WO2018166484A1 - Data encryption and decryption methods and apparatuses, electronic device and readable storage medium - Google Patents

Abstract

Data encryption and decryption methods and apparatuses, an electronic device and a readable storage medium relate to the field of data processing. The data encryption method comprises: obtaining an iris image of a user; generating an iris template according to the iris image; generating a data key according to the iris template, and encrypting the iris template; and encrypting an obtained file to be encrypted according to the data key. As an iris template can be generated according to an iris image, a different data key can be generated for each different file to be encrypted according to a different iris template generated each time. Therefore, the security of data keys and the security of data are improved.

Description

Data encryption, decryption method, device, electronic device and readable storage medium

Cross-reference to related applications

The present application claims priority to Chinese Patent Application No. 2017101636319, entitled "Data Encryption, Decryption Method, Apparatus, and Electronic Device", filed on March 17, 2017, the entire contents of which are incorporated herein by reference. In the application.

Technical field

The present disclosure relates to the field of data processing, and in particular, to a data encryption and decryption method, apparatus, electronic device, and readable storage medium.

Background technique

With the development of technology, the use of storage media such as computers, mobile phones, and radio frequency cards is becoming more and more widespread. Among them, a large number of electronic documents of different types and involving high confidentiality information are stored, and such information will be immeasurable once it is illegally stolen. The loss, and the current common practice is to use a variety of document security software to encrypt the data. The industry's mainstream encryption systems such as PGP and True Crypt use a variety of encryption algorithms to improve security. These encryption systems have a significant drawback, that is, if the key is forgotten, or the key is lost, then Encrypted files cannot be decrypted properly and become obsolete. Moreover, in the prior art, an iris image is used to encrypt a file, and the encryption key generated by the method has the sameness. Therefore, the key generated by the method has poor security and cannot truly guarantee data security.

Summary of the invention

In view of this, the purpose of the present disclosure includes providing a data encryption, decryption method, apparatus, and electronic device to improve the above problems.

In a first aspect, the present disclosure provides a data encryption method, the method comprising: acquiring a user iris image; generating an iris template according to the iris image; generating a data key according to the iris template, and performing the iris template Encryption; encrypting the obtained file to be encrypted according to the data key.

Further, after the step of encrypting the obtained file to be encrypted according to the data key, the method further includes: generating an iris key according to the encrypted file to be encrypted; and pairing the iris template according to the iris key Performing secondary encryption; generating an encrypted data packet according to the second encrypted image and the encrypted file to be encrypted.

Further, the acquiring the iris image of the user comprises: acquiring the iris image of the user by using an iris camera.

Further, the step of generating an iris template according to the iris image includes:

The iris image is processed by using a preset algorithm to obtain intrinsic biometric property data of the human body included in the iris image;

The acquired intrinsic biometric property data is used as data in the iris template.

Further, the step of generating a data key according to the iris template and encrypting the iris template includes:

Performing an operation on the iris template by using a hash algorithm to obtain a data key;

The iris template is encrypted by using a preset encryption algorithm to obtain an encrypted iris template.

In a second aspect, the present disclosure provides a data decryption method, the method includes: acquiring a user iris image; generating a new iris template according to the iris image; and acquiring an encrypted data packet corresponding to the file to be decrypted, where the encrypted data packet is Generating in the process of encrypting the original file to obtain the file to be decrypted, and the encrypted data packet includes the original file and the encrypted original iris template; acquiring the original file and the obtained from the encrypted data packet Decoding the original iris template; generating an iris key according to the original file; decrypting the encrypted original iris template according to the iris key; and the decrypted original iris template and the new iris The template is matched to obtain a matching result; and the file to be decrypted is decrypted according to the matching result.

Further, the decrypting the encrypted file to be decrypted according to the matching result includes: if the matching result is that the decrypted original iris template matches the new iris template, obtaining the basis Decoding a data key generated by the original iris template; and decrypting the encrypted file to be decrypted according to the data key.

Further, according to the matching result, the step of decrypting the file to be decrypted includes:

If the matching result is that the decrypted original iris template is inconsistent with the new iris template, the decryption process is ended.

In a third aspect, the present disclosure provides a data decryption method, including:

Obtaining a first iris template corresponding to the first iris image of the user;

Obtaining the encrypted second iris template and the encrypted data encrypted by the first data key, where the first data key is generated according to the second iris template in the data encryption process;

Decrypting the encrypted second iris template to obtain a second iris template;

Determining whether the first iris template is consistent with the second iris template;

And when the first iris template is consistent with the second iris template, generating the first data key according to the second iris template, and decrypting the encrypted data by using the first data key.

Further, the method further includes:

When the first iris film plate is inconsistent with the second iris template, the data decryption process is ended.

Further, the step of decrypting the encrypted second iris template to obtain a second iris template includes:

Determining an iris encryption algorithm used when the second iris template is encrypted;

Determining an iris decryption algorithm corresponding to the iris encryption algorithm;

Performing an initial decryption of the encrypted second iris template according to the iris decryption algorithm to obtain a second iris template after initial decryption;

The second iris template after the initial decryption is secondarily decrypted according to the iris decryption algorithm, and the second decrypted second iris template is used as the decrypted second iris template.

Further, the first iris template includes first biometric data, the second iris template includes second biometric data, and the step of determining whether the first iris template is consistent with the second iris template comprises:

Determining whether the same data in the first biometric data and the second biometric data exceeds a preset threshold;

When the same data in the first biometric data and the second biometric data exceeds a preset threshold, indicating that the first iris template is consistent with the second iris template;

And when the same data in the first biometric data and the second biometric data is lower than the preset threshold, indicating that the first iris template is inconsistent with the second iris template.

In a fourth aspect, the present disclosure provides a data encryption apparatus, the apparatus comprising: an image acquisition module configured to acquire a user iris image; a first generation module configured to generate an iris template according to the iris image; and a second generation module And configuring the data key to be generated according to the iris template, and encrypting the iris template; and the encryption module is configured to encrypt the to-be-encrypted file obtained according to the data key.

Further, the device further includes: a third generating module, configured to generate an iris key according to the encrypted file to be encrypted; and a template encryption module configured to perform secondary encryption on the iris template according to the iris key; And a data packet generating module configured to generate an encrypted data packet according to the second encrypted IP template and the encrypted file to be encrypted.

In a fifth aspect, the present disclosure provides a data decryption apparatus, the apparatus comprising: a first acquisition module configured to acquire a user iris image; a template generation module configured to generate a new iris template according to the iris image; a module configured to obtain an encrypted data packet corresponding to the file to be decrypted, where the encrypted data packet is generated in a process of encrypting the original file to obtain the to-be-decrypted file, and the encrypted data includes the original file and the encrypted file a raw iris template; a third obtaining module configured to acquire the original file and the encrypted original iris template from the encrypted data packet; and a key generation module configured to generate an iris key according to the original file a template decryption module configured to decrypt the encrypted original iris template according to the iris key; and a matching module configured to match the decrypted original iris template with the new iris template to obtain a match a file decryption module configured to decrypt the file to be decrypted according to the matching result

Further, the file decryption module includes: a comparison sub-module configured to acquire, according to the original iris template, if the matching result is that the decrypted original iris template matches the new iris template a data key; a decryption sub-module configured to decrypt the encrypted file to be decrypted according to the data key.

In a sixth aspect, the present disclosure provides an electronic device including an encryption processor and a memory coupled to the encryption processor, the memory storing instructions when the instruction is encrypted by the The electronic device performs the following operations: acquiring a user iris image; generating an iris template according to the iris image; generating a data key according to the iris template, and encrypting the iris template; The key encrypts the file to be encrypted obtained.

In a seventh aspect, the present disclosure provides an electronic device including an iris collection device for collecting an iris image of a user, the electronic device including a processor and a non-easy computer instruction stored therein Loss memory, the electronic device performing the data encryption method of any one of claims 1-5 when the computer instructions are executed by the processor.

In an eighth aspect, the present disclosure provides an electronic device including an iris collection device for collecting an iris image of a user, the electronic device including a processor and a non-easy computer instruction stored therein Loss memory, the electronic device performing the data decryption method of any one of claims 9-12 when the computer instructions are executed by the processor.

In a ninth aspect, the present disclosure provides a readable storage medium, the readable storage medium comprising a computer program, wherein: when the computer program is running, controlling a user terminal where the readable storage medium is located to execute claim 1 The data encryption method according to any one of 5.

In a tenth aspect, the present disclosure provides a readable storage medium, the readable storage medium comprising a computer program, wherein: when the computer program is running, controlling a user terminal where the readable storage medium is located to perform claim 9- The data decryption method according to any one of 12.

Advantages of the disclosure include, for example:

The present disclosure provides a data encryption and decryption method and an electronic device. First, an iris image of a user is acquired, an iris template is generated according to the iris image, and a data key is generated according to the iris template, so as to improve the security of the iris template, If the other person steals, the iris template needs to be encrypted, and the obtained file to be encrypted is encrypted according to the data key, and the iris template generated by the iris image is used, so that each iris template can be generated according to each time, thereby Different data keys are generated for each file to be encrypted, which improves data key security and data security.

Other features and advantages of the present disclosure will be set forth in the description which follows. The objectives and other advantages of the present disclosure can be realized and obtained by the structure particularly pointed out in the written description and claims.

DRAWINGS

In order to more clearly illustrate the technical solutions of the present disclosure, the drawings to be used in the embodiments will be briefly described below. It should be understood that the following drawings show only certain embodiments of the present disclosure and therefore should not be It is considered to be a limitation on the scope, and other related drawings may be obtained according to the drawings without any creative work for those skilled in the art.

FIG. 1 is a structural block diagram of an electronic device applicable to an embodiment of the present application;

2 is a flowchart of a data encryption method provided by the present disclosure;

FIG. 3 is a flowchart of a data decryption method provided by the present disclosure;

4 is a structural block diagram of a data encryption apparatus provided by the present disclosure;

FIG. 5 is a structural block diagram of a data decryption apparatus provided by the present disclosure.

detailed description

The technical solutions in the present disclosure are clearly and completely described in the following with reference to the accompanying drawings in the present disclosure. It is obvious that the described embodiments are only a part of the embodiments of the present disclosure, and not all of the embodiments. The components of the present disclosure, which are generally described and illustrated in the figures herein, can be arranged and designed in a variety of different configurations. The detailed description of the embodiments of the present disclosure, which is set forth in the claims All other embodiments obtained by a person skilled in the art based on the embodiments of the present disclosure without creative efforts are within the scope of the present disclosure.

It should be noted that similar reference numerals and letters indicate similar items in the following figures, and therefore, once an item is defined in a drawing, it is not necessary to further define and explain it in the subsequent drawings. Meanwhile, in the description of the present disclosure, the terms "first", "second", and the like are used merely to distinguish a description, and are not to be construed as indicating or implying a relative importance.

Please refer to FIG. 1. FIG. 1 is a structural block diagram of an electronic device 100 that can be applied to an embodiment of the present application. The electronic device 100 may include a data encryption device or a data decryption device, a memory 101, a memory controller 102, an encryption processor 103, a peripheral interface 104, an input and output unit 105, an audio unit 106, and a display unit 107.

The components of the memory 101, the storage controller 102, the encryption processor 103, the peripheral interface 104, the input/output unit 105, the audio unit 106, and the display unit 107 are electrically connected directly or indirectly to each other to implement data transmission. Or interaction. For example, the components can be electrically connected to one another via one or more communication buses or signal lines. The data encryption device or the data decryption device includes at least one software or firmware stored in the memory 101 or solidified in an operating system (OS) of the data encryption device or the data decryption device. Software function module. The cryptographic processor 103 is configured to execute executable modules stored in the memory 101, such as software functional modules or computer programs included in the data encryption device or data decryption device.

The memory 101 may be, but not limited to, a random access memory (RAM), a read only memory (ROM), and a programmable read-only memory (PROM). Erasable Programmable Read-Only Memory (EPROM), Electric Erasable Programmable Read-Only Memory (EEPROM), and the like. The memory 101 is configured to store a program, and the encryption processor 103 executes the program after receiving the execution instruction, and the method executed by the server defined by the flow process disclosed in any of the foregoing embodiments may be applied to the encryption process. In the device 103, or implemented by the encryption processor 103.

The cryptographic processor 103 may be an integrated circuit chip with signal processing capabilities. The cryptographic processor 103 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP Processor, etc.), or a digital signal processor (DSP), dedicated integration. Circuit (ASIC), off-the-shelf programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component. The methods, steps, and logical block diagrams disclosed in this disclosure may be implemented or carried out. The general purpose processor may be a microprocessor or the cryptographic processor 103 may be any conventional processor or the like.

The peripheral interface 104 couples various input/output devices to the encryption processor 103 and the memory 101. In some embodiments, peripheral interface 104, cryptographic processor 103, and memory controller 102 can be implemented in a single chip. In other instances, they can be implemented by separate chips.

The input output unit 105 is configured to provide input to the user to enable user interaction with the server (or local terminal). The input and output unit 105 can be, but is not limited to, a mouse, a keyboard, and the like.

The audio unit 106 provides an audio interface to the user, which may include one or more microphones, one or more speakers, and audio circuitry.

The display unit 107 provides an interactive interface (such as a user operation interface) between the electronic device 100 and the user or for displaying image data to the user for reference. In this embodiment, the display unit 107 can be a liquid crystal display or a touch display. For a touch display, it can be a capacitive touch screen or a resistive touch screen that supports single-point and multi-touch operations. Supporting single-point and multi-touch operations means that the touch display can sense the touch operation simultaneously generated from one or more positions on the touch display, and the touch operation is transferred to the encryption processor. 103 performs calculations and processing.

The peripheral interface 104 couples various input/input devices to the encryption processor 103 and the memory 101. In some embodiments, peripheral interface 104, cryptographic processor 103, and memory controller 102 can be implemented in a single chip. In other instances, they can be implemented by separate chips.

The input output unit 105 is configured to provide input to the user to enable user interaction with the processing terminal. The input and output unit 105 can be, but is not limited to, a mouse, a keyboard, and the like.

It should be noted that the electronic device 100 can be applied to encrypt or decrypt data during data transmission between the terminal device and the storage device, for example, when data is transmitted between the terminal device and the storage device. 100 is connected to the terminal device and the storage device respectively, and the connection interface between the terminal device and the storage device may be a USB or SATA type interface, thereby implementing a function of encrypting and decrypting data transfer.

For example, when the terminal device transmits data to the storage device, the electronic device 100 may encrypt the data when the data is transmitted to the storage device, and decrypt the data when the data is read from the storage device, thereby ensuring the security of the data.

In addition, the terminal device may be a terminal such as a personal computer (PC), a tablet computer, a smart phone, a personal digital assistant (PDA), a wearable device, or the like. The storage device can be an SD memory card, or a memory, or other device that can store data.

Please refer to FIG. 2. FIG. 2 is a flowchart of a data encryption method according to the present disclosure. The method specifically includes the following steps:

Step S110: Acquire a user iris image.

As an embodiment, the iris image of the user can be acquired by the iris camera, and the iris camera can adopt an optical anti-shake iris camera, and the iris camera can accurately capture the user's binocular or monocular iris images. In addition, a CCD camera or other image acquisition device can also be used to collect the user's iris image.

Step S120: Generate an iris template according to the iris image.

As an implementation manner, the method for generating an iris template may be to generate an iris template by using an iris image through a one-dimensional log-Gabor filtering algorithm or a two-dimensional log-Gabor filtering algorithm. For example, the iris image can be processed by using the Daubechies-4 wavelet transform to obtain an iris template. The embodiment of the present application does not limit the algorithm used to generate the iris template.

In the embodiment of the present application, the iris template is an iris image format stored in the memory used to compare the similarity of the iris images in order to determine whether the different iris images are the same iris, and the iris template includes the inherent biological characteristics of the individual. The iris template is an iris image format that is smaller in size than the original iris image measured by the camera.

For example, if the original iris image occupies about 100 KByte, the iris template corresponding thereto is about 10 KByte, which is about 1/10 of the original iris image data. This means that the iris template is much reduced compared to the original iris image data. In order to improve the processing speed at the time of authentication and the storage utilization ratio of the memory, the iris template may be a template that processes the iris image by Fourier transform or wavelet transform to include an individual's inherent biological characteristics.

Step S130: Generate a data key according to the iris template, and encrypt the iris template.

After obtaining the iris template, the iris template may be used to encrypt the iris template to generate a data key corresponding to the iris template. In the process of generating the iris template according to the iris image, in the process of collecting the user iris image External environment factors such as light and color may cause differences in the generated templates, and eventually the generated data keys are changed, thereby improving data key security and data security.

For example, an iris image collected under conditions of bright ambient light and good light is different from an iris image collected under conditions of dark environment and poor light. Different irises can be generated according to different iris images. Templates, different iris templates are processed by encryption algorithms, and the resulting data keys are different.

And in order to ensure the security of the iris template, the iris template can also be encrypted, and the encryption algorithm can be encrypted by using an iris module (optional, an iris module of the chip type AES256/128), or Encryption is performed using the national secret algorithm (SM1, SM2, SM3, SM4, SM7).

Step S140: Encrypt the obtained file to be encrypted according to the data key.

After the data key is generated, the data to be encrypted may be encrypted by using the data key, and the encryption method may also adopt a national secret algorithm (SM1, SM2, SM3, SM4, SM7) or the like. The encrypted file is encrypted by using the data key to obtain the encrypted file to be encrypted.

As an implementation manner, the method may further include:

Step S150: Generate an iris key according to the encrypted file to be encrypted.

In order to further improve the security of the iris template, the encrypted file to be encrypted obtained in the above step may generate an iris key according to the encrypted file to be encrypted, and the generating method may adopt a fuzzy algorithm or a fuzzy extractor to perform iris density. Key generation.

Step S160: Perform secondary encryption on the iris template according to the iris key.

If the iris template is encrypted once in step S130, the iris module (optionally, the iris module of the chip type AES256/128 can be used for encryption), and the iris template is used for secondary encryption in this step. The secret algorithm (optional, SM1, SM2, SM3, SM4, SM7, etc.) can be used for encryption. If the iris template is encrypted once in step S130, the national secret algorithm is used (optional, it can be used). If the SM1, SM2, SM3, SM4, SM7 and other national secret algorithms are used for encryption, the iris template is used for secondary encryption in this step. (Optionally, the iris module with the chip type AES256/128 can be used. Encryption to improve the security of the iris template to prevent it from being stolen by others.

Step S170: Generate an encrypted data packet according to the second encrypted image and the encrypted file to be encrypted.

In the process of decrypting the encrypted file to be encrypted, the iris template corresponding to the encrypted file to be encrypted needs to be determined, and the encrypted template can be generated by the secondary encrypted iris template and the encrypted file to be encrypted. The packet, when decrypting the encrypted file to be encrypted, extracts the encrypted file to be encrypted and the second encrypted iris template from the encrypted data packet.

In the embodiment of the present application, after the iris image of the user is acquired, an iris template is generated according to the iris image, and a data key is generated according to the iris template, and the generated iris template is simultaneously encrypted, and then according to the data. The key is used to encrypt the file to be encrypted. In order to improve the security of the iris template, the iris template may be secondarily encrypted according to the iris key generated by the encrypted file to be encrypted, in order to facilitate the decryption process. Extracting a template, the iris template and the encrypted file to be encrypted may be generated into an encrypted data packet, and the data encryption method generates an iris template through an iris image, so that each of the different templates to be encrypted according to the iris template Files generate different keys, improving key security and data security.

Please refer to FIG. 3. FIG. 3 is a flowchart of a data decryption method according to the present disclosure. The data decryption method specifically includes the following steps:

Step S210: Acquire a user iris image.

Obtaining the file to be decrypted after encrypting the original file, if the file to be decrypted is to be decrypted, the iris image of the user needs to be acquired first, and the iris image obtained in this step can also be obtained by the iris camera, and the specific implementation method can be referred to. Step S110, for the sake of brevity of the description, will not be described again.

When a user needs to decrypt a file encrypted using the above encryption method, the file can be decrypted only by using the iris image used in the encryption process. Due to the biological characteristics and uniqueness of the iris image, that is, it is necessary to decrypt the encrypted file by using the iris image of the eye used by the user when encrypting.

Step S220: Generate a new iris template according to the iris image.

In this step, the iris image generation new iris template is the same as the method for generating the iris template in step S120, that is, the new iris template can be generated by a one-dimensional log-Gabor filtering algorithm or a two-dimensional log-Gabor filtering algorithm.

Step S230: Acquire an encrypted data packet corresponding to the file to be decrypted, where the encrypted data packet is generated in the process of encrypting the original file to obtain the file to be decrypted, and the encrypted data includes the original file and the encrypted file. Original iris template.

The encrypted data packet referred to herein may actually be the encrypted data packet generated in step S170, that is, the encrypted data packet is an encrypted data packet generated by the secondary encrypted original iris template and the encrypted original file. The original file may be the file to be encrypted in the above encryption process, and the encrypted original file may be the encrypted file to be encrypted.

Step S240: Acquire the original file and the encrypted original iris template from the encrypted data packet.

After obtaining the encrypted data packet, the original file and the encrypted original iris template can be extracted therefrom. If the original file is an encrypted original file, the encrypted original file needs to be decrypted before being obtained. The original file, the method of decrypting the encrypted original file can also be decrypted by using the national secret algorithm (optional, SM1, SM2, SM3, SM4, SM7 and other national secret algorithms).

In a specific embodiment, the encrypted original file may be encrypted by using a data key in the foregoing encryption method, and the data key is generated by an iris template generated by the user's iris image. . When you need to decrypt the encrypted original file. The iris image provided by the decrypter can be obtained, a new iris template is generated according to the iris image provided by the decrypter, and a new data key is generated by the new iris template, and the encrypted original file is decrypted by using the new data key. Get the original file without encryption.

Step S250: Generate an iris key according to the original file.

The iris key can be generated by the obtained original file, and the method for generating the iris key here can also be generated by using a fuzzy algorithm or a fuzzy extractor.

Step S260: Decrypt the encrypted original iris template according to the iris key.

After obtaining the iris key, the second encrypted original iris template is decrypted according to the iris key. If the original iris template is encrypted once, the national secret algorithm is used (optional, SM1, SM2 may be selected). SM3, SM4, SM7 and other national secret algorithms are used for encryption. The secondary encryption uses the iris module (optional, the iris module with the chip type AES256/128 can be selected) for encryption, and correspondingly, decryption When decrypting, the iris module (optional, iris module with chip type AES256/128) can be used for decryption. The second decryption should use the national secret algorithm (optional, SM1, SM2, SM3 can be selected). , SM4, SM7 and other national secret algorithms) for decryption. If the original iris template is encrypted once, the iris module (chip type AES256/128) is used for encryption, and the secondary encryption is performed by the national secret algorithm (optional, SM1, SM2, SM3, SM4, etc.) SM7 and other national secret algorithms) are encrypted. Correspondingly, when decrypting, one decryption should use the national secret algorithm (optional, you can use SM1, SM2, SM3, SM4, SM7 and other national secret algorithms) for decryption and secondary decryption. The iris module (optional, iris module with AES256/128 chip type) can be used for decryption. That is, the algorithm used in the encryption process of the iris template is encrypted, and the same algorithm is used for decryption in the decryption process.

Step S270: Match the decrypted original iris template with the new iris template to obtain a matching result.

In the above steps, the original iris template and the generated new iris template are obtained, and the original iris template and the new iris template can be matched by probability and threshold methods to obtain a matching result.

In detail, the original iris template can be compared with the new iris template, and the similarity between the two is calculated. If the similarity value exceeds the preset threshold, it indicates that the new iris template acquired later is encrypted. The original iris template used. The user indicating that the decryption is the user at the time of encryption, and the user uses the same eye as the source of the iris image acquired during decryption and encryption. At this time, the matching result of the original iris template and the letter iris template is that the similarity between the two satisfies the decryption requirement.

Step S280: Decrypt the file to be decrypted according to the matching result.

According to the matching result obtained in the above step, if the matching result is that the decrypted original iris template matches the new iris template, the data key generated according to the original iris template is acquired, thereby according to the data key. Decrypting the to-be-decrypted file, if the matching result is that the decrypted original iris template is inconsistent with the new iris template, the data key generated by the original iris template cannot be obtained, and the data key cannot be obtained. The decrypted file is decrypted to prevent data from being stolen, thereby ensuring the security of the data.

After acquiring the iris image of the user, generating a new iris template according to the iris image, and acquiring an encrypted data packet corresponding to the file to be decrypted, where the encrypted data packet is in the process of encrypting the original file to obtain the to-be-decrypted file. Generating, and the encrypted data includes the original file and the encrypted original iris template, and then acquiring the original file and the encrypted original iris template from the encrypted data packet, and generating an iris key according to the original file. And decrypting the encrypted original iris template according to the iris key, and matching the decrypted original iris template with the new iris template, if the matching result is the decrypted original iris template Acquiring with the new iris template matching, acquiring a data key generated according to the original iris template, the data decrypting method is to obtain the original iris template generated by the original file, and then the original iris template and the newly generated new iris The template is matched, so that the iris template and the data encryption method generated during the decryption process of the data are Whether the generated iris templates match, if they match, the decrypted files can be decrypted. If they do not match, the decrypted files cannot be decrypted, thereby improving key security and data security.

The embodiment of the present application discloses a data decryption method, which includes the following steps.

Step S301, obtaining a first iris template corresponding to the first iris image of the user.

The first iris image may be obtained by an iris collection device, and a corresponding algorithm may be used to generate a corresponding first iris template for the collected first iris image. The first iris template can include the iris organism features inherent to the user's individual.

In the data encryption method in the embodiment of the present application, the user may use his own iris as an encryption key in the data encryption process. In the process of decrypting file data using the iris as an encryption key, the iris at the time of encryption must also be used, otherwise the correct decryption cannot be completed.

Step S301: Obtain an encrypted second iris template and encrypted data encrypted by the first data key, where the first data key is generated according to the second iris template in a data encryption process.

In the embodiment of the present application, the first data key is generated by using the second iris template, and the data is encrypted by using the first data key. After the data is encrypted by using the first data key, the encrypted encrypted data and the second iris template used for encryption may be packaged and stored. When the encrypted data needs to be decrypted, the packaged encrypted data may be obtained first. Second iris template. The packaged second iris template may also be encrypted. After the packaged encrypted data and the encrypted second iris template are obtained, the encrypted second iris template and the encrypted data may be separated and processed separately.

In the embodiment of the present application, the number of the first iris images may be one or more. The number of second iris images may be one or more. That is to say, during the encryption process, the user can use the iris of one eye to encrypt, or the iris of two eyes to encrypt, and even more irises of the irises of three eyes of multiple people can be encrypted. Due to the uniqueness of the iris, a larger number of irises can achieve more secure encryption. Correspondingly, during the decryption process, the iris of one eye or two eyes or more eyes is used for decryption to improve the security of the decryption process.

Step S301, decrypting the encrypted second iris template to obtain a second iris template.

In order to improve the security of the encryption process and the decryption process, the second iris template used in the encryption process is also encrypted, and the encryption algorithm used for encrypting the second iris template may be predetermined and randomly selected from a plurality of encryption algorithms. When decrypting the encrypted second iris template, the correct encryption algorithm must be used to decrypt, or the decryption algorithm corresponding to the encryption algorithm can be used for decryption. The encryption algorithm or the decryption algorithm used for encryption may be preset. When the encrypted second iris template needs to be decrypted, the corresponding algorithm is used for decryption to obtain the decrypted second iris template.

Step S301, determining whether the first iris template and the second iris template are consistent.

After the decrypted second iris template is obtained, the second iris template can be compared with the first iris template to determine whether the two are consistent. For example, in the process of encrypting a file, the user uses the iris of the left eye to encrypt, and correspondingly, during the decryption process, the user must also use the iris of the left eye to perform the decryption operation. The user only uses the same eye as the encryption process, and the comparison results of the first iris template and the second iris template are consistent.

Step S301, when the first iris template is consistent with the second iris template, generating the first data key according to the second iris template, and performing the encrypted data by using the first data key. Decrypt.

After comparing the first iris template and the second iris template, if the first iris iris template and the second iris template are identical, or both of the same features exceed a preset threshold, the user is used in decryption. The same eye as when encrypting. At this time, the first data key may be generated according to the second iris template, and the encrypted data is decrypted by using the first data key to obtain the decrypted data, and the data decryption process is completed.

When the first iris film plate is inconsistent with the second iris template, indicating that the user uses an eye different from the eye used by the encryption process, or other users use the iris to attempt to decrypt the encrypted data, such a decryption process is Incorrect, you can end the data decryption process.

In detail, the step of decrypting the encrypted second iris template to obtain a second iris template includes:

Determining an iris encryption algorithm used when the second iris template is encrypted;

Determining an iris decryption algorithm corresponding to the iris encryption algorithm;

Performing an initial decryption of the encrypted second iris template according to the iris decryption algorithm to obtain a second iris template after initial decryption;

The second iris template after the initial decryption is secondarily decrypted according to the iris decryption algorithm, and the second decrypted second iris template is used as the decrypted second iris template.

In detail, the first iris template includes first biometric data, the second iris template includes second biometric data, and the step of determining whether the first iris template is consistent with the second iris template comprises:

Determining whether the same data in the first biometric data and the second biometric data exceeds a preset threshold;

When the same data in the first biometric data and the second biometric data exceeds a preset threshold, indicating that the first iris template is consistent with the second iris template;

And when the same data in the first biometric data and the second biometric data is lower than the preset threshold, indicating that the first iris template is inconsistent with the second iris template.

In the embodiment of the present application, the above encryption method and decryption method can be applied to an encryption decryption device having an iris collection device. When the user needs to encrypt the data on an electronic device, the encryption and decryption device can be connected to the electronic device, and then the iris collection device on the encryption and decryption device is used to collect one or more iris images, and the collected iris image is utilized. Encryption of the data is done according to the above encryption method. When the user wants to decrypt the encrypted data, the encryption and decryption device needs to be used, and the iris image required for decryption is collected by the iris collection device on the encryption and decryption device, and the decrypted data is decrypted according to the decryption method. Data decryption process.

Please refer to FIG. 4. FIG. 4 is a structural block diagram of a data encryption apparatus 200 according to the present disclosure. The apparatus is configured to perform the foregoing data encryption method, and the apparatus specifically includes:

The image acquisition module 210 is configured to acquire a user iris image.

The first generation module 220 is configured to generate an iris template according to the iris image.

The second generation module 230 is configured to generate a data key according to the iris template and encrypt the iris template.

The encryption module 240 is configured to encrypt the obtained file to be encrypted according to the data key.

As an embodiment, the device may further include:

The third generation module 250 is configured to generate an iris key according to the encrypted file to be encrypted.

The template encryption module 260 is configured to perform secondary encryption on the iris template according to the iris key.

The data packet generating module 270 is configured to generate an encrypted data packet according to the second encrypted image and the encrypted file to be encrypted.

Please refer to FIG. 5. FIG. 5 is a structural block diagram of a data decryption apparatus 300 according to the present disclosure. The apparatus is configured to perform the foregoing data decryption method, and the apparatus specifically includes:

The first obtaining module 310 is configured to acquire a user iris image.

The template generation module 320 is configured to generate a new iris template according to the iris image.

The second obtaining module 330 is configured to obtain an encrypted data packet corresponding to the file to be decrypted, where the encrypted data packet is generated in the process of encrypting the original file to obtain the to-be-decrypted file, and the encrypted data includes the original File and encrypted original iris template.

The third obtaining module 340 is configured to obtain the original file and the encrypted original iris template from the encrypted data packet.

The key generation module 350 is configured to generate an iris key according to the original file.

The template decryption module 360 is configured to decrypt the encrypted original iris template according to the iris key.

The matching module 370 is configured to match the decrypted original iris template with the new iris template to obtain a matching result.

The file decryption module 380 is configured to decrypt the file to be decrypted according to the matching result.

As an embodiment, the device may further include:

The comparison sub-module is configured to acquire a data key generated according to the original iris template if the matching result is that the decrypted original iris template matches the matching result of the new iris template.

And a decryption submodule configured to decrypt the encrypted file to be decrypted according to the data key.

A person skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the method described above can refer to the corresponding process in the foregoing apparatus, and details are not described herein again.

In summary, the present disclosure provides a data encryption and decryption method and an electronic device, which first acquires an iris image of a user, generates an iris template according to the iris image, and generates a data key according to the iris template, in order to improve the iris template. Security, to prevent being stolen by others, the iris template needs to be encrypted, and the obtained file to be encrypted is encrypted according to the data key, and the iris template generated by the iris image is generated, so that the iris template can be generated according to each time. The difference is that different data keys are generated for each different file to be encrypted, which improves data key security and data security.

In the several embodiments provided by the present application, it should be understood that the disclosed apparatus and method may also be implemented in other manners. The apparatus embodiments described above are merely illustrative, for example, the flowcharts and block diagrams in the figures illustrate the architecture, functionality, and functionality of possible implementations of apparatus, methods, and computer program products according to various embodiments of the present disclosure. operating. In this regard, each block of the flowchart or block diagram can represent a module, a program segment, or a portion of code that includes one or more of the Executable instructions. It should also be noted that, in some alternative implementations, the functions noted in the blocks may also occur in a different order than those illustrated in the drawings. For example, two consecutive blocks may be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending upon the functionality involved. It is also noted that each block of the block diagrams and/or flowcharts, and combinations of blocks in the block diagrams and/or flowcharts, can be implemented in a dedicated hardware-based system that performs the specified function or function. Or it can be implemented by a combination of dedicated hardware and computer instructions.

In addition, each functional module in various embodiments of the present disclosure may be integrated to form a separate part, or each module may exist separately, or two or more modules may be integrated to form a separate part.

The functions, if implemented in the form of software functional modules and sold or used as separate products, may be stored in a computer readable storage medium. Based on such understanding, the portion of the technical solution of the present disclosure that contributes in essence or to the prior art or the portion of the technical solution may be embodied in the form of a software product stored in a storage medium, including The instructions are used to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present disclosure. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. . It should be noted that, in this context, relational terms such as first and second are used merely to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply such entities or operations. There is any such actual relationship or order between them. Furthermore, the term "comprises" or "comprises" or "comprises" or any other variations thereof is intended to encompass a non-exclusive inclusion, such that a process, method, article, or device that comprises a plurality of elements includes not only those elements but also Other elements, or elements that are inherent to such a process, method, item, or device. An element that is defined by the phrase "comprising a ..." does not exclude the presence of additional equivalent elements in the process, method, item, or device that comprises the element.

The above description is only a preferred embodiment of the present disclosure, and is not intended to limit the disclosure, and various changes and modifications may be made to the present disclosure. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and scope of the present disclosure are intended to be included within the scope of the present disclosure. It should be noted that similar reference numerals and letters indicate similar items in the following figures, and therefore, once an item is defined in a drawing, it is not necessary to further define and explain it in the subsequent drawings.

The above is only the specific embodiment of the present disclosure, but the scope of the present disclosure is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the disclosure. It should be covered within the scope of protection of the present disclosure. Therefore, the scope of protection of the present disclosure should be determined by the scope of the claims.

It should be noted that, in this context, relational terms such as first and second are used merely to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply such entities or operations. There is any such actual relationship or order between them. Furthermore, the term "comprises" or "comprises" or "comprises" or any other variations thereof is intended to encompass a non-exclusive inclusion, such that a process, method, article, or device that comprises a plurality of elements includes not only those elements but also Other elements, or elements that are inherent to such a process, method, item, or device. An element that is defined by the phrase "comprising a ..." does not exclude the presence of additional equivalent elements in the process, method, item, or device that comprises the element.

Industrial applicability

The present disclosure provides a data encryption and decryption method, device, electronic device, and readable storage medium, which can generate different data keys for different files to be encrypted according to different generation of iris templates each time, thereby improving the data key. Data key security and data security.

Claims (21)

A data encryption method, the method comprising: Obtaining a user iris image; Generating an iris template according to the iris image; Generating a data key according to the iris template, and encrypting the iris template; The obtained file to be encrypted is encrypted according to the data key. The method according to claim 1, wherein after the step of encrypting the obtained file to be encrypted according to the data key, the method further comprises: Generating an iris key according to the encrypted file to be encrypted; Performing secondary encryption on the iris template according to the iris key; And generating an encrypted data packet according to the second encrypted image and the encrypted file to be encrypted. The method according to any one of claims 1 or 2, wherein the acquiring a user iris image comprises: The iris image of the user is acquired by an iris camera. The data encryption method according to any one of claims 1 to 3, wherein the step of generating an iris template according to the iris image comprises: The iris image is processed by using a preset algorithm to obtain intrinsic biometric property data of the human body included in the iris image; The acquired intrinsic biometric property data is used as data in the iris template. The data encryption method according to any one of claims 1 to 4, wherein the step of generating a data key according to the iris template and encrypting the iris template comprises: Performing an operation on the iris template by using a hash algorithm to obtain a data key; The iris template is encrypted by using a preset encryption algorithm to obtain an encrypted iris template. A data decryption method, the method comprising: Obtaining a user iris image; Generating a new iris template according to the iris image; Obtaining an encrypted data packet corresponding to the file to be decrypted, where the encrypted data packet is generated in the process of encrypting the original file to obtain the to-be-decrypted file, and the encrypted data packet includes the original file and the encrypted original iris template; Obtaining the original file and the encrypted original iris template from the encrypted data packet; Generating an iris key based on the original file; Decrypting the encrypted original iris template according to the iris key; Matching the decrypted original iris template with the new iris template to obtain a matching result; Decrypting the file to be decrypted according to the matching result. The data decryption method according to claim 6, wherein the decrypting the decrypted file according to the matching result comprises: If the matching result is that the decrypted original iris template matches the new iris template, acquiring a data key generated according to the original iris template; Decrypting the encrypted file to be decrypted according to the data key. The data decryption method according to any one of claims 6 or 7, wherein the step of decrypting the file to be decrypted according to the matching result comprises: If the matching result is that the decrypted original iris template is inconsistent with the new iris template, the decryption process is ended. A data decryption method, comprising: Obtaining a first iris template corresponding to the first iris image of the user; Obtaining the encrypted second iris template and the encrypted data encrypted by the first data key, where the first data key is generated according to the second iris template in the data encryption process; Decrypting the encrypted second iris template to obtain a second iris template; Determining whether the first iris template is consistent with the second iris template; And when the first iris template is consistent with the second iris template, generating the first data key according to the second iris template, and decrypting the encrypted data by using the first data key. The data decryption method according to claim 9, wherein the method further comprises: When the first iris film plate is inconsistent with the second iris template, the data decryption process is ended. The data decryption method according to any one of claims 9 to 10, wherein the step of decrypting the encrypted second iris template to obtain a second iris template comprises: Determining an iris encryption algorithm used when the second iris template is encrypted; Determining an iris decryption algorithm corresponding to the iris encryption algorithm; Performing an initial decryption of the encrypted second iris template according to the iris decryption algorithm to obtain a second iris template after initial decryption; The second iris template after the initial decryption is secondarily decrypted according to the iris decryption algorithm, and the second decrypted second iris template is used as the decrypted second iris template. The data decryption method according to any one of claims 9 to 11, wherein the first iris template includes first biometric data, and the second iris template includes second biometric data, and the judging is The step of whether the first iris template is consistent with the second iris template includes: Determining whether the same data in the first biometric data and the second biometric data exceeds a preset threshold; When the same data in the first biometric data and the second biometric data exceeds a preset threshold, indicating that the first iris template is consistent with the second iris template; And when the same data in the first biometric data and the second biometric data is lower than the preset threshold, indicating that the first iris template is inconsistent with the second iris template. A data encryption device, characterized in that the device comprises: An image acquisition module configured to acquire a user iris image; a first generating module configured to generate an iris template according to the iris image; a second generating module, configured to generate a data key according to the iris template, and encrypt the iris template; The encryption module is configured to encrypt the to-be-encrypted file obtained according to the data key. The device according to claim 13, wherein the device further comprises: a third generation module, configured to generate an iris key according to the encrypted file to be encrypted; a template encryption module, configured to perform secondary encryption on the iris template according to the iris key; And a data packet generating module configured to generate an encrypted data packet according to the second encrypted IP template and the encrypted file to be encrypted. A data decryption device, characterized in that the device comprises: a first acquiring module configured to acquire a user iris image; a template generating module, configured to generate a new iris template according to the iris image; a second acquiring module, configured to acquire an encrypted data packet corresponding to the file to be decrypted, where the encrypted data packet is generated in a process of encrypting the original file to obtain the to-be-decrypted file, and the encrypted data includes the original file And the original iris template after encryption; a third obtaining module, configured to obtain the original file and the encrypted original iris template from the encrypted data packet; a key generation module, configured to generate an iris key according to the original file; a template decryption module configured to decrypt the encrypted original iris template according to the iris key; a matching module, configured to match the decrypted original iris template with the new iris template to obtain a matching result; The file decryption module is configured to decrypt the file to be decrypted according to the matching result. The device according to claim 15, wherein the file decryption module comprises: Aligning the sub-module, configured to acquire a data key generated according to the original iris template if the matching result is that the decrypted original iris template matches the new iris template; And a decryption submodule configured to decrypt the encrypted file to be decrypted according to the data key. An electronic device, comprising: an encryption processor and a memory, the memory coupled to the encryption processor, the memory storing instructions when the instructions are executed by the encryption processor The electronic device performs the following operations: Obtaining a user iris image; Generating an iris template according to the iris image; Generating a data key according to the iris template, and encrypting the iris template; The obtained file to be encrypted is encrypted according to the data key. An electronic device, comprising: an iris collection device, wherein the iris collection device is configured to collect an iris image of a user, the electronic device comprising a processor and a non-volatile memory storing computer instructions, The electronic device performs the data encryption method according to any one of claims 1 to 5 when the computer instruction is executed by the processor. An electronic device, comprising: an iris collection device, wherein the iris collection device is configured to collect an iris image of a user, the electronic device comprising a processor and a non-volatile memory storing computer instructions, The electronic device performs the data decryption method of any one of claims 9-12 when the computer instructions are executed by the processor. A readable storage medium, characterized in that the readable storage medium comprises a computer program, characterized in that: when the computer program is running, controlling a user terminal where the readable storage medium is located to perform any one of claims 1-5 The data encryption method described in the item. A readable storage medium, comprising: a computer program, wherein: when the computer program is running, controlling a user terminal where the readable storage medium is located to perform any one of claims 9-12 The data decryption method described in the item.

Images