WO2022027948A1

WO2022027948A1 - Client, cloud server and identity recognition method therefor, system, and computer storage medium

Info

Publication number: WO2022027948A1
Application number: PCT/CN2021/075547
Authority: WO
Inventors: 周雍恺; 于文海; 钱进; 乔萧雅; 刘国宝; 孙权
Original assignee: 中国银联股份有限公司
Priority date: 2020-08-03
Filing date: 2021-02-05
Publication date: 2022-02-10
Also published as: CN112418863B; TWI781546B; CN112418863A; TW202207130A

Abstract

An identity recognition method executed by a client, the method comprising: collecting biometric information of a user (S110); extracting a first feature value from the biometric information by using a first extraction algorithm pre-stored in the client (S120); sending a first comparison request message containing the first feature value to a cloud server (S130); after comparison is successful, receiving a second extraction algorithm from the cloud server, the second extraction algorithm being an updated version of the first extraction algorithm (S140); extracting a second feature value from the biometric information by using the second extraction algorithm (S150); and sending a registration message containing the second feature value to the cloud server so as to store the second feature value (S160).

Description

Client, cloud server and identification method, system and computer storage medium thereof

【Technical field】

This application claims the priority of a Chinese patent application (application number: 202010766784.4), and this application relates to an identification scheme, more particularly, to a client, a cloud server and an identification method thereof, a computer storage medium and an identification system.

【Background technique】

In recent years, biometrics (such as face, fingerprint, etc.) have gradually become mainstream identification methods due to their close relationship with individual identities. There are many applications in important financial scenarios such as withdrawals, payments, and mobile banking logins. Most of the current biometric identification systems directly collect and store the original plaintext images of biometrics (such as the original images of faces and fingerprints). This solution can achieve good biometric matching, but at the same time there is a huge security Hidden dangers and privacy compliance issues, because once biometric data is leaked, it cannot be changed or destroyed, and biometrics are related to user privacy. Directly collecting and storing plaintext original images will pose compliance risks.

Therefore, an improved identification scheme is desired.

[Content of the invention]

According to an aspect of the present invention, there is provided an identification method performed by a client, the method comprising: collecting biometric information of a user; using a first extraction algorithm pre-stored in the client to extract information from the biometric information extracting a first feature value; sending a first comparison request message containing the first feature value to a cloud server; receiving a second extraction algorithm from the cloud server, where the second extraction algorithm is the first extraction algorithm using the second extraction algorithm to extract a second feature value from the biometric information; and sending a registration message containing the second feature value to the cloud server for storing the second feature value .

As a supplement or alternative to the above solution, the above-mentioned identification method may further include deleting the first extraction algorithm.

As a supplement or replacement to the above solution, in the above identification method, the first comparison request message and the registration message are both encrypted and transmitted.

As a supplement or alternative to the above solution, in the above identification method, the first comparison request message further includes the identification number of the first extraction algorithm, and the registration message further includes the identification number of the second extraction algorithm.

As a supplement or alternative to the above solution, in the above identification method, after the comparison is passed and there is a second extraction algorithm with a newer version than the first extraction algorithm, the second extraction algorithm is received from the cloud server. algorithm.

As a supplement or alternative to the above solution, the above identification method may further include: collecting second biometric information of the user; extracting from the second biometric information by using the second extraction algorithm in the client a third feature value; and sending a second comparison request message containing the third feature value and the identification number of the second extraction algorithm to the cloud server.

According to another aspect of the present invention, a client for identity identification is provided, the client comprising: a collection device for collecting biometric information of a user; an extraction device for using pre-stored information in the client The first extraction algorithm extracts the first feature value from the biological feature information; the sending device is used to send the first comparison request message containing the first feature value to the cloud server; and the receiving device is used for in the After the comparison is passed, a second extraction algorithm is received from the cloud server, and the second extraction algorithm is an updated version of the first extraction algorithm, wherein the extraction device is further configured to use the second extraction algorithm from the extracting a second feature value from the biometric information, and the sending device is further configured to send a registration message including the second feature value to the cloud server so as to store the second feature value.

As a supplement or alternative to the above solution, the above client may further include a deletion device for deleting the first extraction algorithm.

As a supplement or alternative to the above solution, in the above client, the sending device is configured to encrypt and transmit the first comparison request message and the registration message.

As a supplement or replacement to the above solution, in the above client, the first comparison request message further includes the identification number of the first extraction algorithm, and the registration message also includes the identification number of the second extraction algorithm.

As a supplement or alternative to the above solution, in the above client, the receiving device is configured to receive from the cloud server after the comparison is passed and when there is a second extraction algorithm with a newer version than the first extraction algorithm the second extraction algorithm.

As a supplement or alternative to the above solution, in the above client, the collection device is further configured to collect the second biometric information of the user; the extraction device is further configured to use the second biometric information in the client An extraction algorithm extracts a third feature value from the second biometric information; and the sending device is further configured to send a second comparison request message containing the third feature value and the identification number of the second extraction algorithm sent to the cloud server.

According to yet another aspect of the present invention, there is provided an identity recognition method executed by a cloud server, the method comprising: receiving a first comparison request message including a first feature value from a client, the first feature value is obtained by using The first extraction algorithm pre-stored in the client is extracted from the collected biometric information of the user; the first characteristic value is compared with the characteristic value library in the cloud server; after the comparison is passed And when there is a second extraction algorithm with a newer version than the first extraction algorithm, send the second extraction algorithm to the client; receive a registration message including the second feature value from the client, the first extraction algorithm The second feature value is extracted from the previously collected biometric information using the second extraction algorithm; and the second feature value is stored in the feature value library.

As a supplement or alternative to the above solution, the above identification method may further include: after storing the second characteristic value in the characteristic value library, removing the first characteristic value from the characteristic value library the corresponding record.

As a supplement or replacement to the above solution, in the above identification method, the feature value library includes a first sub-feature value library corresponding to the first extraction algorithm and a second sub-feature value library corresponding to the second extraction algorithm an eigenvalue library, wherein records corresponding to the first eigenvalues are stored in the first sub-eigenvalue library, and records corresponding to the second eigenvalues are stored in the second sub-eigenvalue library .

As a supplement or replacement to the above solution, in the above identification method, when the number of records in the first sub-feature value library drops to 0, the association module corresponding to the first extraction algorithm is deleted.

According to yet another aspect of the present invention, a cloud server is provided, the cloud server comprising: a receiving device for receiving a first comparison request message including a first feature value from a client, the first feature value is Extracted from the collected biometric information of the user by using the first extraction algorithm pre-stored in the client; a comparison device, configured to compare the first characteristic value with the characteristic value library in the cloud server pair; a sending device for sending the second extraction algorithm to the client after the comparison is passed and when there is a second extraction algorithm with a newer version than the first extraction algorithm; and a storage device for storing a second characteristic value in the characteristic value library, wherein the receiving means is further configured to receive a registration message from the client comprising the second characteristic value, the second characteristic value being obtained using the The second extraction algorithm is extracted from the previously collected biometric information.

As a supplement or replacement to the above solution, in the above cloud server, the first comparison request message and the registration message are both encrypted and transmitted.

As a supplement or alternative to the above solution, in the above cloud server, the first comparison request message further includes the identification number of the first extraction algorithm, and the registration message further includes the identification number of the second extraction algorithm.

As a supplement or replacement to the above solution, the above cloud server may further include: a removing device, configured to remove from the eigenvalue library after storing the second eigenvalue in the eigenvalue library The record corresponding to the first eigenvalue is described.

As a supplement or alternative to the above solution, in the above cloud server, the feature value library includes a first sub-feature value library corresponding to the first extraction algorithm and a second sub-feature corresponding to the second extraction algorithm A value library, wherein records corresponding to the first feature values are stored in the first sub-feature value library, and records corresponding to the second feature values are stored in the second sub-feature value library.

As a supplement or replacement to the above solution, in the above cloud server, the removing device is further configured to delete the corresponding data of the first extraction algorithm when the number of records in the first sub-feature value library decreases to 0 Associated modules.

According to yet another aspect of the present invention, there is provided a computer storage medium, the medium comprising instructions that, when executed, perform the aforementioned identification method.

According to yet another aspect of the present invention, an identification system is provided, which includes the aforementioned client and a cloud server.

Compared with the existing identification scheme, the identification scheme according to one or more embodiments of the present invention does not directly store the plaintext of biological information or the original image (such as the original image of the face and fingerprint), but adopts the transmission and storage method. The method of biometric feature value, thereby protecting the original biometric information from leakage. In addition, through the comparison of eigenvalues, the authenticity of the identity can also be determined. Compared with the plaintext image, the eigenvalue is obviously much less recognizable to the naked eye, so that the biological privacy of the individual can be protected to a certain extent.

In addition, the identity recognition solution of one or more embodiments of the present invention can be insensitive to the user without requiring the user to collect biometric information again when the extraction algorithm is upgraded. Moreover, the client does not need to maintain and store multiple sets of biometric extraction algorithms, and almost does not increase the burden of processing and storage on the client, so that the identity recognition solution of one or more embodiments of the present invention can ensure the privacy of biometrics. At the same time, the availability and ease of use of algorithm upgrades are realized.

【Description of drawings】

The above and other objects and advantages of the present invention will be more fully apparent from the following detailed description taken in conjunction with the accompanying drawings, wherein the same or similar elements are designated by the same reference numerals.

FIG. 1 shows a schematic flowchart of an identification method performed by a client according to an embodiment of the present invention;

2 shows a schematic structural diagram of a client for identity identification according to an embodiment of the present invention;

FIG. 3 shows a schematic flowchart of an identification method performed by a cloud server according to an embodiment of the present invention; and

4 shows a schematic structural diagram of a cloud server for identity identification according to an embodiment of the present invention;

FIG. 5 shows a smooth upgrade scheme of an identity recognition system in an algorithm update scenario according to an embodiment of the present invention; and

FIG. 6 shows the identification process of the identification system according to an embodiment of the present invention.

【detailed description】

The embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples. The following examples are intended to illustrate the present invention, but not to limit the scope of the present invention.

In the description of this specification, description with reference to the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples", etc., mean specific features described in connection with the embodiment or example , structures, materials, or features are included in at least one example or example of embodiments of the present invention. In this specification, schematic representations of the above terms are not necessarily directed to the same embodiment or example. Furthermore, the particular features, structures, materials or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, the terms "first", "second", and "third" are used for descriptive purposes only and should not be construed to indicate or imply relative importance. Furthermore, those skilled in the art may combine and combine the different embodiments or examples described in this specification, as well as the features of the different embodiments or examples, without conflicting each other.

FIG. 1 shows a schematic flowchart of an identity recognition method 1000 performed by a client according to an embodiment of the present invention. As shown in Figure 1, method 1000 includes the following steps:

In step S110, collect the biometric information of the user;

In step S120, a first feature value is extracted from the biometric information by using a first extraction algorithm pre-stored in the client;

In step S130, a first comparison request message containing the first feature value is sent to the cloud server;

In step S140, a second extraction algorithm is received from the cloud server, and the second extraction algorithm is an updated version of the first extraction algorithm;

In step S150, using the second extraction algorithm to extract a second feature value from the biometric information; and

In step S160, a registration message containing the second characteristic value is sent to the cloud server so as to store the second characteristic value.

In the context of the present invention, the term "client" is also referred to as a client, and refers to a device or device corresponding to a cloud server that provides local services to clients. In one or more embodiments, the client has some basic functions, including a collection function of collecting biometric information of a user, and extracting data of feature values from the collected biometric information by using an extraction algorithm pre-stored in the client processing functions, etc. The client may be a user's smart device, including but not limited to, the user's mobile phone, a laptop computer, and a head-mounted device.

The term "cloud server" is also referred to as a remote server, which refers to a device or device corresponding to a "client" that provides remote services for the client. In one or more embodiments, the cloud server can provide the client with an online comparison function, which is to compare the feature value received from the client with the feature value library in the cloud server. Moreover, the cloud server can also send the updated extraction algorithm to the client after the comparison is passed and there is an updated version of the extraction algorithm.

In the context of the present invention, the term "biometric information" refers to any information inherent in the human body that can be used for personal identification, including, but not limited to, physiological characteristics (eg, fingerprints, iris, facial features, DNA, etc.) and Behavioral characteristics (gait, keystroke habits, etc.). The term "feature value" refers to an attribute extracted or calculated from biometric information by a specific algorithm, such as an extraction algorithm.

The term "extraction algorithm", also known as "biometric recognition algorithm", refers to an algorithm capable of extracting or calculating feature values from biometric information. The extraction algorithm may be adjusted and updated according to the actual situation, so in one or more embodiments, the extraction algorithm may have different versions, for example, to be distinguished by identification numbers.

In step S110, the client may collect the biometric information of the user in various ways. For example, the client can collect the user's fingerprint information through a pre-installed fingerprint identification module. For another example, the client may collect the user's facial information through a camera. For another example, the client can obtain the user's biometric information with the assistance of a third-party device, for example, through a light-reflecting diode that transmits infrared light into a small piece of skin and obtains the user's biometric information (such as the skin) by measuring the wavelength of the reflected light. thickness, cortical structure, etc.), and thereby confirm the identity of the person.

In step S120, a first feature value is extracted from the biometric information by using a first extraction algorithm pre-stored in the client. Here, the terms "first", "second" and "third" are used for descriptive distinction purposes only, and should not be construed as indicating or implying relative importance. It can be understood that although the "first extraction algorithm" and the "second extraction algorithm" are both extraction algorithms, they are different from each other, and thus are distinguished by the terms "first" and "second". The analogy can be made for "first eigenvalue", "second eigenvalue", and "third eigenvalue".

In one or more embodiments of the invention, the client only needs to store one version of the extraction algorithm. When receiving a new version of the extraction algorithm from the cloud server, for example, when receiving the second extraction algorithm, the client can use the second extraction algorithm to replace the first extraction algorithm, so as to avoid maintaining multiple sets of different versions of biometric identification algorithms or extraction algorithms at the same time. The algorithm reduces the complexity and storage burden of the client.

In step S130, a first comparison request message including the first feature value is sent to the cloud server. In one embodiment, the first feature value is encrypted and distributed first, and then transmitted to the cloud server over a secure channel. In one embodiment, in addition to the first feature value, the first comparison request message further includes an identification number or version number of the first extraction algorithm. This is particularly advantageous when there are multiple versions of the extraction algorithm. Through the identification number of the extraction algorithm in the first comparison request message, the cloud server can know which version of the extraction algorithm is used to calculate the feature value contained in the comparison request message. obtained, and thus select an appropriate library of eigenvalues for comparison. Specifically, after the eigenvalue is transmitted to the cloud server, the eigenvalue comparison algorithm of the cloud server will perform a 1:1 or 1:N comparison between the eigenvalue and the eigenvalue library, so as to verify and judge the verification value this time. Whether the distance from the registered feature value is within a threshold interval.

It should be noted that the feature value is sent in the comparison request message, rather than the biometric information or the original image directly, which can protect the biological privacy of individuals to a certain extent.

When the biometric identification algorithm or extraction algorithm of the system is updated, as a client, in one embodiment, multiple sets of biometric identification algorithms of different versions need to be maintained, which increases the complexity of the system and increases the storage burden of the client. In addition, in order to calculate the feature value under the new algorithm, the client has to collect the biometric information of the entity again, which will bring an unfriendly user experience.

Therefore, in an embodiment of the present invention, referring to step S140, a second extraction algorithm is received from the cloud server, and the second extraction algorithm is an updated version of the first extraction algorithm. That is to say, when there are multiple sets of different versions of biometric identification algorithms, the client does not need to maintain multiple sets of algorithms locally, but only needs to receive them from the cloud server, thereby reducing the cost of algorithm update and upgrade. In addition, the upgrade of the extraction algorithm is performed at the moment when the client initiates a new verification comparison. That is, after the cloud server receives the comparison request message, it will determine whether there is an updated version of the biometric feature extraction algorithm used by the client. If there is an updated version and the feature value in the comparison request message is successfully matched, the cloud server will The version of the algorithm is sent to the client.

Next, in step S150, the client uses a second extraction algorithm to extract a second feature value from the biometric information. It should be noted that the client still uses the user's biometric information collected in step S110 (instead of re-collecting the user's biometric information) as the basis of the second extraction algorithm to calculate the second characteristic value. In other words, the client calculates the feature value (eg, the second feature value) of the new version by using the biometric information that has passed the comparison of the old version as the biometric information registered in the new version, so as to achieve a "non-sensing" upgrade.

In step S160, a registration message including the second characteristic value is sent to the cloud server so as to store the second characteristic value. In one embodiment, the first comparison request message and the registration message are both encrypted and transmitted. In one embodiment, the registration message may further include an identification number or version number of the second extraction algorithm. This is particularly advantageous when there are multiple versions of the extraction algorithm. Through the identification number or version number of the extraction algorithm in the registration message, the cloud server can register the second feature value in the feature value library (sub-library) corresponding to the version, Facilitate appropriate comparisons in the future.

Although not shown in FIG. 1 , in one embodiment, the identification method 1000 performed by the client also includes deleting the first extraction algorithm. In this way, the client deletes the first extraction algorithm and retains only the second extraction algorithm. The effect is that the client maintains only one version of the algorithm, which reduces the complexity.

In one embodiment, the identification method 1000 performed by the client may further include: collecting second biometric information of the user; using the second extraction algorithm in the client to extract information from the second biometric information extracting a third feature value; and sending a second comparison request message containing the third feature value and the identification number of the second extraction algorithm to the cloud server.

In this way, through the identification number of the second extraction algorithm, the cloud server can select an appropriate eigenvalue (sub) library to compare with the third eigenvalue, which reduces the complexity of the comparison.

In one embodiment, when storing eigenvalues, a secure multi-party computation (Secure Multi-Party Computation, MPC or SMPC) method is used to store and identify the secret state, and such a security protection level can be higher. The so-called secure multi-party computing is to solve the collaborative computing problem of privacy protection between a group of distrusting participants. Other members involved in the calculation. Each secure multi-party computing participating node has the same status, can initiate collaborative computing tasks, or choose to participate in computing tasks initiated by other parties. Routing addressing and computing logic transmission are controlled by the hub node, looking for relevant data to transmit computing logic at the same time. Each secure multi-party computing node completes data extraction and calculation in the local database according to the calculation logic, and routes the output calculation result to the designated node, so that the multi-party node completes the collaborative computing task and outputs the unique result. In the whole process, all data of all parties is local and not provided to other nodes. Under the condition of ensuring data privacy, the calculation results are fed back to the entire computing task system, so that all parties can get correct data feedback.

Therefore, under the basic premise of not storing the plaintext of biometric features, the identity recognition method 1000 executed by the client can also realize that the user is insensitive when the extraction algorithm is updated, and at the same time, it hardly increases the burden of processing and storage on the client. , so that the biometric recognition system based on feature value can ensure the privacy of biometric features, and at the same time can realize the availability and ease of use of algorithm upgrade.

FIG. 2 shows a schematic structural diagram of a client 2000 for identity recognition according to an embodiment of the present invention. As shown in FIG. 2 , the client 2000 includes a collecting device 210 , an extracting device 220 , a sending device 230 and a receiving device 240 . Wherein, the collecting device 210 is used for collecting the biometric information of the user; the extracting device 220 is used for extracting the first feature value from the biometric information by using the first extraction algorithm pre-stored in the client; the sending device 230 is used for extracting the first feature value from the biometric information; Sending a first comparison request message including the first feature value to the cloud server; and the receiving device 240 is configured to receive a second extraction algorithm from the cloud server, where the second extraction algorithm is part of the first extraction algorithm The updated version, wherein the extracting means 220 is further configured to extract a second feature value from the biometric information by using the second extraction algorithm, and the sending device 230 is further configured to A registration message is sent to the cloud server for storing the second characteristic value.

The collecting device 210 may collect the biometric information of the user in various ways. For example, the collection device 210 may collect the user's fingerprint information through a pre-installed fingerprint identification module. For another example, the collecting device 210 may collect the facial information of the user through a camera. For another example, the collection device 210 can obtain the user's biometric information with the assistance of a third-party device, for example, by using a light-reflecting diode to inject infrared light into a small piece of skin, and obtain the user's biometric information by measuring the wavelength of the reflected light, and obtain the user's biometric information. to confirm the identity of the person.

The extraction device 220 uses the first extraction algorithm pre-stored in the client 2000 to extract the first feature value from the biological feature information. Here, the terms "first", "second" and "third" are used for descriptive distinction purposes only, and should not be construed as indicating or implying relative importance. It can be understood that although the "first extraction algorithm" and the "second extraction algorithm" are both extraction algorithms, they are different from each other, and thus are distinguished by the terms "first" and "second". The analogy can be made for "first eigenvalue", "second eigenvalue", and "third eigenvalue".

In one or more embodiments of the invention, the client 2000 only needs to store one version of the extraction algorithm. When receiving a new version of the extraction algorithm from the cloud server, for example, when receiving the second extraction algorithm, the client 2000 can use the second extraction algorithm to replace the first extraction algorithm, so as to avoid simultaneously maintaining multiple sets of different versions of the biometric identification algorithm or The extraction algorithm reduces the complexity and storage burden of the client 2000.

The sending device 230 sends the first comparison request message including the first feature value to the cloud server. In one embodiment, the first feature value is encrypted and distributed first, and then transmitted to the cloud server over a secure channel. In one embodiment, in addition to the first feature value, the first comparison request message further includes an identification number or version number of the first extraction algorithm. This is particularly advantageous when there are multiple versions of the extraction algorithm. Through the identification number of the extraction algorithm in the first comparison request message, the cloud server can know which version of the extraction algorithm is used to calculate the feature value contained in the comparison request message. obtained, and thus select an appropriate library of eigenvalues for comparison. Specifically, after the eigenvalue is transmitted to the cloud server, the eigenvalue comparison algorithm of the cloud server will perform a 1:1 or 1:N comparison between the eigenvalue and the eigenvalue library, so as to verify and judge the verification value this time. Whether the distance from the registered feature value is within a threshold interval. For example, face verification is a 1:1 comparison. Its identity verification mode is essentially a process of quickly comparing the current face with the portrait database, and determining whether it matches, which can be simply understood as Prove that you are who you are. That is, we first tell the face recognition system that I am Zhang San, and then use it to verify whether the "me" standing in front of the machine is Zhang San. The most common application scenario of this mode is face unlocking. The terminal device only needs to compare the user's pre-registered photos with the photos collected on the spot to determine whether it is the same person, and then the identity verification can be completed. That is to say, in the case of 1:1, the cloud server already knows who the user is. For example, the mobile phone number can be locked, so a 1:1 comparison is performed. For another example, face recognition is a 1:N comparison, that is, after the system collects a photo of "me", it finds an image that matches the current user's face data from a massive portrait database, and performs Match, find out "who I am", especially suitable for situations where you don't know who the user is or only know the scope of a user group.

It should be noted that, in the comparison request message, the sending device 230 sends the feature value instead of directly sending the biometric information or the original image, which can protect the biological privacy of the individual to a certain extent.

Therefore, in one embodiment of the present invention, the receiving device 240 is configured to receive a second extraction algorithm from the cloud server, and the second extraction algorithm is an updated version of the first extraction algorithm. That is to say, when there are multiple sets of different versions of biometric identification algorithms, the client 2000 does not need to maintain multiple sets of algorithms locally, but only needs to receive them from the cloud server, thereby reducing the cost of algorithm update and upgrade. In addition, the upgrade of the extraction algorithm is performed when the client 2000 initiates a new verification comparison. That is, after the sending device 230 sends the comparison request message to the cloud server, the cloud server will determine whether there is an updated version of the biometric feature extraction algorithm used by the client 2000, if there is an updated version and the feature value in the comparison request message matches successfully , the cloud server will send the new version of the algorithm to the client 2000, that is, the receiving device 240 receives the new version of the algorithm from the cloud server after the comparison is passed and there is a second extraction algorithm with a newer version than the first extraction algorithm. The second extraction algorithm is described.

In addition, the extraction device 220 is further configured to extract a second feature value from the biometric information using the second extraction algorithm. It should be pointed out that the extraction device 220 still uses the biometric information of the user previously collected by the collection device 210 (instead of re-collecting the biometric information of the user) as the basis of the second extraction algorithm to perform the second feature value extraction. calculate. In other words, the extraction device 220 calculates the feature value (for example, the second feature value) of the new version by using the biometric information that has been compared with the old version as the biometric information registered in the new version, so as to achieve a "non-sensing" upgrade.

In one embodiment, the sending means 230 is further configured to send a registration message including the second characteristic value to the cloud server so as to store the second characteristic value. In one embodiment, the sending means 230 is configured to encrypt the first comparison request message and the registration message for transmission. In one embodiment, the registration message may further include an identification number or version number of the second extraction algorithm. This is particularly advantageous when there are multiple versions of the extraction algorithm. Through the identification number or version number of the extraction algorithm in the registration message, the cloud server can register the second feature value in the feature value library (sub-library) corresponding to the version, Facilitate appropriate comparisons in the future.

In one embodiment, the collecting device 210 is further configured to collect the second biometric information of the user when the user initiates identity authentication again; the extracting device 220 is further configured to use the second biometric information in the client 2000 The extraction algorithm extracts a third feature value from the second biometric information; and the sending device 230 is further configured to send a second comparison request message containing the third feature value and the identification number of the second extraction algorithm to the cloud server.

In one embodiment, the sending device 230 uses a secure multi-party computation (Secure Multi-Party Computation, MPC or SMPC) method to store and identify the secret state, and such a security protection level may be higher. The so-called secure multi-party computing is to solve the collaborative computing problem of privacy protection between a group of distrusting participants. Other members participating in the calculation. Each secure multi-party computing participating node has the same status, can initiate collaborative computing tasks, or choose to participate in computing tasks initiated by other parties. Routing addressing and computing logic transmission are controlled by the hub node, looking for relevant data to transmit computing logic at the same time. Each secure multi-party computing node completes data extraction and calculation in the local database according to the calculation logic, and routes the output calculation result to the designated node, so that the multi-party node completes the collaborative computing task and outputs the unique result. In the whole process, all data of all parties is local and not provided to other nodes. Under the condition of ensuring data privacy, the calculation results are fed back to the entire computing task system, so that all parties can get correct data feedback.

Therefore, the client 2000 calculates the feature value of the new version by using the biometric information that has passed the comparison of the old version as the biometric information registered in the new version, and automatically replaces the algorithm version of the client 2000, thereby realizing the non-sensing feature value upgrade. In addition, each time the client 2000 compares to the background (eg, a cloud server), it carries version information and moves the version matching process to the background, so that the client 2000 only needs to maintain one version of the algorithm module. In one embodiment, the client 2000 may further include deletion means 250 (shown in dashed lines in FIG. 2 ) for deleting the first extraction algorithm after receiving the second extraction algorithm, which may reduce processing by the client 2000 and storage overhead, so that the client 2000 can realize the availability and ease of use of algorithm upgrades while ensuring the privacy of biometrics.

FIG. 3 shows a schematic flowchart of an identity recognition method 3000 performed by a cloud server according to an embodiment of the present invention. As shown in Figure 3, method 3000 includes the following steps:

In step S310, a first comparison request message containing a first feature value is received from the client, where the first feature value is obtained from the user's biometric information using a first extraction algorithm pre-stored in the client extracted from;

In step S320, the first feature value is compared with the feature value library in the cloud server;

In step S330, after the comparison is passed and there is a second extraction algorithm of a newer version than the first extraction algorithm, the second extraction algorithm is sent to the client;

In step S340, a registration message including a second feature value is received from the client, the second feature value is extracted from the previously collected biometric information using the second extraction algorithm; and

In step S350, the second feature value is stored in the feature value library.

In step S310, a first comparison request message including the first feature value is received from the client. In one embodiment, the first comparison request message can be encrypted and transmitted, which can effectively improve the security of data transmission. In one embodiment, the first comparison request message may further include an identification number of the first extraction algorithm. This is particularly advantageous when there are multiple versions of the extraction algorithm. Through the identification number of the extraction algorithm in the first comparison request message, the cloud server can know which version of the extraction algorithm is used to calculate the feature value contained in the comparison request message. obtained, and thus select the appropriate eigenvalue library for comparison. Specifically, after the eigenvalue is transmitted to the cloud server, the eigenvalue comparison algorithm of the cloud server will perform a 1:1 or 1:N comparison between the eigenvalue and the eigenvalue library, so as to verify and judge the verification value this time. Whether the distance from the registered feature value is within a threshold interval.

In step S330, after the comparison is passed and there is a second extraction algorithm of a newer version than the first extraction algorithm, the cloud server sends the second extraction algorithm to the client. That is to say, when there are multiple sets of different versions of biometric identification algorithms, the client does not need to maintain multiple sets of algorithms locally, but only needs to receive them from the cloud server, thereby reducing the cost of algorithm update and upgrade.

In step S340, a registration message including a second feature value is received from the client, the second feature value is extracted from the previously collected biometric information using the second extraction algorithm, and the second feature value is extracted from the previously collected biometric information. In step S350, the second feature value is stored in the feature value library. Through steps S340 and S350, the cloud server completes the registration and storage of the biometric information, and the entire process is insensitive to the user.

In one embodiment, the registration message is encrypted and transmitted, so as to ensure the security of transmission. In one embodiment, the registration message further includes an identification number of the second extraction algorithm. In this way, through the identification number of the second extraction algorithm, the cloud server can select an appropriate feature value (sub) library to store the second feature value.

Although not shown in FIG. 3 , in one embodiment, the identification method 3000 performed by the cloud server further includes: after storing the second feature value in the feature value database, removing the second feature value from the feature value database A record corresponding to the first feature value. In one embodiment, the eigenvalue library may include a first sub-eigenvalue library corresponding to the first extraction algorithm and a second sub-eigenvalue library corresponding to the second extraction algorithm, wherein The records corresponding to the eigenvalues are stored in the first sub-eigenvalue library, and the records corresponding to the second eigenvalues are stored in the second sub-eigenvalue library. In one embodiment, when the number of records in the first sub-feature value library drops to 0, the associated module corresponding to the first extraction algorithm is deleted, thereby saving space on the cloud server.

Referring to FIG. 4, FIG. 4 shows a schematic structural diagram of a cloud server 4000 for identity recognition according to an embodiment of the present invention. As shown in FIG. 4 , the cloud server 4000 includes: a receiving device 410 , a comparing device 420 , a sending device 430 , and a storage device 440 . The receiving device 410 is configured to receive, from the client, a first comparison request message including a first feature value, where the first feature value is obtained from the user's biometric collected by using a first extraction algorithm pre-stored in the client extracted from the feature information; the comparing device 420 is configured to compare the first feature value with the feature value library in the cloud server; the sending device 430 is configured to compare the first feature value after the comparison is passed When extracting the second extraction algorithm of the updated version of the algorithm, send the second extraction algorithm to the client; and the storage device 440 is configured to store the second feature value in the feature value library, wherein the receiving Apparatus 410 is further configured to receive from the client a registration message containing the second characteristic value extracted from the previously collected biometric information using the second extraction algorithm.

In one embodiment, the first comparison request message and the registration message are both encrypted and transmitted, so as to ensure the security of data or message transmission. In one embodiment, the first comparison request message further includes an identification number of the first extraction algorithm, and the registration message further includes an identification number of the second extraction algorithm. In this way, by extracting the identification number of the algorithm, the cloud server can select an appropriate eigenvalue (sub) library to store the eigenvalues or select an appropriate eigenvalue (sub)library to compare with the eigenvalues.

In one embodiment, the cloud server 4000 may further include: a removing device 450, configured to remove the second characteristic value from the characteristic value library and the first characteristic value from the characteristic value library after the second characteristic value is stored in the characteristic value library. A record corresponding to an eigenvalue. In one embodiment, the eigenvalue library includes a first sub-eigenvalue library corresponding to the first extraction algorithm and a second sub-eigenvalue library corresponding to the second extraction algorithm, wherein the A record corresponding to a feature value is stored in the first sub-feature value library, and a record corresponding to the second feature value is stored in the second sub-feature value library. In this embodiment, the removing device 450 may be configured to delete the associated module corresponding to the first extraction algorithm when the number of records in the first sub-feature value library decreases to 0.

Generally speaking, if the upgrade of the extraction algorithm is not considered, the biometric identification system (including the client and the cloud server) based on the feature value can be divided into two stages: pre-registration and online comparison. Among them, early registration refers to the first time that a user registers his biometrics in the system. After collecting biometric information or original image on the client, the feature value is directly extracted on the client, and then the feature value is transmitted to the cloud for storage. Inventory. Online comparison is in the subsequent verification process. When the user initiates an authentication, the client will collect the biometric information or the original image and extract the feature value. After the feature value is transmitted to the cloud, the feature value comparison algorithm of the cloud server will It performs a 1:1 or 1:N comparison with the eigenvalue library, so as to verify and judge whether the distance between the current verification value and the registered eigenvalue is within a threshold interval.

FIG. 5 shows a smooth upgrade solution of an identity recognition system in an algorithm update scenario according to an embodiment of the present invention. As shown in FIG. 5 , the upgrade process does not notify all users to complete the unified upgrade within a specified time period, but is performed when the user initiates a new verification and comparison. When the user initiates identification and comparison, the client still uses the existing version (N version) of the feature value extraction algorithm to extract the feature value, and then transmits it to the cloud server, and the cloud server uses the N version of the feature value comparison algorithm to discriminate and compare . If the comparison fails, the cloud server returns the comparison failure. Once the comparison is passed, the cloud service program finds that there is a new version (N+1 version) of the algorithm, and directly pushes the N+1 version of the eigenvalue algorithm to the client, and the client updates the eigenvalue algorithm from N version to N +1 version, at the same time, extract the feature value of the N+1 version of the original image collected this time, and transmit it to the cloud server, and register the feature value of the N+1 version into the database, thus completing the N+1 version. The version comparison completed the feature value registration of the N+1 version, and the whole process was completely unaware of the user (because the process of collecting features is only once, and other processes are automatically completed by the client and the cloud server).

Referring further to FIG. 6, it shows the identification process of the identification system according to one embodiment of the present invention. Corresponding to the process shown in Figure 5, in the subsequent process of initiating identification, that is, in the step of feature value extraction, the version number of the identification algorithm (the N+1 version after the update) will be piggybacked. Therefore, when After the feature value is encrypted and transmitted to the cloud server, the cloud server will match the corresponding back-end feature value comparison program according to the version number, so as to achieve correct comparison and identification. On the cloud server side, each time a new comparison request involves updating the comparison algorithm, a record will be inserted into the new feature value library. An optimized approach is to insert a record in the new eigenvalue library, and at the same time delete the corresponding record in the old version eigenvalue library. When the number of entries in the eigenvalue library of the old version drops to 0, it means that this version has been completely replaced, then the eigenvalue library of this version can be deleted, and the associated modules such as the feature comparison algorithm corresponding to this version can also be deleted. This saves system space.

The apparatus embodiments described above are only illustrative, wherein the modules described as separate components may not be physically separated, that is, they may be located in one place, or may be distributed to multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution in this embodiment. Those of ordinary skill in the art can understand and implement it without creative effort.

From the description of the various embodiments above, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and certainly can also be implemented by hardware. Based on this understanding, the above-mentioned technical solutions can be embodied in the form of software products in essence or in the form of contributions to the prior art, and the computer software products can be stored in a computer-readable storage medium, the computer-readable recording A medium includes any mechanism for storing or transmitting information in a form readable by a computer (eg, a computer). Machine-readable media include, for example, read only memory (ROM), random access memory (RAM), magnetic disk storage media, optical storage media, flash storage media, electrical, optical, acoustic, or other forms of propagated signals (eg, carrier waves) , infrared signals, digital signals, etc.), etc., the computer software product includes several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute the various embodiments or certain parts of the embodiments. Methods.

To sum up, the technical solution of the present application can realize the following on the basic premise of not storing the plaintext of biometrics:

1) User insensitivity: When the algorithm is upgraded, there is no need to ask the user to collect biometric information again, which can be insensitive to the user;

2) The client maintains low processing complexity and storage overhead: the client does not need to maintain and store multiple sets of biometric algorithm identification versions, and almost no additional processing and storage burdens are imposed on the client.

The final effect is that the eigenvalue-based identification system can ensure the privacy of biometrics, and at the same time, it can realize the availability and ease of use of algorithm upgrades.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (apparatus) and computer program products according to embodiments of the present application. It will be understood that each flow and/or block in the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce Means for implementing the functions specified in a flow or flow of a flowchart and/or a block or blocks of a block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions The apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

These computer program instructions can also be loaded on a computer or other programmable data processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process such that The instructions provide steps for implementing the functions specified in the flow or blocks of the flowcharts and/or the block or blocks of the block diagrams.

While the preferred embodiments of the present application have been described, additional changes and modifications to these embodiments may occur to those skilled in the art once the basic inventive concepts are known. Therefore, the appended claims are intended to be construed to include the preferred embodiment and all changes and modifications that fall within the scope of this application. Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

An identity recognition method performed by a client, characterized in that the method comprises:

Collect the user's biometric information;

Extract the first feature value from the biometric information by using the first extraction algorithm pre-stored in the client;

sending the first comparison request message containing the first feature value to the cloud server;

receiving a second extraction algorithm from the cloud server, the second extraction algorithm being an updated version of the first extraction algorithm;

extracting a second feature value from the biometric information using the second extraction algorithm; and

Sending a registration message containing the second characteristic value to the cloud server for storing the second characteristic value.
The identification method of claim 1, further comprising:

Delete the first extraction algorithm.
The identification method according to claim 1, wherein the first comparison request message and the registration message are both encrypted and transmitted.
The identification method of claim 1, wherein the first comparison request message further includes an identification number of the first extraction algorithm, and the registration message further includes an identification number of the second extraction algorithm.
The identification method according to claim 1, wherein the second extraction algorithm is received from the cloud server after the comparison is passed and when there is a second extraction algorithm with a newer version than the first extraction algorithm.
The identification method according to claim 1 or 5, further comprising:

collecting the second biometric information of the user;

extracting a third feature value from the second biometric information using the second extraction algorithm in the client; and

Sending a second comparison request message containing the third feature value and the identification number of the second extraction algorithm to the cloud server.
A client for identity identification, characterized in that the client comprises:

a collection device for collecting the biometric information of the user;

an extraction device, configured to extract a first feature value from the biometric information by using a first extraction algorithm pre-stored in the client;

a sending device, configured to send a first comparison request message including the first feature value to a cloud server; and

a receiving device, configured to receive a second extraction algorithm from the cloud server, where the second extraction algorithm is an updated version of the first extraction algorithm,

Wherein, the extraction device is further configured to extract a second feature value from the biometric information by using the second extraction algorithm, and the sending device is further configured to send a registration message containing the second feature value to the the cloud server to store the second feature value.
The client of claim 7, further comprising:

A deletion device is used to delete the first extraction algorithm.
The client of claim 7, wherein the sending means is configured to encrypt the first comparison request message and the registration message for transmission.
8. The client of claim 7, wherein the first comparison request message further includes an identification number of the first extraction algorithm, and the registration message further includes an identification number of the second extraction algorithm.
The client of claim 7, wherein the receiving means is configured to receive the first extraction algorithm from the cloud server after the comparison is passed and when there is a second extraction algorithm with a newer version than the first extraction algorithm Second extraction algorithm.
The client according to claim 7 or 11, wherein the collecting means is further configured to collect second biometric information of the user; the extracting means is further configured to utilize the second extraction in the client an algorithm extracts a third feature value from the second biometric information; and the sending device is further configured to send a second comparison request message containing the third feature value and the identification number of the second extraction algorithm to the cloud server.
An identity recognition method performed by a cloud server, characterized in that the method comprises:

receiving, from the client, a first comparison request message including a first feature value, where the first feature value is extracted from the collected biometric information of the user by using a first extraction algorithm pre-stored in the client;

comparing the first characteristic value with the characteristic value library in the cloud server;

After the comparison is passed and there is a second extraction algorithm of a newer version than the first extraction algorithm, sending the second extraction algorithm to the client;

receiving from the client a registration message containing a second feature value extracted from the previously collected biometric information using the second extraction algorithm; and

The second eigenvalue is stored in the eigenvalue library.
The identification method according to claim 13, wherein the first comparison request message and the registration message are both encrypted and transmitted.
The identification method of claim 13, wherein the first comparison request message further includes an identification number of the first extraction algorithm, and the registration message further includes an identification number of the second extraction algorithm.
The identification method of claim 13, further comprising:

After storing the second feature value in the feature value library, the record corresponding to the first feature value is removed from the feature value library.
The identification method according to claim 16, wherein the feature value library comprises a first sub-feature value library corresponding to the first extraction algorithm and a second sub-feature value library corresponding to the second extraction algorithm , wherein the records corresponding to the first eigenvalues are stored in the first sub-eigenvalue library, and the records corresponding to the second eigenvalues are stored in the second sub-eigenvalue library.
The identification method according to claim 17, wherein when the number of records in the first sub-feature value library drops to 0, the association module corresponding to the first extraction algorithm is deleted.
A cloud server, characterized in that the cloud server comprises:

A receiving device, configured to receive a first comparison request message including a first feature value from a client, where the first feature value is obtained from the user's biometric information using a first extraction algorithm pre-stored in the client extracted from;

a comparison device, configured to compare the first feature value with a feature value library in the cloud server;

A sending device, configured to send the second extraction algorithm to the client after the comparison is passed and when there is a second extraction algorithm of a newer version than the first extraction algorithm; and

a storage device for storing the second eigenvalue in the eigenvalue library,

Wherein, the receiving device is further configured to receive from the client a registration message including the second characteristic value, where the second characteristic value is obtained from the biometric information previously collected by using the second extraction algorithm extracted from.
The cloud server of claim 19, wherein the first comparison request message and the registration message are both encrypted and transmitted.
The cloud server of claim 19, wherein the first comparison request message further includes an identification number of the first extraction algorithm, and the registration message further includes an identification number of the second extraction algorithm.
The cloud server of claim 19, further comprising:

A removing device is configured to remove a record corresponding to the first characteristic value from the characteristic value library after the second characteristic value is stored in the characteristic value library.
The cloud server according to claim 22, wherein the eigenvalue library comprises a first sub-eigenvalue library corresponding to the first extraction algorithm and a second sub-eigenvalue library corresponding to the second extraction algorithm, The records corresponding to the first feature values are stored in the first sub-feature value library, and the records corresponding to the second feature values are stored in the second sub-feature value library.
The cloud server according to claim 23, wherein the removing means is further configured to delete the first sub-eigenvalue library and the related The association module corresponding to the first extraction algorithm described above.
A computer storage medium, characterized in that, the medium comprises instructions, and the instructions execute the identification method according to any one of claims 1 to 6 and 13 to 18 when running.
An identification system, comprising the client according to any one of claims 7 to 12 and the cloud server according to any one of claims 19 to 24.