WO2018165811A1 - Method for saving and verifying biometric template, and biometric recognition apparatus and terminal - Google Patents

Abstract

Disclosed are a method for saving and verifying a biometric template, and a biometric recognition apparatus and terminal, belonging to the technical field of biological recognition. The method for saving a biometric template comprises: processing a biometric encrypted template generated by means of biometric template encryption, so as to obtain M groups of biometric encrypted template data, where M ≥ 2 (S11, S33); and saving the M groups of biometric encrypted template data in N storage regions, so that at least one group of biometric encrypted template data is saved in each of the storage regions after a saving operation, where 1 < N ≤ M (S12, S34). By means of processing a biometric encrypted template into multiple groups of biometric encrypted template data and then separately saving the multiple pieces of biometric encrypted template data in at least two storage regions, the multiple groups of biometric encrypted template data are separately saved in the multiple storage regions and will thus not easily be fully leaked, so that the large security hazard brought about by the prior art for the application of a biometric template can be effectively eliminated.

Description

Biometric template preservation, verification method, biometric identification device, terminal Technical field

The embodiments of the present invention relate to the field of biometric identification technologies, and in particular, to a biometric template storage and verification method, a biometric identification device, and a terminal.

Background technique

Because the biological characteristics of the human body such as fingerprints, palm prints, lip lines and irises are unique, they can be used for identity verification, etc., to meet the security and confidentiality requirements of different application scenarios. For example, when a laptop, a mobile phone, or a tablet is turned on, or enters a critical location, it is necessary to collect the fingerprint of the user for authentication.

When using biometrics as an authentication method, as shown in Figure 1a, it is common practice to first process the biometric raw data into a biometric template, ie, a registration template, and then save the biometric template as a whole in a relatively secure storage area. For example, in Figure 1a, an EMMC (Embedded Multi Media Card) memory stored in a TEE (Trusted Execution Environment) is taken as an example. When the authentication comparison is needed, the biometric template is extracted and compared with the newly collected biometric template, and the comparison is passed, otherwise the verification fails.

Since the biometric template is stored in a storage area that is not very secure, if the storage area is attacked, the biometric template will be leaked as a whole, which will bring a larger application to the biometric template. Security risks.

Summary of the invention

In view of this, the biometric template storage and verification method, the biometric identification device, and the terminal provided by the embodiments of the present application are used to solve at least the above problems in the prior art.

A first aspect of the embodiments of the present application provides a biometric template saving method, where the biometric template saving method includes:

Processing the biometric encryption template generated according to the biometric template encryption to obtain the M group Biometric encryption template data, M≥2;

The M group biometric encryption template data is stored in the N storage areas, and at least one set of biometric encryption template data exists in each storage area after storage, 1<N≤M.

Optionally, in a specific embodiment of the present application, at least one of the N storage areas is a storage area of a chip-level security environment.

Optionally, in a specific embodiment of the present application, the processing, by the biometric encryption template generated by the biometric template, includes: performing a splitting process on the biometric encryption template.

Optionally, in a specific embodiment of the present application, the biometric encryption template generated according to the biometric template encryption is processed, and before the obtaining the M biometric encryption template data, the method further includes: encrypting the biometric encryption according to the biometric template. The key used in the template is placed anywhere in the biometric encryption template.

Optionally, in a specific embodiment of the present application, the key is placed into a start position or an end position of the biometric encryption template.

Optionally, in a specific embodiment of the present application, the method further includes:

Performing verification data obtained by performing consistency check on the biometric template into any position in the biometric template;

The biometric template containing the verification data is encrypted to generate the biometric encryption template.

Optionally, in a specific embodiment of the present application, the consistency check is a hash check, the obtained check data is a hash check value, and the hash check value is placed. Before or after the start position of the biometric template.

Optionally, in a specific embodiment of the present application, the method further includes:

Collect biometric raw data;

Performing biometric and/or image feature extraction on the collected biometric raw data to obtain a plurality of biometric data;

Combining the plurality of biometric data to obtain the biometric template.

Optionally, in a specific embodiment of the present application, the biometric original data is fingerprint feature original data or fingerprint image data;

The biometric data is fingerprint feature point data or fingerprint feature image extremum data;

Performing biometric and/or image feature extraction on the collected biometric raw data to obtain a plurality of biometric data includes: extracting fingerprint feature points from the collected fingerprint feature point original data, and obtaining multiple fingerprint feature point data. And/or, performing fingerprint feature image extraction on the collected fingerprint feature raw data to obtain a plurality of fingerprint feature image extremum data.

A second aspect of the embodiments of the present application provides a biometric template verification method, including:

Processing the M group associated biometric encryption template data obtained from the N storage areas to obtain a biometric encryption template, M≥2, 1<N≤M;

And performing a consistency check verification on the biometric template to be verified obtained according to the biometric encryption template. If the verification is passed, determining that the biometric template to be verified is consistent with the original biometric template.

Optionally, in a specific embodiment of the present application, the N storage areas include at least one storage area of a chip-level security environment.

Optionally, in a specific embodiment of the present application, the performing verification verification of the biometric template to be verified according to the biometric encryption template includes: generating a consistency check of the biometric template to be verified. The first verification data is compared with the second verification data obtained from the biometric verification template to be verified;

If the first check data is the same as the second check data, the verification is considered to pass.

Optionally, in a specific embodiment of the present application, performing consistency check on the biometric template to be verified includes: performing hash check on the biometric template to be verified.

Optionally, in a specific embodiment of the present application, the second check data is extracted from a header or a tail of the to-be-verified biometric template.

Optionally, in a specific embodiment of the present application, the obtaining a biometric template to be verified according to the biometric encryption template includes:

Extracting a key from a header or a tail of the biometric encryption template;

Decrypting the biometric encryption template according to the key to obtain a biometric template to be verified.

A third aspect of the embodiments of the present application provides a biometric identification device, which includes a biometrics collection module, a biometric data processing chip, and a storage module.

The biometric collection module is configured to collect biometric information of the user;

The biometric data processing chip is configured to perform feature extraction on the biometric information, obtain biometric data and combine the biometric template into a biometric template, and perform encryption processing on the biometric template to generate a biometric encryption template; The biometric template generated by the biometric template encryption is processed to obtain the M group biometric encryption template data, M≥2;

The storage module is configured to store the M sets of biometric encryption template data, where the storage module includes N storage areas, and the M sets of biometric encryption template data are stored in the storage module, and at least in each storage area There is a set of biometric encryption template data, 1 < N ≤ M.

Optionally, in a specific embodiment of the present application, a template generating unit and a template processing unit are included;

The template generating unit is configured to perform feature extraction on the biometric information, obtain biometric data and combine the biometric template into a biometric template, and perform encryption processing on the biometric template to generate a biometric encryption template.

The template processing unit is configured to process the biometric encryption template generated according to the biometric template encryption to obtain M sets of biometric encryption template data.

Optionally, in a specific embodiment of the present application, the biometric data processing chip further includes: a template data acquiring unit, a template restoring unit, and a template verifying unit;

The template data acquiring unit is configured to acquire M sets of biometric encryption template data associated with each other from the N storage areas of the storage module;

The template restoring unit is configured to recombine the M group biometric encryption template data to obtain a biometric encryption template;

The decryption verification unit is configured to decrypt the biometric encryption template to obtain a biometric template to be verified, and determine the biometric to be verified by performing consistency verification on the biometric template to be verified. Whether the template is consistent with the original biometric template.

A fourth aspect of the embodiments of the present application provides a terminal comprising the biometric identification device according to any one of claims 16 to 18.

As can be seen from the foregoing technical solutions, the embodiment of the present application processes the biometric encryption template into, for example, split into multiple sets of biometric encryption template data, and then stores the plurality of biometric encryption template data in at least two storage areas. , so that multiple sets of biometric encryption template data are dispersed There are a plurality of storage areas. Compared with the prior art, the biometric template is stored in a storage area as a whole, and the probability of attacking multiple sets of biometric encryption template data dispersed in multiple storage areas is less. Correspondingly, the probability of being leaked as a whole is also lower, so that the large security risks brought by the prior art to the application of the biometric template can be effectively eliminated.

DRAWINGS

FIG. 1a is a schematic diagram of a prior art biometric template storage.

FIG. 1b is a flowchart of a biometric template saving method according to Embodiment 1 of the present application.

FIG. 2 is a flowchart of a biometric template saving method according to Embodiment 2 of the present application.

FIG. 3 is a flowchart of a biometric template saving method according to Embodiment 3 of the present application.

4 is a flowchart of a biometric template verification method according to Embodiment 4 of the present application.

FIG. 5 is a structural diagram of a biometric identification device according to Embodiment 5 of the present application.

detailed description

For a better understanding of the technical solutions in the embodiments of the present application, the technical solutions in the embodiments of the present application are clearly and completely described below with reference to the accompanying drawings. It is apparent that the described embodiments are only a part of the embodiments of the present application, and not all of them. Therefore, other embodiments obtained by those skilled in the art based on the described embodiments should fall within the scope of protection of the embodiments of the present application.

[Example 1]

FIG. 1b is a flowchart of a biometric template saving method according to Embodiment 1 of the present application. As shown in FIG. 1b, the biometric template saving method includes:

S11. Process the biometric encryption template generated according to the biometric template encryption to obtain M group biometric encryption template data, where M≥2.

In this step, the biometric template may be generated by combining a plurality of biometric data, that is, combining the plurality of biometric data to generate a biometric template. The biometric data may be obtained by performing fingerprint feature extraction and/or image feature extraction processing on the collected biometric raw data.

In this step, the biometric encryption template is generated according to the biometric template encryption, and the biometric template may be encrypted by using an AES (128-bit or 256-bit) encryption algorithm to generate a biometric encryption template. Illustratively, if the AES256 encryption algorithm is used, the AES256-CBC algorithm can be specifically employed. When the biometric template is encrypted by the AES256-CBC algorithm, the biometric template may be first divided into a plurality of cipher blocks to be encrypted (equivalent to plaintext blocks), and then each cipher block to be encrypted is encrypted according to the following method:

Exchanging the first block to be encrypted with an initialization vector block and then encrypting with an encryption key (256 bits, randomly generated) to generate the first ciphertext;

And the second ciphertext to be encrypted is XORed with the first ciphertext, and then encrypted by the encryption key to generate a second ciphertext;

XORing the third block to be encrypted with the second ciphertext, encrypting with the encryption key, generating a third ciphertext, and so on, until all the cipher blocks to be encrypted are encrypted, and generating All ciphertexts are all biometric encryption templates.

In the above encryption process, since the AES256-CBC algorithm performs an exclusive OR operation with the previous ciphertext for the plaintext block (starting from the second one), the generated biometric encryption template is more complicated, so AES256-CBC is adopted. The biometric encryption template generated by the algorithm has the advantages of difficulty in cracking and difficulty in active attack.

Alternatively, in the embodiment, the AES128-CBC (encryption key is 128-bit) algorithm may be used for the encryption processing, and the processing method thereof is similar to the AES256-CBC algorithm, and details are not described herein again.

In this step, in order to obtain the M group (at least 2 groups) biometric encryption template data, when the biometric encryption template is processed, the biometric encryption template may be split and processed to form the M group biometric encryption template data. . The splitting process can be processed by a relatively simple splitting algorithm, such as uniformly splitting the biometric encryption template into M groups, or splitting the first 10 KB data of the biometric template into a set of biometric templates. Encrypt the data, split the remaining data of the biometric template and encrypt the data as another set of biometric templates (here, M=2 is taken as an example). The splitting process can also be processed by other splitting algorithms to meet the problem of splitting the biometric encryption template into M sets of biometric encryption template data. After the split processing, the amount of data in each group of the M group biometric encrypted data may be the same, for example, 5 KB, or may be partially the same. Some are different, but they can also be different from each other, depending on actual needs.

S12: The M group biometric encryption template data is stored in the N storage areas, and at least one set of biometric encryption template data is stored in each of the stored storage areas, where 1<N≤M.

After performing this step, one of two things will happen:

(1) One set of biometric encryption template data is stored in each of the N storage areas (ie, when M=N).

(2) At least one set of biometric encryption template data exists in each of the N storage areas (ie, when 1<N<M). For example, when M=3 and N=2, one set of biometric encryption template data exists in one of the two storage areas, and two sets of biometric encryption template data exist in the other storage area.

In this embodiment, the biometric encryption template is processed into, for example, split into multiple sets of biometric encryption template data, and then the plurality of biometric encryption template data are dispersed and stored in at least two storage areas, so that multiple sets of biometric encryption are performed. The template data is dispersed and stored in a plurality of storage areas, and the plurality of sets of biometric encryption template data dispersed in the plurality of storage areas are simultaneously attacked compared with the prior art in which the biometric templates are integrally stored in one storage area. The probability is smaller, and the probability of being leaked by the whole is lower, which can effectively eliminate the large security risks brought by the prior art to the application of the biometric template. That is to say, the embodiment benefits from the feature of the decentralized storage of the biometric template data. If it is attacked, the problem of the overall leakage of the feature template data is not easy to occur, and it is of course not excluded that some biometric encrypted data is leaked. Possibility, but since the biometric template can be decrypted only when the M group biometric template encrypted data is acquired as a whole, it is difficult to be restored to the biometric template even if part of the biometric encrypted data is leaked. Further, even if the plurality of sets of biometric encryption template data are illegally acquired, it is difficult to generate a corresponding organism because the corresponding processing method (such as the combined processing method is obviously unknown to the illegal acquirer) cannot be known. Feature encryption template. At the same time, since the biometric encryption template is encrypted data, it is also difficult to perform illegal decryption.

In a specific application, at least one of the N storage areas is a storage area of a chip-level security environment such as an SE (Secure Element). Since the chip-level security environment is a hardware-level security environment, the possibility of successful attack is extremely low, and its data security protection, etc. The level is higher than the software-level and semi-software-level security environment, so it is difficult to leak the biometric encryption module data stored in the storage area of the chip-level security environment. In other words, even if the biometric encryption template data in other storage areas is leaked, the biometric encryption template data stored in the storage area of the chip level security environment is hard to be leaked, thereby making the M group biometric template Encrypted data is difficult to be leaked as a whole, which can effectively eliminate the large security risks caused by the application of the biometric template in the prior art. Therefore, by using a storage area of a chip-level security environment to store at least one set of biometric encryption template data, the requirements for distributed preservation can be satisfied, and the requirements for biometric encrypted data to avoid overall leakage can be satisfied.

Further, when the total amount of data of the M group biometric encryption template data is large, the storage area of the chip level security environment is difficult to save one or more groups with a large amount of data due to a small total storage capacity. Biometric encryption template data. In order to solve this problem, optionally, one or more sets of biometric encryption template data in the M group biometric encryption template data may be stored in a storage area of the chip level security environment, and the remaining one is Group or groups of biometric encryption template data with large data volume are stored in software-level or semi-software-level security environments with large total storage capacity such as TEE (Trusted Execution Environment), TrustZone (trust zone), SGX (Software Guard Extensions) , software protection extension instructions) or Rich OS (rich operating system) and other storage areas such as external storage media: EMMC memory, SD card, disk and so on.

[Embodiment 2]

FIG. 2 is a flowchart of a biometric template saving method according to Embodiment 2 of the present application. As shown in FIG. 2, on the basis of the first embodiment of the present application, the biometric template saving method includes:

S21. The key used to generate the biometric encryption template according to the biometric template encryption is placed in any position in the biometric encryption template.

The biometric encryption template is essentially a data sequence having a certain length, whereby any position placed in the biometric encryption template may be placed in the biometric encryption template, ie, the data sequence. Before the first data, between any two data in the data sequence, after the last data of the data sequence. The location at which the key is placed can be recorded so that the key can be accurately extracted during subsequent applications, such as decryption. Preferably, the key is placed before the first data of the data sequence, That is, before the start position of the biometric encryption template, or after the key is placed after the last data of the data sequence, that is, after the end position of the biometric encryption template. After the key is placed in the biometric encryption template, the key is included in the biometric encryption template. Exemplarily, the key belongs to a symmetric key, and may be randomly generated by a random number generating function of the system, or may be set in advance (such as writing in program code).

S22. Process the biometric encryption template generated according to the biometric template encryption to obtain M group biometric encryption template data, where M≥2.

The step S22 is consistent with the step S11 in the first embodiment of the present application, and the implementation principle is similar, and details are not described herein again. It should be noted that the key is already included in the bio-encryption template in this step.

S23: The M group biometric encryption template data is stored in the N storage areas, and at least one set of biometric encryption template data is stored in each of the stored storage areas, where 1<N≤M.

This step is the same as the step S12 in the first embodiment of the present application, and the implementation principle is similar to the step S12, and details are not described herein again. It should be noted that since the key is usually the key to encryption and decryption, in order to make the key more difficult to be leaked, the key may also be stored in the storage area of the chip-level security environment, for example, including A set of biometric encryption template data (such as not less than 64 Bytes of data) of the key is stored in a storage area of the chip level security environment.

In this embodiment, by placing the key into the biometric encryption template, the biometric encryption template can be decrypted by the key in the subsequent application, so as to obtain the original biometric template (ie, the biometric encryption template is generated by encryption). Feature template).

[Embodiment 3]

FIG. 3 is a flowchart of a biometric template saving method according to Embodiment 3 of the present application. As shown in FIG. 3, based on the first embodiment of the present application, the biometric template saving method includes:

S31. The verification data obtained by performing consistency check on the biometric template is placed in any position in the biometric template.

In this step, the biometric template may be generated by combining a plurality of biometric data, that is, combining the plurality of biometric data to generate a biometric template. Further, the biometric data refers to fingerprint feature extraction and/or image feature extraction processing on the collected biometric raw data. The obtained data, that is, the biometric and/or image feature extraction of the collected biometric raw data, can obtain a plurality of biometric data. At the same time, in order to ensure more accurate biometric data, biometric feature data can be collected multiple times, and then the biometric feature extraction and/or image feature extraction of the collected biometric raw data can be performed to obtain more biometric data.

In general, biometric raw data may include fingerprints, palm prints, lip lines, and iris feature raw data. In this embodiment, taking the fingerprint feature raw data as an example, the fingerprint feature original data may include fingerprint valley ridge original data or fingerprint image original data. The fingerprint feature data is generally fingerprint feature point data or fingerprint feature image extremum data.

Correspondingly, the biometric feature and/or image feature extraction is performed on the collected biometric raw data, and obtaining the plurality of biometric data specifically includes: extracting fingerprint feature points from the collected fingerprint feature point original data, such as fingerprint valley data. Obtaining a plurality of fingerprint feature point data, and/or performing fingerprint feature image extraction on the collected fingerprint feature original data, such as fingerprint image data, to obtain a plurality of fingerprint feature image extremum data.

Optionally, for the fingerprint module of the larger size that collects the original data of the fingerprint feature, the fingerprint data collected by the fingerprint module of a larger size (such as the fingerprint valley data) has a larger number and the fingerprint included. The feature raw data is relatively complete. Therefore, the fingerprint feature point extraction method can be used to extract the fingerprint feature original data to obtain multiple fingerprint feature data. For the small size fingerprint module, due to its small size, the collection is small. The original fingerprint data of the fingerprint feature is relatively small, and the original fingerprint data of the fingerprint feature is relatively incomplete. Therefore, the fingerprint image feature extraction method is generally used to extract the extreme value data of the plurality of fingerprint feature images, thereby obtaining multiple fingerprint feature data. . Alternatively, regardless of the size of the fingerprint module, both the original data of the fingerprint feature and the original data of the fingerprint image are collected, and then the fingerprint feature original data is extracted by fingerprint feature point extraction and extracted based on the fingerprint image feature. The method of extracting the fingerprint image raw data to obtain a plurality of fingerprint feature data. The fingerprint feature template obtained on the basis of the fingerprint feature template may be a fingerprint feature template obtained based on the fingerprint valley data, may be a fingerprint feature template obtained based on the fingerprint image data, or may be based on fingerprint valley data and fingerprint image data. The fingerprint feature template obtained by the combination.

Optionally, the fingerprint feature point data may include a fingerprint endpoint, a bifurcation point, a bifurcation point, and an isolated Point, ring point and/or short grain data.

A typical process for obtaining a fingerprint feature template is as follows:

a) the system prompts the user to press the fingerprint module through the interface;

b) the user presses the fingerprint module with a finger according to the interface prompt;

c) after detecting that the user presses the fingerprint module, the system collects user fingerprint feature original data such as fingerprint valley data and/or fingerprint image data through the fingerprint module;

d) performing fingerprint feature extraction on the fingerprint feature raw data, for example, by fingerprint feature extraction algorithm extraction and/or fingerprint image feature extraction, to obtain multiple fingerprint feature data;

e) Repeat steps a to d to obtain a fingerprint feature template consisting of a large number of fingerprint feature data.

It should be noted that the fingerprint feature template can be obtained through the fingerprint original feature data, but the reverse process is irreversible, that is, the fingerprint feature template cannot restore the fingerprint original feature data, because the fingerprint feature extraction algorithm extracts only the fingerprint feature. The data of the point does not save all the texture information of the fingerprint, so there is a problem that part of the fingerprint texture information is lost, so the original data of the fingerprint feature cannot be restored by the fingerprint template.

In this step S31, in order to verify whether the biometric template is falsified or destroyed after being acquired, the verification data may be placed in any position in the biometric encryption template, and the verification data may be determined to be obtained. Whether the biometric template is identical to the original biometric template. For example, the same hash check is performed on the acquired biometric template to be verified to obtain a hash check value that can be used as the check data, and the hash check value is obtained simultaneously with the biometric template to be verified. Obtaining another check data (such as another hash check value) for comparison. If the two hash check values are the same, it may be determined that the biometric template to be verified is completely consistent with the original biometric template, otherwise The biometric template to be verified may be determined to be an illegal biometric template.

In this step, the verification data, for example, the location where the hash check value is placed in the biometric template can be freely selected, and is generally not limited. More commonly, the check data, for example the hash check value, can be placed before or after the start of the biometric template. In use, the location is usually recorded so that in the subsequent application, when the acquired biometric template needs to be consistently verified, the phase can be accurately extracted according to the location where the record is saved. The verification data should be. Obviously, the verification data is placed in the biometric template, which is equivalent to the biometric template containing the verification data.

In this step, the biometric template or the biometric template to be verified may be hashed by the SHA-256 algorithm, and the corresponding hash check value obtained as the check data is obtained accordingly.

S32. Encrypt the biometric template containing the verification data to generate a biometric encryption template.

For example, the encryption in this step may adopt the AES256-CBC algorithm in the first embodiment of the present application. Of course, other encryption algorithms can also be used.

S33. Process the biometric encryption template generated according to the biometric template encryption to obtain M group biometric encryption template data, where M≥2.

S34: The M group biometric encryption template data is stored in the N storage areas, and at least one set of biometric encryption template data exists in each storage area after the storage, 1<N≤M.

In this embodiment, the biometric encryption template may be a biometric encryption template generated by encrypting the biometric template containing the verification data. Steps S33 and S34 are respectively consistent with steps S11 and S12 in the first embodiment of the present application, and the implementation principle is similar to that of S11 and S12, and details are not described herein again.

In this embodiment, by placing the verification data into the biometric template, the biometric template obtained by the verification data can be consistently verified in the subsequent application to ensure the acquired biometric template and the original creature. The feature templates are identical.

[Embodiment 4]

4 is a flowchart of a biometric template verification method according to Embodiment 4 of the present application. As shown in FIG. 4, the biometric template verification method includes:

S41. Process the M sets of associated biometric encryption template data acquired from the N storage areas to obtain a biometric encryption template, where M≥2, 1<N≤M.

In this step, the operation of acquiring the M sets of associated biometric encrypted data from the N storage areas of the N storage areas, for example, the storage area including the at least one chip level security environment, may specifically be related to the M related entities stored in the M group. The corresponding inverse operation when the feature encrypts the data. That is, the M group biometric encryption template data is stored in the N storage areas according to the deposit method, and then the M group biometric encryption template data is also acquired in a manner corresponding to the original deposit mode. Taken from the N storage areas. For example, the way to deposit is: 3 sets of biometric models The board encryption data is stored in two storage areas, wherein the first group and the second group biometric encryption template data are stored in the first storage area, and the third group biometric encryption template data is stored in the second storage area; Then, the acquisition method is: taking out the first group and the second group of biometric encryption template data from the first storage area, and extracting the third group biometric encryption template data from the second storage area.

In this step, the processing of obtaining the biometric encryption template from the M group associated biometric encryption template data and the processing of obtaining the M group biometric encryption template data from the biometric encryption template may be a pair of reciprocal operations. For example, the process of obtaining the M group biometric encryption template data from the biometric encryption template is a splitting process, and then the process of obtaining the biometric encryption template from the M group associated biometric encryption template data is corresponding to the splitting process. Combined processing.

S42. Perform consistency check verification on the biometric template to be verified obtained according to the biometric encryption template. If the verification is passed, determine that the biometric template to be verified is consistent with the original biometric template.

Specifically, the process of obtaining the biometric template to be verified according to the biometric encryption template and the process of encrypting and generating the biometric encryption template according to the original biometric template (corresponding to the biometric template in the above embodiment) are used to perform a pair of reciprocal operations. . For example, the process of generating the biometric encryption template according to the original biometric template is to use the AES256-CBC algorithm to encrypt the original biometric template to generate the biometric template, and then the biometric template to be verified according to the biometric encryption template is utilized. The inverse algorithm corresponding to the AES256-CBC algorithm decrypts the biometric encryption template to obtain a biometric template to be verified.

For example, the method for obtaining the biometric template to be verified according to the biometric encryption template includes: decrypting the biometric encryption template according to the key obtained from the biometric encryption template to obtain a biometric template to be verified. Specifically, the method may be: extracting a key from an agreed position of the biometric encryption template, such as a header or a tail; and decrypting the biometric encryption template according to the key to obtain a biometric template to be verified. Wherein the agreed location may be derived from a record holding a location of the key in the biometric encryption template.

In this step, the consistency check verification performed on the biometric template to be verified is consistent with the consistency check on the original biometric template. That is to verify the biometric template and pair The consistency check processing performed by the original biometric template is the same. For example, the consistency check performed may be the same hash check as the SHA-256 check.

Illustratively, the process of obtaining the biometric template to be verified and the consistency verification verification of the biometric template to be verified may include:

a) Decrypting the biometric encryption template to obtain the biometric template to be verified and the verification data 1. According to the hash check principle, the check data here can be regarded as the check data generated by the original biometric template through the same hash check.

b) Perform the consistency check on the biometric template to be verified by the same hash check to generate the check data 2.

c) Aligning the verification data 2 with the verification data one. If the two are the same, it is determined that the biometric template to be verified is completely consistent with the original biometric template, that is, the biometric template to be verified is legal. Otherwise, it is determined that the biometric template to be verified is inconsistent with the original biometric template, that is, the biometric template to be verified is invalid.

The biometric template verification method provided in the fourth embodiment processes the M-type associated biometric encryption template data obtained from the N storage areas to obtain the biometric encryption template, and then obtains the biometric encryption template to be verified. The biometric template is subjected to consistency verification, so as to determine whether the biometric template to be verified is consistent with the original biometric template, that is, whether the biometric template to be verified is legal.

Generally, the biometric template saving method and the biometric template verification method provided in the above embodiments may be used in combination. Here's a look at the process used in conjunction with:

S501. Perform a hash check on the biometric template (such as a SHA-256 algorithm check) to generate a first hash check value.

S502. After the first hash check value is placed at the end position of the biometric template, generate a biometric verification template.

S503. Encrypt the biometric verification template by using a first key (corresponding to the key in the foregoing embodiment) (for example, using an AES256-CBC algorithm for encryption) to generate a biometric encryption template, where the key may be implemented by a system. The random number generation function is randomly generated, and can also be preset, as in the implementation. Pre-written in the program (code).

S504. Place the first key before the starting position in the biometric encryption template.

S505. Split the biometric encryption template into which the first key is placed to obtain two sets of biometric encryption template data.

S506. Store one set of biometric encryption template data, for example, including the first key, in a storage area of the SE security environment, and store another set of biometric encryption template data in a storage area of the TEE security environment.

In practical applications, if the AES256-CBC algorithm is used for encryption in the above process, the data capacity of the set of biometric encryption template data containing the first key should be greater than or equal to 64 Bytes and less than or equal to 10 KB. Setting the capacity to 64 Bytes or more is to completely include the first key (such as 256 bits) in the data of the group, and setting it to not more than 10 KB is based on the consideration that the total capacity of the SE storage area is small.

S507. Extract two sets of associated biometric encryption template data to be verified from the storage area of the SE and the storage area of the TEE.

S508. Combine the two sets of biometric encryption template data to be verified (corresponding to the splitting process) to obtain a biometric encryption template to be verified (corresponding to the biometric encryption template).

S509. Decrypt the biometric encryption template (the part excluding the second key) to be verified according to the second key extracted from the biometric encryption template header to be verified, to obtain a biometric verification template to be verified (corresponding to the biometric feature) Check template).

S510. Extract a second hash check value (corresponding to the first hash check value) from a tail of the biometric verification template to be verified, and a biometric template to be verified.

S511. Perform a hash check on the biometric template to be verified (same as the hash check) to obtain a third hash check value. If the third hash check value is the same as the second hash check value, The biometric template to be verified is completely consistent with the biometric template, that is, the biometric template to be verified is a legal biometric template. Otherwise, it is determined that the biometric template to be verified is inconsistent with the biometric template, that is, the biometric template to be verified is an illegal biometric template.

[Embodiment 5]

FIG. 5 is a structural diagram of a biometric identification device according to Embodiment 5 of the present application. The biometric device is a device including a biometrics acquisition module 1 (such as a fingerprint acquisition chip, a fingerprint sensor, etc.), a biometric data processing chip 2 (such as a microprocessor), and a storage module 3. The biometric device may be applied to a mobile terminal (such as a smart phone, a tablet, etc.) or other electronic device for performing the biometric template saving method and/or the biometric template verification method as described in the above embodiments. .

Specifically, as an embodiment, the biometric collection module 1 is configured to collect biometric information of the user during the biometric registration phase. The biometric collection module 1 may be specifically a biometric sensor (such as a fingerprint sensor) for collecting biometric information. The biometric information may be specifically biometric raw data (such as fingerprint raw data).

The biometric data processing chip 2 is configured to perform feature extraction on the biometric information collected by the biometric collection module 1 to obtain biometric data and combine the biometric templates into a biometric template, and encrypt the biometric template to generate a biometric a feature encryption template; and processing the biometric encryption template generated according to the biometric template encryption to obtain the M group biometric encryption template data, M≥2, for example, the biometric data processing chip 2 can be decomposed by default The sub-algorithm splits the biometric encryption template into the M sets of biometric encryption template data.

Optionally, the biometric data processing chip 2 includes: a template generating unit and a template processing unit.

The template generating unit is configured to perform feature extraction on the biometric information collected by the biometric feature collection module 1 to obtain biometric data and combine the biometric template into a biometric template, and encrypt the biometric template to generate a biometric Feature encryption template.

The template processing unit is configured to process the biometric encryption template generated by the biometric template encryption to obtain the M group biometric encryption template data, where M≥2. For example, the template processing unit may adopt a preset splitting algorithm. And dividing the biometric encryption template into the M group biometric encryption template data.

Optionally, in a specific embodiment, the template generating unit may be further configured to process the biometric encryption template in the template processing unit and obtain M sets of biometric encryption template data. Previously, the key used to generate the biometric encryption template based on the biometric template encryption is placed in any location in the biometric encryption template.

Optionally, in a specific embodiment, the template generating unit may be further configured to: before the template processing unit processes the biometric encryption template and obtain M sets of biometric encryption template data, The template performs consistency check, and the verification data obtained by performing consistency check on the biometric template is placed in any position in the biometric template. The template generating unit may specifically generate the biometric encryption template by encrypting the biometric template containing the verification data.

The storage module 3 is configured to store the M sets of biometric encryption template data. Specifically, the storage module 3 may include N storage areas, and after the M sets of biometric encryption template data are stored in the storage module, at least one set of biometric encryption template data exists in each storage area. 1 < N ≤ M.

As a preferred embodiment, at least one of the M storage areas of the storage module is a storage area of a chip-level security environment such as an SE (Secure Element).

In a practical application, the biometric data processing chip may further include: a template data acquiring unit, a template restoring unit, and a template verifying unit.

The template data acquiring unit is configured to acquire M sets of biometric encryption template data associated with each other from the N storage areas of the storage module;

The template restoring unit is configured to recombine the M group biometric encryption template data to obtain a biometric encryption template;

The decryption verification unit is configured to decrypt the biometric encryption template to obtain a biometric template to be verified, and determine the biometric to be verified by performing consistency verification on the biometric template to be verified. Whether the template is consistent with the original biometric template.

Optionally, the decryption verification unit is specifically configured to: use the first verification data generated by performing consistency check on the biometric template to be verified, and the second verification data obtained from the to-be-verified biometric verification template. Verifying the data for comparison verification. If the first verification data is the same as the second verification data, the verification passes and may determine that the biometric template to be verified is consistent with the original biometric template; otherwise The verification fails and may determine that the biometric template to be verified does not match the original biometric template.

Optionally, the biometric device may be used to perform the corresponding method or step in the first to fourth embodiments of the present application, or may further perform the corresponding method in the first to fourth embodiments of the present application by using the included module (unit) or the like. step. The implementation principle is similar to the first to fourth embodiments of the present application, and details are not described herein again.

Illustratively, the biometric data processing chip in this embodiment may multiplex the CPU chip of the mobile terminal or other electronic device, and does not necessarily have to be a dedicated CPU chip (for example, a dedicated CPU integrated in the biometric module). That is, in the form of a reusable CPU chip, the processing power of the reusable CPU chip can be further exerted.

[Embodiment 6]

Embodiment 6 of the present application provides a terminal. The terminal includes the biometric device as described in Embodiment 5 of the present application. Illustratively, the terminal may be a mobile phone, a tablet, a personal computer, a server, a network device, or other electronic device, etc., including the biometric device as described in Embodiment 5 of the present application.

Finally, it should be noted that the above embodiments are only used to explain the technical solutions of the embodiments of the present application, and are not limited thereto; although the present application is described in detail with reference to the foregoing embodiments, those skilled in the art should understand that The technical solutions described in the foregoing embodiments may be modified, or some of the technical features may be equivalently replaced; and the modifications or substitutions do not deviate from the spirit of the technical solutions of the embodiments of the present application. range.

Claims (19)

A biometric template saving method, comprising: Processing the biometric encryption template generated according to the biometric template encryption to obtain M group biometric encryption template data, M≥2; The M group biometric encryption template data is stored in the N storage areas, and at least one set of biometric encryption template data is stored in each of the stored storage areas, 1<N≤M. The biometric template saving method according to claim 1, wherein at least one of the N storage areas is a storage area of a chip level security environment. The biometric template saving method according to claim 1, wherein the processing the biometric encryption template generated according to the biometric template comprises: performing a splitting process on the biometric encryption template. The biometric template saving method according to claim 1, wherein the biometric encryption template generated by the biometric template is processed to obtain the M biometric encryption template data, and the method further comprises: encrypting according to the biometric template. The key used to generate the biometric encryption template is placed anywhere in the biometric encryption template. The biometric template saving method according to claim 4, wherein the key is placed at a start position or an end position of the biometric encryption template. The biometric template saving method according to claim 1, further comprising: Performing verification data obtained by performing consistency check on the biometric template into any position in the biometric template; The biometric template containing the verification data is encrypted to generate the biometric encryption template. The biometric template saving method according to claim 6, wherein the consistency check is a hash check, the obtained check data is a hash check value, and the hash check is performed. The value is placed before or after the start of the biometric template. The biometric template saving method according to claim 1, further comprising: Collect biometric raw data; Performing biometric and/or image feature extraction on the collected biometric raw data to obtain a plurality of biometric data; Combining the plurality of biometric data to obtain the biometric template. The biometric template saving method according to claim 8, wherein the biometric raw data is fingerprint feature original data or fingerprint image data; The biometric data is fingerprint feature point data or fingerprint feature image extremum data; Performing biometric and/or image feature extraction on the collected biometric raw data to obtain a plurality of biometric data includes: extracting fingerprint feature points from the collected fingerprint feature point original data, and obtaining multiple fingerprint feature point data. And/or, performing fingerprint feature image extraction on the collected fingerprint feature raw data to obtain a plurality of fingerprint feature image extremum data. A biometric template verification method, comprising: Processing the M group associated biometric encryption template data obtained from the N storage areas to obtain a biometric encryption template, M≥2, 1<N≤M; And performing a consistency check verification on the biometric template to be verified obtained according to the biometric encryption template. If the verification is passed, determining that the biometric template to be verified is consistent with the original biometric template. The biometric template according to claim 10, wherein the N storage areas contain at least one storage area of a chip level security environment. The biometric template according to claim 11, wherein the performing the consistency check verification on the biometric template to be verified obtained according to the biometric encryption template comprises: performing consistency check on the biometric template to be verified The generated first verification data is compared with the second verification data obtained from the biometric verification template to be verified; If the first verification data is the same as the second verification data, the verification is passed. The biometric template according to claim 12, wherein the performing the consistency check on the biometric template to be verified comprises: performing a hash check on the biometric template to be verified. The biometric template according to claim 12, wherein the second verification data is extracted from a header or a tail of the biometric template to be verified. The biometric template according to claim 10, wherein the obtaining the biometric template to be verified according to the biometric encryption template comprises: Extracting a key from a header or a tail of the biometric encryption template; Decrypting the biometric encryption template according to the key to obtain a biometric template to be verified. A biometric identification device, comprising: a biometrics acquisition module, a biometric data processing chip and a storage module; The biometric collection module is configured to collect biometric information of a user; The biometric data processing chip is configured to perform feature extraction on the biometric information, obtain biometric data and combine the biometric template into a biometric template, and perform encryption processing on the biometric template to generate a biometric encryption template; Processing the biometric encryption template generated according to the biometric template encryption to obtain M group biometric encryption template data, M≥2; The storage module is configured to store the M sets of biometric encryption template data, the storage module includes N storage areas, and the M sets of biometric encryption template data are stored in the storage module, each storage area There is at least one set of biometric encryption template data, 1<N≤M. The biometric device according to claim 16, comprising a template generating unit and a template processing unit; The template generating unit is configured to perform feature extraction on the biometric information, obtain biometric data and combine the biometric template into a biometric template, and perform encryption processing on the biometric template to generate a biometric encryption template. The template processing unit is configured to process the biometric encryption template generated according to the biometric template encryption to obtain M sets of biometric encryption template data. The biometric identification device according to claim 17, wherein the biometric data processing chip further comprises: a template data acquiring unit, a template restoring unit, and a template verifying unit; The template data acquiring unit is configured to acquire M sets of biometric encryption template data associated with each other from the N storage areas of the storage module; The template restoring unit is configured to recombine the M group biometric encryption template data to obtain a biometric encryption template. The decryption verification unit is configured to decrypt the biometric encryption template to obtain a biometric template to be verified, and determine the biometric template to be verified by performing consistency verification on the biometric template to be verified. Whether it is consistent with the original biometric template. A terminal characterized by comprising the biometric identification device according to any one of claims 16 to 18.

Images