Biometric identification method and device

Abstract

The present application discloses a biometric identification method and device, which belongs to the field of computer technology. The method includes: after acquiring a biological image under TEE, extracting biometric data in the biological image under the TEE, and then matching all or part of the biometric data with a biometric template in SE to obtain a biometric identification result. In the present application, since the security level of SE is higher than that of TEE, the biometric identification function reaches a high security level. In addition, since the calculation complexity of the template matching of biometric data is not high and the processing pressure of SE is relatively small, the template matching speed can be guaranteed to be high, thereby ensuring a high biometric identification speed. In this way, the present application enables biometric identification to be protected at a high security level while only slightly increasing the latency and without affecting the biometric identification performance, thereby improving the security of biometric identification.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a biometric identification method and device. Background Art

[0002] Biometrics refers to the use of biological characteristics inherent in the human body, such as physiological characteristics (such as fingerprints, faces, or irises) or behavioral characteristics (such as handwriting, voice, or gait) to identify personal identity by closely combining computers with high-tech means such as optics, acoustics, biosensors, and biostatistics principles. With the development of computer technology, biometrics has been widely used as a convenient and relatively safe way to verify human-computer authentication.

[0003] Since the user's biometrics are irreplaceable assets, and the terminal can use biometrics to unlock the system or transfer values, in order to ensure data security, the biometric recognition process is required to be implemented in the secure area of ​​the terminal. At present, a trusted execution environment (TEE) can be set up in the terminal, and the terminal can perform the biometric recognition process under the TEE. Specifically, the terminal can first obtain a biometric image under the TEE, then extract the biometric data in the biometric image, and then match the biometric data with the stored biometric template to obtain a biometric recognition result.

[0004] However, the security of TEE is limited and it is still easy to be attacked by attackers. Once the attacker breaks into TEE, he can directly control the output biometric recognition result to pass without matching the biometric data; or he can replace the stored biometric template with another biometric template so that the biometric data can be matched successfully, and then the output biometric recognition result will be passed. This leads to low security of biometric recognition. Summary of the invention

[0005] The present application provides a biometric identification method and device, which can improve the security of biometric identification. The technical solution is as follows:

[0006] In a first aspect, a biometric recognition method is provided, characterized in that the method includes: acquiring a biometric image under TEE; extracting biometric data in the biometric image under the TEE; and matching all or part of the biometric data with a biometric template in a secure element (SE) to obtain a biometric recognition result.

[0007] It should be noted that the biometric image is an image containing biometric features, for example, the biometric image may be at least one of a fingerprint image, a palm print image, a face image or an iris image, etc. At this time, the biometric template may be at least one of a fingerprint template, a palm print template, a face template or an iris template.

[0008] In the embodiment of the present application, a biological image is obtained under TEE and the biometric data in the biological image is extracted. Since the security level of TEE is higher than that of the ordinary execution environment (Rich Execution Environment, REE), the security of the biological image and the biometric data can be guaranteed. In addition, since the system processor is used when TEE is running, the computing power and storage capacity under TTE are both high, so the extraction speed of the biometric data can be guaranteed to be high, thereby ensuring the high speed of biometric recognition. In addition, at least a part of the template matching of the biometric data is performed in SE and the biometric recognition result is output. Since the security level of SE is higher than that of TEE, the biometric recognition function reaches a high security level. In addition, since the calculation complexity of the template matching of the biometric data is not high, the processing pressure of SE is small, so the template matching speed can be guaranteed to be high, thereby ensuring the high speed of biometric recognition. In this way, a solution for supporting biometric recognition with SE is provided, which only slightly increases the delay and does not affect the biometric recognition performance (recognition rate and false recognition rate), so that the biometric recognition is protected at a high security level, thereby improving the security of biometric recognition.

[0009] In a possible implementation, before matching all or part of the biometric data with the biometric template in the SE to obtain the biometric recognition result, it also includes: sending all of the biometric data to the SE under the TEE. Correspondingly, matching all or part of the biometric data with the biometric template in the SE to obtain the biometric recognition result includes: matching all of the biometric data with a preset biometric template in the SE to obtain the biometric recognition result. In an embodiment of the present application, the SE can complete the template matching of the biometric data to obtain the biometric recognition result, thereby greatly improving the security of biometric recognition.

[0010] In another possible implementation, before matching all or part of the biometric data with the biometric template in the SE to obtain the biometric identification result, the method further includes: matching at least a part of the biometric data with the first biometric template in the TEE to obtain a first matching result; and sending the first matching result and at least another part of the biometric data to the SE in the TEE. Accordingly, matching all or part of the biometric data with the biometric template in the SE to obtain the biometric identification result includes: matching at least another part of the biometric data with the second biometric template in the SE to obtain a second matching result, and determining the biometric identification result based on the first matching result and the second matching result.

[0011] It should be noted that both the first biometric template and the second biometric template belong to the preset biometric template, and the second biometric template includes a part of the preset biometric template that is different from the first biometric template, that is, the second biometric template and the first biometric template may not be completely the same, for example, the first biometric template and the second biometric template may overlap. For another example, the first biometric template and the second biometric template may be completely different, that is, the first biometric template and the second biometric template may be different parts of the preset biometric template.

[0012] In the embodiment of the present application, TEE and SE can be combined to complete the template matching of the biometric data to obtain the biometric recognition result, that is, TEE and SE perform two-stage template matching, which can effectively ensure that the template matching speed is not greatly affected by the use of SE, thereby improving the security of biometric recognition while ensuring a high template matching speed, and then ensuring a high biometric recognition speed.

[0013] It is worth noting that before acquiring the biometric image under TEE, the process also includes: acquiring the preset biometric template; and extracting the first biometric template and the second biometric template from the preset biometric template.

[0014] It should be noted that the preset biometric template may be a complete biometric template generated after successful biometric registration. After extracting the first biometric template and the second biometric template from the preset biometric template, in order to ensure the security of the first biometric template and the second biometric template, the first biometric template may be stored in a memory under the TEE, and the second biometric template may be stored in the SE.

[0015] Furthermore, before performing a second match between at least another part of the biometric data and the second biometric template, the method further includes: when the matching degree indicated by the first matching result is greater than or equal to the first matching degree, triggering an operation of performing a second match between the at least another part of the data and the second biometric template in the SE. When the matching degree indicated by the first matching result is less than the first matching degree, directly determining the biometric recognition result as a failed recognition under the TEE, and ending the biometric recognition operation.

[0016] In the embodiment of the present application, when the matching degree indicated by the first matching result is less than the first matching degree, it indicates that at least a part of the data in the biometric data does not match the first biometric template, that is, the matching degree of the first template matching performed under TEE is very low, so there is no need to perform the second template matching in SE at this time, and the biometric recognition can be directly determined to be unsuccessful under TEE, and the biometric recognition operation is terminated. In this way, when a biometric image that has not been biometrically registered is recognized, it can be quickly determined that the biometric recognition has failed, thereby reducing the biometric recognition delay when the input biometric image is incorrect.

[0017] When the matching degree indicated by the first matching result is greater than or equal to the first matching degree, it indicates that at least a portion of the biometric data is relatively matched with the first biometric template, that is, the matching degree of the first template matching performed under TEE is not very low, so the second template matching can be continued in SE at this time, and the SE outputs the final biometric recognition result. In this way, the accuracy of biometric recognition can be guaranteed.

[0018] It should be noted that there may be multiple first biometric templates and multiple second biometric templates, the multiple first biometric templates correspond one-to-one to the multiple second biometric templates, and a corresponding first biometric template and a second biometric template belong to the same preset biometric template.

[0019] In this case, further, under the TEE, performing a first match on at least a portion of the biometric data with the first biometric template to obtain a first match result includes: performing a first match on at least a portion of the data with each of the multiple first biometric templates under the TEE to obtain a first match result corresponding to each of the first biometric templates. Correspondingly, in the SE, performing a second match on at least another portion of the biometric data with the second biometric template to obtain a second match result, and determining a biometric identification result based on the first match result and the second match result includes: in the SE, sorting the multiple second biometric templates in order from high to low according to the multiple matching degrees indicated by the multiple first match results corresponding to the multiple first biometric templates; in the SE, performing a second match on the at least another portion of the data with the multiple second biometric templates in sequence according to the sorting; in the SE, obtaining a second match result each time the second match between the at least another portion of the data and a second biometric template is completed, and determining a biometric identification result corresponding to the second biometric template based on the second match result and the first match result. If the biometric recognition result of the second biometric template is successful, the biometric recognition operation is terminated in the SE; if the biometric recognition result of the second biometric template is unsuccessful, at least another part of the biometric data is continued to be matched with the next second biometric template in the SE for a second time.

[0020] In the embodiment of the present application, after sorting the multiple second biometric templates corresponding to the multiple first biometric templates one by one according to the order of the multiple matching degrees indicated by the multiple first matching results corresponding to the multiple first biometric templates from high to low, the order of the multiple second biometric templates represents the order of the multiple second biometric templates and the biometric data from the most likely to successfully match to the least likely to successfully match. Afterwards, according to the order, each time the second match between the biometric data and a second biometric template is completed, the biometric recognition result is determined once, and when the biometric recognition result of this time is a pass, the biometric recognition operation is terminated. In this way, when identifying a biometric image that has been biometrically registered, it can be quickly determined that the biometric recognition has passed, thereby reducing the biometric recognition delay when the input biometric image is correct.

[0021] In a second aspect, a biometric recognition device is provided, comprising: a processor and an SE; the processor is used to obtain a biometric image under TEE and extract biometric data from the biometric image; the SE is used to match all or part of the biometric data with a biometric template to obtain a biometric recognition result.

[0022] Optionally, the processor is further used to send all of the biometric data to the SE under the TEE; accordingly, the SE is used to match all of the biometric data with a preset biometric template to obtain a biometric recognition result.

[0023] Optionally, the processor is further used to perform a first match on at least a portion of the biometric data with a first biometric template under the TEE to obtain a first matching result; send the first matching result and at least another portion of the biometric data to the SE under the TEE; accordingly, the SE is used to perform a second match on at least another portion of the biometric data with a second biometric template to obtain a second matching result, and determine a biometric recognition result based on the first matching result and the second matching result; wherein the second biometric template includes a portion of a preset biometric template that is different from the first biometric template.

[0024] Optionally, the first biometric template and the second biometric template are different parts of a preset biometric template.

[0025] Optionally, the processor is further configured to obtain the preset biometric template; and extract the first biometric template and the second biometric template from the preset biometric template.

[0026] Optionally, the processor is further configured to trigger the SE to perform a second match between the at least another portion of data and a second biometric template when the matching degree indicated by the first matching result is greater than or equal to the first matching degree.

[0027] Optionally, there are multiple first biometric templates and multiple second biometric templates, and the multiple first biometric templates correspond one-to-one to the multiple second biometric templates, and a corresponding first biometric template and a second biometric template belong to the same preset biometric template; the processor is also used to perform a first match on the at least one portion of the data with each first biometric template in the multiple first biometric templates under the TEE to obtain a first matching result corresponding to each first biometric template; accordingly, the SE is used to sort the multiple second biometric templates in order from high to low according to the multiple matching degrees indicated by the multiple first matching results corresponding to the multiple first biometric templates; according to the sorting, the at least another portion of the data is sequentially matched with the multiple second biometric templates for a second time; whenever the second matching of the at least another portion of the data with a second biometric template is completed, a second matching result is obtained, and the biometric recognition result corresponding to the second biometric template is determined according to the second matching result and the first matching result.

[0028] Optionally, the biometric template is at least one of a fingerprint template, a face template or an iris template.

[0029] According to a third aspect, a biometric identification device is provided, comprising: a TEE module and an SE module; the TEE module is used to acquire a biometric image and extract biometric data from the biometric image; the SE module is used to match all or part of the biometric data with a biometric template to obtain a biometric identification result.

[0030] Optionally, the TEE module is further used to send all of the biometric data to the SE module; correspondingly, the SE module is used to match all of the biometric data with a preset biometric template to obtain a biometric recognition result.

[0031] Optionally, the TEE module is further used to perform a first match on at least a portion of the biometric data with a first biometric template to obtain a first matching result; and send the first matching result and at least another portion of the biometric data to the SE module; accordingly, the SE module is used to perform a second match on at least another portion of the biometric data with a second biometric template to obtain a second matching result, and determine a biometric recognition result based on the first matching result and the second matching result; wherein the second biometric template includes a portion of a preset biometric template that is different from the first biometric template.

[0032] Optionally, the first biometric template and the second biometric template are different parts of a preset biometric template.

[0033] Optionally, the device is further used to obtain the preset biometric template; and extract the first biometric template and the second biometric template from the preset biometric template.

[0034] Optionally, the TEE module is further configured to trigger the SE module to perform a second match on the at least another portion of data with a second biometric template when the matching degree indicated by the first matching result is greater than or equal to the first matching degree.

[0035] Optionally, there are multiple first biometric templates and multiple second biometric templates, and the multiple first biometric templates correspond one-to-one to the multiple second biometric templates, and a corresponding first biometric template and a second biometric template belong to the same preset biometric template; the TEE module is also used to perform a first match between the at least one portion of the data and each first biometric template in the multiple first biometric templates to obtain a first matching result corresponding to each first biometric template; accordingly, the SE module is used to sort the multiple second biometric templates in order from high to low according to the multiple matching degrees indicated by the multiple first matching results corresponding to the multiple first biometric templates; according to the sorting, the at least another portion of the data is sequentially matched with the multiple second biometric templates for a second time; each time the second matching of the at least another portion of the data with a second biometric template is completed, a second matching result is obtained, and a biometric recognition result corresponding to the second biometric template is determined based on the second matching result and the first matching result.

[0036] Optionally, the biometric template is at least one of a fingerprint template, a face template or an iris template.

[0037] In a fourth aspect, a computer-readable storage medium is provided, wherein instructions are stored in the computer-readable storage medium, and when the computer-readable storage medium is run on a computer, the computer executes the biometric recognition method described in the first aspect.

[0038] In a fifth aspect, a computer program product comprising instructions is provided, which, when executed on a computer, enables the computer to execute the biometric recognition method described in the first aspect.

[0039] The technical effects obtained by the above-mentioned second, third, fourth and fifth aspects are similar to the technical effects obtained by the corresponding technical means in the above-mentioned first aspect, and will not be repeated here.

[0040] The technical solution provided by the present application can at least bring the following beneficial effects: after acquiring a biological image under TEE, extract the biometric data in the biological image under TEE. Afterwards, in SE, all or part of the biometric data is matched with the biometric template to obtain a biometric result. Since the security level of SE is higher than that of TEE, the biometric function reaches a high security level. In addition, since the calculation complexity of the template matching of biometric data is not high and the processing pressure of SE is relatively small, the template matching speed can be guaranteed to be high, thereby ensuring a high biometric speed. In this way, the embodiment of the present application enables biometrics to be protected at a high security level while only slightly increasing the latency and without affecting the biometric performance, thereby improving the security of biometrics. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 It is a structural diagram of a system architecture provided by an embodiment of the present application;

[0042] Figure 2 is a schematic diagram of the structure of a biometric identification device provided in an embodiment of the present application;

[0043] Figure 3 is a schematic diagram of the structure of another biometric identification device provided in an embodiment of the present application;

[0044] Figure 4 is a flow chart of a biometric identification method provided in an embodiment of the present application;

[0045] Figure 5 is a flow chart of another biometric identification method provided in an embodiment of the present application;

[0046] Figure 6 is a flow chart of another biometric identification method provided in an embodiment of the present application;

[0047] Figure 7 is a schematic diagram of a biometric template provided in an embodiment of the present application;

[0048] Figure 8 It is a schematic diagram of a biometric recognition process provided in an embodiment of the present application. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the present application clearer, the implementation of the present application will be further described in detail below in conjunction with the accompanying drawings. Before explaining the embodiments of the present application in detail, the application scenarios and system architecture involved in the embodiments of the present application are described.

[0050] The application scenarios involved in the embodiments of the present application are described below. The embodiments of the present application can be applied to scenarios such as power-on unlocking scenarios and application identity authentication scenarios that require the use of biometric functions. The embodiments of the present application introduce SE to perform template matching in the biometric process, so that the biometric function can also reach a high security level, thereby greatly improving the security of biometrics. In the embodiments of the present application, the acquisition of biological images and the extraction of biometric data can be performed under TEE, and then at least a portion of the biometric data can be template matched in SE. Specifically, all of the biometric data can be directly matched with a preset biometric template in SE to obtain a biometric result; or, at least a portion of the biometric data can be first matched with a first biometric template under TEE to obtain a first matching result, and then at least another portion of the biometric data can be second matched with a second biometric template in SE to obtain a second matching result, and the biometric result is determined based on the first matching result and the second matching result. In this way, while meeting the high-security biometric data protection, the biometric speed and biometric performance (i.e., recognition rate and false recognition rate) are not affected, so that user needs can be met without affecting user experience.

[0051] The following is a description of the system architecture involved in the embodiments of the present application. Figure 1 is a schematic diagram of a system architecture provided by an embodiment of the present application. Figure 1 , the system architecture may include: REE, TEE and SE. REE and TEE are two parallel execution environments, which are isolated by hardware, and both are generated by the processor running necessary software, such as operating system software and security software. SE can be an independent dedicated security chip (such as a smart card, or an embedded security module (EmbeddedSecure Element, eSE), etc.), or it can be integrated into the system on chip (System on Chip, SoC) in the form of a security unit (such as inSE, etc.). The security level of SE is higher than that of TEE, and the security level of TEE is higher than that of REE. For example, SE can be a secure processing unit (Secure Processing Unit, SPU). For another example, SE is a hardware different from the processor, which is used to perform operations or processing with a higher security level, so its security is higher than that of TEE and REE.

[0052] REE is the operating environment of terminal operating systems such as Android or iOS, including modules such as client application (CA), TEE function application programming interface (API), TEE client API and multimedia operating system components. CA is a client application provided to users. TEE function API is a friendly interface provided to CA for accessing TEE core services (such as trusted storage and encryption algorithm services). TEE client API is the underlying communication interface provided to CA for accessing trusted applications (TA) in TEE and exchanging data with TA. Multimedia operating system components include modules such as public device drivers and REE communication agents. REE communication agents provide message transmission between CA and TA.

[0053] Compared with the open environment of REE, TEE provides a relatively secure closed execution environment. TEE is mainly composed of TA, TEE internal API, trusted operating system components and trusted kernel. TA runs in TEE to provide security services to users. TA communicates with TA through TEE internal API. Trusted operating system components include TEE communication agent, trusted core framework and trusted function modules. TEE communication agent and REE communication agent together realize the secure transmission of messages between CA and TA. Trusted core framework provides secure operating system (OS) functions to TA. Trusted function modules provide auxiliary facilities support to application developers. Trusted kernel mainly provides scheduling and other OS management functions to trusted core framework and trusted function modules.

[0054] SE implements functions such as secure data storage and encryption and decryption operations through the chip operating system (COS). SE can be packaged into various forms, the most common of which are smart cards, eSE, inSE, etc. SE can provide chip-level hardware protection and can resist various physical attacks. The main functions of SE include: secure storage of keys, data encryption operations, and secure storage of information. The secure storage of keys can establish a relatively complete key management system to ensure that the keys cannot be read. Data encryption operations include support for reliable security algorithms, ciphertext transmission of sensitive data, and tamper-proofing of data transmission. Secure information storage refers to strict file access permission mechanisms and reliable authentication algorithms and processes.

[0055] Next, the biometric identification device provided in the embodiment of the present application is described. In one possible implementation, Figure 1 The system architecture shown can be Figure 2The biometric identification device shown is implemented. Specifically, Figure 2 2 is a schematic diagram of a biometric identification device provided in an embodiment of the present application. The biometric identification device may be a computer device 200. Figure 2 The computer device includes at least one processor 201, a communication bus 202, a memory 203, at least one communication interface 204 and a SE 208. The at least one processor 201 is used to form Figure 1 REE and TEE in the system architecture shown. Optionally, the processor 201 and SE 208 respectively execute respective software programs, including but not limited to system software, application software or driver software.

[0056] The processor 201 may be at least one of a general-purpose central processing unit (CPU), a microprocessor, or a microcontroller, and may also include an application-specific integrated circuit (ASIC), or may be one or more integrated circuits for controlling the execution of the program of the present application. The communication bus 202 may include a path for transmitting information between the above components. The memory 203 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, or a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 203 may exist independently and be connected to the processor 201 via the communication bus 202. The memory 203 may also be integrated with the processor 201. The communication interface 204 is any transceiver-like device used to communicate with other devices or communication networks, such as Ethernet, Radio Access Network (RAN), Wireless Local Area Networks (WLAN), etc.

[0057] In a specific implementation, as an embodiment, the processor 201 may include one or more CPUs, such as Figure 2 In a specific implementation, as an embodiment, a computer device may include multiple processors, such as Figure 2 201 and processor 205 are shown in FIG. For example, processor 201 and processor 205 form a big-core architecture, that is, processor 201 is a big core and processor 20 is a small core. Each of these processors can be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). The processor here can refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0058] In a specific implementation, as an embodiment, the computer device may further include an output device 206 and an input device 207. The output device 206 communicates with the processor 201 and may display information in a variety of ways. For example, the output device 206 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. The input device 207 communicates with the processor 201 and may receive user input in a variety of ways. For example, the input device 207 may be a mouse, a keyboard, a touch screen device, or a sensor device.

[0059] The above-mentioned computer device can be a general-purpose computer device or a special-purpose computer device. In a specific implementation, the computer device can be a desktop computer, a portable computer, a network server, a PDA (Personal Digital Assistant), a mobile phone, a tablet computer, a wireless terminal device, a communication device or an embedded device. The embodiment of the present application does not limit the type of computer device. Among them, the memory 203 is used to store the program code 210 for executing the solution of the present application, and the processor 201 is used to execute the program code 210 stored in the memory 203. The computer device can implement the following by means of the processor 201 and the program code 210 in the memory 203 Figure 4 All operations performed under the TEE in the embodiment. The computer device can also implement the SE208 and the program code 210 in the memory 203 Figure 4 All operations executed in the SE in the embodiment. Alternatively, the program software run by SE208 may not be stored in the memory 203, but may be stored inside SE208, which is not limited in the embodiment of the present application.

[0060] In one possible implementation, Figure 1 The TEE and SE in the system architecture shown can be used as a functional module to implement their respective functions. Specifically, Figure 3 is a schematic diagram of the structure of a biometric identification device provided in an embodiment of the present application, see Figure 3 The biometric recognition device may include a TEE module 301 and a SE module 302. The TEE module 301 is used to perform the following Figure 4 In the embodiment, all operations to be performed under TEE, SE module 302 is used to perform the following Figure 4 All operations to be performed in the SE in the embodiment. Optionally, the TEE module 301 and the SE module 302 can be implemented by software, hardware, or a combination of the two. When the TEE module 301 and the SE module 302 are implemented by software, the two modules can be run separately at Figure 2 The biometric identification device and the biometric identification method provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the following method embodiment, which will not be elaborated in detail here.

[0061] Next, the biometric identification method provided in the embodiments of the present application is described. Figure 4 is a flow chart of a biometric identification method provided in an embodiment of the present application. Figure 4 , the method includes: step 401: acquiring a biological image under TEE. It should be noted that the biological image is an image containing biological features, for example, the biological image can be at least one of a fingerprint image, a palm print image, a face image or an iris image. Specifically, the biological image can be acquired by an image acquisition device under TEE. Of course, the biological image can also be acquired by other methods under TEE, and the embodiments of the present application are not limited to this.

[0062] It should be noted that the image acquisition device is used to collect biological images, such as the image acquisition device can be at least one of a fingerprint sensor, a collector or a camera, etc. The fingerprint sensor can be, for example, an ultrasonic fingerprint sensor, a press-type fingerprint sensor or an optical fingerprint sensor. In a possible implementation, after the fingerprint sensor collects the fingerprint image, it can send the fingerprint image to the memory space of the TA used for biometric identification in the TEE through the serial peripheral interface (Serial Peripheral Interface, SPI); after the camera collects the face image, it can send the face image to the memory space of the TA used for biometric identification in the TEE through the camera serial interface (Camera Serial Interface, CSI). It is worth noting that the embodiment of the present application can perform step 401 when the biometric service under REE is started, that is, step 401 can be performed when the user uses the biometric service. The biometric service can be power-on unlocking, application identity authentication, etc., which is not limited in the embodiment of the present application.

[0063] Step 402: Extract the biometric data in the biometric image under TEE. It should be noted that the biometric data in the biometric image is used to indicate the biometric features contained in the biometric image. For example, when the biometric image is a fingerprint image, the biometric data may be parameters (such as direction, curvature, and position, etc.) of detail feature points (such as the starting point, end point, junction point, and bifurcation point of the lines) in the biometric image. For another example, when the biometric image is a face image, the biometric data may be attributes (such as size, position, and distance, etc.) of facial contour points (such as the iris, nose wings, and mouth corners, etc.) in the face image.

[0064] Specifically, a feature extraction algorithm may be used under TEE to extract biometric data from the biometric image. Furthermore, the biometric data from the biometric image may be extracted under TEE through a TA for biometric identification. It should be noted that the feature extraction algorithm may be pre-set. For example, when the biometric image is a fingerprint image, the feature extraction algorithm may be a fingerprint feature extraction algorithm, and when the biometric image is a face image, the feature extraction algorithm may be a face feature extraction algorithm.

[0065] It is worth noting that the embodiment of the present application can obtain a biological image and extract the biometric data in the biological image under TEE. Since TEE is isolated from REE and has a high security level, the security of the biological image and biometric data can be guaranteed. In addition, since TEE uses a processor when running, the computing power and storage capacity under TTE are both high, so the extraction speed of biometric data can be guaranteed to be high, thereby ensuring a high biometric recognition speed.

[0066] Step 403: In SE, all or part of the biometric data is matched with the biometric template to obtain a biometric recognition result. It should be noted that the biometric template can be pre-set, such as the biometric template can be at least one of a fingerprint template, a face template or an iris template. Moreover, when all of the biometric data is matched with the biometric template, the biometric template can be a complete biometric template generated after the biometric registration is successful, that is, the biometric template can be a preset biometric template; when part of the biometric data is matched with the biometric template, the biometric template can be a part of the complete biometric template generated after the biometric registration is successful, that is, the biometric template can be a part of the preset biometric template.

[0067] It is worth noting that in the embodiment of the present application, at least a portion of the template matching of the biometric data can be performed in the SE and the biometric recognition result can be output. Since the SE can provide chip-level hardware protection and can resist various physical attacks, the security level is higher than that of the TEE, so the biometric recognition function reaches a high security level. In addition, since the calculation complexity of the template matching of the biometric data is not high and the processing pressure of the SE is relatively small, the template matching speed can be guaranteed to be high, thereby ensuring a high biometric recognition speed. In this way, the embodiment of the present application provides a solution for supporting biometrics with SE, which only slightly increases the latency and does not affect the biometric performance (recognition rate and false recognition rate), so that the biometrics are protected at a high security level, thereby improving the security of biometrics.

[0068] Specifically, when in SE, all of the biometric data is matched with the biometric template to obtain a biometric recognition result, step 403 can be implemented through the following first possible implementation method; when in SE, part of the biometric data is matched with the biometric template to obtain a biometric recognition result, step 403 can be implemented through the following second possible implementation method.

[0069] In the first possible implementation, see Figure 5, before step 403, step 4031 may be performed first: sending all of the biometric data to SE under TEE. Accordingly, the operation of step 403 may be step 4032: in SE, matching all of the biometric data with a preset biometric template to obtain a biometric result. It should be noted that in the first possible implementation, SE completes the template matching of the biometric data to obtain the biometric result, which can greatly improve the security of biometrics. In addition, matching all of the biometric data with the preset biometric template means matching the biometrics indicated by the biometric data with the biometrics indicated by the preset biometric template. If the match is successful, the biometric result can be determined as passed. If the match fails, the biometric result can be determined as failed.

[0070] In the second possible implementation, see Figure 6 , before step 403, step 4033 may be performed first: in TEE, at least a portion of the biometric data is first matched with the first biometric template to obtain a first matching result, and the first matching result and at least another portion of the biometric data are sent to SE in TEE. Accordingly, the operation of step 403 may be step 4034: in SE, at least another portion of the biometric data is second matched with the second biometric template to obtain a second matching result, and the biometric recognition result is determined based on the first matching result and the second matching result.

[0071] It should be noted that in the second possible implementation, the TEE and SE are combined to complete the template matching of the biometric data to obtain the biometric recognition result, that is, the TEE and SE perform two-stage template matching, which can effectively ensure that the template matching speed is not greatly affected by the use of SE, thereby improving the security of biometrics while ensuring a high template matching speed, and then ensuring a high biometric recognition speed. In addition, the first biometric template and the second biometric template are both preset biometric templates, and the second biometric template includes a portion of the preset biometric template that is different from the first biometric template. The first biometric template can be stored in a memory under the TEE, for example Figure 2 The second biometric template can be stored in the SE in the memory 203. The second biometric template and the first biometric template may not be completely the same, for example, there is overlap. Furthermore, the first biometric template and the second biometric template may be completely different, that is, the first biometric template and the second biometric template may be different parts of the preset biometric template, for example, Figure 7As shown, the preset biometric template is A, and the preset biometric module A can be divided into two parts, one part is A1 and the other part is A2, and then A1 is used as the first biometric module and A2 is used as the second biometric template. Since the computing power and storage capacity under TEE are higher than those of SE, in order to improve the template matching speed, the proportion of the first biometric template in the preset biometric template can be greater than the proportion of the second biometric template in the preset biometric template. In addition, in order to ensure the security of the second biometric template in SE, the non-overlapping part of the second biometric template and the first biometric template needs to have sufficient data strength, that is, the second biometric template cannot be easily derived based on the first biometric template.

[0072] It should be noted that the first matching of at least a portion of the biometric data with the first biometric template is to match the biometric indicated by at least a portion of the biometric data with the biometric indicated by the first biometric template to obtain a first matching result. The first matching result is used to indicate the degree of matching between at least a portion of the biometric data and the first biometric template. When at least another portion of the biometric data is sent to the SE under the TEE, all of the biometric data can be directly sent to the SE under the TEE; or, under the TEE, according to the distribution rules of the first biometric template and the second biometric template in the preset biometric template, a portion of the data corresponding to the first biometric template and a portion of the data corresponding to the second biometric template are determined from the biometric data, and a portion of the data corresponding to the second biometric template in the biometric data is sent to the SE.

[0073] It should be noted that the second matching of at least another part of the biometric data with the second biometric template is to match the biometric indicated by at least another part of the biometric data with the biometric indicated by the second biometric template to obtain a second matching result. The second matching result is used to indicate the degree of matching between at least another part of the biometric data and the second biometric template. Among them, in SE, when determining the biometric recognition result based on the first matching result and the second matching result, the matching degree indicated by the first matching result and the matching degree indicated by the second matching result can be weighted averaged according to the first weight corresponding to the TEE and the second weight corresponding to the SE to obtain the target matching degree; if the target matching degree is greater than or equal to the second matching degree, the biometric recognition result is determined to be a passed recognition; if the target matching degree is less than the second matching degree, the biometric recognition result is determined to be a failed recognition. Of course, the biometric recognition result can also be determined in SE by other means based on the first matching result and the second matching result, and the embodiments of the present application are not limited to this. It should be noted that the first weight corresponding to TEE and the second weight corresponding to SE can be set in advance, such as according to the security levels of TEE and SE, or according to the security levels of TEE and SE and the distribution rules of the first biometric template and the second biometric template in the preset biometric template.

[0074] In addition, the second matching degree can be set in advance, and the second matching degree can be set larger. When the target matching degree is greater than or equal to the second matching degree, it indicates that the biometric data matches the preset biometric template very well, and thus it can be determined that the biometric identification is passed. When the target matching degree is less than the second matching degree, it indicates that the biometric data does not match the preset biometric template very well, and thus it can be determined that the biometric identification is not passed.

[0075] Furthermore, before the second possible implementation, the first biometric template and the second biometric template may be generated. Specifically, a preset biometric template may be obtained, and the first biometric template and the second biometric template may be extracted from the preset biometric template. When obtaining the preset biometric template, a biometric image may be collected upon receiving a biometric registration instruction, and then the biometric data in the collected biometric image may be extracted as the preset biometric template. It should be noted that the biometric registration instruction is used to instruct the registration of a biometric template, and the biometric registration instruction may be triggered by a user, and the user may trigger the instruction through operations such as clicking, sliding, voice, or gesture, which is not limited in the embodiments of the present application.

[0076] In addition, after extracting the first biometric template and the second biometric template from the preset biometric template, in order to ensure the security of the first biometric template and the second biometric template, the first biometric template can be stored in the memory under the TEE, and the second biometric template can be stored in the SE.

[0077] It is worth noting that in order to reduce the biometric latency and improve the user experience, under the second possible implementation method mentioned above, the biometric speed can be further improved by the following method 1 and / or method 2. Method 1: After obtaining the first matching result under TEE, determine whether the matching degree indicated by the first matching result is less than the first matching degree; when the matching degree indicated by the first matching result is less than the first matching degree, directly determine the biometric result as a failed recognition under TEE, and end the biometric operation; when the matching degree indicated by the first matching result is greater than or equal to the first matching degree, trigger the operation of performing a second match between at least another part of the biometric data and the second biometric template in SE.

[0078] It should be noted that the first matching degree can be set in advance, and the first matching degree can be set very small. When the matching degree indicated by the first matching result is less than the first matching degree, it indicates that at least a part of the data in the biometric data does not match the first biometric template very much, that is, the matching degree of the first segment template matching performed under TEE is very low, so there is no need to perform the second segment template matching in SE at this time, and the biometric recognition failure can be directly determined under TEE to end the biometric recognition operation. In this way, when a biometric image that has not been biometrically registered is recognized, it can be quickly determined that the biometric recognition has failed, thereby reducing the biometric recognition delay when the input biometric image is incorrect.

[0079] When the matching degree indicated by the first matching result is greater than or equal to the first matching degree, it indicates that at least a portion of the biometric data is relatively matched with the first biometric template, that is, the matching degree of the first template matching performed under TEE is not very low, so the second template matching can be continued in SE at this time, and the SE outputs the final biometric recognition result. In this way, the accuracy of biometric recognition can be guaranteed.

[0080] It is worth noting that there are often multiple preset biometric templates generated after successful biometric registration, such as a preset biometric template corresponding to the fingerprint of each of multiple fingers. In this case, there will be multiple first biometric templates and multiple second biometric templates, and the multiple first biometric templates correspond one-to-one to the multiple second biometric templates, and the corresponding first biometric template and the second biometric template belong to the same preset biometric template. In this case, under TEE, at least a portion of the biometric data is first matched with the first biometric template to obtain the first matching result, and at least a portion of the biometric data can be first matched with each of the multiple first biometric templates under TEE to obtain the first matching result corresponding to each first biometric template.

[0081] Accordingly, in method one, when the multiple first matching results corresponding to the multiple first biometric templates are all less than the first matching degree, the biometric recognition result can be directly determined as recognition failure under TEE, and the biometric recognition operation can be terminated; when the multiple first matching results corresponding to the multiple first biometric templates have a first matching result with an indicated matching degree greater than or equal to the first matching degree, an operation of performing a second matching operation on at least another part of the biometric data with the second biometric template in SE is triggered.

[0082] Accordingly, the biometric identification speed can be further improved by the following method 2. Method 2: In the SE, the multiple second biometric templates are sorted in the order of the multiple matching degrees indicated by the multiple first matching results corresponding to the multiple first biometric templates from high to low; in the SE, at least another part of the biometric data is sequentially matched with the multiple second biometric templates according to the sorting; in the SE, each time the second matching of at least another part of the biometric data with a second biometric template is completed, a second matching result is obtained, and the biometric identification result corresponding to the second biometric template is determined based on the second matching result and the first matching result; if the biometric identification result of the second biometric template is identification passed, the biometric identification operation is terminated in the SE, and if the biometric identification result of the second biometric template is identification failed, the at least another part of the biometric data is continued to be matched with the next second biometric template in the SE.

[0083] It should be noted that after sorting the multiple second biometric templates corresponding to the multiple first biometric templates one by one according to the order of the multiple matching degrees indicated by the multiple first matching results corresponding to the multiple first biometric templates from high to low, the order of the multiple second biometric templates represents the order of the multiple second biometric templates and the biometric data from the most likely to successfully match to the least likely to successfully match. After that, according to the order, each time the second match between the biometric data and a second biometric template is completed, the biometric recognition result is determined once, and when the biometric recognition result of this time is a pass, the biometric recognition operation is terminated. In this way, when recognizing a biometric image that has been biometrically registered, it can be quickly determined that the biometric recognition has passed, thereby reducing the biometric recognition delay when the input biometric image is correct.

[0084] It is worth noting that after obtaining the biometric result in SE, SE can send the biometric result to the biometric service under REE so that the biometric service can perform subsequent processes based on the biometric result. In a possible implementation, when the biometric result is a pass, SE can enable the system key service. For example, when the biometric result is a pass, if SE receives a system key acquisition request sent by the biometric service, the stored system key can be returned to the biometric service so that the biometric service can use the system key to unlock and access the system file; or, when the biometric result is a pass, SE can use the stored system key to unlock the system file so that the biometric service can directly access the system file.

[0085] For ease of understanding, the following Figure 8 The biometric identification process provided in the embodiment of the present application is illustrated by way of example. Figure 8 , the biometric identification process may include the following steps (1) to (7). (1) Acquire a biometric image through an image acquisition device under TEE; (2) Extract biometric data from the biometric image under TEE; (3) Under TEE, perform a first match between at least a portion of the biometric data and a first biometric template to obtain a first matching result; (4) Send the first matching result and at least another portion of the biometric data to SE under TEE; (5) In SE, perform a second match between at least another portion of the biometric data and a second biometric template to obtain a second matching result; (6) In SE, determine a biometric identification result based on the first matching result and the second matching result; (7) In SE, send the biometric identification result to the biometric identification service under REE, and when the biometric identification result is a pass, enable the system key service.

[0086] In the embodiment of the present application, after acquiring a biological image under TEE, the biometric data in the biological image is extracted under TEE. Afterwards, in SE, all or part of the biometric data is matched with the biometric template to obtain a biometric result. Since the security level of SE is higher than that of TEE, the biometric function reaches a high security level. In addition, since the calculation complexity of the template matching of the biometric data is not high, the processing pressure of SE is relatively small, so the template matching speed can be guaranteed to be high, thereby ensuring a high biometric speed. In addition, the embodiment of the present application can combine TEE and SE to perform two-stage template matching, that is, the first stage template matching of the biometric data can be performed under TEE, and then the second stage template matching of the biometric data can be performed in SE, thereby effectively ensuring that the template matching speed is not greatly affected by the use of SE. In this way, the embodiment of the present application only slightly increases the delay and does not affect the biometric performance, so that the biometric is protected at a high security level, thereby improving the security of biometrics.

[0087] In the above embodiments, the corresponding method flow can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (for example: coaxial cable, optical fiber, data subscriber line (Digital Subscriber Line, DSL)) or wireless (for example: infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server, data center, etc. that contains one or more available media integrated. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a digital versatile disc (DVD)), or a semiconductor medium (eg, a solid state disk (SSD)).

[0088] The above-mentioned embodiments are provided for the present application and are not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A biometric identification method, characterized in that: The method comprises: Acquire biological images in a trusted execution environment (TEE); Extracting biometric data from the biometric image under the TEE; Under the TEE, performing a first match on at least a portion of the biometric data with a first biometric template to obtain a first matching result; Sending the first matching result and at least another part of the biometric data to a secure element SE under the TEE; In the SE, a second match is performed on at least another part of the biometric data and a second biometric template to obtain a second matching result, and a biometric recognition result is determined based on the first matching result and the second matching result.

2. The method according to claim 1, characterized in that The first biometric template and the second biometric template are different parts of a preset biometric template.

3. The method according to claim 1 or 2, characterized in that Before acquiring the biological image in the trusted execution environment TEE, the method further includes: Obtain a preset biometric template; The first biometric template and the second biometric template are extracted from the preset biometric template.

4. The method according to claim 1, characterized in that Before the SE performs a second matching between at least another part of the biometric data and the second biometric template, the SE further includes: When the matching degree indicated by the first matching result is greater than or equal to the first matching degree, an operation of performing a second matching between the at least another portion of data and a second biometric template in the SE is triggered.

5. The method according to claim 1, characterized in that There are a plurality of first biometric templates and a plurality of second biometric templates, the plurality of first biometric templates correspond to the plurality of second biometric templates one by one, and a corresponding first biometric template and a corresponding second biometric template belong to the same preset biometric template; The first matching of at least a portion of the biometric data with a first biometric template under the TEE to obtain a first matching result includes: Under the TEE, first matching the at least a portion of the data with each first biometric template of the plurality of first biometric templates to obtain a first matching result corresponding to each first biometric template; Correspondingly, in the SE, performing a second matching on at least another part of the biometric data with a second biometric template to obtain a second matching result, and determining a biometric recognition result according to the first matching result and the second matching result, including: In the SE, the plurality of second biometric templates are sorted in descending order of a plurality of matching degrees indicated by a plurality of first matching results corresponding to the plurality of first biometric templates; In the SE, second matching is performed on the at least another portion of data in sequence with the plurality of second biometric templates according to the order; In the SE, whenever a second match between the at least another portion of data and a second biometric template is completed, a second matching result is obtained, and a biometric recognition result corresponding to the second biometric template is determined based on the second matching result and the first matching result.

6. The method according to claim 1, 2, 4 or 5, characterized in that The biometric template is at least one of a fingerprint template, a face template or an iris template.

7. A biometric identification device, characterized in that: The device comprises: a processor and a security element SE; The processor is configured to obtain a biological image in a trusted execution environment TEE, extract biometric data in the biological image, perform a first match on at least a portion of the biometric data with a first biometric template to obtain a first matching result, and send the first matching result and at least another portion of the biometric data to the SE; The SE is used to perform a second match on at least another part of the biometric data with a second biometric template to obtain a second matching result, and determine a biometric recognition result based on the first matching result and the second matching result.

8. The device according to claim 7, characterized in that The first biometric template and the second biometric template are different parts of a preset biometric template.

9. The device according to claim 7 or 8, characterized in that The processor is further configured to obtain a preset biometric template; and extract the first biometric template and the second biometric template from the preset biometric template.

10. The device according to claim 7, characterized in that The processor is further configured to trigger the SE to perform a second match between the at least another portion of data and a second biometric template when the matching degree indicated by the first matching result is greater than or equal to the first matching degree.

11. The device according to claim 7, characterized in that There are a plurality of first biometric templates and a plurality of second biometric templates, the plurality of first biometric templates correspond to the plurality of second biometric templates one by one, and a corresponding first biometric template and a corresponding second biometric template belong to the same preset biometric template; The processor is further configured to perform a first match between the at least a portion of the data and each of the plurality of first biometric templates under the TEE to obtain a first matching result corresponding to each of the first biometric templates; Accordingly, the SE is used to sort the plurality of second biometric templates in descending order of the plurality of matching degrees indicated by the plurality of first matching results corresponding to the plurality of first biometric templates; According to the arrangement, the at least another part of the data is sequentially matched with the multiple second biometric templates; each time the second matching of the at least another part of the data with a second biometric template is completed, a second matching result is obtained, and based on the second matching result and the first matching result, a biometric recognition result corresponding to the second biometric template is determined.

12. The device according to claim 7, 8, 10 or 11, characterized in that The biometric template is at least one of a fingerprint template, a face template or an iris template.

13. A biometric identification device, characterized in that: The device comprises: a feasible execution environment TEE module and a secure element SE module; The TEE module is used to acquire a biological image, extract biological characteristic data in the biological image, perform a first match on at least a portion of the biological characteristic data with a first biological characteristic template to obtain a first matching result; and send the first matching result and at least another portion of the biological characteristic data to the SE module; The SE module is used to perform a second match on at least another part of the biometric data with a second biometric template to obtain a second matching result, and determine a biometric recognition result based on the first matching result and the second matching result.

14. The device according to claim 13, characterized in that The first biometric template and the second biometric template are different parts of a preset biometric template.

15. The device according to claim 13 or 14, characterized in that The device is also used to obtain a preset biometric template; and extract the first biometric template and the second biometric template from the preset biometric template.

16. The device according to claim 13, characterized in that The TEE module is further configured to trigger the SE module to perform a second match between the at least another portion of data and a second biometric template when the matching degree indicated by the first matching result is greater than or equal to the first matching degree.

17. The device according to claim 13, characterized in that There are a plurality of first biometric templates and a plurality of second biometric templates, the plurality of first biometric templates correspond to the plurality of second biometric templates one by one, and a corresponding first biometric template and a corresponding second biometric template belong to the same preset biometric template; The TEE module is further configured to perform a first match between the at least a portion of the data and each of the plurality of first biometric templates to obtain a first matching result corresponding to each of the first biometric templates; Accordingly, the SE module is used to sort the plurality of second biometric templates in descending order of the plurality of matching degrees indicated by the plurality of first matching results corresponding to the plurality of first biometric templates; According to the arrangement, the at least another part of the data is sequentially matched with the multiple second biometric templates; each time the second matching of the at least another part of the data with a second biometric template is completed, a second matching result is obtained, and based on the second matching result and the first matching result, a biometric recognition result corresponding to the second biometric template is determined.

18. The device according to claim 13, 14, 16 or 17, characterized in that The biometric template is at least one of a fingerprint template, a face template or an iris template.

Images