WO2020191547A1

WO2020191547A1 - Biometric recognition method and apparatus

Info

Publication number: WO2020191547A1
Application number: PCT/CN2019/079339
Authority: WO
Inventors: 潘时林
Original assignee: 华为技术有限公司
Priority date: 2019-03-22
Filing date: 2019-03-22
Publication date: 2020-10-01
Also published as: CN111989693A

Abstract

Disclosed are a biometric recognition method and apparatus, belonging to the technical field of computers. The method comprises: after acquiring, under a TEE, a biometric image, extracting, under the TEE, biometric feature data from the biometric image; and then matching, in an SE, all of or part of the biometric feature data with a biometric feature template to obtain a biometric recognition result. In the present application, since the security level of an SE is higher than a TEE, the biometric recognition function reaches a high security level. In addition, since the calculation of template matching of biometric feature data is not complicated, and the processing pressure of the SE is relatively small, it can be ensured that the template matching speed is relatively high, and thus, it can be ensured that the biometric recognition speed is relatively high. In this way, by means of the present application, where the delay is only increased slightly and biometric recognition performance is not affected, biometric recognition achieves protection with a high security level, so that the security of biometric recognition can be improved.

Description

Biometric identification method and device

Technical field

This application relates to the field of computer technology, in particular to a biometric identification method and device.

Background technique

Biometric identification refers to the close integration of computers with high-tech methods such as optics, acoustics, biosensors, and biostatistics, and the use of inherent physical features (such as fingerprints, faces, or irises) or behavioral features (such as Biometrics such as handwriting, voice, or gait, etc.) are used for personal identification. With the development of computer technology, biometrics has been widely used as a convenient and relatively safe way of man-machine verification.

Since the user's biometrics are the user's non-replaceable assets, and the terminal can use the biometrics to perform operations such as system unlocking or value transfer, in order to ensure data security, the biometric identification process must be implemented in the secure area of the terminal. Currently, a Trusted Execution Environment (TEE) can be set in the terminal, and the terminal can perform a biometric identification process under the TEE. Specifically, the terminal may first obtain the biological image under the TEE, and then extract the biological characteristic data in the biological image, and then match the biological characteristic data with the stored biological characteristic template to obtain the biological recognition result.

However, TEE has a limited degree of security and is relatively easy to be attacked by attackers. After the attacker breaks through the TEE, he can directly control the output of the biometric recognition result to pass the recognition without matching the biometric data; alternatively, he can replace the stored biometric template with another biometric template to If the biometric data is matched successfully, the biometric identification result output will be recognized as passed. As a result, the security of biometrics is low.

Summary of the invention

This application provides a biometric identification method and device, which can improve the security of biometric identification. The technical solution is as follows:

In a first aspect, a biometric identification method is provided, characterized in that the method includes: acquiring a biometric image under a TEE; extracting biometric data in the biometric image under the TEE; and performing a secure element (Secure Element) , SE), matching all or part of the biometric data with a biometric template to obtain a biometric recognition result.

It should be noted that the biological image is an image containing biological characteristics. For example, the biological image may be at least one of a fingerprint image, a palmprint image, a human face image, or an iris image. At this time, the biometric template may be at least one of a fingerprint template, a palm print template, a face template, or an iris template.

In the embodiment of the application, the biological image is acquired under the TEE and the biological characteristic data in the biological image is extracted. Since the security level of the TEE is higher than the ordinary execution environment (Rich Execution Environment, REE), the biological image and biological characteristics can be guaranteed Data security. Moreover, since the TEE uses the system processor when it is running, the computing power and storage capacity under the TTE are high, so it can ensure a high extraction speed of biometric data, thereby ensuring a high biometric identification speed. In addition, at least a part of the template matching is performed on the biometric data in the SE and the biometric recognition result is output. Since the security level of the SE is higher than the TEE, the biometric recognition function reaches a high security level. In addition, since the calculation of template matching of biometric data is not complicated, the processing pressure of SE is small, so it can ensure that the template matching speed is high, and thus the biometric recognition speed can be ensured. In this way, a solution to support biometric identification with SE is provided, which only slightly increases the time delay and does not affect the biometric performance (recognition rate and false recognition rate), so that biometric identification is protected by a high security level. Thereby, the security of biometric identification can be improved.

In a possible implementation manner, in the SE, matching all or part of the biometric data with the biometric template, and before obtaining the biometric result, further includes: comparing the biometric data under the TEE All of the data is sent to the SE. Correspondingly, in the SE, matching all or part of the biometric data with a biometric template to obtain a biometric recognition result includes: in the SE, matching all or part of the biometric data with a preset The biometric template is matched to obtain the biometric result. In the embodiment of the present application, the SE can completely complete the template matching of the biometric data to obtain the biometric recognition result, thereby greatly improving the security of biometric recognition.

In another possible implementation manner, in the SE, matching all or part of the biometric data with the biometric template, and before obtaining the biometric result, further includes: under the TEE, matching the At least a part of the biometric data is first matched with the first biometric template to obtain a first matching result; under the TEE, the first matching result and at least another part of the biometric data are combined Sent to the SE. Correspondingly, in the SE, matching all or part of the biometric data with a biometric template to obtain a biometric recognition result includes: in the SE, matching at least another part of the biometric data A second matching is performed between the data and the second biometric template to obtain a second matching result, and the biometric recognition result is determined according to the first matching result and the second matching result.

It should be noted that both the first biometric template and the second biometric template belong to the preset biometric template, and the second biometric template includes the part of the preset biometric template that is different from the first biometric template, namely The second biometric template and the first biometric template may not be completely the same, for example, the first biometric template and the second biometric template may overlap. For another example, the first biometric template and the second biometric template may be completely different, that is, the first biometric template and the second biometric template may be different parts of the preset biometric template, respectively.

In the embodiment of this application, the template matching of the biometric data can be completed by the combination of TEE and SE to obtain the biometric results, that is, the two-stage template matching is performed by TEE and SE, which can effectively ensure the template matching speed The use of SE does not have a major impact, so that while improving the security of biometrics, it can ensure a high template matching speed, and then a high biometrics recognition speed.

It is worth noting that, before acquiring the biological image under TEE, the method further includes: acquiring the preset biological feature template; extracting the first biological feature template and the first biological feature template from the preset biological feature template 2. Biometric template.

It should be noted that the preset biometric template may be a complete biometric template generated after successful biometric registration. After extracting the first biometric template and the second biometric template from the preset biometric templates, in order to ensure the safety of the first biometric template and the second biometric template, the first biometric template can be stored in the TEE In the memory, the second biometric template is stored in the SE.

Further, before performing the second matching of at least another part of the biometric data with the second biometric template, the method further includes: when the matching degree indicated by the first matching result is greater than or equal to the first matching degree, Trigger the second matching operation of the at least another part of the data with the second biometric template in the SE. When the degree of matching indicated by the first matching result is less than the first degree of matching, it is directly determined under the TEE that the biometric recognition result is not passed, and the biometric recognition operation is ended.

In the embodiment of the present application, when the matching degree indicated by the first matching result is less than the first matching degree, it indicates that at least a part of the biometric data does not match the first biometric template, that is, the first biometric template is performed under TEE. The matching degree of one-stage template matching is very low, so there is no need to perform the second-stage template matching in the SE at this time, and the biometric recognition can be determined directly under the TEE to end the biometric recognition operation. In this way, when recognizing a biological image without biological registration, it can be quickly determined that the biological recognition is not passed, so that the biological recognition time delay can be reduced when the input biological image is wrong.

When the matching degree indicated by the first matching result is greater than or equal to the first matching degree, it indicates that at least a part of the biometric data matches the first biometric template, that is, the matching of the first paragraph of template matching performed under TEE The degree is not very low, so at this time, the second-stage template matching can be continued in the SE, and the SE will output the final biometric results. In this way, the accuracy of biometric identification can be guaranteed.

It should be noted that there may be multiple first biological feature templates and multiple second biological feature templates, and the multiple first biological feature templates are in one-to-one correspondence with the multiple second biological feature templates. A biological characteristic template and a second biological characteristic template belong to the same preset biological characteristic template.

In this case, further, under the TEE, first matching at least part of the biometric data with the first biometric template to obtain a first matching result includes: under the TEE, Perform a first match between the at least part of the data and each first biometric template of the plurality of first biometric templates to obtain a first matching result corresponding to each first biometric template. Correspondingly, in the SE, at least another part of the biometric data is subjected to a second matching with a second biometric template to obtain a second matching result, and according to the first matching result and the second matching result The second matching result, determining the biometric recognition result, includes: in the SE, according to the order of the plurality of matching degrees indicated by the plurality of first matching results corresponding to the plurality of first biometric templates, from high to low, Sort the plurality of second biometric templates; in the SE, according to the sort, sequentially perform a second match on the at least another part of the data with the plurality of second biometric templates; in the In SE, each time the second matching between the at least another part of data and a second biometric template is completed, a second matching result is obtained, and according to the second matching result and the first matching result, it is determined to correspond to The biometric recognition result of the second biometric template. If the biometric recognition result of the second biometric template is recognized as passed, then the biometric recognition operation is ended in the SE. If the biometric recognition result of the second biometric template is recognized as not passed, then in the SE At least another part of the biometric data is continuously matched with the next second biometric template.

In the embodiment of the present application, in the order of the multiple matching degrees indicated by the multiple first matching results corresponding to the multiple first biometric templates, the pairs correspond to the multiple first biological feature templates in a one-to-one order. After sorting the plurality of second biometric templates, the order of the plurality of second biometric templates represents the order of the plurality of second biometric templates and the biometric data from the most likely to successfully match to the least possible . After that, according to the sorting, every time the second matching between the biometric data and a second biometric template is completed, the biometric recognition result is determined once, and the biometric recognition operation is ended when the biometric recognition result is passed. In this way, when recognizing a biological image that has undergone biological registration, it can be quickly determined that the biological recognition has passed, so that the biological recognition time delay can be reduced when the input biological image is correct.

In a second aspect, a biological recognition device is provided, the device includes: a processor and an SE; the processor is configured to obtain a biological image and extract biological characteristic data in the biological image under a TEE; SE is used to match all or part of the biometric data with a biometric template to obtain a biometric recognition result.

Optionally, the processor is further configured to send all of the biometric data to the SE under the TEE; correspondingly, the SE is configured to send all of the biometric data to the preset The set biometric template is matched to obtain the biometric recognition result.

Optionally, the processor is further configured to perform a first matching of at least a part of the biometric data with a first biometric template under the TEE to obtain a first matching result; in the TEE Send the first matching result and at least another part of the biometric data to the SE; correspondingly, the SE is used to combine at least another part of the biometric data with the first Perform a second matching between two biometric templates to obtain a second matching result, and determine a biometric recognition result according to the first matching result and the second matching result; wherein, the second biometric template includes a preset biometric The part of the feature template that is different from the first biometric template.

Optionally, the first biometric template and the second biometric template are respectively different parts of a preset biometric template.

Optionally, the processor is further configured to obtain the preset biometric template; extract the first biometric template and the second biometric template from the preset biometric template.

Optionally, the processor is further configured to, when the degree of matching indicated by the first matching result is greater than or equal to the first degree of matching, trigger the SE to perform the comparison between the at least another part of the data and the second biometric template. The second match.

Optionally, there are multiple first biological feature templates and multiple second biological feature templates, and the multiple first biological feature templates have a one-to-one correspondence with the multiple second biological feature templates, and correspond to one first biological feature. The characteristic template and a second biological characteristic template belong to the same preset biological characteristic template; the processor is further configured to combine the at least part of the data with the plurality of first biological characteristic templates under the TEE Perform first matching on each of the first biometric templates to obtain the first matching result corresponding to each of the first biometric templates; accordingly, the SE is used to correspond to the multiple first biometric templates The plurality of second biometric templates are sorted in the descending order of the matching degrees indicated by the plurality of first matching results; according to the sorting, the at least another part of the data is sequenced with the plurality of A second biometric template for a second matching; each time the second matching between the at least another part of the data and a second biometric template is completed, a second matching result is obtained, based on the second matching result and the The first matching result determines the biometric recognition result corresponding to the second biometric template.

Optionally, the biometric template is at least one of a fingerprint template, a face template, or an iris template.

In a third aspect, a biometric identification device is provided, the device includes: a TEE module and an SE module; the TEE module is used to obtain a biological image and extract biometric data in the biological image; the SE module, It is used to match all or part of the biometric data with a biometric template to obtain a biometric recognition result.

Optionally, the TEE module is also used to send all of the biometric data to the SE module; correspondingly, the SE module is used to combine all of the biometric data with a preset biometric data. The feature template is matched to obtain the biometric recognition result.

Optionally, the TEE module is further configured to perform a first matching of at least a part of the biometric data with a first biometric template to obtain a first matching result; compare the first matching result with Sending at least another part of the biometric data to the SE module; correspondingly, the SE module is configured to perform a second matching of at least another part of the biometric data with a second biometric template, Obtain a second matching result, and determine a biometric recognition result according to the first matching result and the second matching result; wherein, the second biometric template includes a preset biometric template that is different from the first Part of the biometric template.

Optionally, the device is further configured to obtain the preset biometric template; extract the first biometric template and the second biometric template from the preset biometric template.

Optionally, the TEE module is further configured to trigger the SE module to compare the at least another part of the data with the second biometric template when the degree of matching indicated by the first matching result is greater than or equal to the first degree of matching. Perform a second match.

Optionally, there are multiple first biological feature templates and multiple second biological feature templates, and the multiple first biological feature templates have a one-to-one correspondence with the multiple second biological feature templates, and correspond to one first biological feature. The characteristic template and a second biological characteristic template belong to the same preset biological characteristic template; the TEE module is also used to combine the at least part of the data with each first biological characteristic of the plurality of first biological characteristic templates. The feature template performs first matching to obtain the first matching result corresponding to each of the first biological feature templates; accordingly, the SE module is configured to perform the first matching according to the multiple first biological feature templates corresponding to the multiple first biological feature templates. The plurality of matching degrees indicated by the matching result are ordered from high to low, and the plurality of second biometric templates are sorted; according to the sorting, the at least another part of data is sequentially matched with the plurality of second biometrics. The template performs a second matching; each time the second matching between the at least another part of data and a second biometric template is completed, a second matching result is obtained, and according to the second matching result and the first matching result, The biometric recognition result corresponding to the second biometric template is determined.

In a fourth aspect, a computer-readable storage medium is provided, and the computer-readable storage medium stores instructions that, when run on a computer, cause the computer to execute the biometric identification method described in the first aspect.

In a fifth aspect, a computer program product containing instructions is provided, which when running on a computer, causes the computer to execute the biometric identification method described in the first aspect.

The technical effects obtained by the foregoing second, third, fourth, and fifth aspects are similar to those obtained by the corresponding technical means in the foregoing first aspect, and will not be repeated here.

The technical solution provided by this application can at least bring about the following beneficial effects: after acquiring a biological image under the TEE, the biological characteristic data in the biological image is extracted under the TEE. Then, in the SE, all or part of the biometric data is matched with the biometric template to obtain the biometric recognition result. Since the security level of SE is higher than TEE, the biometric recognition function has reached a high security level. In addition, since the calculation of template matching of biometric data is not complicated, the processing pressure of SE is small, so it can ensure that the template matching speed is high, and thus the biometric identification speed can be ensured. In this way, the embodiment of the present application only slightly increases the time delay and does not affect the performance of the biometrics, so that the biometrics is protected with a high security level, thereby improving the security of the biometrics.

Description of the drawings

FIG. 1 is a schematic structural diagram of a system architecture provided by an embodiment of the present application;

2 is a schematic structural diagram of a biometric identification device provided by an embodiment of the present application;

FIG. 3 is a schematic structural diagram of another biometric identification device provided by an embodiment of the present application;

Figure 4 is a flowchart of a biometric identification method provided by an embodiment of the present application;

Figure 5 is a flowchart of another biometric identification method provided by an embodiment of the present application;

FIG. 6 is a flowchart of another biometric identification method provided by an embodiment of the present application;

Figure 7 is a schematic diagram of a biometric template provided by an embodiment of the present application;

Fig. 8 is a schematic diagram of a biometric identification process provided by an embodiment of the present application.

detailed description

In order to make the objectives, technical solutions, and advantages of the present application clearer, the implementation manners of the present application will be further described in detail below in conjunction with the accompanying drawings. Before explaining the embodiments of the present application in detail, the application scenarios and system architectures involved in the embodiments of the present application are described.

The following describes the application scenarios involved in the embodiments of the present application. The embodiments of this application can be applied to scenarios that require the use of biometrics, such as booting and unlocking scenarios, application identity authentication scenarios, etc. The embodiments of this application introduce SE in the biometric identification process to perform template matching, so that the biometrics function can also be used. Reach a high security level, which can greatly improve the security of biometrics. In the embodiment of the present application, the acquisition of biological images and the extraction of biological characteristic data can be performed under TEE, and then at least a part of template matching is performed on the biological characteristic data in SE. Specifically, it is possible to directly match all of the biometric data with a preset biometric template in the SE to obtain a biometric recognition result; or, first, under the TEE, at least part of the biometric data can be matched with The first biometric template performs first matching to obtain a first matching result, and then in SE, at least another part of the biometric data is subjected to a second matching with the second biometric template to obtain a second matching result, and According to the first matching result and the second matching result, the biometric recognition result is determined. In this way, while satisfying high-security biometric data protection, it does not affect the biometric speed and biometric performance (ie, recognition rate and misrecognition rate), so that user needs can be met without affecting user experience.

The following describes the system architecture involved in the embodiments of the present application. FIG. 1 is a schematic structural diagram of a system architecture provided by an embodiment of the present application. Referring to Figure 1, the system architecture may include: REE, TEE, and SE. REE and TEE are two parallel execution environments, which are isolated by hardware, and both are generated by the processor running necessary software, such as operating system software and security software. The SE can be an independent dedicated security chip (such as a smart card, or an Embedded Secure Element (eSE), etc.), or it can be integrated into a System on Chip (SoC) in the form of a security unit (such as inSE, etc.) . The security level of SE is higher than TEE, and the security level of TEE is higher than REE. For example, the SE may be a secure processing unit (Secure Processing Unit, SPU). For another example, SE is a piece of hardware different from a processor, used to perform operations or processing with a higher security level, so its security is higher than TEE and REE.

REE is the operating environment of terminal operating systems such as Android or iOS, and includes modules such as client application (Client Application, CA), TEE function application programming interface (Application Programming Interface, API), TEE client API, and multimedia operating system components. CA is a client application provided to users. The TEE function API is a friendly interface provided to CA to access TEE core services (such as trusted storage and encryption algorithm services). The TEE client API is a low-level communication interface provided to the CA to access the trusted application (Trusted Application, TA) in the TEE and to exchange data with the TA. The multimedia operating system components include modules such as public device drivers and REE communication agent. The REE communication agent provides message transmission between CA and TA.

Compared with the open environment REE, TEE provides a safer and closed execution environment. TEE is mainly composed of TA, TEE internal API, trusted operating system components, and trusted kernel. TA runs on TEE to provide users with security services. TA and TA communicate with each other through TEE internal API. The trusted operating system components include TEE communication agents, trusted core frameworks, and trusted functions. TEE communication agent and REE communication agent together realize the secure transmission of messages between CA and TA. The trusted core framework provides TA with a secure operating system (Operating System, OS) function. The trusted function module provides auxiliary facility support to application developers. The trusted kernel mainly provides scheduling and other OS management functions to the trusted core framework and trusted function modules.

SE implements functions such as data secure storage, encryption and decryption operations through the Chip Operating System (COS). SE can be packaged into various forms, such as smart cards, eSE, inSE, etc. are common. SE can provide chip-level hardware protection and can resist various physical attacks. The main functions of SE include: secure storage of keys, data encryption operations, and secure storage of information. The secure storage of keys can establish a relatively complete key management system to ensure that keys cannot be read. Data encryption operations include support for reliable security algorithms, ciphertext transmission of sensitive data, and anti-tampering of data transmission. Information security storage refers to a strict file access authority mechanism and reliable authentication algorithms and processes.

Next, the biometric identification device provided by the embodiment of the present application will be described. In a possible implementation manner, the system architecture shown in FIG. 1 may be implemented by the biometric identification device shown in FIG. 2. Specifically, FIG. 2 is a schematic structural diagram of a biometric identification device provided by an embodiment of the present application. The biometric identification device may be a computer device 200. Referring to FIG. 2, the computer device includes at least one processor 201, a communication bus 202, a memory 203, at least one communication interface 204, and an SE208. The at least one processor 201 is used to form the REE and TEE in the system architecture shown in FIG. 1. Optionally, the processors 201 and SE208 execute their respective software programs, including but not limited to system software, application software, or driver software.

The processor 201 may be at least one of a general-purpose central processing unit (CPU), a microprocessor, or a microcontroller, and may also include an application-specific integrated circuit (ASIC), or may be One or more integrated circuits used to control the execution of the program of this application. The communication bus 202 may include a path for transferring information between the aforementioned components. The memory 203 can be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, or it can be a random access memory (RAM) or can store information and instructions. Other types of dynamic storage devices can also be Electrically Erasable Programmable Read-Only Memory (EEPROM), CD-ROM (Compact Disc Read-Only Memory, CD-ROM) or other optical disk storage , CD storage (including compressed CDs, laser disks, CDs, digital universal CDs, Blu-ray CDs, etc.), disk storage media or other magnetic storage devices, or can be used to carry or store desired program codes in the form of instructions or data structures And any other media that can be accessed by the computer, but not limited to this. The memory 203 may exist independently and is connected to the processor 201 through the communication bus 202. The memory 203 may also be integrated with the processor 201. The communication interface 204 is any device such as a transceiver for communicating with other devices or communication networks, such as Ethernet, Radio Access Network (RAN), and Wireless Local Area Networks (WLAN).

In specific implementation, as an embodiment, the processor 201 may include one or more CPUs, such as CPU0 and CPU1 as shown in FIG. 2. In specific implementation, as an embodiment, the computer device may include multiple processors, such as the processor 201 and the processor 205 as shown in FIG. 2. For example, the processor 201 and the processor 205 form a large and small core architecture, that is, the processor 201 is a large core and the processor 20 is a small core. Each of these processors can be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). The processor here may refer to one or more devices, circuits, and/or processing cores for processing data (such as computer program instructions).

In a specific implementation, as an embodiment, the computer device may further include an output device 206 and an input device 207. The output device 206 communicates with the processor 201 and can display information in a variety of ways. For example, the output device 206 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector, etc. . The input device 207 communicates with the processor 201, and can receive user input in a variety of ways. For example, the input device 207 may be a mouse, a keyboard, a touch screen device, or a sensor device.

The above-mentioned computer equipment may be a general-purpose computer equipment or a special-purpose computer equipment. In a specific implementation, the computer device may be a desktop computer, a portable computer, a web server, a PDA (Personal Digital Assistant, PDA), a mobile phone, a tablet computer, a wireless terminal device, a communication device, or an embedded device. The embodiments of this application do not Limit the type of computer equipment. The memory 203 is used to store the program code 210 for executing the solution of the present application, and the processor 201 is used to execute the program code 210 stored in the memory 203. The computer device can implement all operations performed under the TEE in the embodiment of FIG. 4 below through the processor 201 and the program code 210 in the memory 203. The computer device can also implement all operations performed in the SE in the embodiment of FIG. 4 through the SE 208 and the program code 210 in the memory 203. Or, alternatively, the program software run by the SE208 may not be stored in the memory 203, but stored inside the SE208, which is not limited in the embodiment of the present application.

In a possible implementation manner, the TEE and SE in the system architecture shown in FIG. 1 can be used as a functional module to implement their respective functions. Specifically, FIG. 3 is a schematic structural diagram of a biometric identification device provided by an embodiment of the present application. Referring to FIG. 3, the biometric identification device may include a TEE module 301 and an SE module 302. The TEE module 301 is used to perform all operations to be performed under the TEE in the embodiment of FIG. 4 below, and the SE module 302 is used to perform all the operations to be performed in the SE in the embodiment of FIG. 4 below. Optionally, the TEE module 301 and the SE module 302 can be implemented by software, hardware or a combination of both. When the TEE module 301 and the SE module 302 are implemented by software, these two modules can run on the processor 201 and the SE 208 in FIG. 2 respectively. The biometric identification device provided in the above embodiment and the biometric identification method embodiment belong to the same concept, and the specific implementation process is detailed in the following method embodiment, which will not be elaborated here.

Next, the biometric identification method provided by the embodiment of the present application will be described. Fig. 4 is a flowchart of a biometric identification method provided by an embodiment of the present application. Referring to Fig. 4, the method includes: Step 401: Acquire a biological image under TEE. It should be noted that the biological image is an image containing biological characteristics. For example, the biological image may be at least one of a fingerprint image, a palmprint image, a human face image, or an iris image. Specifically, the biological image can be acquired through the image acquisition device under the TEE. Of course, the biological image can also be acquired through other methods under the TEE, which is not limited in the embodiment of the present application.

It should be noted that the image capture device is used to capture biological images. For example, the image capture device may be at least one of a fingerprint sensor, a collector, or a camera. The fingerprint sensor may be, for example, an ultrasonic fingerprint sensor, a push fingerprint sensor, or an optical fingerprint sensor. . In a possible implementation, after the fingerprint sensor collects the fingerprint image, the fingerprint image can be sent to the memory space of the TA for biometric identification in the TEE through the serial peripheral interface (Serial Peripheral Interface, SPI) In: After the camera collects the face image, the face image can be sent to the memory space of the TA used for biometric identification in the TEE through the camera serial interface (CSI). It is worth noting that, in the embodiment of the present application, step 401 may be performed when the biometric identification service under the REE is started, that is, step 401 may be performed when the user uses the biometric identification service. The biometric service may be booting and unlocking, application identity authentication, etc., which is not limited in the embodiment of the present application.

Step 402: Extract the biological characteristic data in the biological image under the TEE. It should be noted that the biological feature data in the biological image is used to indicate the biological features contained in the biological image. For example, when the biometric image is a fingerprint image, the biometric data can be the parameters (such as direction, curvature, and bifurcation points) of the minutiae feature points (such as the starting point, end point, joining point, and bifurcation point of lines) in the biological image. Location etc.). For another example, when the biological image is a face image, the biological feature data may be attributes (such as size, position, distance, etc.) of facial contour points (such as iris, nose and corner of mouth, etc.) in the face image.

Specifically, a feature extraction algorithm can be used under TEE to extract biological feature data in the biological image. Furthermore, the biometric data in the biometric image can be extracted through TA for biometric recognition under TEE. It should be noted that the feature extraction algorithm can be set in advance. For example, when the biological image is a fingerprint image, the feature extraction algorithm can be a fingerprint feature extraction algorithm, and when the biological image is a face image, the feature extraction algorithm can be a face feature extraction algorithm.

It is worth noting that the embodiments of this application can acquire biological images under TEE and extract the biological characteristic data in the biological images. Since TEE operates in isolation from REE and has a high security level, the security of biological images and biological data can be guaranteed. . Moreover, since the TEE uses a processor when it is running, the computing power and storage capacity under the TTE are both high, so it can ensure that the extraction speed of biometric data is high, thereby ensuring that the biometric recognition speed is high.

Step 403: In the SE, all or part of the biometric data is matched with the biometric template to obtain a biometric recognition result. It should be noted that the biometric template can be set in advance. For example, the biometric template can be at least one of a fingerprint template, a face template, or an iris template. And, when matching all of the biometric data with the biometric template, the biometric template may be a complete biometric template generated after the biometric registration is successful, that is, the biometric template may be a preset biometric Template; when matching the part of the biometric data with the biometric template, the biometric template can be part of the complete biometric template generated after the biometric registration is successful, that is, the biometric template can be a preset Part of the biometric template.

It is worth noting that in the embodiment of this application, at least a part of the template matching can be performed on the biometric data in the SE and the biometric results can be output. Since the SE can provide chip-level hardware protection, it can resist various physical attacks and has a security level. It is higher than TEE, so the biometric recognition function reaches a high security level. In addition, since the calculation of template matching of biometric data is not complicated, the processing pressure of SE is small, so it can ensure that the template matching speed is high, and thus the biometric identification speed can be ensured. In this way, the embodiment of the present application provides a solution for supporting biometrics by using SE, which provides high security for biometrics without affecting the biometric performance (recognition rate and false recognition rate) while only slightly increasing the time delay. Level of protection, which can improve the security of biometrics.

Specifically, when in SE, all of the biometric data is matched with the biometric template to obtain the biometric recognition result, step 403 can be implemented in the first possible implementation manner as follows; when in SE, When the part of the biometric data is matched with the biometric template, and the biometric recognition result is obtained, step 403 can be implemented in the following second possible implementation manner.

In the first possible implementation manner, referring to FIG. 5, step 4031 may be performed before step 403: sending all the biometric data to the SE under the TEE. Correspondingly, the operation of step 403 may be step 4032: in SE, all of the biometric data is matched with a preset biometric template to obtain a biometric recognition result. It should be noted that, in the first possible implementation manner, the SE completely completes the template matching of the biometric data to obtain the biometric recognition result, which can greatly improve the security of biometric recognition. In addition, matching all of the biometric data with the preset biometric template is to match the biometrics indicated by the biometric data with the biometrics indicated by the preset biometric template. If the matching is successful, you can It is determined that the biometric recognition result is recognition passed, and if the matching fails, it can be determined that the biometric recognition result is recognition failed.

In the second possible implementation manner, referring to FIG. 6, step 4033 may be performed before step 403: under TEE, perform a first matching of at least a part of the biometric data with the first biometric template to obtain The first matching result, and sending the first matching result and at least another part of the biometric data to the SE under the TEE. Correspondingly, the operation of step 403 may be step 4034: in SE, perform a second matching of at least another part of the biometric data with the second biometric template to obtain a second matching result, and according to the first matching result With the second matching result, the biometric recognition result is determined.

It should be noted that in the second possible implementation manner, the template matching of the biometric data is completed by the combination of TEE and SE to obtain the biometric result, that is, the two-stage template matching is performed by TEE and SE. This can effectively ensure that the template matching speed is not greatly affected by the use of SE, so that while improving the security of biometrics, it can ensure that the template matching speed is high, and then the biometrics recognition speed can be high. In addition, the first biometric template and the second biometric template both belong to a preset biometric template, and the second biometric template includes a part of the preset biometric template that is different from the first biometric template. The first biometric template may be stored in a memory under the TEE, for example, in the memory 203 of FIG. 2, and the second biometric template may be stored in the SE. The second biometric template and the first biometric template may not be completely the same, for example, there is overlap. Furthermore, the first biometric template and the second biometric template can be completely different, that is, the first biometric template and the second biometric template can be different parts of the preset biometric template, for example, as shown in FIG. 7 As shown, the preset biometric template is A, and the preset biometric module A can be divided into two parts, one part is A1, the other part is A2, and then A1 is used as the first biometric module and A2 is used as the second biometric module. Feature template. Since the computing power and storage capacity under TEE are higher than SE, in order to improve the template matching speed, the proportion of the first biometric template in the preset biometric template can be greater than that of the second biometric template in the preset biometric template. In the proportion. Moreover, in order to ensure the safety of the second biometric template in the SE, the non-overlapping part of the second biometric template and the first biometric template needs to have sufficient data strength, that is, the first biometric template cannot be easily derived from the first biometric template. 2. Biometric template.

It should be noted that the first matching of at least part of the biometric data with the first biometric template means that the biometrics indicated by the at least part of the biometric data are indicated by the first biometric template. The biological characteristics are matched, and the first matching result is obtained. The first matching result is used to indicate the degree of matching between at least a part of the biometric data and the first biometric template. Wherein, when sending at least another part of the biometric data to the SE under the TEE, all of the biometric data can be directly sent to the SE under the TEE; or, under the TEE, according to the first biological feature The distribution rules of the template and the second biometric template in the preset biometric template. From the biometric data, determine a part of the data corresponding to the first biometric template and a part of the data corresponding to the second biometric template. Part of the biometric data corresponding to the second biometric template is sent to the SE.

It should be noted that the second matching of at least another part of the biometric data with the second biometric template is to match the biometrics indicated by the at least another part of the biometric data with the second biometric template. The indicated biological characteristics are matched, and the second matching result is obtained. The second matching result is used to indicate the degree of matching between at least another part of the biometric data and the second biometric template. Among them, in SE, when determining the biometric result according to the first matching result and the second matching result, the first weight corresponding to the TEE and the second weight corresponding to the SE can be used to compare the matching degree indicated by the first matching result with the first The matching degree indicated by the two matching results is weighted and averaged to obtain the target matching degree; if the target matching degree is greater than or equal to the second matching degree, the biometric recognition result is determined to pass; if the target matching degree is less than the second matching degree, the biological The recognition result is that the recognition fails. Of course, in the SE, the biometric recognition result can also be determined in other ways according to the first matching result and the second matching result, which is not limited in the embodiment of the present application. It should be noted that the first weight corresponding to TEE and the second weight corresponding to SE can be set in advance. For example, it can be set according to the security level of TEE and SE, or can be set according to the security level of TEE and SE and the first biological The distribution rules of the feature template and the second biometric template in the preset biometric template are set.

In addition, the second matching degree can be set in advance, and the second matching degree can be set to be larger. When the target matching degree is greater than or equal to the second matching degree, it indicates that the biometric data closely matches the preset biometric template, and thus the biometric identification can be determined to pass. When the target matching degree is less than the second matching degree, it indicates that the biometric data does not match the preset biometric template, so it can be determined that the biometric recognition is not passed.

Further, before the second possible implementation manner, the first biometric template and the second biometric template can also be generated first. Specifically, a preset biometric template can be acquired, and the first biometric template and the second biometric template can be extracted from the preset biometric template. Wherein, when obtaining a preset biometric template, when a biometric registration instruction is received, a biometric image can be collected, and then biometric data in the collected biometric image can be extracted as the preset biometric template. It should be noted that the biometric registration instruction is used to instruct the registration of the biometric template. The biometric registration instruction can be triggered by the user, and the user can be triggered by operations such as tap operation, sliding operation, voice operation, or gesture operation. There is no restriction on this.

In addition, after extracting the first biometric template and the second biometric template from the preset biometric templates, in order to ensure the safety of the first biometric template and the second biometric template, the first biometric template can be stored in the TEE In the memory below, store the second biometric template in the SE.

It is worth noting that, in order to reduce the time delay of biometrics and improve user experience, in the second possible implementation manner described above, the following method 1 and/or method 2 can be used to further improve the speed of biometric identification. Method 1: After obtaining the first matching result under TEE, determine whether the matching degree indicated by the first matching result is less than the first matching degree; when the matching degree indicated by the first matching result is less than the first matching degree, directly determine under TEE The biometric recognition result is that the recognition is not passed, and the biometric recognition operation is ended; when the matching degree indicated by the first matching result is greater than or equal to the first matching degree, the SE is triggered to connect at least another part of the biometric data with the first The second biometric template performs the second matching operation.

It should be noted that the first matching degree can be set in advance, and the first matching degree can be set to be small. When the matching degree indicated by the first matching result is less than the first matching degree, it indicates that at least a part of the biometric data does not match the first biometric template, that is, the matching degree of the first paragraph of template matching performed under TEE It is very low, so there is no need to perform the second-stage template matching in the SE at this time, and the biometric identification can be determined directly under the TEE to end the biometric identification operation. In this way, when recognizing a biological image without biological registration, it can be quickly determined that the biological recognition is not passed, so that the biological recognition time delay can be reduced when the input biological image is wrong.

It is worth noting that there are often multiple preset biometric templates generated after successful biometric registration. For example, a preset biometric template corresponding to the fingerprint of each finger among multiple fingers can be generated. In this case, there will be multiple first biological feature templates and multiple second biological feature templates. The multiple first biological feature templates and the multiple second biological feature templates have a one-to-one correspondence, corresponding to a first biological feature. The characteristic template and a second biological characteristic template belong to the same preset biological characteristic template. In this case, under TEE, at least part of the biometric data is first matched with the first biometric template, and when the first matching result is obtained, at least part of the biometric data can be Part of the data is first matched with each first biometric template of the plurality of first biometric templates to obtain a first matching result corresponding to each first biometric template.

Correspondingly, in the first manner, when the plurality of first matching results corresponding to the plurality of first biometric templates are all less than the first matching degree, it is directly determined under the TEE that the biometric recognition result is the recognition failure, and the biometric recognition operation is ended; When the plurality of first matching results corresponding to the plurality of first biometric templates has a first matching result whose indicated matching degree is greater than or equal to the first matching degree, the SE is triggered to trigger at least one of the biometric data The other part of the data is subjected to a second matching operation with the second biometric template.

Correspondingly, the speed of biometric identification can be further improved through the following method two. Manner 2: In SE, the plurality of second biometric templates are sorted according to the order from high to low indicated by the plurality of first matching results corresponding to the plurality of first biometric templates; In SE, according to the sort, at least another part of the biometric data is sequentially matched with the plurality of second biometric templates; in SE, whenever at least another part of the biometric data is completed When a second matching result is obtained with a second biometric template, a second matching result is obtained. According to the second matching result and the first matching result, the biometric result corresponding to the second biometric template is determined; if this second If the biometric result of the biometric template is recognized as passed, the biometric recognition operation is ended in the SE. If the biometric result of the second biometric template is not passed, then at least another part of the biometric data in the SE The data continues to be matched with the next second biometric template.

It should be noted that, according to the order of the multiple matching degrees indicated by the multiple first matching results corresponding to the multiple first biometric templates, the multiple matching degrees corresponding to the multiple first biological feature templates are one-to-one. After the second biometric templates are sorted, the order of the plurality of second biometric templates represents the order of the plurality of second biometric templates and the biometric data from the most likely to successfully match to the least possible. After that, according to the sorting, every time the second matching between the biometric data and a second biometric template is completed, the biometric recognition result is determined once, and the biometric recognition operation is ended when the biometric recognition result is passed. In this way, when recognizing a biological image that has undergone biological registration, it can be quickly determined that the biological recognition has passed, so that the biological recognition time delay can be reduced when the input biological image is correct.

It is worth noting that after obtaining the biometric result in the SE, the SE can send the biometric result to the biometric service under the REE, so that the biometric service can perform the follow-up process based on the biometric result. In a possible implementation manner, when the biometric identification result is passed, the SE can enable the system key service. For example, when the biometric identification result is passed, if the SE receives the system key acquisition sent by the biometric service Upon request, the stored system key can be returned to the biometric service so that the biometric service can use the system key to unlock and access system files; or, when the biometric result is passed, the SE can use the stored The system key unlocks the system file so that the biometric service can directly access the system file.

For ease of understanding, the biometric identification process provided by the embodiment of the present application will be described with reference to FIG. 8 as an example. For example, referring to FIG. 8, the biometric identification process may include the following steps (1) to (7). (1) Acquire biological images through an image acquisition device under TEE; (2) Extract biological characteristic data in the biological image under TEE; (3) Under TEE, at least part of the biological characteristic data is combined with the first The first matching result of the biometric template is performed to obtain the first matching result; (4) The first matching result and at least another part of the biometric data are sent to the SE under the TEE; (5) In the SE, the At least another part of the biometric data is second matched with the second biometric template to obtain the second matching result; (6) In SE, the biometric recognition result is determined according to the first matching result and the second matching result; ( 7) In SE, send the biometric identification result to the biometric identification service under REE, and enable the system key service when the biometric identification result is passed.

In the embodiment of the present application, after the biological image is acquired under the TEE, the biological characteristic data in the biological image is extracted under the TEE. Then, in the SE, all or part of the biometric data is matched with the biometric template to obtain the biometric recognition result. Since the security level of SE is higher than TEE, the biometric recognition function has reached a high security level. In addition, since the calculation of template matching of biometric data is not complicated, the processing pressure of SE is small, so it can ensure that the template matching speed is high, and thus the biometric identification speed can be ensured. In addition, in this embodiment of the application, two-stage template matching can be performed by combining TEE and SE, that is, the first stage template matching can be performed on biometric data under TEE, and then the second stage of biometric data can be performed in SE. Template matching can effectively ensure that the template matching speed will not be greatly affected by the use of SE. In this way, the embodiment of the present application only slightly increases the time delay and does not affect the performance of the biometrics, so that the biometrics is protected with a high security level, thereby improving the security of the biometrics.

In the foregoing embodiments, the corresponding method flow can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented by software, it can be implemented in the form of a computer program product in whole or in part. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on the computer, the processes or functions described in the embodiments of the present application are generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website, computer, server, or data center. Transmission to another website, computer, server, or data center via wired (for example: coaxial cable, optical fiber, Digital Subscriber Line (DSL)) or wireless (for example: infrared, wireless, microwave, etc.). The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center integrated with one or more available media. The usable medium may be a magnetic medium (for example: floppy disk, hard disk, tape), optical medium (for example: Digital Versatile Disc (DVD)), or semiconductor medium (for example: Solid State Disk (SSD) )Wait.

The above-mentioned examples provided for this application are not intended to limit this application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this application shall be included in the protection scope of this application. Inside.

Claims

A biometric identification method, characterized in that the method includes:

Acquire biological images under the trusted execution environment TEE;

Extracting biometric data in the biological image under the TEE;

In the secure element SE, all or part of the biometric data is matched with the biometric template to obtain the biometric identification result.
The method according to claim 1, characterized in that, in the secure element SE, matching all or part of the biometric data with a biometric template, before obtaining a biometric result, further comprising:

Sending all of the biometric data to the SE under the TEE;

Correspondingly, in the secure element SE, matching all or part of the biometric data with a biometric template to obtain a biometric recognition result includes:

In the SE, all of the biometric data is matched with a preset biometric template to obtain a biometric recognition result.
The method according to claim 1, characterized in that, in the secure element SE, matching all or part of the biometric data with a biometric template, before obtaining a biometric result, further comprising:

Under the TEE, perform a first match on at least a part of the biometric data with a first biometric template to obtain a first matching result;

Sending the first matching result and at least another part of the biometric data to the SE under the TEE;

Correspondingly, in the secure element SE, matching all or part of the biometric data with a biometric template to obtain a biometric recognition result includes:

In the SE, a second matching is performed on at least another part of the biometric data with a second biometric template to obtain a second matching result, and according to the first matching result and the second matching result To determine the biometric results;

Wherein, the second biometric template includes a part of the preset biometric template that is different from the first biometric template.
The method according to claim 3, wherein the first biometric template and the second biometric template are different parts of a preset biometric template.
The method according to claim 3 or 4, characterized in that, before acquiring the biological image under the trusted execution environment TEE, the method further comprises:

Acquiring the preset biometric template;

Extract the first biometric template and the second biometric template from the preset biometric template.
The method according to any one of claims 3-5, wherein, in the SE, before performing a second matching of at least another part of the biometric data with a second biometric template ,Also includes:

When the degree of matching indicated by the first matching result is greater than or equal to the first degree of matching, a second matching operation of the at least another part of data with the second biometric template is triggered in the SE.
The method according to any one of claims 3-6, wherein there are multiple first biological feature templates and multiple second biological feature templates, and the multiple first biological feature templates and the multiple The second biometric template has a one-to-one correspondence, and a corresponding first biometric template and a second biometric template belong to the same preset biometric template;

The first matching of at least a part of the biometric data with a first biometric template under the TEE to obtain a first matching result includes:

Under the TEE, perform a first match between the at least part of the data and each first biometric template of the plurality of first biometric templates to obtain the first biometric template corresponding to each first biometric template. Match result

Correspondingly, in the SE, at least another part of the biometric data is subjected to a second matching with a second biometric template to obtain a second matching result, and according to the first matching result and the second matching result The second matching result to determine the biometric recognition result includes:

In the SE, sort the plurality of second biometric templates according to the order of the plurality of matching degrees indicated by the plurality of first matching results corresponding to the plurality of first biometric templates;

In the SE, according to the sorting, the at least another part of the data is sequentially matched with the plurality of second biometric templates;

In the SE, each time the second matching between the at least another part of data and a second biometric template is completed, a second matching result is obtained. According to the second matching result and the first matching result, The biometric recognition result corresponding to the second biometric template is determined.
The method according to any one of claims 1-7, wherein the biometric template is at least one of a fingerprint template, a face template, or an iris template.
A biometric identification device, characterized in that the device comprises: a processor and a secure element SE;

The processor is configured to obtain a biological image under a trusted execution environment TEE, and extract the biological characteristic data in the biological image;

The SE is used to match all or part of the biometric data with a biometric template to obtain a biometric recognition result.
The device of claim 9, wherein:

The processor is further configured to send all of the biometric data to the SE under the TEE;

Correspondingly, the SE is used to match all of the biometric data with a preset biometric template to obtain a biometric recognition result.
The device of claim 9, wherein:

The processor is further configured to perform a first matching of at least a part of the biometric data with a first biometric template under the TEE to obtain a first matching result; under the TEE, the A first matching result and sending at least another part of the biometric data to the SE;

Correspondingly, the SE is used to perform a second matching of at least another part of the biometric data with a second biometric template to obtain a second matching result, and according to the first matching result and the first matching result 2. The matching result is to determine the biometric recognition result; wherein the second biometric template includes a part of the preset biometric template that is different from the first biometric template.
The device of claim 11, wherein the first biometric template and the second biometric template are different parts of a preset biometric template.
The device according to claim 11 or 12, wherein:

The processor is further configured to obtain the preset biometric template; extract the first biometric template and the second biometric template from the preset biometric template.
The device according to any one of claims 11-13, wherein:

The processor is further configured to trigger the SE to perform a second match between the at least another part of data and a second biometric template when the degree of matching indicated by the first matching result is greater than or equal to the first degree of matching.
The device according to any one of claims 11-14, wherein there are multiple first biological feature templates and multiple second biological feature templates, and the multiple first biological feature templates and the multiple The second biometric template has a one-to-one correspondence, and a corresponding first biometric template and a second biometric template belong to the same preset biometric template;

The processor is further configured to perform a first match between the at least a part of the data and each first biometric template of the plurality of first biometric templates under the TEE to obtain each first biometric template. A first matching result corresponding to a biometric template;

Correspondingly, the SE is configured to compare the plurality of second biometric templates according to the order of the plurality of matching degrees indicated by the plurality of first matching results corresponding to the plurality of first biometric templates. Sorting; according to the sorting, the at least another part of data is sequentially matched with the plurality of second biometric templates; each time the second matching of the at least another part of data with a second biometric template is completed During matching, a second matching result is obtained, and a biometric recognition result corresponding to the second biometric template is determined according to the second matching result and the first matching result.
The device according to any one of claims 9-15, wherein the biometric template is at least one of a fingerprint template, a face template, or an iris template.
A biometric identification device, characterized in that the device includes: a feasible execution environment TEE module and a secure element SE module;

The TEE module is used to obtain biological images and extract biological characteristic data in the biological images;

The SE module is used to match all or part of the biometric data with a biometric template to obtain a biometric recognition result.
The device of claim 17, wherein:

The TEE module is also used to send all of the biometric data to the SE module;

Correspondingly, the SE module is used to match all of the biometric data with a preset biometric template to obtain a biometric recognition result.
The device of claim 17, wherein:

The TEE module is further configured to perform a first match between at least a part of the biometric data and a first biometric template to obtain a first matching result; and compare the first matching result with the biometric data At least another part of the data in is sent to the SE module;

Correspondingly, the SE module is configured to perform a second matching of at least another part of the biometric data with a second biometric template to obtain a second matching result, and according to the first matching result and the The second matching result determines the biometric recognition result; wherein the second biometric template includes a part of the preset biometric template that is different from the first biometric template.
The device of claim 19, wherein the first biometric template and the second biometric template are different parts of a preset biometric template.
The device according to claim 19 or 20, wherein:

The device is also used to obtain the preset biometric template; extract the first biometric template and the second biometric template from the preset biometric template.
The device according to any one of claims 19-21, wherein:

The TEE module is further configured to trigger the SE module to perform a second match between the at least another part of data and a second biometric template when the degree of matching indicated by the first matching result is greater than or equal to the first degree of matching .
The device according to any one of claims 19-22, wherein there are a plurality of first biometric templates and a plurality of second biometric templates, and the plurality of first biometric templates and the plurality of The second biometric template has a one-to-one correspondence, and a corresponding first biometric template and a second biometric template belong to the same preset biometric template;

The TEE module is further configured to perform a first match between the at least a part of the data and each first biometric template of the plurality of first biometric templates to obtain the corresponding First match result;

Correspondingly, the SE module is configured to compare the plurality of second biometrics in the descending order of the matching degrees indicated by the plurality of first matching results corresponding to the plurality of first biometric templates. The templates are sorted; according to the sorting, the at least another part of data is sequentially matched with the plurality of second biometric templates; each time the first part of the at least another part of data and a second biometric template is completed In the second matching, a second matching result is obtained, and a biometric recognition result corresponding to the second biometric template is determined according to the second matching result and the first matching result.
The device according to any one of claims 17-23, wherein the biometric template is at least one of a fingerprint template, a face template, or an iris template.