biometric application module, a second biometric application module, and a secure data sharing channel,
  • the first biometric application module runs in the trusted execution environment TEE of the main processor
  • the second biometric application module runs in the secure environment of the slave processor
  • the method includes: the first biometric The application module performs a first biometric identification operation to obtain first biometric data; the first biometric application module transmits the first biometric data to the secure data sharing channel.
  • the method further includes: the second biometric application module performs a second biometric recognition operation to obtain second biometric data; and the second biometric application module performs a second biometric identification operation; 2.
  • the biometric data is transmitted to the secure data sharing channel.
  • the method further includes: the second biometric application module receives the first biometric data transmitted by the secure data sharing channel; and the second biometric application module performs the first
  • the second biometric identification operation includes: the second biometric application module performs the second biometric identification operation according to the first biometric data.
  • the first biometric application module to perform the first biometric recognition operation and the second biometric application module to perform the second biometric recognition operation includes: at the same time In the paragraph, the first biometric application module performs the first biometric recognition operation and the second biometric application module performs the second biometric recognition operation.
  • the second biometric application module performing the second biometric recognition operation includes: the second biometric application module performs the second biometric recognition operation in the safe environment in a statically compiled manner. 2. Biometric identification operations.
  • the secure data sharing channel is a shared memory allocated by a driver of the biometric identification system.
  • the method further includes: the first biometric application module performs authentication and registration on the secure data sharing channel; and the second biometric application module performs authentication and registration on the secure data sharing channel. Certification registration.
  • the system further includes a biometric control module and a biometric agent module
  • the biometric control module runs in the rich execution environment REE of the main processor
  • the biometric agent module Run in the non-secure environment of the slave processor
  • the security environment is an operating environment independent of the non-secure environment
  • the method further includes: the biometric control module controls the allocator through the biometric agent module The second biometric application module.
  • the biometric agent module and the second biometric application module communicate through an inter-process communication IPC.
  • the main processor is a central processing unit CPU
  • the slave processor is a digital signal processor DSP.
  • a terminal device including a memory, a processor, a touch screen, and a fingerprint module.
  • the memory is used to store a computer program.
  • the processor is used to call and run the computer program from the memory. When the program is run, the processing The device executes the foregoing first aspect or any possible implementation of the first aspect.
  • a computer readable medium for storing a computer program, the computer program including instructions for executing the second aspect or any possible implementation of the second aspect.
  • a computer program product including instructions, which when run on a computer, causes the computer to execute the above-mentioned second aspect or any optional implementation method of the second aspect.
  • Fig. 1 shows a schematic block diagram of an application scenario of an embodiment of the present application.
  • Figure 2 shows a schematic block diagram of a fingerprint identification system based on a dual-core processor.
  • Fig. 3 shows a schematic block diagram of a biometric identification system according to an embodiment of the present application.
  • Figure 4 shows a schematic diagram of the design and implementation of a secure data sharing channel.
  • Fig. 5 shows another schematic block diagram of the biometric identification system according to an embodiment of the present application.
  • FIG. 6 shows a schematic diagram of interaction within the operating system of the slave processor according to an embodiment of the present application.
  • Fig. 7 shows a schematic block diagram of a biometric identification method according to an embodiment of the present application.
  • FIG. 8 shows a schematic block diagram of a terminal device according to an embodiment of the present application.
  • biometric technology exists in many fields, such as attendance, payment, and unlocking.
  • the biological characteristics include, but are not limited to: any one or more of fingerprints, iris, retina, genes, voice, human face, palm geometry, veins, gait, and handwriting.
  • the terminal device has a biometric identification function.
  • the biometric identification system involved in the embodiments of the present application can be applied to smart phones, tablet computers, notebook computers, desktops, and other mobile terminals or other terminal devices with biometric identification devices.
  • the fingerprint identification device may be specifically an optical fingerprint device, which may be arranged in a partial area or the entire area below the display screen to form an under-display optical fingerprint system.
  • FIG. 1 is a schematic structural diagram of a terminal device to which the embodiment of the application can be applied.
  • the terminal device 100 includes a display screen 120 and a fingerprint identification device 130, wherein the fingerprint identification device 130 is arranged below the display screen 120 Local area.
  • the fingerprint identification device 130 may include a sensing array with multiple optical sensing units, where the sensing array may also be a fingerprint sensor.
  • the area where the sensing array is located or its optical sensing area is the fingerprint detection area 103 of the fingerprint identification device 130.
  • the fingerprint detection area 103 is located in the display area 102 of the display screen 120. Therefore, when the user needs to unlock the terminal device 100 or perform other fingerprint verification, only a finger Press on the fingerprint detection area 103 located on the display screen 120 to realize fingerprint input. Since the fingerprint detection can be implemented in the screen, the terminal device 100 adopting the above structure does not need to reserve a space on the front side to set a fingerprint button (such as a Home button).
  • a fingerprint button such as a Home button
  • the display screen 120 may be a display screen with a self-luminous display unit, such as an organic light-emitting diode (Organic Light-Emitting Diode, OLED) display or a micro-LED (Micro-LED) display Screen.
  • the display screen 120 may be specifically a touch-sensitive display screen, which can not only perform screen display, but also detect a user's touch or press operation, thereby providing a user with a human-computer interaction interface.
  • the terminal device 100 may include a touch controller, and the touch controller may specifically be a touch panel, which may be provided on the surface of the display screen 120, or may be partially integrated or integrated.
  • the fingerprint identification device 130 may use the display unit (ie, an OLED light source) of the OLED display screen 120 located in the fingerprint detection area 103 as an excitation light source for optical fingerprint detection.
  • the fingerprint identification device 130 may also use a built-in light source or an external light source to provide an optical signal for fingerprint detection.
  • the fingerprint identification device 130 may be applied to a non-self-luminous display screen, such as a liquid crystal display screen or other passively-luminous display screens.
  • a non-self-luminous display screen such as a liquid crystal display screen or other passively-luminous display screens.
  • the fingerprint identification device 130 may also include an excitation light source for optical fingerprint detection.
  • It may be specifically an infrared light source or a light source of non-visible light of a specific wavelength, which may be arranged under the backlight module of the liquid crystal display or arranged in the edge area under the protective cover of the terminal device 100, and the fingerprint identification device 130 is arranged under the backlight module, and the backlight module is designed to allow the fingerprint detection light to pass through the liquid crystal panel and the backlight module by opening holes or other optical designs on the film layers such as diffuser, brightness enhancement film, and reflective film. The sensing array of the fingerprint identification device 130 is reached.
  • the sensing array of the fingerprint identification device 130 may specifically be a photodetector (Photodetector) array, which includes a plurality of photodetectors distributed in an array, and the photodetector may be used as the optical sensing unit as described above. .
  • Photodetector Photodetector
  • the light emitted by the display unit of the fingerprint detection area 103 is reflected on the fingerprint on the surface of the finger and forms reflected light, wherein the reflected light of the ridge and valley of the fingerprint is different Yes, the reflected light passes through the display screen 120 and is received by the photodetector array and converted into a corresponding electrical signal, that is, a fingerprint detection signal; fingerprint image data can be obtained based on the fingerprint detection signal, and The fingerprint matching verification is further performed, so as to realize the optical fingerprint recognition function in the terminal device 100.
  • the terminal device 100 may also include a transparent protective cover 110, which may be a glass cover or a sapphire cover, which is located above the display screen 120 and covers The front side of the terminal device 100. Because, in the embodiment of the present application, the so-called finger pressing on the display screen 120 actually refers to pressing the cover 110 above the display 120 or covering the surface of the protective layer of the cover 110.
  • a transparent protective cover 110 which may be a glass cover or a sapphire cover
  • the fingerprint identification device 130 may include a light detection part 134 and an optical component 132.
  • the light detection part 134 includes the sensor array and is electrically connected to the sensor array.
  • the connected reading circuit and other auxiliary circuits can be fabricated on a chip (Die) through a semiconductor process; that is, the light detection part 134 can be fabricated on an optical imaging chip or an image sensor chip.
  • the optical component 132 may be disposed above the sensing array of the light detecting part 134, and the optical component 132 may include a filter, a light guide layer, and other optical elements; the filter layer may be used for The ambient light penetrating the finger is filtered out, and the light guide layer is mainly used to guide the reflected light reflected from the finger surface (such as optical collimation or convergence) to the sensing array for optical detection.
  • the light emitted by the display screen 120 is reflected on the surface of the finger to be detected above the display screen 120, and the reflected light reflected from the finger is optically collimated or converged by the microhole array or the lens unit, and then further After being filtered by the filter layer, it is received by the optical detection part 134, and the optical detection part 134 may further detect the received reflected light, thereby obtaining a fingerprint image of the finger to realize fingerprint recognition.
  • the position of the filter layer of the optical component 132 is not limited to the position below the light guide layer; for example, in an alternative
  • the filter layer may also be disposed between the light guide layer and the display screen 120, that is, located above the light guide layer; or, the optical component 132 may include two filter layers, The two are respectively arranged above and below the light guide layer.
  • the filter layer can also be integrated into the light guide layer, or even omitted, which is not limited in this application.
  • the optical component 132 and the light detecting part 134 may be packaged in the same optical fingerprint chip. It can also be installed inside the fingerprint identification device as a relatively independent component from the optical detection part 134, that is, the optical assembly 732 is arranged outside the chip where the optical detection part 734 is located, for example, the optical assembly 732 is bonded together Above the chip, or part of the components of the optical assembly 732 are integrated into the chip. Wherein, the light guide layer of the optical component 732 has various implementation schemes.
  • the light guide layer of the optical component 732 is specifically an optical path modulator or an optical path collimator made on a semiconductor silicon wafer or other substrates (such as silicon oxide or nitride), which has A plurality of light path modulation units or collimating units, specifically, the light path modulation units or collimating units may be through holes with a high aspect ratio, so the multiple collimating units or lens units may form a through hole array.
  • the reflected light reflected from the finger the light incident on the optical path modulation unit or the collimating unit can pass through and be received by the optical sensing unit below it, and each optical sensing unit can basically receive the communication above it.
  • the reflected light of the fingerprint pattern guided by the hole, so that the sensor array can detect the fingerprint image of the finger.
  • the light guide layer may also include an optical lens (Lens) layer, which has one or more optical lens units, such as a lens group composed of one or more aspheric lenses.
  • the reflected light reflected from the finger is collimated or condensed by the optical lens unit and is received by the optical sensor unit below it. According to this, the sensor array can detect the fingerprint image of the finger.
  • the sensing array of the light detecting part 134 may specifically include only a single sensing array, or a dual sensing array (Dual Array) or a multiple sensing array (Multiple Array) having two or more sensing arrays arranged side by side. ) Structure.
  • the optical component 732 can use a single light guide layer to simultaneously cover the two or more sensing arrays; alternatively, the optical component 732 may also include two or more light guide layers arranged side by side, such as two or more light path modulators or light path collimators, or two or more optical lens layers, the two or more light guide layers arranged side by side
  • the optical layers are respectively arranged above the two or more sensing arrays, and are used to guide or condense the relevant reflected light to the sensing arrays below them.
  • the display screen 120 may also be a non-self-luminous display screen, such as a backlit liquid crystal display screen; in this case, the fingerprint identification device 130 cannot use the display screen 120
  • the display unit is used as an excitation light source, so it is necessary to integrate an excitation light source inside the fingerprint identification device 130 or set an excitation light source outside it to achieve optical fingerprint detection.
  • the detection principle is consistent with the content described above.
  • One part of the algorithm (that is, the first fingerprint application module) runs on the CPU, and the other part of the algorithm (the second fingerprint application module) runs on the Digital Signal Processor (Digital Signal Processor).
  • DSP Digital Signal Processor
  • the CPU has already implemented the security of fingerprint data with the help of Trusted Execution Environment (TEE), that is, the first fingerprint
  • TEE Trusted Execution Environment
  • the application module runs in the TEE of the CPU.
  • the DSP-based fingerprint application runs in the Rich Execution Environment (REE), that is, the second fingerprint application module runs in a non-secure environment and runs on the CPU.
  • REE Rich Execution Environment
  • the first fingerprint application module in the TEE The acquired fingerprint data and the fingerprint data acquired by the second fingerprint application module running in the REE on the DSP may need to be communicated under the control of the fingerprint control module running in the REE on the CPU. Therefore, the transmission and processing of the fingerprint data is safe Hidden dangers. Obviously, this kind of application cannot meet the needs of users and enterprises, especially in the field of payment.
  • the embodiment of the present application provides a biometric identification system, which can ensure the security of biometric data based on the biometric application of the dual-core processor.
  • FIG. 3 shows a schematic block diagram of a biometric identification system 200 provided by an embodiment of the present application.
  • the biometric identification system 200 includes a first biometric application module 210, a second biometric application module 220, and a secure data sharing channel 230.
  • the first biometric application module 210 runs on a main processor.
  • the second biometric application module 220 runs in the secure environment of the slave processor; the secure data sharing channel 230 is used for the first biometric application module and the second Transfer data between biometric application modules.
  • the main processor of the terminal device such as the operating system (OS) of the CPU
  • TEE refers to an independent safe operating environment in the OS of the main processor, which is isolated from the REE and runs independently.
  • CA operating system
  • TEE provides a series of security services for TA, including application execution integrity, secure storage, secure interaction with input and output devices, key management, encryption algorithm, and CA in REE For secure communications, etc.
  • the OS of the slave processor can also be divided into two operating environments, one is a non-secure environment and the other is a secure environment, where the secure environment refers to a domain separately divided in the OS of the slave processor ( domain), that is, the secure environment and the non-secure environment are independent of each other. Applications running in a non-secure environment cannot arbitrarily access applications in a secure environment.
  • the security environment of the slave processor complies with the security specifications in various scenarios and is similar to the TEE of the master processor.
  • this article uses fingerprint identification applications as an example to describe. However, it should be understood that this is only used for exemplary description, and is not used to limit the embodiments of the present application.
  • fingerprint recognition applications include at least a series of operations such as fingerprint image collection, fingerprint image processing, feature extraction, and fingerprint matching. From the above description, it can be seen that in order to improve the unlocking speed and recognition performance, each operation in the fingerprint recognition application can be changed.
  • Run on the main processor and the slave processor respectively that is, the first biometric application module and the second biometric application module in the embodiment of the present application jointly complete the fingerprint identification application.
  • the first biometric application module performs fingerprint identification
  • the image completes operations such as feature extraction and fingerprint matching
  • the second biometric application module completes fingerprint image processing and other operations on the collected fingerprint image.
  • the first biometrics application module and the second biometrics application module can be run in a secure environment respectively. Specifically, the first biometric application module can be run in the TEE of the main processor, and the second biometric application module can be run in the safe environment of the slave processor.
  • the first biometric application module is TA.
  • the storage and transmission of fingerprint data can also be performed through a secure data sharing channel.
  • the first biometric application module performs a first biometric identification operation to obtain first biometric data; the first biometric application module transmits the first biometric data to the secure data sharing channel.
  • the second biometric application module performs a second biometric recognition operation to obtain second biometric data; the second biometric application module transmits the second biometric data to the secure data sharing channel .
  • the execution of the first biometric identification operation precedes the execution of the second biometric identification operation.
  • the second biometric application module reads from the The secure data sharing channel acquires the first biometric data, and performs the second biometric identification operation based on the first biometric data to obtain the second biometric data.
  • the execution of the first biometric identification operation is later than the execution of the second biometric identification operation.
  • the first biometric application module performs the first biometric identification operation from The secure data sharing channel acquires the second biometric data, and performs the second biometric identification operation based on the second biometric data.
  • the first biometric application module obtains the original biometric data from the biometric collection device, and forwards it to the second biometric application module through the secure data sharing channel for use by the second biometric application module.
  • the first biometric application module and the second biometric application module may perform biometric recognition operations in parallel. That is, in the same time period, the first biometric application module performs the first biometric recognition operation and the second biometric application module performs the second biometric recognition operation.
  • the secure data sharing channel can be used by the first biometric application module and the second biometric application module by dividing a specific shared memory in a driver. Since in FIG. 2, the first biometrics application module and the second biometrics application module need to pass through a non-secure environment for data transmission, so that the security of the data cannot be guaranteed.
  • the secure data sharing channel in the embodiment of this application can only be read and written by the first biometric application module and the second biometric application module, and other applications cannot access it, so that the fingerprint data is always in a secure environment. It will not be stolen and attacked by other applications, thereby improving the privacy and security of fingerprint applications.
  • Figure 4 shows a design and implementation diagram of a secure data sharing channel in an embodiment of the present application.
  • the hardware abstraction layer (Hardware Abstract Layout, HAL) can apply for the driver to allocate shared memory.
  • the shared memory sends the first biometric application module and the second biometric application module.
  • Perform registration and the first biometric application module and the second biometric application module respectively authenticate the registration initiated by the shared memory to prevent illegal registration.
  • the first biometric application module and the second biometric application module can obtain the use address of the shared memory, so that data can be performed between the first biometric application module and the second biometric application module through the secure data sharing channel Transmission.
  • the security of the secure data sharing channel can be guaranteed.
  • the second biometric application module may run in a statically compiled manner.
  • the security environment of the slave processor is used as the carrier for the execution of the second biometric application module and can be registered in the OS of the slave processor in a statically compiled manner, which can further ensure the safety of fingerprint data calling and running on the secure data sharing channel Sex.
  • the first biometric application module and the second biometric application module are used to perform different biometric recognition operations.
  • the first biometric application module and the second biometric application module perform different operations on the same fingerprint image collected by the fingerprint sensor in parallel.
  • the first biometric application module performs feature extraction on the fingerprint image
  • the second The biometric application module performs image processing on the fingerprint image.
  • the recognition speed can be greatly improved.
  • the first biometrics application module performs operations with a small amount of calculation
  • the second biometrics application module performs operations with a large amount of calculations. Since the main processor needs to run other algorithms in addition to the fingerprint algorithm, therefore, Sharing the fingerprint recognition operation with a larger computational load on the slave processor can also increase the fingerprint recognition speed.
  • the biometric identification system 200 of the embodiment of the present application further includes a biometric control module 240 and a biometric agent module 250.
  • the biometric control module 240 runs in the rich execution environment REE of the main processor.
  • the biometric agent module 250 runs in a non-secure environment in the slave processor, the secure environment is an operating environment independent of the non-secure environment, and the biometric control module 240 is used to pass the
  • the biometric agent module 250 controls the second biometric application module 220.
  • the biometric control module runs in the REE of the main processor, it cannot directly control the second biometric application module in the safe environment of the slave processor, and can use an application running in the non-safe environment of the slave processor as The biometrics agent module and the biometrics control module can control the operation of the second biometrics application module through the biometrics agent module.
  • the biometric agent module may communicate with the second biometric application module through inter-process communication (IPC).
  • IPC inter-process communication
  • the biometrics agent module and the second biometrics application module are located in separate user spaces in the slave processor operating system.
  • the kernel space in the operating system that is, the IPC interface in the kernel space
  • the kernel space usually has a higher level of authority, so it belongs to a safe environment.
  • the IPC interface is also located in the IPC communication can include pipes, system IPC (including message queues, signals and shared storage), and sockets (SOCKET).
  • other applications on the slave processor can all run in a non-secure environment, that is, only the second biometric application module runs in a secure environment, and other applications cannot communicate with the second biometric application module, and because The IPC communication capacity is limited.
  • the biometric agent module and the second biometric application module can only communicate with the control flow, not involving data flow communication, so that the data of the first biometric application module and the second biometric application module will not be Obtained by other applications in non-secure environments, ensuring data security.
  • processors should include but are not limited to the following: CPU, DSP, Advanced Reduced Instruction Set (Advance Reduced Instruction Set Computer (RISC) machines, ARM), Programmable Gate Array (Programmable Gate Array, FPGA), or dedicated For the integrated circuit (Application Specific Integrated Circuit, ASIC), etc.
  • the master processor + slave processor solution in the embodiment of the present application can be applied to various processor combinations.
  • the main processor in the embodiment of the application can be a CPU
  • the slave processor can be a DSP.
  • DSP is widely used in audio and video processing, machine learning, computer vision, and deep learning, it can fully demonstrate its powerful images. Data processing and computing capabilities.
  • the fingerprint application based on DSP can make up for the slowness of CPU data processing (especially image processing).
  • the fingerprint application solution based on DSP improves the unlocking speed and recognition performance from the collaborative optimization of software and hardware and the deep optimization of the System on Chip (SoC) platform.
  • SoC System on Chip
  • FIG. 7 shows a schematic block diagram of a biometric identification method 300 provided by an embodiment of the present application.
  • the method is applied to a biometric identification system, and the biometric identification system includes a first biometric application module and a second biometric.
  • the first biometric application module performs a first biometric recognition operation to obtain first biometric data
  • the first biometric application module transmits the first biometric data to the secure data sharing channel.
  • the method further includes:
  • the second biometric application module performs a second biometric identification operation to obtain second biometric data
  • the second biometric application module transmits the second biometric data to the secure data sharing channel.
  • the first biometric recognition operation performed by the first biometric application module and the second biometric recognition operation performed by the second biometric application module may be for the same creature to be recognized.
  • Features can also be for different biological features to be identified.
  • the method further includes: the second biometric application module receives the first biometric data transmitted by the secure data sharing channel; the second biometric application module Performing the second biometric identification operation includes: the second biometric application module performs the second biometric identification operation according to the first biometric data.
  • the first biometric application module to perform the first biometric recognition operation and the second biometric application module to perform the second biometric recognition operation includes: In the same time period, the first biometric application module performs the first biometric identification operation and the second biometric application module performs the second biometric identification operation.
  • the execution of the first biometric identification operation may be earlier than the execution of the second biometric identification operation, or the execution of the first biometric identification operation may be later than the second biometric identification operation.
  • the execution of the operation further includes: the first biometric application module receives the second biometric data transmitted by the secure data sharing channel; the first biometric application module performs a first biometric recognition operation, including : The first biometric application module performs the first biometric identification operation according to the second biometric data.
  • the second biometric application module performing the second biometric recognition operation includes: the second biometric application module performs all operations in the safe environment in a statically compiled manner. The second biometric recognition operation.
  • the secure data sharing channel is a shared memory allocated by the driver of the biometric identification system.
  • the method further includes: the first biometric application module performs authentication and registration on the secure data sharing channel; and the second biometric application module performs the secure data sharing Channel for authentication registration.
  • the system further includes a biometrics control module and a biometrics agent module
  • the biometrics control module runs in the rich execution environment REE of the main processor
  • the biometrics The proxy module runs in the non-secure environment of the slave processor, the security environment is an operating environment independent of the non-secure environment
  • the method further includes: the biometric control module passes through the biometric proxy module Controlling the second biometric application module.
  • the biometric agent module and the second biometric application module communicate through inter-process communication IPC.
  • the master processor is a central processing unit CPU
  • the slave processor is a digital signal processor DSP.
  • the biometric identification method according to the embodiment of the present application can correspond to each unit/module in the biometric identification system of the embodiment of the present application, and the corresponding processes in the method can be passed through the devices shown in FIGS. 3 to 6 For the sake of brevity, it will not be repeated here.
  • An embodiment of the present application also provides a terminal device, which includes the biometric identification system of the foregoing various embodiments.
  • the terminal device further includes a biometrics collection device for collecting biometrics to be identified, and the biometrics to be identified are used for processing by the first biometrics application module and the second biometrics application module.
  • FIG. 8 is a schematic block diagram of a terminal device 400 provided according to an embodiment of the present application.
  • the terminal device 400 shown in FIG. 8 includes: a radio frequency (RF) circuit 410, a memory 420, other input devices 430, a display screen 440, a sensor 450, an audio circuit 460, an I/O subsystem 470, a processor 480, And power supply 490 and other components.
  • RF radio frequency
  • FIG. 8 does not constitute a limitation on the terminal device, and may include more or less components than shown in the figure, or combine certain components, or split certain components , Or different component arrangements.
  • the display screen 440 belongs to a user interface (User Interface, UI), and the terminal device 400 may include a user interface that is less than that shown or less.
  • UI User Interface
  • terminal device 400 The components of the terminal device 400 will be specifically introduced below in conjunction with FIG. 8:
  • the RF circuit 410 can be used for receiving and sending signals during information transmission or communication. In particular, after receiving the downlink information of the base station, it is processed by the processor 480; in addition, the designed uplink data is sent to the base station.
  • the RF circuit includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier (LNA), a duplexer, and the like.
  • the RF circuit 410 can also communicate with the network and other devices through wireless communication.
  • the memory 420 may be used to store software programs and modules.
  • the processor 480 executes various functional applications and data processing of the terminal device 400 by running the software programs and modules stored in the memory 420.
  • the memory 420 may mainly include a program storage area and a data storage area.
  • the program storage area may store an operating system, an application program required by at least one function (such as a sound playback function, an image playback function, etc.), etc.;
  • the data (such as audio data, phone book, etc.) created by the use of the terminal device 400, etc.
  • the memory 420 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other volatile solid-state storage devices.
  • the other input device 430 may be used to receive input digital or character information, and to generate signal input related to user settings and function control of the terminal device 400.
  • other input devices 430 may include, but are not limited to, physical keyboards, function keys (such as volume control buttons, switch buttons, etc.), trackballs, mice, joysticks, optical mice (optical mice are touch sensitive that do not display visual output). A surface, or an extension of a touch-sensitive surface formed by a touch screen), and so on.
  • the other input device 430 is connected to the other input device controller 471 of the I/O subsystem 470, and performs signal interaction with the processor 480 under the control of the other device input controller 471.
  • the display screen 440 may be used to display information input by the user or information provided to the user and various menus of the terminal device 400, and may also accept user input.
  • the specific display screen 440 may be a touch screen, and may include a display panel 441 and a touch panel 442.
  • the touch panel 442 can cover the display panel 441, and the user can, according to the content displayed on the display panel 441 (the display content includes, but is not limited to, soft keyboard, virtual mouse, virtual keys, icons, etc.), the touch overlay on the display panel 441 The operation is performed on or near the control panel 442.
  • the touch panel 442 After the touch panel 442 detects the operation on or near it, it is transmitted to the processor 480 through the I/O subsystem 470 to determine the user input, and then the processor 480 passes the I/O according to the user input.
  • the /O subsystem 470 provides corresponding visual output on the display panel 441.
  • the touch panel 442 and the display panel 441 are used as two independent components to implement the input and input functions of the terminal device 400, but in some embodiments, the touch panel 442 and the display panel 441 may be combined.
  • the input and output functions of the terminal device 400 are realized by integration.
  • the terminal device 400 may further include at least one sensor 450.
  • the sensor 450 may be a biometric sensor, that is, the biometric collection device in the embodiment of the present application.
  • the audio circuit 460, the speaker 461, and the microphone 462 may provide an audio interface between the user and the terminal device 400.
  • the audio circuit 460 can transmit the converted signal of the received audio data to the speaker 461, which is converted into a sound signal for output by the speaker 461; on the other hand, the microphone 462 converts the collected sound signal into a signal, which is received by the audio circuit 460
  • the audio data is converted into audio data, and then the audio data is output to the RF circuit 410 to be sent to, for example, another mobile phone, or the audio data is output to the memory 420 for further processing.
  • the I/O subsystem 470 is used to control input and output external devices, and may include an input controller 471, a sensor controller 472, and a display controller 473 for other devices.
  • one or more other input control device controllers 471 receive signals from and/or send signals to other input devices 430, and other input devices 430 may include physical buttons (press buttons, rocker buttons, etc.) , Dial, slide switch, joystick, click wheel, optical mouse (optical mouse is a touch-sensitive surface that does not display visual output, or an extension of the touch-sensitive surface formed by the display screen).
  • the other input control device controller 471 may be connected to any one or more of the above-mentioned devices.
  • the display controller 473 in the I/O subsystem 470 receives signals from the display screen 440 and/or sends signals to the display screen 440. After the display screen 440 detects the user input, the display controller 473 converts the detected user input into an interaction with the user interface object displayed on the display screen 440, that is, human-computer interaction is realized.
  • the sensor controller 472 may receive signals from one or more sensors 450 and/or send signals to one or more sensors 450.
  • the terminal device includes at least one processor 480.
  • the processor 480 may include the master processor and the slave processor in the embodiment of the present application.
  • the processor 480 is the control center of the terminal device 400 and connects the entire Each part of the terminal device executes various functions and processing data of the terminal device 400 by running or executing software programs and/or modules stored in the memory 420, and calling data stored in the memory 420, so as to perform various functions and processing data of the terminal device 400. Overall monitoring.
  • the processor 480 may include one or more processing units; preferably, the processor 480 may integrate an application processor and a modem processor, where the application processor mainly processes the operating system, user interface, application programs, etc. , The modem processor mainly deals with wireless communication. It can be understood that the foregoing modem processor may not be integrated into the processor 480.
  • the processor 480 may be used to execute each step in the method embodiment of the present application.
  • the terminal device 400 also includes a power source 490 (such as a battery) for supplying power to various components.
  • a power source 490 such as a battery
  • the power source may be logically connected to the processor 480 through a power management system, so that functions such as charging, discharging, and power consumption can be managed through the power management system.
  • the terminal device 400 may also include a camera, a Bluetooth module, etc., which will not be repeated here.
  • the units and circuits can be implemented by electronic hardware or a combination of computer software and electronic hardware. Whether these functions are performed by hardware or software depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of this application.
  • circuits, branches, and units may be implemented in other ways.
  • the branches described above are illustrative.
  • the division of the unit is only a logical function division, and there may be other divisions in actual implementation.
  • multiple units or components can be combined or integrated into A branch or some features can be ignored or not implemented.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the technical solution of this application essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program code .

Abstract

本申请实施例提供了一种生物特征识别系统、方法和终端设备，所述生物特征识别系统包括：第一生物特征应用模块、第二生物特征应用模块和安全数据共享通道，所述第一生物特征应用模块运行在主处理器的可信执行环境TEE中，所述第二生物特征应用模块运行在从处理器的安全环境中；所述安全数据共享通道用于在所述第一生物特征应用模块和所述第二生物特征应用模块之间传输数据。本申请实施例的生物特征识别系统、方法和终端设备，能够提高双核处理器的生物识别应用的安全性。

Description

生物特征识别系统、方法和终端设备 技术领域
本申请涉及生物识别技术领域，尤其涉及一种生物特征识别系统、方法和终端设备。
背景技术
随着信息技术的不断发展，信息安全问题也日显突出，如何确保信息系统的安全已成为全社会关注的问题，数据安全和敏感信息问题越来越被个人、企业乃至国家所重视。生物识别技术，由于其安全性和便捷性，被广泛应用在解锁、支付、银行账号等领域，生物特征数据的安全性是个人及企业格外重视的问题，也是考核生物识别相关产品是否达标的一个重要指标。
以指纹应用为例，为了实现识别率和解锁速度的双重突破，相关技术中提出了使用主处理器+从处理器的双核协同的方案，主处理器上的指纹应用可借助可信执行环境(Trusted Execution Enviroment，TEE)来实现了指纹数据的安全性，但从处理器上的指纹应用则仍处于非安全环境(Rich Execution Environment，REE)中，指纹数据的传输和处理存在安全隐患。
发明内容
有鉴于此，本申请实施例提供了一种生物特征识别系统、方法和终端设备，能够提高双核处理器的生物识别应用的安全性。
第一方面，提供了一种生物特征识别系统，所述生物特征识别系统包括第一生物特征应用模块、第二生物特征应用模块和安全数据共享通道，所述第一生物特征应用模块运行在主处理器的可信执行环境TEE中，所述第二生物特征应用模块运行在从处理器的安全环境中；所述安全数据共享通道用于在所述第一生物特征应用模块和所述第二生物特征应用模块之间传输数据。
通过将从处理器上的生物特征应用运行在独立的安全环境中，并通过安全数据共享通道在主处理器上的第一生物特征应用模块和从处理器上的第二生物特征应用模块之间传输数据，从而使得数据始终运行在安全环境 中，用户的信息安全得到了保障。
在一种可能的实现方式中，所述安全数据共享通道是由所述生物特征识别系统的驱动分配的共享内存。
在一种可能的实现方式中，所述第一生物特征应用模块和所述第二生物特征应用模块用于对所述安全数据共享通道进行认证注册。
通过对所述安全数据共享通道进行认证注册，使得所述安全数据共享通道只能由所述第一生物特征应用模块和所述第二生物特征应用模块进行读写，其他应用无法访问，从而保证了安全数据共享通道的安全性。
在一种可能的实现方式中，所述第二生物特征应用模块用于以静态编译的方式在所述安全环境中运行。
具体地，从处理器的安全环境可以以静态编译的方式注册到从处理器的操作系统中，从而可以提高运行库的安全性。
在一种可能的实现方式中，所述第一生物特征应用模块和所述第二生物特征应用模块用于并行进行不同的生物特征识别操作。
通过所述第一生物特征应用模块和所述第二生物特征应用模块的并行操作，可以提高生物特征识别的速度。
在一种可能的实现方式中，所述系统还包括生物特征控制模块和生物特征代理模块，所述生物特征控制模块运行在所述主处理器的富执行环境REE中，所述生物特征代理模块运行在所述从处理器中的非安全环境中，所述安全环境为独立于所述非安全环境的运行环境，所述生物特征控制模块用于通过所述生物特征代理模块控制所述第二生物特征应用模块。
在一种可能的实现方式中，所述生物特征代理模块与所述第二生物特征应用模块通过进程间通信IPC进行通信。
采用IPC控制所述第二生物特征应用模块，通信容量有限，并且不涉及生物特征数据，从而使得其他应用无法获取到生物特征相关数据。
在一种可能的实现方式中，所述主处理器为中央处理器CPU，所述从处理器为数字信号处理器DSP。
基于DSP的指纹应用可以弥补CPU数据处理(特别是图像处理)慢的缺陷，同时配合CPU可以实现双核并行处理方案，丰富了识别策略。基于DSP的指纹应用方案从软硬件协同优化和SoC平台深度优化等方向来提升解锁速度与识别性能。
第二方面，提供了一种生物特征识别方法，所述方法应用于生物特征识别系统中，所述生物特征识别系统包括第一生物特征应用模块、第二生物特征应用模块和安全数据共享通道，所述第一生物特征应用模块运行在主处理器的可信执行环境TEE中，所述第二生物特征应用模块运行在从处理器的安全环境中，所述方法包括：所述第一生物特征应用模块进行第一生物特征识别操作，获取第一生物特征数据；所述第一生物特征应用模块将所述第一生物特征数据传输至所述安全数据共享通道。
在一种可能的实现方式中，所述方法还包括：所述第二生物特征应用模块进行第二生物特征识别操作，获取第二生物特征数据；所述第二生物特征应用模块将所述第二生物特征数据传输至所述安全数据共享通道。
在一种可能的实现方式中，所述方法还包括：所述第二生物特征应用模块接收所述安全数据共享通道传输的所述第一生物特征数据；所述第二生物特征应用模块进行第二生物特征识别操作，包括：所述第二生物特征应用模块根据所述第一生物特征数据，进行所述第二生物特征识别操作。
在一种可能的实现方式中，所述第一生物特征应用模块进行所述第一生物特征识别操作和所述第二生物特征应用模块进行所述第二生物特征识别操作，包括：在同一时间段内，所述第一生物特征应用模块进行所述第一生物特征识别操作和所述第二生物特征应用模块进行所述第二生物特征识别操作。
在一种可能的实现方式中，所述第二生物特征应用模块进行第二生物特征识别操作，包括：所述第二生物特征应用模块以静态编译的方式在所述安全环境中进行所述第二生物特征识别操作。
在一种可能的实现方式中，所述安全数据共享通道是由所述生物特征识别系统的驱动分配的共享内存。
在一种可能的实现方式中，所述方法还包括：所述第一生物特征应用模块对所述安全数据共享通道进行认证注册；所述第二生物特征应用模块对所述安全数据共享通道进行认证注册。
在一种可能的实现方式中，所述系统还包括生物特征控制模块和生物特征代理模块，所述生物特征控制模块运行在所述主处理器的富执行环境REE中，所述生物特征代理模块运行在所述从处理器的非安全环境中，所述安全环境为独立于所述非安全环境的运行环境，所述方法还包括：所述 生物特征控制模块通过所述生物特征代理模块控制所述第二生物特征应用模块。
在一种可能的实现方式中，所述生物特征代理模块与所述第二生物特征应用模块通过进程间通信IPC进行通信。
在一种可能的实现方式中，所述主处理器为中央处理器CPU，所述从处理器为数字信号处理器DSP。
第三方面，提供一种终端设备，包括存储器、处理器、触摸屏和指纹模组，该存储器用于存储计算机程序，处理器用于从存储器中调用并运行计算机程序，当程序被运行时，该处理器执行上述第一方面或第一方面任意可能的实现方式中的方法。
第四方面，提供一种计算机可读介质，用于存储计算机程序，该计算机程序包括用于执行第二方面或第二方面的任意可能的实现方式中的方法的指令。
第五方面，提供了一种包括指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第二方面或第二方面的任一可选的实现方式中的方法。
本申请的这些方面或其他方面在以下实施例的描述中会更加简明易懂。
附图说明
图1示出了本申请实施例的应用场景的示意性框图。
图2示出了一种基于双核处理器的指纹识别系统的示意性框图。
图3示出了本申请实施例的生物特征识别系统的示意性框图。
图4示出了安全数据共享通道的设计实现示意图。
图5示出了本申请实施例的生物特征识别系统的另一示意性框图。
图6示出了本申请实施例的从处理器操作系统内部的交互示意图。
图7示出了本申请实施例的生物特征识别方法的示意性框图。
图8示出了本申请实施例的终端设备的示意性框图。
具体实施方式
为了使本领域的人员更好地理解本申请实施例中的技术方案，下面将 结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述。显然，所描述的实施例仅是本申请实施例的一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员所获得的所有其他实施例，都应当属于本申请实施例保护的范围。
随着生物识别技术的快速发展，在很多领域中，都存在着生物识别技术的身影，如考勤领域、支付领域和解锁领域等。其中，生物特征包括但不限于：指纹、虹膜、视网膜、基因、声音、人脸、手掌几何、静脉、步态和笔迹中的任意一项或者多项。通过在终端设备配置用于采集生物特征数据的装置，使得终端设备具有生物识别功能。本申请实施例涉及的生物特征识别系统可应用于智能手机、平板电脑、笔记本电脑、台式以及其他具有生物识别装置的移动终端或者其他终端设备。
以指纹识别应用为例，在上述终端设备中，指纹识别装置可以具体为光学指纹装置，其可以设置在显示屏下方的局部区域或者全部区域从而形成屏下(Under-display)光学指纹系统。
如图1所示为本申请实施例可以适用的终端设备的结构示意图，所述终端设备100包括显示屏120和指纹识别装置130，其中，所述指纹识别装置130设置在所述显示屏120下方的局部区域。所述指纹识别装置130可以包括具有多个光学感应单元的感应阵列，其中，所述感应阵列也可以是一个指纹传感器。所述感应阵列所在区域或者其光学感应区域为所述指纹识别装置130的指纹检测区域103。如图1所示，所述指纹检测区域103位于所述显示屏120的显示区域102之中，因此，使用者在需要对所述终端设备100进行解锁或者其他指纹验证的时候，只需要将手指按压在位于所述显示屏120的指纹检测区域103，便可以实现指纹输入。由于指纹检测可以在屏内实现，因此采用上述结构的终端设备100无需其正面专门预留空间来设置指纹按键(比如Home键)。
作为一种优选的实施例中，所述显示屏120可以采用具有自发光显示单元的显示屏，比如有机发光二极管(Organic Light-Emitting Diode，OLED)显示屏或者微型发光二极管(Micro-LED)显示屏。另外，所述显示屏120可以具体为触控显示屏，其不仅可以进行画面显示，还可以检测用户的触摸或者按压操作，从而为用户提供一个人机交互界面。比如，在一种实施例中，所述终端设备100可以包括触摸控制器，所述触摸控制器 可以具体为触控面板，其可以设置在所述显示屏120表面，也可以部分集成或者整体集成到所述显示屏120内部，从而形成所述触控显示屏。以采用OLED显示屏为例，所述指纹识别装置130可以利用所述OLED显示屏120位于所述指纹检测区域103的显示单元(即OLED光源)来作为光学指纹检测的激励光源。
在其他实施例中，所述指纹识别装置130也可以采用内置光源或者外置光源来提供用于进行指纹检测的光信号。在这种情况下，所述指纹识别装置130可以适用于非自发光显示屏，比如液晶显示屏或者其他的被动发光显示屏。以应用在具有背光模组和液晶面板的液晶显示屏为例，为支持液晶显示屏的屏下指纹检测，所述指纹识别装置130还可以包括用于光学指纹检测的激励光源，所述激励光源可以具体为红外光源或者特定波长非可见光的光源，其可以设置在所述液晶显示屏的背光模组下方或者设置在所述终端设备100的保护盖板下方的边缘区域，而所述指纹识别装置130设置在所述背光模组下方，且所述背光模组通过对扩散片、增亮片、反射片等膜层进行开孔或者其他光学设计以允许指纹检测光穿过液晶面板和背光模组并到达所述指纹识别装置130的感应阵列。
并且，所述指纹识别装置130的感应阵列具体可以为光探测器(Photo detector)阵列，其包括多个呈阵列式分布的光探测器，所述光探测器可以作为如上所述的光学感应单元。当手指按压在所述指纹检测区域103时，所述指纹检测区域103的显示单元发出的光线在手指表面的指纹发生反射并形成反射光，其中所述手指指纹的脊和谷的反射光是不同的，反射光从所述显示屏120透过并被所述光探测器阵列所接收并转换为相应的电信号，即指纹检测信号；基于所述指纹检测信号便可以获得指纹图像数据，并且可以进一步进行指纹匹配验证，从而在所述终端设备100实现光学指纹识别功能。
应当理解的是，在具体实现上，所述终端设备100还可以包括透明保护盖板110，所述盖板110可以为玻璃盖板或者蓝宝石盖板，其位于所述显示屏120的上方并覆盖所述终端设备100的正面。因为，本申请实施例中，所谓的手指按压在所述显示屏120实际上是指按压在所述显示屏120上方的盖板110或者覆盖所述盖板110的保护层表面。
作为一种可选的实现方式，如图1所示，所述指纹识别装置130可以 包括光检测部分134和光学组件132，所述光检测部分134包括所述感应阵列以及与所述感应阵列电连接的读取电路及其他辅助电路，其可以在通过半导体工艺制作在一个芯片(Die)；即所述光检测部分134可以制作在光学成像芯片或者图像传感芯片。
所述光学组件132可以设置在所述光检测部分134的感应阵列的上方，所述光学组件132可以包括滤光层(Filter)、导光层以及其他光学元件；所述滤光层可以用于滤除穿透手指的环境光，而所述导光层主要用于从手指表面反射回来的反射光导引(比如光学准直或者汇聚)至所述感应阵列进行光学检测。
所述显示屏120发出的光线在所述显示屏120上方的待检测手指表面发生反射，从手指反射回来的反射光经所述微孔阵列或者所述透镜单元进行光学准直或者汇聚之后，进一步经过滤光层的滤波后被所述光学检测部分134接收，所述光学检测部分134可以进一步对接收到的该反射光进行检测，从而获取到所述手指的指纹图像以实现指纹识别。
应当理解，上述指纹识别装置130仅是一种示例性的结构，在具体实现上，该光学组件132的滤光层的位置并不局限在所述导光层的下方；比如，在一种替代实施例中，该滤光层也可以设置在所述导光层和所述显示屏120之间，即位于所述导光层上方；或者，所述光学组件132可以包括两层滤光层，二者分别设置在所述导光层的上方和下方。在其他替代实施例中，该滤光层也可以集成到所述导光层内部，甚至也可以省略掉，本申请对此不做限制。
在具体实现上，所述光学组件132可以与所述光检测部分134封装在同一个光学指纹芯片。也可以是作为与光学检测部分134相对独立的部件安装在指纹识别装置内部，即是将所述光学组件732设置在所述光检测部分734所在的芯片外部，比如将所述光学组件732贴合在所述芯片上方，或者将所述光学组件732的部分元件集成在上述芯片之中。其中，所述光学组件732的导光层有多种实现方案。
在一种实施例中，所述光学组件732的导光层具体为在半导体硅片或者其他基材(比如硅氧化物或氮化物)制作而成的光路调制器或者光路准直器，其具有多个光路调制单元或者准直单元，具体地，所述光路调制单元或者准直单元可以具体为具有高深宽比的通孔，因此所述多个准直单元 或者透镜单元可以构成通孔阵列。在从手指反射回来的反射光中，入射到所述光路调制单元或者准直单元的光线可以穿过并被其下方的光学感应单元接收，每一个光学感应单元基本上能够接收到其上方的通孔导引过来的指纹纹路的反射光，从而所述感应阵列便可以检测出手指的指纹图像。
在其他替代实施例中，所述导光层也可以包括光学透镜(Lens)层，其具有一个或多个光学透镜单元，比如一个或多个非球面透镜组成的透镜组。从手指反射回来的反射光经所述光学透镜单元进行光路准直或者汇聚之后，并被其下方的光学感应单元接收，据此，所述感应阵列可以检测出手指的指纹图像。
另一方面，所述光检测部分134的感应阵列可以具体只包括单一的感应阵列，也可以采用具有两个或以上并排设置的感应阵列的双感应阵列(Dual Array)或多感应阵列(Multiple Array)的架构。当所述光检测部分134采用双感应阵列或者多感应阵列架构时，所述光学组件732可以采用单独一个导光层同时覆盖所述两个或以上的感应阵列；可替代地，所述光学组件732也可以包括两个或以上并排设置的导光层，比如两个或以上的光路调制器或光路准直器，或者两个或以上的光学透镜层，所述两个或以上并排设置的导光层分别对应设置在所述两个或以上的感应阵列的上方，用于将相关反射光导引或者汇聚到其下方的感应阵列。
在其他替代实现方式中，所述显示屏120也可以采用非自发光的显示屏，比如采用背光的液晶显示屏；在这种情况下，所述指纹识别装置130便无法采用所述显示屏120的显示单元作为激励光源，因此需要在所述指纹识别装置130内部集成激励光源或者在其外部设置激励光源来实现光学指纹检测，其检测原理与上面描述内容是一致的。
当前指纹应用主要是在一个处理器(例如中央处理器(Central Processing Unit，CPU))上开发，而光学指纹由于数据量大，受干扰多，使得算法复杂性加大，特别是在低温、干手指和强光直射等刁钻场景下，指纹识别的图像处理以及对比识别的数据运算更加复杂，对于软硬件的要求更高，使用一个处理器已经难以满足性能要求。在本申请实施例中，采用主处理器+从处理器的双核协同处理，可以实现识别率和解锁速度的双重突破。如图2所示，将指纹识别算法分为两部分，一部分算法(即第一指纹应用模块)在CPU上运行，另一部分算法(第二指纹应用模块)在数字 信号处理器(Digital Signal Processor，DSP)上运行，由于DSP具有强大的图像数据处理和运算能力，因此，可以大幅提高解锁速度和识别性能。
随着信息技术的不断发展，信息安全问题也日显突出，如何确保信息系统的安全已成为全社会关注的问题，数据安全和敏感信息问题越来越被个人、企业乃至国家所重视。在图2所示的由主处理器+从处理器共同实现指纹识别的技术方案中，CPU上已经借助可信执行环境(Trusted Execution Enviroment，TEE)实现了指纹数据的安全性，即第一指纹应用模块运行在CPU的TEE中。而基于DSP的指纹应用则是运行在富执行环境(Rich Execution Environment，REE)的，也就是说，第二指纹应用模块运行在非安全环境中，并且运行在CPU上TEE中第一指纹应用模块获得的指纹数据和运行在DSP上REE中的第二指纹应用模块获得的指纹数据可能需要在运行在CPU上REE中的指纹控制模块的控制下实现通信，因此，指纹数据的传输和处理存在安全隐患。这种应用显然是无法满足用户及企业需求的，尤其是在支付领域。
因此，本申请实施例提供了一种生物特征识别系统，能够在双核处理器的生物识别应用的基础上保证生物特征数据的安全性。
图3示出了本申请实施例提供的生物特征识别系统200的示意性框图。如图3所示，所述生物特征识别系统200包括第一生物特征应用模块210、第二生物特征应用模块220和安全数据共享通道230，所述第一生物特征应用模块210运行在主处理器的可信执行环境TEE中，所述第二生物特征应用模块220运行在从处理器的安全环境中；所述安全数据共享通道230用于在所述第一生物特征应用模块和所述第二生物特征应用模块之间传输数据。
目前，终端设备的主处理器，如CPU的操作系统(Operating System，OS)可以包括两大运行环境，一种是REE，运行在其内部的应用为客户应用(Client Application，CA)；另一种是TEE，运行在其内部的应用为可信应用(Trusted Application，TA)。TEE是指在主处理器的OS内的一个独立的安全运行环境，该环境与REE相互隔离，独立运行。与REE中的CA所不同的是，TEE为TA提供一系列的安全服务，包括应用执行的完整性、安全存储、与输入输出设备的安全交互、密钥管理、加密算法以及与REE中的CA进行安全通信等。同样地，也可以将从处理器的OS划分为 两种运行环境，一种是非安全环境，另一种是安全环境，其中，安全环境是指在从处理器的OS中单独划分的一个域(domain)，也就是说，安全环境与非安全环境是相互独立的。非安全环境中运行的应用不能随意访问安全环境中的应用。从处理器的安全环境符合各种场景下的安全规范，与主处理器的TEE类似。
为了便于理解，本文以指纹识别应用为例进行描述。但应理解，这仅用于示例性说明，并不用于对本申请实施例进行限定。
通常，指纹识别应用至少包括对指纹图像的采集、指纹图像的处理、特征提取和指纹匹配等一系列操作，由上述描述可知，为了提高解锁速度和识别性能，可以将指纹识别应用中的各操作分别运行在主处理器和从处理器上，即由本申请实施例中的第一生物特征应用模块和第二生物特征应用模块共同完成指纹识别应用，例如，第一生物特征应用模块对采集的指纹图像完成特征提取和指纹匹配等操作，而第二生物特征应用模块则对采集的指纹图像完成指纹图像的处理等操作。为了提高指纹数据的安全性，可以分别将第一生物特征应用模块和第二生物特征应用模块运行在安全环境中。具体地，可以将第一生物特征应用模块运行在主处理器的TEE中，将第二生物特征应用模块运行在从处理器的安全环境中。对应地，第一生物特征应用模块为TA。
当第一生物特征应用模块和第二生物特征应用模块分别应用在安全环境中时，还可以通过安全数据共享通道进行指纹数据的存储和传输。例如，所述第一生物特征应用模块进行第一生物特征识别操作，获取第一生物特征数据；所述第一生物特征应用模块将所述第一生物特征数据传输至所述安全数据共享通道。再例如，所述第二生物特征应用模块进行第二生物特征识别操作，获取第二生物特征数据；所述第二生物特征应用模块将所述第二生物特征数据传输至所述安全数据共享通道。可选地，所述第一生物特征识别操作的执行先于所述第二生物特征识别操作的执行，例如，所述第二生物特征应用模块在进行第二生物特征识别操作之前，从所述安全数据共享通道获取所述第一生物特征数据，并基于所述第一生物特征数据进行所述第二生物特征识别操作，以获得第二生物特征数据。可选地，所述第一生物特征识别操作的执行晚于所述第二生物特征识别操作的执行，例如，所述第一生物特征应用模块在进行所述第一生物特征识别操作 之前，从所述安全数据共享通道获取所述第二生物特征数据，并基于所述第二生物特征数据进行所述第二生物特征识别操作。可选地，所述第一生物特征应用模块从生物特征采集装置获取到原始生物特征数据，并通过安全数据共享通道转发给第二生物特征应用模块，以供第二生物特征应用模块使用。
可选地，在本申请实施例中，所述第一生物特征应用模块和所述第二生物特征应用模块可以并行进行生物特征识别操作。即在同一时间段内，所述第一生物特征应用模块进行所述第一生物特征识别操作和所述第二生物特征应用模块进行所述第二生物特征识别操作。
可选地，安全数据共享通道可以通过在驱动(driver)中划分一块特定的共享内存供所述第一生物特征应用模块和所述第二生物特征应用模块使用。由于在图2中，所述第一生物特征应用模块和所述第二生物特征应用模块之间需要经过非安全环境才能进行数据的传输，从而使得数据的安全性得不到保障。而本申请实施例中的安全数据共享通道可以只由所述第一生物特征应用模块和所述第二生物特征应用模块进行读写，其他应用无法访问，这样使得指纹数据始终处于安全环境中，不会被其他应用窃取和攻击，从而提高了指纹应用的私密性与安全性。
图4示出了本申请实施例中的安全数据共享通道的设计实现图。如图4所示，首先硬件抽象层(Hardware Abstract Layout，HAL)可以申请由driver分配共享内存，在driver分配好共享内存之后，由共享内存向第一生物特征应用模块和第二生物特征应用模块进行注册，而第一生物特征应用模块和第二生物特征应用模块分别对该共享内存发起的注册进行认证，防止非法注册。注册成功后，第一生物特征应用模块和第二生物特征应用模块可以获取共享内存的使用地址，从而可以通过安全数据共享通道在第一生物特征应用模块和第二生物特征应用模块之间进行数据的传输。通过增加权限检查和控制，可以保证安全数据共享通道的安全性。
可选地，在本申请实施例中，所述第二生物特征应用模块可以以静态编译的方式运行。具体地，从处理器的安全环境作为第二生物特征应用模块执行的载体，可以以静态编译的方式注册到从处理器的OS中，可以进一步保证安全数据共享通道上指纹数据调用与运行的安全性。
上文提及，所述第一生物特征应用模块和所述第二生物特征应用模块 用于进行不同的生物特征识别操作。可选地，第一生物特征应用模块和第二生物特征应用模块并行对指纹传感器采集的同一指纹图像进行不同的操作，例如，第一生物特征应用模块对该指纹图像进行特征提取，同时第二生物特征应用模块对该指纹图像进行图像处理。从而可以较大地提高识别速度。再例如，第一生物特征应用模块进行运算量较小的操作，而第二生物特征应用模块进行运算量较大的操作，由于主处理器除了要进行指纹算法，还需要运行其他算法，因此，将运算量较大的指纹识别操作分担在从处理器上，也可以提高指纹识别速度。
如图5所示，本申请实施例的生物特征识别系统200还包括生物特征控制模块240和生物特征代理模块250，所述生物特征控制模块240运行在所述主处理器的富执行环境REE中，所述生物特征代理模块250运行在所述从处理器中的非安全环境中，所述安全环境为独立于所述非安全环境的运行环境，所述生物特征控制模块240用于通过所述生物特征代理模块250控制所述第二生物特征应用模块220。
由于生物特征控制模块运行在主处理器的REE中，其不能直接控制从处理器的安全环境中的第二生物特征应用模块，可以将运行在从处理器的非安全环境中的某个应用作为生物特征代理模块，进而生物特征控制模块就可以通过该生物特征代理模块控制所述第二生物特征应用模块的运行。可选地，生物特征代理模块可以通过进程间通信(Inter-Process Communication，IPC)与第二生物特征应用模块进行通信。如图6所示，所述生物特征代理模块和所述第二生物特征应用模块分别位于从处理器操作系统中相互独立的用户空间。由于进程的用户空间通常是不能互相访问的，因此可以通过操作系统中的内核空间，即内核空间中的IPC接口，使得所述生物特征代理模块和所述第二生物特征应用模块能够进行通信。内核空间通常具有较高的权限级别，因此属于安全环境。其中，IPC接口也位于IPC通信可以包括管道、系统IPC(包括消息队列、信号和共享存储)以及套接字(SOCKET)等。
可选地，从处理器上的其他应用可以均运行在非安全环境中，也即只有第二生物特征应用模块运行在安全环境中，其他应用无法与第二生物特征应用模块进行通信，并且由于IPC通信容量有限，生物特征代理模块与第二生物特征应用模块只能进行控制流的通信，不涉及数据流的通信，从 而使得第一生物特征应用模块和第二生物特征应用模块的数据不会被其他非安全环境中的应用获取到，保证了数据的安全性。
应理解，处理器应包括但不限于以下各种：CPU、DSP、高级精简指令集机器(Advance Reduced Instruction Set Computer(RISC)machines，ARM)、可编程门阵列(Programmable Gate Array，FPGA)或专用集成电路(Application Specific Integrated Circuit，ASIC)等，本申请实施例中主处理器+从处理器的方案可适用于各种处理器的组合。特别地，本申请实施例中的主处理器可以是CPU，从处理器可以是DSP，由于DSP广泛应用于音视频处理、机器学习、计算机视觉与深度学习等领域，充分的展现其强大的图像数据处理和运算能力。基于DSP的指纹应用可以弥补CPU数据处理(特别是图像处理)慢的缺陷，同时配合CPU可以实现双核并行处理方案，丰富了识别策略。基于DSP的指纹应用方案从软硬件协同优化和系统芯片(System on Chip，SoC)平台深度优化等方向来提升解锁速度与识别性能。
图7示出了本申请实施例提供的生物特征识别方法300的示意性框图，所述方法应用于生物特征识别系统中，所述生物特征识别系统包括第一生物特征应用模块、第二生物特征应用模块和安全数据共享通道，所述第一生物特征应用模块运行在主处理器的可信执行环境TEE中，所述第二生物特征应用模块运行在从处理器的安全环境中，所述方法300包括：
S310，所述第一生物特征应用模块进行第一生物特征识别操作，获取第一生物特征数据；
S320，所述第一生物特征应用模块将所述第一生物特征数据传输至所述安全数据共享通道。
可选地，如图7所示，所述方法还包括：
S330，所述第二生物特征应用模块进行第二生物特征识别操作，获取第二生物特征数据；
S340，所述第二生物特征应用模块将所述第二生物特征数据传输至所述安全数据共享通道。
可选地，所述第一生物特征应用模块进行的所述第一生物特征识别操作与所述第二生物特征应用模块进行的所述第二生物特征识别操作可以是针对同一个待识别的生物特征，也可以是针对不同待识别的生物特征。
可选地，在本申请实施例中，所述方法还包括：所述第二生物特征应用模块接收所述安全数据共享通道传输的所述第一生物特征数据；所述第二生物特征应用模块进行第二生物特征识别操作，包括：所述第二生物特征应用模块根据所述第一生物特征数据，进行所述第二生物特征识别操作。
可选地，在本申请实施例中，所述第一生物特征应用模块进行所述第一生物特征识别操作和所述第二生物特征应用模块进行所述第二生物特征识别操作，包括：在同一时间段内，所述第一生物特征应用模块进行所述第一生物特征识别操作和所述第二生物特征应用模块进行所述第二生物特征识别操作。
可选地，所述第一生物特征识别操作的执行可以早于所述第二生物特征识别操作的执行，或者，所述第一生物特征识别操作的执行可以晚于所述第二生物特征识别操作的执行。例如，所述方法还包括：所述第一生物特征应用模块接收所述安全数据共享通道传输的所述第二生物特征数据；所述第一生物特征应用模块进行第一生物特征识别操作，包括：所述第一生物特征应用模块根据所述第二生物特征数据，进行所述第一生物特征识别操作。
可选地，在本申请实施例中，所述第二生物特征应用模块进行第二生物特征识别操作，包括：所述第二生物特征应用模块以静态编译的方式在所述安全环境中进行所述第二生物特征识别操作。
可选地，在本申请实施例中，所述安全数据共享通道是由所述生物特征识别系统的驱动分配的共享内存。
可选地，在本申请实施例中，所述方法还包括：所述第一生物特征应用模块对所述安全数据共享通道进行认证注册；所述第二生物特征应用模块对所述安全数据共享通道进行认证注册。
可选地，在本申请实施例中，所述系统还包括生物特征控制模块和生物特征代理模块，所述生物特征控制模块运行在所述主处理器的富执行环境REE中，所述生物特征代理模块运行在所述从处理器的非安全环境中，所述安全环境为独立于所述非安全环境的运行环境，所述方法还包括：所述生物特征控制模块通过所述生物特征代理模块控制所述第二生物特征应用模块。
可选地，在本申请实施例中，所述生物特征代理模块与所述第二生物特征应用模块通过进程间通信IPC进行通信。
可选地，在本申请实施例中，所述主处理器为中央处理器CPU，所述从处理器为数字信号处理器DSP。
根据本申请实施例的生物特征识别方法可对应于本申请实施例的生物特征识别系统中的各个单元/模块，并且，该方法中的相应流程都可以通过图3至图6中所示装置中的各个单元/模块来实现，为了简洁，在此不再赘述。
本申请实施例还提供了一种终端设备，该终端设备包括上述各种实施例的生物特征识别系统。可选地，该终端设备还包括用于采集待识别生物特征的生物特征采集装置，所述待识别生物特征用于所述第一生物特征应用模块和所述第二生物特征应用模块进行处理。
图8是根据本申请实施例提供的终端设备400的示意性框图。图8所示的终端设备400包括：射频(Radio Frequency，RF)电路410、存储器420、其他输入设备430、显示屏440、传感器450、音频电路460、I/O子系统470、处理器480、以及电源490等部件。本领域技术人员可以理解，图8中示出的终端设备结构并不构成对终端设备的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者拆分某些部件，或者不同的部件布置。本领领域技术人员可以理解显示屏440属于用户界面(User Interface，UI)，且终端设备400可以包括比图示或者更少的用户界面。
下面结合图8对终端设备400的各个构成部件进行具体的介绍：
RF电路410可用于收发信息或通话过程中，信号的接收和发送，特别地，将基站的下行信息接收后，给处理器480处理；另外，将设计上行的数据发送给基站。通常，RF电路包括但不限于天线、至少一个放大器、收发信机、耦合器、低噪声放大器(Low Noise Amplifier，LNA)、双工器等。此外，RF电路410还可以通过无线通信与网络和其他设备通信。
存储器420可用于存储软件程序以及模块，处理器480通过运行存储在存储器420的软件程序以及模块，从而执行终端设备400的各种功能应用以及数据处理。存储器420可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序(比如声音播放功能、图像播放功能等)等；存储数据区可存储根据终端设备400 的使用所创建的数据(比如音频数据、电话本等)等。此外，存储器420可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他易失性固态存储器件。
其他输入设备430可用于接收输入的数字或字符信息，以及产生与终端设备400的用户设置以及功能控制有关的信号输入。具体地，其他输入设备430可包括但不限于物理键盘、功能键(比如音量控制按键、开关按键等)、轨迹球、鼠标、操作杆、光鼠(光鼠是不显示可视输出的触摸敏感表面，或者是由触摸屏形成的触摸敏感表面的延伸)等中的一种或多种。其他输入设备430与I/O子系统470的其他输入设备控制器471相连接，在其他设备输入控制器471的控制下与处理器480进行信号交互。
显示屏440可用于显示由用户输入的信息或提供给用户的信息以及终端设备400的各种菜单，还可以接受用户输入。具体的显示屏440可以是触控屏，可包括显示面板441，以及触控面板442。触控面板442可覆盖显示面板441，用户可以根据显示面板441显示的内容(该显示内容包括但不限于，软键盘、虚拟鼠标、虚拟按键、图标等等)，在显示面板441上覆盖的触控面板442上或者附近进行操作，触控面板442检测到在其上或附近的操作后，通过I/O子系统470传送给处理器480以确定用户输入，随后处理器480根据用户输入通过I/O子系统470在显示面板441上提供相应的视觉输出。虽然在图8中，触控面板442与显示面板441是作为两个独立的部件来实现终端设备400的输入和输入功能，但是在某些实施例中，可以将触控面板442与显示面板441集成而实现终端设备400的输入和输出功能。
终端设备400还可包括至少一种传感器450，例如，该传感器450可以是生物特征传感器，也就是本申请实施例中生物特征采集装置。
音频电路460、扬声器461，麦克风462可提供用户与终端设备400之间的音频接口。音频电路460可将接收到的音频数据转换后的信号，传输到扬声器461，由扬声器461转换为声音信号输出；另一方面，麦克风462将收集的声音信号转换为信号，由音频电路460接收后转换为音频数据，再将音频数据输出至RF电路410以发送给比如另一手机，或者将音频数据输出至存储器420以便进一步处理。
I/O子系统470用来控制输入输出的外部设备，可以包括其他设备输入 控制器471、传感器控制器472、显示控制器473。可选的，一个或多个其他输入控制设备控制器471从其他输入设备430接收信号和/或者向其他输入设备430发送信号，其他输入设备430可以包括物理按钮(按压按钮、摇臂按钮等)、拨号盘、滑动开关、操纵杆、点击滚轮、光鼠(光鼠是不显示可视输出的触摸敏感表面，或者是由显示屏形成的触摸敏感表面的延伸)。值得说明的是，其他输入控制设备控制器471可以与任一个或者多个上述设备连接。所述I/O子系统470中的显示控制器473从显示屏440接收信号和/或者向显示屏440发送信号。显示屏440检测到用户输入后，显示控制器473将检测到的用户输入转换为与显示在显示屏440上的用户界面对象的交互，即实现人机交互。传感器控制器472可以从一个或者多个传感器450接收信号和/或者向一个或者多个传感器450发送信号。
终端设备包括至少一个处理器480，例如，该处理器480可以包括本申请实施例中的主处理器和从处理器，处理器480是终端设备400的控制中心，利用各种接口和线路连接整个终端设备的各个部分，通过运行或执行存储在存储器420内的软件程序和/或模块，以及调用存储在存储器420内的数据，执行终端设备400的各种功能和处理数据，从而对终端设备进行整体监控。可选的，处理器480可包括一个或多个处理单元；优选的，处理器480可集成应用处理器和调制解调处理器，其中，应用处理器主要处理操作系统、用户界面和应用程序等，调制解调处理器主要处理无线通信。可以理解的是，上述调制解调处理器也可以不集成到处理器480中。该处理器480可以用来执行本申请方法实施例中的各个步骤。
终端设备400还包括给各个部件供电的电源490(比如电池)，优选的，电源可以通过电源管理系统与处理器480逻辑相连，从而通过电源管理系统实现管理充电、放电、以及功耗等功能。
尽管未示出，终端设备400还可以包括摄像头、蓝牙模块等，在此不再赘述。
应理解，说明书通篇中提到的“一个实施例”或“一实施例”意味着与实施例有关的特定特征、结构或特性包括在本申请的至少一个实施例中。因此，在整个说明书各处出现的“在一个实施例中”或“在一实施例中”未必一定指相同的实施例。此外，这些特定的特征、结构或特性可以任意适合的方式结合在一个或多个实施例中。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及电路，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
在本申请所提供的几个实施例中，应该理解到，所揭露的电路、支路和单元，可以通过其它的方式实现。例如，以上所描述的支路是示意性的，例如，该单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到一个支路，或一些特征可以忽略，或不执行。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以该权利要求的保护范围为准。

Claims (20)

  1. 一种生物特征识别系统，其特征在于，所述生物特征识别系统包括第一生物特征应用模块、第二生物特征应用模块和安全数据共享通道，所述第一生物特征应用模块运行在主处理器的可信执行环境TEE中，所述第二生物特征应用模块运行在从处理器的安全环境中；
    所述安全数据共享通道用于在所述第一生物特征应用模块和所述第二生物特征应用模块之间传输数据。
  2. 根据权利要求1所述的生物特征识别系统，其特征在于，所述安全数据共享通道是由所述生物特征识别系统的驱动分配的共享内存。
  3. 根据权利要求1或2所述的生物特征识别系统，其特征在于，所述第一生物特征应用模块和所述第二生物特征应用模块用于对所述安全数据共享通道进行认证注册。
  4. 根据权利要求1至3中任一项所述的生物特征识别系统，其特征在于，所述第二生物特征应用模块用于以静态编译的方式在所述安全环境中运行。
  5. 根据权利要求1至4中任一项所述的生物特征识别系统，其特征在于，所述第一生物特征应用模块和所述第二生物特征应用模块用于并行进行不同的生物特征识别操作。
  6. 根据权利要求1至5中任一项所述的生物特征识别系统，其特征在于，所述系统还包括生物特征控制模块和生物特征代理模块，所述生物特征控制模块运行在所述主处理器的富执行环境REE中，所述生物特征代理模块运行在所述从处理器中的非安全环境中，所述安全环境为独立于所述非安全环境的运行环境，所述生物特征控制模块用于通过所述生物特征代理模块控制所述第二生物特征应用模块。
  7. 根据权利要求6所述的生物特征识别系统，其特征在于，所述生物特征代理模块与所述第二生物特征应用模块通过进程间通信IPC进行通信。
  8. 根据权利要求1至7中任一项所述的生物特征识别系统，其特征在于，所述主处理器为中央处理器CPU，所述从处理器为数字信号处理器DSP。
  9. 一种终端设备，其特征在于，所述终端设备包括如权利要求1至8 中任一项所述的生物特征识别系统。
  10. 根据权利要求9所述的终端设备，其特征在于，所述终端设备还包括生物特征采集装置，所述生物特征采集装置用于采集待识别生物特征，所述待识别生物特征用于所述第一生物特征应用模块和所述第二生物特征应用模块进行处理。
  11. 一种生物特征识别方法，其特征在于，所述方法应用于生物特征识别系统中，所述生物特征识别系统包括第一生物特征应用模块、第二生物特征应用模块和安全数据共享通道，所述第一生物特征应用模块运行在主处理器的可信执行环境TEE中，所述第二生物特征应用模块运行在从处理器的安全环境中，所述方法包括：
    所述第一生物特征应用模块进行第一生物特征识别操作，获取第一生物特征数据；
    所述第一生物特征应用模块将所述第一生物特征数据传输至所述安全数据共享通道。
  12. 根据权利要求11所述的生物特征识别方法，其特征在于，所述方法还包括：
    所述第二生物特征应用模块进行第二生物特征识别操作，获取第二生物特征数据；
    所述第二生物特征应用模块将所述第二生物特征数据传输至所述安全数据共享通道。
  13. 根据权利要求12所述的生物特征识别方法，其特征在于，所述方法还包括：
    所述第二生物特征应用模块接收所述安全数据共享通道传输的所述第一生物特征数据；
    所述第二生物特征应用模块进行第二生物特征识别操作，包括：
    所述第二生物特征应用模块根据所述第一生物特征数据，进行所述第二生物特征识别操作。
  14. 根据权利要求12所述的生物特征识别方法，其特征在于，所述第一生物特征应用模块进行所述第一生物特征识别操作和所述第二生物特征应用模块进行所述第二生物特征识别操作，包括：
    在同一时间段内，所述第一生物特征应用模块进行所述第一生物特征 识别操作和所述第二生物特征应用模块进行所述第二生物特征识别操作。
  15. 根据权利要求12至14中任一项所述的生物特征识别方法，其特征在于，所述第二生物特征应用模块进行第二生物特征识别操作，包括：
    所述第二生物特征应用模块以静态编译的方式在所述安全环境中进行所述第二生物特征识别操作。
  16. 根据权利要求11至15中任一项所述的生物特征识别方法，其特征在于，所述安全数据共享通道是由所述生物特征识别系统的驱动分配的共享内存。
  17. 根据权利要求11至16中任一项所述的生物特征识别方法，其特征在于，所述方法还包括：
    所述第一生物特征应用模块对所述安全数据共享通道进行认证注册；
    所述第二生物特征应用模块对所述安全数据共享通道进行认证注册。
  18. 根据权利要求11至17中任一项所述的生物特征识别方法，其特征在于，所述系统还包括生物特征控制模块和生物特征代理模块，所述生物特征控制模块运行在所述主处理器的富执行环境REE中，所述生物特征代理模块运行在所述从处理器的非安全环境中，所述安全环境为独立于所述非安全环境的运行环境，所述方法还包括：
    所述生物特征控制模块通过所述生物特征代理模块控制所述第二生物特征应用模块。
  19. 根据权利要求18所述的生物特征识别方法，其特征在于，所述生物特征代理模块与所述第二生物特征应用模块通过进程间通信IPC进行通信。
  20. 根据权利要求11至19中任一项所述的生物特征识别方法，其特征在于，所述主处理器为中央处理器CPU，所述从处理器为数字信号处理器DSP。
PCT/CN2019/072658 2019-01-22 2019-01-22 生物特征识别系统、方法和终端设备 WO2020150892A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2019/072658 WO2020150892A1 (zh) 2019-01-22 2019-01-22 生物特征识别系统、方法和终端设备
CN201980000134.4A CN109863491B (zh) 2019-01-22 2019-01-22 生物特征识别系统、方法和终端设备

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2019/072658 WO2020150892A1 (zh) 2019-01-22 2019-01-22 生物特征识别系统、方法和终端设备

Publications (1)

Publication Number Publication Date
WO2020150892A1 true WO2020150892A1 (zh) 2020-07-30

Family

ID=66889424

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/072658 WO2020150892A1 (zh) 2019-01-22 2019-01-22 生物特征识别系统、方法和终端设备

Country Status (2)

Country Link
CN (1) CN109863491B (zh)
WO (1) WO2020150892A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105791284A (zh) * 2016-02-29 2016-07-20 华为技术有限公司 一种数据安全传输装置及方法
CN106547618A (zh) * 2016-10-19 2017-03-29 沈阳微可信科技有限公司 通信系统和电子设备
CN106815510A (zh) * 2017-01-18 2017-06-09 珠海市魅族科技有限公司 一种数据处理的方法及终端
CN106897595A (zh) * 2017-01-20 2017-06-27 北京奇虎科技有限公司 一种移动终端

Family Cites Families (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN201247471Y (zh) * 2008-07-25 2009-05-27 电子科技大学中山学院 一种自动指纹识别系统
US9384518B2 (en) * 2012-03-26 2016-07-05 Amerasia International Technology, Inc. Biometric registration and verification system and method
CN105989490B (zh) * 2014-08-12 2019-11-05 神盾股份有限公司 电子装置及指纹识别控制方法
US9444627B2 (en) * 2014-12-24 2016-09-13 Intel Corporation System and method for providing global platform compliant trusted execution environment
GB2552721A (en) * 2016-08-03 2018-02-07 Cirrus Logic Int Semiconductor Ltd Methods and apparatus for authentication in an electronic device
CN107688770A (zh) * 2016-08-05 2018-02-13 金佶科技股份有限公司 指纹辨识模块以及指纹辨识方法
US11036870B2 (en) * 2016-08-22 2021-06-15 Mastercard International Incorporated Method and system for secure device based biometric authentication scheme
WO2018145286A1 (zh) * 2017-02-09 2018-08-16 深圳市汇顶科技股份有限公司 基于生物特征的认证方法、认证装置及电子设备
CN106921799A (zh) * 2017-02-24 2017-07-04 深圳市金立通信设备有限公司 一种移动终端安全防护方法以及移动终端
CN107103288B (zh) * 2017-03-31 2020-12-18 南京车链科技有限公司 一种利用终端进行指纹识别的方法、装置和终端
CN108985756B (zh) * 2017-06-05 2022-11-22 华为技术有限公司 Se应用处理方法、用户终端以及服务器
CN107403152B (zh) * 2017-07-19 2020-07-31 大唐终端技术有限公司 高通平台TrustZone指纹识别实现方法及系统
CN110929255A (zh) * 2018-04-12 2020-03-27 Oppo广东移动通信有限公司 应用程序的安全控制方法、装置及移动终端、存储介质
CN108924426B (zh) * 2018-08-01 2020-01-10 Oppo广东移动通信有限公司 图像处理方法和装置、电子设备、计算机可读存储介质

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105791284A (zh) * 2016-02-29 2016-07-20 华为技术有限公司 一种数据安全传输装置及方法
CN106547618A (zh) * 2016-10-19 2017-03-29 沈阳微可信科技有限公司 通信系统和电子设备
CN106815510A (zh) * 2017-01-18 2017-06-09 珠海市魅族科技有限公司 一种数据处理的方法及终端
CN106897595A (zh) * 2017-01-20 2017-06-27 北京奇虎科技有限公司 一种移动终端

Also Published As

Publication number Publication date
CN109863491A (zh) 2019-06-07
CN109863491B (zh) 2023-10-27

Similar Documents

Publication Publication Date Title
KR102354415B1 (ko) 전자 장치 및 전자 장치 제어 방법
US10949637B2 (en) Electronic device comprising sensor and method for operating same
CN111630832B (zh) 具有布置成其至少一部分与像素交叠的红外元件的显示器和包含该显示器的电子装置
EP2869528B1 (en) Method for performing authentication using biometrics information and portable electronic device supporting the same
KR102204247B1 (ko) 전자 장치의 생체 정보 처리 방법 및 장치
US9261991B2 (en) Multi-layered sensing with multiple resolutions
CN110870072A (zh) 包括用于阻挡多个光接收传感器之间的干扰的遮光构件的图像传感器，以及包含其的电子设备
US11138488B2 (en) Organic light emitting diode (“OLED”) single-use payment instrument
CN103699825A (zh) 显示设备和用于操作显示设备的方法
WO2018000370A1 (zh) 一种移动终端的认证方法及移动终端
KR102208430B1 (ko) 지문 센서의 전원을 제어하는 방법과 이를 수행하는 지문 처리 장치 및 전자 장치
WO2021115113A1 (zh) 数据处理方法、装置及存储介质
WO2020177083A1 (zh) 指纹识别的方法、装置和终端设备
US20240095329A1 (en) Cross-Device Authentication Method and Electronic Device
WO2018143675A1 (ko) 생체 센서를 제어하는 방법 및 전자 장치
JP7450708B2 (ja) 表示方法及び電子機器
CN108141497A (zh) 一种信息交互的方法及设备
CN108537027A (zh) 资源分配方法和装置、终端、计算机可读存储介质
WO2020073166A1 (zh) 指纹识别方法、装置和终端设备
WO2020150892A1 (zh) 生物特征识别系统、方法和终端设备
WO2022165939A1 (zh) 一种跨设备认证方法及电子设备
CN116049813B (zh) 基于可信执行环境的触屏数据处理方法、设备及存储介质
KR20140127124A (ko) 시스템 자원에 대한 접근을 관리하는 전자 장치
US20210382615A1 (en) Device and method for providing feedback for user input in electronic device
KR20210099783A (ko) 전자 장치 및 전자 장치의 암호화 방법

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19911993

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19911993

Country of ref document: EP

Kind code of ref document: A1