WO2020220213A1

WO2020220213A1 - Biological feature recognition method and electronic device

Info

Publication number: WO2020220213A1
Application number: PCT/CN2019/085036
Authority: WO
Inventors: 李彦青; 李洪生
Original assignee: 深圳市汇顶科技股份有限公司
Priority date: 2019-04-29
Filing date: 2019-04-29
Publication date: 2020-11-05
Also published as: CN110235141B; CN110235141A

Abstract

A biological feature recognition method and an electronic device. The biological feature recognition method comprises: performing first determination, in a first security environment, on the validity of a biological feature to be recognized (S101); performing second determination on the validity of said biological feature in a second security environment (S102); and performing final determination on the validity of said biological feature according to the result of the first determination and the result of the second determination (S103). In view of the above, the biological feature recognition method reduces the resource requirements for biological feature recognition and improves the security of biological feature recognition.

Description

Biometric identification method and electronic equipment

Technical field

The embodiments of the present application relate to the field of biometric identification technology, and in particular, to a biometric identification method and electronic equipment.

Background technique

Because the biological characteristics of the human body such as fingerprints, palm prints, lip prints and iris are unique, they can be used for identity verification to meet the security and confidentiality requirements of different application scenarios. Nowadays, biometric identification technology is being used more and more widely in embedded terminal equipment, such as mobile phone unlocking, access control system, mobile payment and various smart locks.

Security is one of the focuses of biometric identification technology, and security is restricted by the limited resources of terminal equipment, such as processor frequency and memory space. Among them, low power consumption is especially important for embedded terminal equipment. As well as security requirements, providing a biometric identification solution with higher security has become a technical problem to be solved urgently.

Summary of the invention

In view of this, the biometric identification method and electronic device provided by the embodiments of the present application are used to at least solve the above-mentioned problems in the prior art.

The embodiment of the application provides a biometric identification method, which includes:

Make an initial judgment on the legality of the biological features to be identified in the first security environment, and make a second judgment on the legality of the biological features to be identified in the second security environment;

According to the result of the first judgment and the result of the second judgment, it is judged whether the biological feature to be identified is legal.

The embodiment of the present application provides an electronic device configured with a first security environment and a second security environment, in the first security environment, the legality of the biological feature to be identified is first determined, and in the second security environment, the identification is to be performed The legality of the biological feature is judged again to determine whether the biological feature to be identified is legal based on the result of the initial judgment and the result of the second judgment.

Optionally, in any embodiment of the present application, judging whether the biological feature to be identified is legal based on the result of the initial judgment and the result of the second judgment includes:

If the first recognition result and the second recognition result both indicate that the biometric feature to be recognized is legal, then it is determined that the biometric feature to be recognized is legal; or,

If at least one of the first recognition result and the second recognition result indicates that the biological feature to be recognized is illegal, it is determined that the biological feature to be recognized is illegal.

Optionally, in any embodiment of the present application, if the first recognition result indicates for the first time that the biological feature to be recognized is legal, then the recognition of the biological feature to be recognized in the second security environment is initiated to generate a second recognition Result; otherwise, it is directly determined that the biological feature to be identified is illegal.

Optionally, in any embodiment of the present application, the amount of data calculation when recognizing the biological feature to be identified in the first security environment is greater than the amount of data calculation when recognizing the biological feature to be recognized in the second security environment the amount.

Optionally, in any embodiment of the present application, the biometric template data corresponding to the same biometric template is scattered and stored in the first security environment and the second security environment; correspondingly,

Performing the initial judgment on the legality of the biological feature to be identified in the first security environment includes: using the biometric template data stored in the first security environment to make the initial judgment on the legality of the biological feature to be identified;

Re-judging the legitimacy of the biological feature to be identified in the second security environment includes: using the biometric template data stored in the second security environment to judge the legitimacy of the biological feature to be identified again.

Optionally, in any embodiment of the present application, the method further includes: analyzing the sample image to obtain the first biological feature to be recognized, so as to recognize the first biological feature to be recognized in the first security environment to generate the first recognition result.

Optionally, in any embodiment of the present application, the method further includes: analyzing the sample image to obtain the second biological feature to be recognized, so as to recognize the second biological feature to be recognized in the first security environment to generate a second recognition result.

Optionally, in any embodiment of the present application, the security of the first secure environment is less than the security of the second secure environment.

Optionally, in any embodiment of the present application, the first security environment is a trusted execution environment or a rich execution environment, and the second security environment is a chip-level security environment.

Optionally, in any embodiment of the present application, it further includes: according to the identity verification request of the upper-level biometric application, initiating the identification of the biometric to be identified in the first security environment to generate the first identification result, and/or , Start to recognize the biological feature to be recognized in the second security environment to generate the second recognition result.

Optionally, in any embodiment of the present application, the method further includes: the first security environment returns the first recognition result to the upper-level biometric application; and/or, the second security environment reports the The upper-level biometric application returns the second recognition result.

As can be seen from the above technical solutions, in the embodiments of the present application, the legality of the biometrics to be identified is judged for the first time in the first safe environment; the legality of the biometrics to be identified is judged again in the second safe environment; The result of the initial judgment and the result of the second judgment determine whether the biological feature to be identified is legal. It can be seen that, since the biometrics to be identified are recognized in the first security environment and the second security environment, the resource requirements for biometric identification are reduced; in addition, it is equivalent to whether the biometrics to be identified are legally performed. Double judgment, thereby improving the safety of biometric identification.

Description of the drawings

FIG. 1 is a schematic diagram of the application of the biometric identification scheme in the first embodiment of the application on electronic equipment;

2 is a schematic diagram of the flow of the biometric identification method in the second embodiment of this application;

FIG. 3 is a schematic flowchart of the biometric identification method in Embodiment 3 of this application.

Detailed ways

In order to enable those of ordinary skill in the art to better understand the technical solutions in the embodiments of the present application, the technical solutions in the embodiments of the present application are described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Therefore, other embodiments obtained by those of ordinary skill in the art based on the described embodiments should fall within the protection scope of the embodiments of the present application.

In the following embodiments of this application, the legality of the biometrics to be identified is judged for the first time in the first safe environment; the legality of the biometrics to be identified is judged again in the second safe environment; according to the result of the initial judgment And the result of the re-judgment, judging whether the biological feature to be identified is legal. It can be seen that, since the biometrics to be identified are recognized in the first security environment and the second security environment, the resource requirements for biometric identification are reduced; in addition, it is equivalent to double checking whether the biometrics to be identified are legal or not. Judgment, thereby improving the security of biometric identification.

In the following embodiments, the application of the biometric identification scheme of the embodiments of the present application to embedded electronic devices is used as an example for description, and the first security environment and the second security environment are specifically configured on them. Further, the first The security environment is a Trusted Execution Environment (TEE) or a Rich Execution Environment (REE), and the second security environment is a chip-level security environment such as a secure element (SE). In the following embodiments, the first security environment is a trusted execution environment TEE and the second security environment is a secure element SE as an example for description. However, it should be noted here that the first security environment and the second security environment are not limited to the specific environments exemplified here, as long as they can reduce the resources required for biometric identification. Requirements, and any environment that can improve the security of biometric identification.

In addition, it should be noted that the biological features to be identified in the following embodiments may be fingerprint features, palm print features, lip print features, iris features, and other biological features with identity attributes.

Figure 1 is a schematic diagram of the application of the biometric identification scheme in the first embodiment of the application on electronic equipment; as shown in Figure 1, the electronic equipment is equipped with rich execution environment REE, trusted execution environment TEE, secure element SE, rich execution The environment REE can run various third-party identity authentication applications, the trusted execution environment TEE runs the biometric authentication trusted application (Trusted Application, referred to as TA) corresponding to the third-party identity authentication application, and the secure element SE runs simultaneously A trusted application TA of biometrics corresponding to a third-party identity authentication application. Among them, the trusted application TA of biometrics in the trusted execution environment TEE is used to control the initial judgment of the legality of the biometrics to be identified according to the biometric template in the first secure environment, and to enable the secure element if necessary The biometric identification trusted application TA on the SE then re-judges the legality of the biometrics to be identified in the second security environment according to the biometric template.

Figure 2 is a schematic flow chart of the biometric identification method in the second embodiment of this application; as shown in Figure 2, it includes the following steps:

S101. Perform an initial judgment on the legality of the biological characteristics to be identified in the first security environment;

In this embodiment, the biological feature to be recognized is obtained by feature extraction on the collected biometric image. The biological feature to be recognized participates in the recognition in step S101 and also participates in the recognition in step S102, for example, if If the biometric feature is recognized as a fingerprint feature, feature extraction can be performed on the fingerprint image collected based on the capacitive sensing principle to obtain the fingerprint feature.

In this embodiment, when recognizing the biological characteristic to be identified in step S101, the biological characteristic template data stored in the first security environment is specifically used to match the biological characteristic to be identified. The biometric template data is encrypted and stored in the first security environment, and after decryption, it is matched with the biometric to be identified.

Specifically, in a specific application scenario, when encrypting the biometric template data, an AES (128-bit or 256-bit) encryption algorithm can be used to encrypt the biometric template data to generate a biometric encryption template. Exemplarily, if the AES256 encryption algorithm is used, the AES256-CBC algorithm may be specifically used, and the AES128-CBC (encryption key is 128 bits) algorithm may also be used for encryption processing. Here, for security considerations, since the security of the secure element SE is greater than the feasible execution environment TEE, the encryption processing of the biometric template is preferably performed in the secure element SE, and the encryption key is stored in the secure element SE.

What needs to be explained here is that in an application scenario, in order to increase the accuracy of recognition, the result of the initial judgment indicates for the first time that the biometric to be identified is legal, which does not mean that the biometric to be identified is only recognized once in the first security environment. In fact, it is also possible to perform multiple identifications of the biological feature to be identified in the first security environment. If the number of times the biological feature to be identified is identified as legal is at least once, it is indicated for the first time that the biological feature to be identified is legal. For example, a single press of the user on the biometrics acquisition module obtains multiple biometric sample images, feature extraction is performed on each biometric sample image to obtain the corresponding biological feature to be identified, and the multiple biometric sample images correspond to the The identification biometrics are matched with the biometric template respectively to perform multiple identifications of the biometrics to be identified. If the biometrics to be identified are identified as legal for at least once, then it is the first time that the biometrics to be identified are legal.

Alternatively, in another application scenario, a single press of the user on the biometric collection module is collected to obtain a biometric sample image, and feature extraction is performed on the biometric sample image to obtain the biometric feature to be identified. If there are multiple biometric templates to be identified, the features to be identified are matched with multiple biometric templates to perform multiple identifications of the biometrics to be identified. If the biometrics to be identified are identified as legal at least once, then It is the first time that the biometric to be identified is legal.

S102. Re-judge the legality of the biological characteristics to be identified in the second security environment;

In this embodiment, when recognizing the biological characteristics to be recognized in step S102, the biometric template data stored in the second security environment is specifically used to match the biological characteristics to be recognized. The biometric template data is encrypted and stored in the second security environment, and after decryption, it is matched with the biometric to be identified.

Specifically, in a specific application scenario, when encrypting the biometric template data, the same AES (128-bit or 256-bit) encryption algorithm as in step S101 can be used to encrypt the biometric template data to generate a biometric encryption template.

Here, it should be noted that the process of encrypting the biometric template data can be after all the biometric template data is obtained, and some of the biometric template data can be encrypted and stored in the first security environment, and the other part of the biometric template data can be encrypted. The characteristic template data is encrypted and stored in the second secure environment, that is, in the biometric registration stage, the biometric template data corresponding to the same biometric template is scattered and stored in the first secure environment and the second secure environment.

Further, the selection of the biometric template data stored in the first security environment and the second security environment can be specifically considered from the perspective of the amount of data calculation when performing biometric identification. For example, if the first security environment can support a larger amount of data calculation compared to the second security environment, when performing biometric identification, the biometric template data that consumes more resources will be encrypted and stored in the first In a secure environment, the biometric template data that consumes less resources is encrypted and stored in the second secure environment. As mentioned above, if the first secure environment is the trusted execution environment TEE, and the second secure environment is the secure element SE, the biometric template data that needs to consume more resources will be encrypted and stored in the trusted execution environment TEE , The biometric template data that needs to consume less resources is encrypted and stored in the secure element SE. In other words, it is equivalent to splitting the process of biometric identification into the first security environment and the second security environment based on the amount of data calculation; or, also known as, when identifying the biometric features to be identified in the first security environment The amount of data calculation is greater than the amount of data calculation for identifying the biological feature to be identified in the second security environment.

Since the secure element SE is a hardware-level security environment, the possibility of being attacked is extremely low, and its data security protection level is higher than that of the trusted execution environment TEE. Therefore, on the one hand, it is stored in the chip-level security environment It is more difficult for the biometric template data in the storage area to be leaked. On the other hand, the biometrics to be identified are not easy to be tampered with, thereby ensuring the security of biometric identification.

What needs to be explained here is that in an application scenario, in order to increase the accuracy of recognition, when the result of the judgment again shows that the biometric to be recognized is legal, it does not mean that the biometric to be recognized is only recognized once in the second security environment. In fact, it is also possible to perform multiple identifications of the biometrics to be identified in the second security environment. If the biometrics to be identified are identified as legal at least once, then it again indicates that the biometrics to be identified are legal. For example, a single press of the user on the biometrics acquisition module obtains multiple biometric sample images, feature extraction is performed on each biometric sample image to obtain the corresponding biological feature to be identified, and the multiple biometric sample images correspond to the The identification biometrics are matched with the biometric template respectively to perform multiple identifications of the biometrics to be identified. If the biometrics to be identified are identified as legal at least once, then the biometrics to be identified are again indicated as legal.

Alternatively, in another application scenario, one press of the user on the biometric collection module is collected to obtain a biometric sample image, and feature extraction is performed on the biometric sample image to obtain the biometric feature to be identified. If there are multiple biometric templates to be identified, the features to be identified are matched with multiple biometric templates to perform multiple identifications of the biometrics to be identified. If the biometrics to be identified are identified as legal at least once, then Again, the biometrics to be identified are legal.

S103: According to the result of the initial judgment and the result of the second judgment, finally judge whether the biological feature to be identified is legal.

In this embodiment, since the recognition processing of the biological features to be recognized in step S101 and step S102 is relatively independent or also called double isolation recognition, that is, there will be no mutual influence between step S101 and step S102, and step S101 and step S102 There is no particular limitation on the execution timing between. For this reason, in step S103, double consideration is performed according to the result of the initial judgment obtained in step S101 and the result of second judgment obtained in step S102, so as to finally judge the to-be-identified Whether the biometric is legal.

Specifically, if the result of the initial judgment and the result of the second judgment both indicate that the biological feature to be identified is legal, then the biological feature to be identified is judged to be legal; if the result of the initial judgment and the result of the second judgment are If at least one of the results indicates that the biological feature to be identified is illegal, it is finally determined that the biological feature to be identified is illegal. For example, if the biometric template data in the first security environment is illegally tampered with, or the biometric feature to be recognized recognized in the first security environment is illegally tampered with, the result of the initial judgment will indicate that the biometric feature to be recognized It is illegal, and for the second security environment, there will be similar situations. It can be seen that through the above-mentioned double isolation identification, the safety of biometric identification can be ensured. In addition, performing the identification of the biological characteristics to be identified in the first safe environment and the second safe environment, respectively, also effectively guarantees the timeliness of the biometric identification.

Here, it should be noted that, according to the identity verification request of the upper-level biometric application, the initial determination of the legality of the biometric to be identified in the first security environment is initiated in step S101, and the second security environment is initiated in step S102. The legality of the biometrics to be identified is judged again.

Fig. 3 is a schematic flowchart of the biometric identification method in the third embodiment of this application; as shown in Fig. 3, it includes the following steps:

S201: Perform an initial judgment on the legality of the biological feature to be identified in the first security environment to generate a first identification result;

In this embodiment, step S201 is similar to step S101. For details, please refer to the record in the first embodiment. However, unlike the above-mentioned embodiment, the biometric feature to be recognized in step S201 is the first biometric feature to be recognized by analyzing the biometric image in the first secure environment, in other words, in the first secure environment in step S201 Recognizing the first biological feature to be recognized generates a first recognition result.

S202. According to the first recognition result, determine for the first time whether the biological feature to be recognized is legal; if it is legal, perform step S203, otherwise, perform step S206;

The difference from the above-mentioned embodiment is that, as mentioned above, the first secure environment is a trusted execution environment TEE, and the second secure environment is a secure element SE. Because the security of the trusted execution environment TEE is less than that of the secure element SE Therefore, in order to further improve the timeliness and simplify the technical processing process, the first recognition result is used as the triggering condition for the subsequent biometric recognition to be recognized in the second security environment. Specifically, when the first recognition result indicates that the biometrics to be recognized are legal for the first time, the recognition of the biometrics to be recognized in the second security environment is started, which is different from the above-mentioned first embodiment. There is no absolute time sequence dependency between the identification of the biological characteristics to be identified in the safe environment and the identification of the biological characteristics to be identified in the first safe environment. When the first recognition result indicates that the biological feature to be recognized is illegal for the first time, it can be directly determined that the biological feature to be recognized is illegal, and the subsequent step S203 is not executed.

It should be noted here that in an application scenario, in order to increase the accuracy of recognition, when the first recognition result indicates for the first time that the biometric to be recognized is legal, it does not mean that the biometric to be recognized is only recognized once in the first security environment. In fact, it is also possible to perform multiple identifications of the biological feature to be identified in the first security environment, and generate the first identification result according to the results of the multiple identifications. If the number of times the biological feature to be recognized is recognized as legal is at least once, the first recognition result in which the biological feature to be recognized is recognized as legal is finally generated. For example, a single press of the user on the biometrics acquisition module obtains multiple biometric sample images, feature extraction is performed on each biometric sample image to obtain the corresponding biological feature to be identified, and the multiple biometric sample images correspond to the The identification biometrics are matched with the biometric template respectively to perform multiple identifications of the biometrics to be identified, and the first identification result is generated according to the results of the multiple identifications; if the biometrics to be identified are identified as legal at least once, Then, the first recognition result in which the biological feature to be recognized is recognized as legal is finally generated.

Alternatively, in another application scenario, a single press of the user on the biometric collection module is collected to obtain a biometric sample image, and feature extraction is performed on the biometric sample image to obtain the biometric feature to be identified. If there are multiple biometric templates to be judged, the features to be identified are matched with the multiple biometric templates to perform multiple identifications of the biological features to be identified, and the first identification result is generated according to the results of the multiple identifications; It is recognized that the biological feature is recognized as legal at least once, and then the first recognition result in which the biological feature to be recognized is recognized as legal is finally generated.

S203: Perform a second judgment on the legality of the biological feature to be identified in the second security environment to generate a second identification result;

In this embodiment, the execution of step S203 is based on the first identification result in step S201 indicating that the biometric to be identified is legal as a trigger condition. The specific identification process is similar to step S102 in the first embodiment. For details, please refer to the above This is the first embodiment.

The difference from the first embodiment above is that, in order to prevent the biometric feature to be identified from being tampered with, in this embodiment, the biometric feature to be identified participating in the re-judgment in step S203 is the first biometric feature extracted from the collected biometric image. The second biological feature to be recognized is equivalent to the second recognition result generated by recognizing the second biological feature to be recognized in the second security environment. It should be noted here that the biometric images are collected on the same part of the same user.

S204. According to the second recognition result, judge again whether the biological feature to be recognized is legal, if legal, execute step S205, otherwise, execute step S206.

In this embodiment, performing identification based on the second identification result in step S204 is equivalent to re-checking or confirming the result that was first determined to be legal in step S202. In fact, since the second security environment is the secure element SE, its security is higher than that of the trusted execution environment TEE as the first security environment. Therefore, it is equivalent to the step S202 through a higher security security environment. The result that is judged as legal for the first time shall be re-checked or confirmed to further ensure the safety of the biometric identification process. In addition, as mentioned above, the recognition processing in the second security environment is based on the premise that the first recognition result indicates that the biometric to be recognized is legal for the first time, and it does not need to be executed again when the first recognition result indicates that the biometric to be recognized is illegal for the first time The identification process performed in the second security environment, therefore, compared with the first embodiment, the overall flow of biometric identification is optimized, which further improves the timeliness of identification.

It should be noted here that in an application scenario, in order to increase the accuracy of recognition, when the second recognition result again shows that the biometric to be recognized is legal, it does not mean that the biometric to be recognized is only recognized once in the second security environment In fact, it is also possible to perform multiple identifications of the biological features to be identified in the second security environment, and generate the second identification result according to the results of the multiple identifications. If the number of times the biological feature to be recognized is recognized as legal is at least once, a second recognition result in which the biological feature to be recognized is recognized as legal is finally generated. For example, a single press of the user on the biometric acquisition module obtains multiple biometric sample images, and feature extraction is performed on each biometric sample image to obtain the corresponding biometric feature to be identified. The identification biometrics are matched with the biometric template to perform multiple identifications of the biometrics to be identified, and a second identification result is generated according to the results of the multiple identifications; if the biometrics to be identified are identified as legal at least once, Finally, a second recognition result in which the biological feature to be recognized is recognized as legal is generated.

Alternatively, in another application scenario, one press of the user on the biometric collection module is collected to obtain a biometric sample image, and feature extraction is performed on the biometric sample image to obtain the biometric feature to be identified. If there are multiple biometric templates to be identified, the features to be identified are matched with the multiple biometric templates to perform multiple identifications of the biological features to be identified, and the second identification result is generated according to the results of the multiple identifications; It is recognized that the biological feature is recognized as legal at least once, and the second recognition result in which the biological feature to be recognized is recognized as legal is finally generated.

S205: Determine that the biometric to be identified is legal, and feed back the determination result that the biometric to be identified is legal to the upper-level biometric application;

S206. Determine that the biological feature to be identified is illegal, and feed back the judgment result that the biological feature to be identified is illegal to the upper-level biological feature application.

Referring to the above steps S205 and S206, if the biological feature to be identified is determined to be illegal according to the first recognition result, the first security environment can feed back the result of this determination to the upper-level feature; and if it is determined based on the first recognition result If the biological feature to be identified is legal, and based on the second identification result, it is determined that the biological feature to be identified is illegal, then the second security environment can feed back the result of this determination to the upper biometric application. However, considering that the security level of the second security environment is greater than that of the first security environment, it is equivalent to determining that the biometric to be recognized is legal based on the second recognition result, then the result of the re-determination can be considered accurate, or the above The result of the initial determination is confirmed, which is equivalent to that the result of the second determination comes from a safer environment, that is, the second safe environment. The determination result of the legality of the biometric to be identified is more reliable. Therefore, in this embodiment, when the second determination is made When the biometric to be identified is legal, it is preferable that the second security environment feeds back the result of re-determining the legality of the biometric to be identified to the upper biometric application, so as to ensure the safety of subsequent upper biometric applications.

Here, it should be noted that the difference from the first embodiment above is that according to the identity verification request of the upper-level biometric application, the identification of the biometric to be identified in the first security environment is initiated to generate the first identification result; When the first recognition result determines that the biological feature to be recognized is legal for the first time, the recognition of the biological feature to be recognized in the second security environment is started to generate a second recognition result.

The above-mentioned products can execute the methods provided in the embodiments of the present application, and have functional modules and beneficial effects corresponding to the execution methods. For technical details not described in detail in this embodiment, please refer to the method provided in the embodiment of this application.

The electronic devices in the embodiments of this application exist in various forms, including but not limited to:

(1) Mobile communication equipment: This type of equipment is characterized by mobile communication functions, and its main goal is to provide voice and data communications. Such terminals include: smart phones (such as iPhone), multimedia phones, functional phones, and low-end phones.

(2) Ultra-mobile personal computer equipment: This type of equipment belongs to the category of personal computers, has calculation and processing functions, and generally also has mobile Internet features. Such terminals include: PDA, MID and UMPC devices, such as iPad.

(3) Portable entertainment equipment: This type of equipment can display and play multimedia content. Such devices include: audio, video players (such as iPod), handheld game consoles, e-books, as well as smart toys and portable car navigation devices.

(4) Server: A device that provides computing services. The composition of a server includes a processor 810, hard disk, memory, system bus, etc. The server is similar to a general computer architecture, but because it needs to provide highly reliable services, it has High requirements in terms of performance, reliability, security, scalability, and manageability.

(5) Other electronic devices with data interaction functions.

So far, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions recited in the claims can be performed in a different order and still achieve desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or sequential order shown in order to achieve the desired result. In certain embodiments, multitasking and parallel processing may be advantageous.

In the 1990s, the improvement of a technology can be clearly distinguished between hardware improvements (for example, improvements in circuit structures such as diodes, transistors, switches, etc.) or software improvements (improvements in method flow). However, with the development of technology, the improvement of many methods and processes of today can be regarded as a direct improvement of the hardware circuit structure. Designers almost always get the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be realized by hardware entity modules. For example, a programmable logic device (Programmable Logic Device, PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user's programming of the device. It is programmed by the designer to "integrate" a digital system on a PLD without requiring the chip manufacturer to design and manufacture a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly realized by "logic compiler" software, which is similar to the software compiler used in program development and writing. The original code must also be written in a specific programming language, which is called Hardware Description Language (HDL), and there is not only one type of HDL, but many types, such as ABEL (Advanced Boolean Expression Language) , AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description), etc., currently most commonly used It is VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. It should also be clear to those skilled in the art that just a little bit of logic programming of the method flow in the above-mentioned hardware description languages and programming into an integrated circuit, the hardware circuit that implements the logic method flow can be easily obtained.

The controller can be implemented in any suitable manner. For example, the controller can take the form of, for example, a microprocessor or a processor and a computer-readable medium storing computer-readable program codes (such as software or firmware) executable by the (micro)processor. , Logic gates, switches, application specific integrated circuits (ASICs), programmable logic controllers and embedded microcontrollers. Examples of controllers include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20 and Silicon Labs C8051F320, the memory controller can also be implemented as a part of the memory control logic. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, it is entirely possible to program the method steps to make the controller use logic gates, switches, application specific integrated circuits, programmable logic controllers and embedded The same function can be realized in the form of a microcontroller, etc. Therefore, such a controller can be regarded as a hardware component, and the devices included in it for implementing various functions can also be regarded as a structure within the hardware component. Or even, the device for realizing various functions can be regarded as both a software module for realizing the method and a structure within a hardware component.

The systems, devices, modules, or units illustrated in the above embodiments may be specifically implemented by computer chips or entities, or implemented by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cell phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or Any combination of these devices.

For the convenience of description, when describing the above device, the functions are divided into various units and described separately. Of course, when implementing this application, the functions of each unit can be implemented in the same one or more software and/or hardware.

Those skilled in the art should understand that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

This application is described with reference to flowcharts and/or block diagrams of methods, equipment (systems), and computer program products according to the embodiments of this application. It should be understood that each process and/or block in the flowchart and/or block diagram, and the combination of processes and/or blocks in the flowchart and/or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing equipment to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing equipment are generated It is a device that realizes the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device. The device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment. The instructions provide steps for implementing functions specified in a flow or multiple flows in the flowchart and/or a block or multiple blocks in the block diagram.

In a typical configuration, the computing device includes one or more processors (CPU), input/output interfaces, network interfaces, and memory.

The memory may include non-permanent memory in computer readable media, random access memory (RAM) and/or non-volatile memory, such as read-only memory (ROM) or flash memory (flash RAM). Memory is an example of computer readable media.

Computer-readable media include permanent and non-permanent, removable and non-removable media, and information storage can be realized by any method or technology. The information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disc (DVD) or other optical storage, Magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media can be used to store information that can be accessed by computing devices. According to the definition in this article, computer-readable media does not include transitory media, such as modulated data signals and carrier waves.

It should also be noted that the terms "include", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, product or equipment including a series of elements not only includes those elements, but also includes Other elements that are not explicitly listed, or include elements inherent to this process, method, commodity, or equipment. If there are no more restrictions, the element defined by the sentence "including a..." does not exclude the existence of other identical elements in the process, method, commodity, or equipment that includes the element.

Those skilled in the art should understand that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, this application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

This application may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific transactions or implement specific abstract data types. This application can also be practiced in distributed computing environments. In these distributed computing environments, remote processing devices connected through a communication network execute transactions. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, as for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and for related parts, please refer to the part of the description of the method embodiment.

The above descriptions are only examples of this application and are not used to limit this application. For those skilled in the art, this application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this application shall be included in the scope of the claims of this application.

Claims

A biometric identification method, characterized in that it comprises:

Make an initial judgment on the legality of the biological features to be identified in the first security environment, and make a second judgment on the legality of the biological features to be identified in the second security environment;

According to the result of the initial judgment and the result of the second judgment, it is finally judged whether the biological feature to be identified is legal.
The method according to claim 1, wherein, according to the result of the initial judgment and the result of the second judgment, finally judging whether the biological feature to be identified is legal comprises:

If the result of the initial judgment and the result of the second judgment both show that the biological feature to be identified is legal, then it is judged that the biological feature to be identified is legal; or,

If at least one of the result of the initial judgment and the result of the second judgment indicates that the biological feature to be identified is illegal, it is determined that the biological feature to be identified is illegal.
The method according to claim 2, characterized in that, if the result of the initial judgment indicates that the biological feature to be identified is legal for the first time, then start to judge the legality of the biological feature to be identified in the second security environment; otherwise; , Directly determine that the biological feature to be identified is illegal.
The method according to claim 1, characterized in that the amount of data calculation for the initial determination of the legality of the biological feature to be identified in the first security environment is greater than that of the legality of the biological feature to be identified in the second security environment. The amount of data calculation for re-judgment.
The method according to claim 1, wherein the biometric template data corresponding to the same biometric template is stored in the first security environment and the second security environment; correspondingly,

Performing the initial judgment on the legality of the biological feature to be identified in the first security environment includes: using the biometric template data stored in the first security environment to make the initial judgment on the legality of the biological feature to be identified;

Re-judging the legitimacy of the biological feature to be identified in the second security environment includes: using the biometric template data stored in the second security environment to judge the legitimacy of the biological feature to be identified again.
The method according to claim 1, further comprising: analyzing the sample image to obtain the first biological feature to be identified, so as to make an initial judgment on the legality of the first biological feature to be identified in the first security environment.
The method according to claim 6, further comprising: analyzing the sample image to obtain the second biological feature to be identified, so as to judge the legality of the second biological feature to be identified in the second security environment.
The method according to any one of claims 1-7, wherein the security of the first security environment is less than the security of the second security environment.
The method according to claim 8, wherein the first security environment is a trusted execution environment or a rich execution environment, and the second security environment is a chip-level security environment.
The method according to any one of claims 1-9, further comprising: initiating an initial judgment on the legality of the biometric to be identified in the first security environment according to the identity verification request of the upper-level biometric application, and /Or, initiate another judgment on the legality of the biological feature to be identified in the second security environment.
The method according to claim 11, further comprising: the first security environment returns the first recognition result to the upper biometric application; and/or, the second security environment reports the The upper biometric application returns the second recognition result.
An electronic device, characterized in that it is configured with a first security environment and a second security environment, in the first security environment to make an initial judgment on the legality of the biological feature to be identified, and in the second security environment The legality of the biological feature to be identified is judged again in order to finally judge whether the biological feature to be identified is legal according to the result of the initial judgment and the result of the second judgment.
The electronic device according to claim 12, wherein the amount of data calculation for the initial determination of the legality of the biological feature to be identified in the first security environment is greater than that of the biological feature to be identified in the second security environment. The amount of data calculation when re-judging the legitimacy of biometrics.
The electronic device according to claim 12, wherein the biometric template data corresponding to the same biometric template is stored in the first security environment and the second security environment in a dispersed manner.
The electronic device according to any one of claims 12-14, wherein the security of the first secure environment is less than the security of the second secure environment.
The electronic device according to claim 15, wherein the first security environment is a trusted execution environment or a rich execution environment, and the second security environment is a chip-level security environment.