Anti-peeping cipher authentication method and system based on biometric feature
Technical field
The present invention relates to a plurality of technical fields such as computer software technology, cipher authentication, touch screen and biometric feature, be specifically related to a kind of anti-peeping cipher authentication method based on biometric feature, and the system that adopts the method.
Background technology
Along with popularizing that touch screen (such as electric capacity touch screen, resistance touch screen etc.) uses, the situation of inputting password by the simulating keyboard (or dummy keyboard) of touch screen is also more and more common, for example, and touch-screen mobile phone, touch screen ATM etc.But the hidden danger the same with physical keyboard, that this simulating keyboard is difficult to get rid of the user equally when inputting password " being peeped by other people ", thereby can't guarantee privacy and property safety.
Existing anti-peeping technology comprises: (1) adds visual barrier to cipher inputting keyboard, and (2) at random or dynamic arrangement keyboard position.The former need to carry out hardware modification (increase cost, be not suitable for the touch-screen equipments such as mobile phone) to keyboard appearance.Latter can not be got rid of the possibility of being peeped press key contents by other people fully.And two kinds of methods all can reduce the convenience of user's input.
Existing password constituted mode is one dimension mostly, i.e. PIN code, letter character, graphical passwords input.If we combine these one dimension passwords with specific " biometric feature ", the password constituted mode has just become two-dimentional.Increase this new dimension of biometric feature, can effectively strengthen security, because some specific biometric feature can't be spied upon and get access to by other people.U.S.'s patent of invention (US7305559) proposes to add a kind of biometric feature in password input mode---" input rhythm " (measuring the absolute and relative time interval of button and switching)---strengthens security.But this method is difficult to really prevent " being peeped ", because input the rhythm of action of password in case seen by other people, is perhaps recorded by video camera, thereby still is easy to be repeated illegally to obtain password by other people.
Summary of the invention
Can not effectively anti-peeping this defective in order to overcome the existing password input mode, the present invention proposes a kind of anti-peeping cipher authentication method based on biometric feature, and the system that adopts the method, can solve " anti-peeping " cipher authentication problem on the touch-screen equipment, the security that has greatly improved cipher authentication in this type systematic.
Specifically for achieving the above object, the present invention adopts following technical scheme:
A kind of anti-peeping cipher authentication method based on biometric feature, its step comprises:
1) user presses a touch screen, detects and record the light and heavy degree of at every turn pressing this touch screen, will record the depression sequence of this light and heavy degree as the password of setting, perhaps the part of the password of conduct setting;
2) according to the correctness of the password authentification user who sets by the depression sequence of touch-screen input, realize password authentification.
Further, also input in following one or more when the user presses described touch screen in the step 1): numeral, letter, symbol, figure, the common password that consists of described setting of the content of this input and described depression sequence; Step 2) also comprises the content of user input is verified.
Further, when the user presses described touch screen, give the user sense feedback to be difficult for being spied on, remember for the user with the light and heavy degree of the current button of prompting user, and guarantee to only have the current user who carries out touch-screen input just can perceive the light and heavy degree of current key-press input.This sense feedback is preferably tactile feedback, such as the mobile phone vibration etc., also can be audio feedback etc. other be difficult for the feedback of being spied on.
Further, when pressing touch screen by the user and the contact area of this touch screen represent described light and heavy degree, perhaps press the described light and heavy degree of pressure representative of touch screen by the user.Preferably, described contact area or described pressure are arranged certain threshold value, whether judge the light and heavy degree of pressing above this threshold value by contact area or pressure that judgement detects.
A kind of anti-peeping cipher authentication system based on biometric feature, it comprises:
One touch screen is used for inputting password to be set or to be verified;
One detection module connects described touch screen, for detection of and recording user press the light and heavy degree of touch screen, the depression sequence that comprises this light and heavy degree is all or part of as password described to be set or to be verified;
One authentication module connects described touch screen and described detection module, is used for the password of user's setting and the password to be verified of user's input are compared, and realizes password authentification.
Further, comprise that also one connects the sense feedback module of described touch screen, be used for when the user presses described touch screen, give this user provide about press light and heavy degree, only have the sense feedback that this user can perception.Described sense feedback module is preferably Vib..
Further, described detection module is an optical touch screen sensor, when pressing touch screen for detection of the user and the contact area of this touch screen; Perhaps described detection module is a pressure transducer, presses the pressure of touch screen for detection of the user.
The cipher authentication scheme that the present invention proposes relates generally to two parts: 1) to the user input every password biometric feature (be the input mode feature, comprise finger contact screen area, pressure size, etc.) authenticate; 2) further, after inputting every password, the user give the user with " sense of touch " feedback (or audio feedback etc. other be difficult for the feedbacks of being spied on).Above dimension (being button " weight " and tactile feedback) all is difficult to be perceived by the person of peeping, so the present invention can effectively stop the situation generation that Password Input is peeped and stolen, thereby strengthens the security of cipher authentication system.Need not simultaneously to increase hardware cost, implement convenient and swift.The present invention program can be used for any based on equipment touch screen, that need cipher authentication, such as equipment such as smart mobile phone, ATM, panel computer, gate control systems.
Description of drawings
Fig. 1 is finger different among the embodiment, touch posture, dynamics affects the contact area that optical touch screen sensor senses, the difference synoptic diagram of pressure;
Fig. 2 is the synoptic diagram that is difficult for the tactile feedback discovered by the person of peeping among the embodiment according to different touch screen " weight ";
Fig. 3 is the process flow diagram of cipher authentication among the embodiment;
Fig. 4 is the numerical ciphers Verification System operation synoptic diagram of realizing at the Android cell phone platform among the embodiment.
Fig. 5 is the synoptic diagram that can strengthen the security of graphical passwords Verification System among the embodiment.
Embodiment
Below by specific embodiment, and cooperate accompanying drawing, the present invention is described in detail.
Because the finger dynamics that applies of user is different, have influence on also difference to some extent of contact area that optical touch screen sensor senses and pressure size when touch screen.As shown in Figure 1, different fingers, touch posture, dynamics all can have influence on the surface of contact difference in size, and in Fig. 1 (a), light finger is pressed screen, and contact area is less; In Fig. 1 (b), finger is heavily pressed screen, and contact area is larger.And the variation of this feature only has the active user to perceive, and is difficult to be peeped or perceive by the third party, as shown in Figure 2.The present invention namely utilizes these biometric feature to strengthen the security of cipher authentication system.
The anti-peeping cipher authentication method based on biometric feature of present embodiment, implementation step is as follows:
1. password setting:
When the user arranges each password, this cipher authentication system detects and records " weight " degree (representing with contact area or pressure) that (storage) points touch screen when pressing this password, and come the light and heavy degree of the current button of prompting user to remember for the user with the sense feedback that is difficult for being spied on, thereby form the two-dimentional password combination of " password+finger touch screen feature ".
Password described here is the password on the ordinary meaning, such as digital password, graphical passwords etc.In other embodiments, the user is the content of setting code not also, but directly inputs the sequence of pressing for more than a time, will record the depression sequence of this light and heavy degree as " password " set.
When adopting contact area to represent that the user points " weight " degree of touch screen when pressing this password, can detect this contact area by optical touch screen sensor, and obtain this contact area size by corresponding software api interface.Concrete testing process is: optical touch screen sensor can perceive finger contact to the actual pixel value of touch screen (being that the user points the contact area with screen), calls simultaneously corresponding software api interface and obtains this actual pixel value.For example, just can call the getSize method of MotionEvent Class the inside based on the touch-screen equipment of the Android of Google system software platform, thereby obtain the contact area numerical value of finger and touch screen, this numerical value is turned to a numerical value within 0 to 1 scope by the getSize method standard.
When adopting pressure to represent that the user points " weight " degree of touch screen when pressing this password, can detect this pressure by the pressure transducer that is connected with touch screen, and it is big or small to obtain this pressure by corresponding software api interface.Concrete testing process is: the pressure transducer that is connected with touch screen can perceive finger whether touch screen is existed pressure, calls simultaneously corresponding software api interface this pressure is converted into concrete numerical value.For example, just can call the getPressure method of MotionEvent Class the inside based on the touch-screen equipment of the Android of Google system software platform, thereby obtain finger to the numerical value of touch screen pressure size.
More than with the getSize in the Android of the Google system software platform and getPressure method for example, only in order to the testing process of cipher authentication of the present invention to be described, but not limit it.Those of ordinary skill in the art can make amendment or be equal to replacement cipher authentication detection method of the present invention (as based on the touch-screen equipment of iOS system of Apple, touch screen ATM device, touch screen gate control system etc.) on the touch-screen equipment based on other software platforms, and does not break away from the spirit and scope of the present invention.
2. password authentification:
When the user inputs password, not only to input correct password content, and will check " weight " degree (contact area or pressure size) of each password key, just can reach the purpose of valid password input.Concrete password authentification flow process as shown in Figure 3.At first, the user inputs password by touch key-press, comes simultaneously the button weight of current each Password Input of perception by tactile feedback, and native system is with each password content and the corresponding button weight thereof of user's input under the synchronous recording.Then, this Verification System will be carried out first step checking, i.e. " password content (numeral, letter, symbol etc.) checking "; When each password content is correct, carry out again the second step checking, namely for " the weight checking " of each password key.Only have when user's input and successively passed through this two steps card, native system is just judged the Password Input success; Any step is demonstrate,proved and unsuccessfully all will be caused native system to judge the Password Input failure.Certainly, as mentioned above, when only depression sequence that light and heavy degree is different is as the password set in other embodiments, only need carry out " weight checking ".
3. based on the assistant authentification of tactile feedback:
Setting or the authentication password stage, after inputting each password, this cipher authentication system will give user's one " tactile feedback " (such as, the mobile phone vibration, also can be that other are difficult for the sense feedback that quilt is spied on), to guarantee the only having current user who carries out touch-screen input just can perceive " weight " degree of current key-press input.In the present embodiment, this sense feedback is tactile feedback, is specially the form of mobile phone vibration.As shown in Figure 2, in Fig. 2 (a), finger " flicking " analogue-key " 1 ", contact area is less; In Fig. 2 (b), finger " is heavily pressed " analogue-key " 1 ", and contact area is larger, causes the mobile phone vibration.
The below provides a concrete application example.This example utilizes implementation method of the present invention, has realized a digital Password Input software based on the Android touch-screen mobile phone.The Android platform provides the api interface that obtains touch screen contact area and pressure, calls Vib..Whether this software surpasses certain threshold value according to the contact area that detects is judged " gently ", " weight " degree of keystroke dynamics, and gives the user corresponding tactile feedback---for example, " gently " pressed by friction, " weight " and is vibration 1 time.Shown in Fig. 4 program operation synoptic diagram, correct password is 1234, and the order of following " heavy gently " is pressed.The finger mark is pressed for " weight " among the figure, and then press for " gently " at unmarked place: among Fig. 4 (a), but numerical ciphers is inputted correct button weight mistake, so cause the invalid password input; Among Fig. 4 (b), numerical ciphers input and the input of button weight are all correct, are the valid password input.
The present invention is not only applicable to the conventional digital cipher authentication system, is equally applicable to the graphical passwords Verification System, and as shown in Figure 5, Fig. 5 (a) is traditional graph cipher authentication system interface; Fig. 5 (b) is that the finger mark is pressed for " weight " in conjunction with the Password Input process synoptic diagram of finger touch screen size information, and then press for " gently " at unmarked place.---being button " weight " (finger contact face and pressure size) and tactile feedback (vibration)---in the time of user's tablet pattern password, in conjunction with second dimension of biometric feature as the password formation can reach anti-peeping purpose equally.Even third party or person of peeping be the repetitive pattern password successfully, owing to the biometric feature information that can't obtain based on touch screen and tactile feedback, thereby also just can't crack this cipher authentication system.
Further, can also adopt the scheme of biometric feature to combine the solution of the present invention and other, such as combining with " input rhythm " (measuring absolute and relative time interval of button and switching) of mentioning in the background technology etc., can realize more complicated, safer cipher authentication.
Above embodiment is only in order to technical scheme of the present invention to be described but not limit it; those of ordinary skill in the art can make amendment or is equal to replacement technical scheme of the present invention; and not breaking away from the spirit and scope of the present invention, protection scope of the present invention should be as the criterion so that claim is described.