User identity verification method and device, equipment, storage medium and product

Abstract

The invention discloses a user identity verification method and device, equipment, a storage medium and a product, and relates to the technical field of secure digital identity verification, and the method comprises the steps: storing biological characteristic data in an SIM card with high performance, and when a user needs to perform identity verification, sending the biological characteristic data to the SIM card; the platform side can read the biological characteristic data in the SIM card in various modes to realize complex biological characteristic data comparison; when the SIM card feeds back data, the biological characteristic metadata and the biological characteristic vector are encrypted in different modes in a segmented manner, so that secret key updating is realized in a biological characteristic information encryption process with a relatively high security requirement, and the security is improved; and meanwhile, signature verification and MAC message check codes are added to the whole data ciphertext, so that the message integrity and non-repudiation are ensured.

Description

Technical Field

[0001] This application relates to the field of secure digital identity verification technology, and in particular to a user identity verification method, apparatus, device, storage medium, and product. Background Technology

[0002] Biometric identification technology is a method of identity verification that utilizes an individual's unique physiological or behavioral characteristics. This technology relies on inherent human physical features or behavioral patterns that are difficult to replicate or forge, such as fingerprints, facial features, and iris patterns, and is widely used in personal authentication, access control, transaction security, and many other fields. The biometric identification process typically consists of two phases: registration (or entry) and matching (or verification). In the registration phase, individual biometric samples are collected via sensors, then digitized and stored. In the matching phase, when a user attempts to access a protected resource, the current biometric sample is retrieved and compared with a stored template to determine if a match has been made.

[0003] Existing technical solutions involve a SIM card receiving the biometric information's signature from a mobile phone, comparing the biometric signature with the signature stored on the SIM card, and returning the comparison result. During this process, the security and uniqueness of data transmission are ensured by comparing the random numbers stored in the card with the written random numbers and by using asymmetric encryption on the biometric signature. However, the limited computing resources of a SIM card are insufficient to support complex biometric comparison algorithms, affecting the speed and accuracy of the comparison. Furthermore, since biometric information is private data, relying solely on asymmetric encryption and random number checks during transmission is insufficient to verify data integrity. This approach also lacks resistance to replay attacks, resulting in low data security when performing complex biometric data comparisons for identity verification. Summary of the Invention

[0004] The main purpose of this application is to provide a user authentication method, apparatus, device, storage medium and product, which aims to solve the technical problem of low data security when authentication involves complex biometric data comparison.

[0005] To achieve the above objectives, this application proposes a user authentication method, which is applied to the SIM card side, and the method includes:

[0006] When a biometric data reading instruction is received from a mobile phone or device, the locally stored biometric metadata is asymmetrically encrypted using a first national commercial cryptographic algorithm and an asymmetric public key to obtain the encrypted metadata ciphertext.

[0007] The biometric vector stored locally and the preset public key are symmetrically encrypted using a second national commercial cryptographic algorithm and the aforementioned metadata encrypted ciphertext to obtain the feature vector encrypted ciphertext.

[0008] The metadata encrypted ciphertext and the feature vector encrypted ciphertext are concatenated, and the concatenated encrypted ciphertext is signed using the first national commercial cryptographic algorithm and the asymmetric public key to obtain the first signature value;

[0009] The data is written into the application protocol data unit instruction, the encrypted metadata ciphertext, the encrypted feature vector ciphertext and the first signature value are concatenated to obtain the encrypted biometric data.

[0010] The first MAC value corresponding to the encrypted biometric data is determined by the second national commercial cryptographic algorithm and the MAC symmetric key;

[0011] The encrypted biometric data, the first MAC value, and the first signature value are fed back to the mobile phone or device, so that the mobile phone or device can send the encrypted biometric data, the first MAC value, and the first signature value to the platform side for user authentication.

[0012] This application also proposes a user authentication method, which is applied on the platform side, and the method includes:

[0013] Receive encrypted biometric data, first MAC value, and first signature value sent by a mobile phone or device;

[0014] Data integrity is verified based on the first MAC value and the first signature value;

[0015] Upon successful verification, the encrypted biometric data is decrypted according to a preset encryption rule to obtain biometric metadata and biometric vectors.

[0016] The biometric metadata and biometric vector are compared with the pre-stored biometric information, and the user authentication result is fed back to the mobile phone or device.

[0017] This application also proposes a user authentication method, which is applied on the platform side, and the method includes:

[0018] The receiving device collects and encrypts the encrypted user biometric metadata, and then decrypts the encrypted user biometric metadata to obtain the user biometric metadata.

[0019] Extract the user's biometric vector based on the user's biometric metadata;

[0020] The user biometric metadata, the user biometric vector, and the preset biometric information are formatted according to a preset format to obtain formatted biometric data;

[0021] Generate an external authentication application protocol data unit instruction, send the external authentication application protocol data unit instruction to the SIM card side, establish a secure channel with the SIM card side, and receive the external authentication result fed back by the SIM card side;

[0022] A key is generated and written to an application protocol data unit. The key is written to an application protocol data unit and includes an encrypted key and a second MAC value. The encrypted key consists of a metadata symmetric key, an asymmetric public key, and a MAC symmetric key.

[0023] The key is written to the application protocol data unit instruction through the secure channel and sent to the SIM card side so that the SIM card side can verify the second MAC value and store the decrypted metadata symmetric key, asymmetric public key and MAC symmetric key;

[0024] The formatted biometric data is segmented and encrypted based on the metadata symmetric key and the external authentication result to obtain segmented encrypted biometric data.

[0025] The third MAC value and the second signature value corresponding to the segmented encrypted biometric data are determined based on the asymmetric public key.

[0026] According to the preset instruction format, the segmented encrypted biometric data, the third MAC value and the second signature value are concatenated to generate a data writing instruction for the application protocol data unit.

[0027] The data is written to the application protocol data unit through the secure channel and the instruction is sent to the SIM card side so that the SIM card side can verify the third MAC value and the second signature value according to the data written to the application protocol data unit instruction, and decrypt and store the segmented encrypted biometric data according to the preset encryption rules.

[0028] In one embodiment, the step of generating the key and writing it into the application protocol data unit instruction includes:

[0029] Generate metadata symmetric key, asymmetric public key, and MAC symmetric key according to the preset data format;

[0030] A random number acquisition instruction is generated and sent to the SIM card side so that the SIM card side can return a random number and a SIM card side key;

[0031] The obtained random number, metadata symmetric key, asymmetric public key, and MAC symmetric key are concatenated to obtain the key to be written;

[0032] Determine the second MAC value corresponding to the key to be written;

[0033] The key to be written is encrypted using the SIM card side key to obtain the encrypted key to be written.

[0034] Generate a key writing application protocol data unit instruction based on the second MAC value and the encrypted key to be written.

[0035] In one embodiment, the step of segmenting and encrypting the formatted biometric data according to the metadata symmetric key and the external authentication result to obtain segmented encrypted biometric data includes:

[0036] The user's biometric metadata in the formatted biometric data is encrypted using a third-country commercial cryptographic algorithm and a metadata symmetric key to obtain encrypted user metadata.

[0037] The ciphertext data of the first preset number of bits in the external authentication result, the ciphertext data of the preset number of bytes in the encrypted user metadata, and the MAC data of the last preset number of bits in the external authentication result are concatenated, and the hash value of the concatenated data is calculated according to the hash function of the fourth national commercial cryptographic algorithm to obtain the ciphertext of the user's biometric metadata.

[0038] The user biometric vector in the formatted biometric data is encrypted using the second national commercial cryptographic algorithm and the ciphertext of the user biometric metadata to obtain the ciphertext of the user biometric vector.

[0039] Segmented encrypted biometric data is generated based on the encrypted user biometric metadata and the encrypted user biometric vector.

[0040] This application also proposes a user authentication method, which is applied to the SIM card side, and the method includes:

[0041] Upon receiving an external authentication application protocol data unit instruction from the platform side, a secure channel is established with the platform side, and the generated external authentication result is fed back to the platform side.

[0042] The system receives a key writing application protocol data unit instruction sent by the platform through the secure channel, and performs key integrity verification based on the second MAC value in the key writing application protocol data unit instruction.

[0043] When the key integrity verification passes, the encrypted key is decrypted, and the decrypted metadata symmetric key, asymmetric public key, and MAC symmetric key are stored in the highest security area of ​​the storage area.

[0044] The system receives a data writing instruction sent by the platform through the secure channel and performs data integrity verification based on the third MAC value and the second signature value in the data writing instruction.

[0045] When the data integrity verification passes, the segmented encrypted biometric data is decrypted according to the preset encryption rules, and the decrypted biometric metadata and biometric vector are stored.

[0046] Furthermore, to achieve the above objectives, this application also proposes a user authentication device, which is applied to the SIM card side, and the user authentication device includes:

[0047] The metadata encryption module is used to perform asymmetric encryption on the locally stored biometric metadata using a first national commercial cryptographic algorithm and an asymmetric public key when it receives a biometric data reading instruction sent by a mobile phone or device, so as to obtain the encrypted ciphertext of the metadata.

[0048] The feature vector encryption module is used to symmetrically encrypt the locally stored biometric vector and the preset public key using a second national commercial cryptographic algorithm and the metadata encryption ciphertext to obtain the feature vector encryption ciphertext.

[0049] The first signature calculation module is used to concatenate the encrypted ciphertext of the metadata and the encrypted ciphertext of the feature vector, and perform signature calculation on the concatenated encrypted ciphertext according to the first national commercial cryptographic algorithm and the asymmetric public key to obtain the first signature value.

[0050] The biometric data splicing module is used to splice data written into the application protocol data unit instruction, the encrypted metadata ciphertext, the encrypted feature vector ciphertext and the first signature value to obtain encrypted biometric data.

[0051] The first MAC determination module is used to determine the first MAC value corresponding to the encrypted biometric data using the second national commercial cryptographic algorithm and the MAC symmetric key.

[0052] The data feedback module is used to feed back the encrypted biometric data, the first MAC value, and the first signature value to the mobile phone or device, so that the mobile phone or device can send the encrypted biometric data, the first MAC value, and the first signature value to the platform side for user authentication.

[0053] Furthermore, to achieve the above objectives, this application also proposes a user authentication device, which is applied on the platform side and includes:

[0054] The data receiving module is used to receive encrypted biometric data, a first MAC value, and a first signature value sent by a mobile phone or device.

[0055] The data verification module is used to perform data integrity verification based on the first MAC value and the first signature value;

[0056] The data decryption module is used to decrypt the encrypted biometric data according to a preset encryption rule when the verification is successful, so as to obtain biometric metadata and biometric vector.

[0057] The data comparison module is used to compare the biometric metadata and the biometric vector with the pre-stored biometric information, and to send the user authentication result back to the mobile phone or device.

[0058] Furthermore, to achieve the above objectives, this application also proposes a user authentication device. This user authentication device is applied to the platform side and includes:

[0059] The data formatting module is used to receive encrypted user biometric metadata collected and encrypted by the device, and decrypt the encrypted user biometric metadata to obtain user biometric metadata; extract user biometric vectors based on the user biometric metadata; and format the user biometric metadata, the user biometric vectors, and preset biometric information according to a preset format to obtain formatted biometric data.

[0060] The external authentication module is used to generate external authentication application protocol data unit instructions, send the external authentication application protocol data unit instructions to the SIM card side, establish a secure channel with the SIM card side, and receive the external authentication results fed back by the SIM card side;

[0061] A key writing module is used to generate a key writing application protocol data unit instruction. The key writing application protocol data unit instruction includes an encrypted key and a second MAC value. The encrypted key consists of a metadata symmetric key, an asymmetric public key, and a MAC symmetric key. The key writing application protocol data unit instruction is sent to the SIM card side through the secure channel so that the SIM card side verifies the second MAC value and stores the decrypted metadata symmetric key, asymmetric public key, and MAC symmetric key.

[0062] The data writing module is used to encrypt the formatted biometric data in segments according to the metadata symmetric key and the external authentication result to obtain segmented encrypted biometric data; determine the third MAC value and second signature value corresponding to the segmented encrypted biometric data according to the asymmetric public key; concatenate the segmented encrypted biometric data, the third MAC value and the second signature value according to a preset instruction format to generate a data writing application protocol data unit instruction; and send the data writing application protocol data unit instruction to the SIM card side through the secure channel, so that the SIM card side verifies the third MAC value and the second signature value according to the data writing application protocol data unit instruction, and decrypts and stores the segmented encrypted biometric data according to a preset encryption rule.

[0063] Furthermore, to achieve the above objectives, this application also proposes a user authentication device, which is applied to the SIM card side, and the user authentication device includes:

[0064] The external authentication module is used to establish a secure channel with the platform side when it receives the external authentication application protocol data unit instruction sent by the platform side, and to feed back the generated external authentication result to the platform side; it also receives the key writing application protocol data unit instruction sent by the platform side through the secure channel, and performs key integrity verification based on the second MAC value in the key writing application protocol data unit instruction.

[0065] The key writing module is used to decrypt the encrypted key when the key integrity verification passes, and store the decrypted metadata symmetric key, asymmetric public key and MAC symmetric key in the highest security area of ​​the storage area.

[0066] The data writing module is used to receive the data writing application protocol data unit instruction sent by the platform side through the secure channel, and to perform data integrity verification according to the third MAC value and the second signature value in the data writing application protocol data unit instruction; when the data integrity verification passes, the segmented encrypted biometric data is decrypted according to the preset encryption rules, and the decrypted biometric metadata and biometric vector are stored.

[0067] In addition, to achieve the above objectives, this application also proposes a user authentication device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the user authentication method as described above.

[0068] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and which, when executed by a processor, implements the steps of the user authentication method described above.

[0069] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the user authentication method described above.

[0070] This application provides a user authentication method. When the SIM card receives a biometric data reading instruction, it performs asymmetric encryption on the biometric metadata using a first national commercial cryptographic algorithm and an asymmetric public key to obtain encrypted metadata ciphertext. It then performs symmetric encryption on the biometric vector and a preset public key using a second national commercial cryptographic algorithm and the encrypted metadata ciphertext to obtain encrypted feature vector ciphertext. The encrypted metadata ciphertext and the encrypted feature vector ciphertext are concatenated, and a signature calculation is performed on the concatenated ciphertext using the first national commercial cryptographic algorithm and the asymmetric public key to obtain a first signature value. The data is written into an application protocol data unit instruction, and the encrypted metadata ciphertext, the encrypted feature vector ciphertext, and the first signature value are concatenated to obtain encrypted biometric data. A first MAC value corresponding to the encrypted biometric data is determined using the second national commercial cryptographic algorithm and a MAC symmetric key. The encrypted biometric data, the first MAC value, and the first signature value are fed back to the mobile phone or device, so that the mobile phone or device sends the encrypted biometric data, the first MAC value, and the first signature value to the platform side for user authentication. This application stores biometric data in a high-performance SIM card. When user authentication is required, the platform can retrieve the user's biometric data from the SIM card using other devices. This leverages the advantage of storing biometric data in a high-performance SIM card to achieve complex biometric data comparisons. When the SIM card returns data, it segments and encrypts the biometric metadata and biometric vectors in different ways. This enables key updates during the encryption process of biometric information with high security requirements, increasing its security. At the same time, it adds signature verification and message checksum to the overall encrypted data to ensure message integrity and non-repudiation. Attached Figure Description

[0071] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0072] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0073] Figure 1 This is a flowchart illustrating the user authentication method of this application in Embodiment 1.

[0074] Figure 2 This is a flowchart illustrating the second embodiment of the user authentication method in this application.

[0075] Figure 3 This is an interactive diagram illustrating the reading of biometric data in the user authentication method of this application;

[0076] Figure 4 This is a flowchart illustrating the third embodiment of the user authentication method in this application.

[0077] Figure 5 This is a flowchart illustrating the fourth embodiment of the user authentication method in this application.

[0078] Figure 6 A schematic diagram illustrating the interaction of writing biometric data in the user authentication method of this application;

[0079] Figure 7 This is a schematic diagram of the module structure of a user authentication device according to Embodiment 1 of this application;

[0080] Figure 8 This is a schematic diagram of the module structure of Embodiment 2 of the user authentication device in this application;

[0081] Figure 9 This is a schematic diagram of the module structure of the user authentication device in Embodiment 3 of this application;

[0082] Figure 10 This is a schematic diagram of the module structure of Embodiment 4 of the user authentication device in this application;

[0083] Figure 11 This is a schematic diagram of the device structure of the hardware operating environment involved in the user authentication method in this application embodiment.

[0084] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0085] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0086] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0087] The main solution of this application embodiment is as follows: When the SIM card receives a biometric data reading instruction sent by a mobile phone or device, it performs asymmetric encryption on the locally stored biometric metadata using a first national commercial cryptographic algorithm and an asymmetric public key to obtain metadata encrypted ciphertext; it then performs symmetric encryption on the locally stored biometric vector and a preset public key using a second national commercial cryptographic algorithm and the metadata encrypted ciphertext to obtain feature vector encrypted ciphertext; it concatenates the metadata encrypted ciphertext and the feature vector encrypted ciphertext, and performs signature calculation on the concatenated encrypted ciphertext according to the first national commercial cryptographic algorithm and the asymmetric public key to obtain a first signature value; it concatenates the data written to the application protocol data unit instruction, the metadata encrypted ciphertext, the feature vector encrypted ciphertext, and the first signature value to obtain encrypted biometric data; it determines the first MAC value corresponding to the encrypted biometric data using the second national commercial cryptographic algorithm and a MAC symmetric key; and it feeds back the encrypted biometric data, the first MAC value, and the first signature value to the mobile phone or device, so that the mobile phone or device sends the encrypted biometric data, the first MAC value, and the first signature value to the platform side for user authentication.

[0088] Current technology involves the SIM card receiving the biometric data transmitted from the mobile phone, comparing the biometric data's signature with the stored biometric data within the SIM card, and returning the comparison result. During this process, the security and uniqueness of data transmission are ensured by comparing the random numbers stored in the card with the written random numbers and by using asymmetric encryption on the biometric data's signature. However, the SIM card's limited computing resources are insufficient to support complex biometric comparison algorithms, affecting the speed and accuracy of the comparison. Furthermore, since biometric data is considered private data, relying solely on asymmetric encryption and random number checks during transmission is insufficient to verify data integrity. This method also lacks resistance to replay attacks, resulting in low data security when performing complex biometric data comparisons for identity verification.

[0089] This application provides a solution in which, upon receiving a biometric data reading instruction, the SIM card side performs asymmetric encryption on biometric metadata using a first national commercial cryptographic algorithm and an asymmetric public key to obtain encrypted metadata ciphertext; then, it performs symmetric encryption on the biometric vector and a preset public key using a second national commercial cryptographic algorithm and the encrypted metadata ciphertext to obtain encrypted feature vector ciphertext; the encrypted metadata ciphertext and the encrypted feature vector ciphertext are concatenated, and a signature calculation is performed on the concatenated ciphertext using the first national commercial cryptographic algorithm and the asymmetric public key to obtain a first signature value; the data is written into an application protocol data unit instruction, and the encrypted metadata ciphertext, the encrypted feature vector ciphertext, and the first signature value are concatenated to obtain encrypted biometric data; a first MAC value corresponding to the encrypted biometric data is determined using the second national commercial cryptographic algorithm and a MAC symmetric key; and the encrypted biometric data, the first MAC value, and the first signature value are fed back to the mobile phone or device, so that the mobile phone or device sends the encrypted biometric data, the first MAC value, and the first signature value to the platform side for user authentication. This application stores biometric data in a high-performance SIM card. When user authentication is required, the platform can retrieve the user's biometric data from the SIM card using other devices. This leverages the advantage of storing biometric data in a high-performance SIM card to achieve complex biometric data comparisons. When the SIM card returns data, it segments and encrypts the biometric metadata and biometric vectors in different ways. This enables key updates during the encryption process of biometric information with high security requirements, increasing its security. At the same time, it adds signature verification and message checksum to the overall encrypted data to ensure message integrity and non-repudiation.

[0090] It should be noted that the executing entity of the method in this embodiment can be a computing service device with user authentication, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone; or it can be a user authentication device with the same or similar functions. This embodiment and the following embodiments will be described using a user authentication device as an example.

[0091] Based on this, embodiments of this application provide a user authentication method, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the user authentication method of this application.

[0092] In this embodiment, the method is applied to the SIM card side, and the user authentication method includes steps S11 to S16:

[0093] Step S11: Upon receiving a biometric data reading instruction from a mobile phone or device, the biometric metadata stored locally is asymmetrically encrypted using a first national commercial cryptographic algorithm and an asymmetric public key to obtain encrypted metadata ciphertext.

[0094] It is understood that the execution entity in this embodiment can be the SIM card side, and the Subscriber Identity Module (SIM) card can be a high-performance Super SIM card. A biometric data access method is designed based on the Super SIM card's unique secure storage mechanism. Under the premise of ensuring security, biometric data is stored in the Super SIM card. When user authentication is required, the biometric data in the Super SIM card can be read for authentication.

[0095] Biometric data required for user authentication can be fingerprints, palm prints, or facial information. This embodiment and the following embodiments take palm print image data stored in the Super SIM card as an example. When a user needs to use palm print information for authentication or transactions, the palm print feature vector is read through Near Field Communication (NFC) technology of the device or through the device card channel or Bearer Independent Protocol (BIP) channel of the mobile application. After receiving the read command, the Super SIM card uses the first national commercial cryptographic algorithm SM2 to perform asymmetric encryption on the palm print image metadata A0, A1 (11-15) pre-written into the SIM card. The encryption key is the asymmetric public key M2, and the encrypted ciphertext of the metadata is obtained.

[0096] Step S12: The biometric vector stored locally and the preset public key are symmetrically encrypted using the second national commercial cryptographic algorithm and the metadata encryption ciphertext to obtain the feature vector encryption ciphertext.

[0097] Understandably, at this point, the Super SIM card generates a public-private key pair for calculating the ciphertext data signature. The second national commercial cryptographic algorithm, SM4-CBC, is used to symmetrically encrypt the palmprint feature vector A2 data and the aforementioned generated public key. The encryption key is the first 16 bytes of the metadata ciphertext calculated in step S11 (byte length is only an example and can be adjusted according to actual conditions), and the IV is the last 16 bytes of the metadata ciphertext calculated in step S11 (byte length is only an example and can be adjusted according to actual conditions).

[0098] Step S13: Concatenate the encrypted ciphertext of the metadata and the encrypted ciphertext of the feature vector, and perform signature calculation on the concatenated encrypted ciphertext according to the first national commercial cryptographic algorithm and the asymmetric public key to obtain the first signature value.

[0099] It should be understood that the metadata encrypted ciphertext and the feature vector encrypted ciphertext are concatenated, and the first national commercial cryptographic algorithm SM2 is used to perform signature calculation on the concatenated encrypted ciphertext. The signature key is the asymmetric public key M2, and the first signature value is obtained.

[0100] Step S14: The data is written into the application protocol data unit instruction, the metadata encryption ciphertext, the feature vector encryption ciphertext and the first signature value and then concatenated to obtain the encrypted biometric data.

[0101] It should be understood that the data write Application Protocol Data Unit (APDU) instruction refers to the instruction received when writing data to the SIM card. The data format of the write data APDU instruction includes CLA, INS, P1, P2, LC, and DATA. DATA consists of encrypted palmprint image metadata, encrypted palmprint feature vector, and a signature value. The encrypted metadata, encrypted feature vector, and first signature value are concatenated with parts of CLA, INS, P1, P2, and LC to obtain the encrypted biometric data.

[0102] Step S15: Determine the first MAC value corresponding to the encrypted biometric data using the second national commercial cryptographic algorithm and the MAC symmetric key.

[0103] It should be understood that the MAC value of the above-mentioned concatenated encrypted biometric data is calculated using the second national commercial cryptographic algorithm SM4-CBC, with the key being the MAC symmetric key M3 and the IV being 16 bytes of 00, thus obtaining the first MAC value corresponding to the encrypted biometric data.

[0104] Step S16: The encrypted biometric data, the first MAC value, and the first signature value are fed back to the mobile phone or device, so that the mobile phone or device sends the encrypted biometric data, the first MAC value, and the first signature value to the platform side for user authentication.

[0105] Understandably, the SIM card sends the encrypted biometric data, the first MAC value, and the first signature value back to the mobile phone or device. The mobile phone or device then transmits the information to the platform. The platform receives the encrypted data transmitted by the device or app, verifies the obtained encrypted data MAC value, verifies the signature value, and then decrypts the encrypted data according to the encryption rules to obtain the palmprint data feature vector and palmprint image metadata. By comparing it with the palmprint information stored in the database, the platform returns the verification result.

[0106] This embodiment provides a user authentication method. When the SIM card receives a biometric data reading instruction, it performs asymmetric encryption on the biometric metadata using a first national commercial cryptographic algorithm and an asymmetric public key to obtain encrypted metadata ciphertext. It then performs symmetric encryption on the biometric vector and a preset public key using a second national commercial cryptographic algorithm and the encrypted metadata ciphertext to obtain encrypted feature vector ciphertext. The encrypted metadata ciphertext and the encrypted feature vector ciphertext are concatenated, and a signature calculation is performed on the concatenated ciphertext using the first national commercial cryptographic algorithm and the asymmetric public key to obtain a first signature value. The data is written into an application protocol data unit instruction, and the encrypted metadata ciphertext, the encrypted feature vector ciphertext, and the first signature value are concatenated to obtain encrypted biometric data. A first MAC value corresponding to the encrypted biometric data is determined using the second national commercial cryptographic algorithm and a MAC symmetric key. The encrypted biometric data, the first MAC value, and the first signature value are fed back to the mobile phone or device, so that the mobile phone or device sends the encrypted biometric data, the first MAC value, and the first signature value to the platform side for user authentication. This embodiment stores biometric data in a high-performance SIM card. When user authentication is required, the platform can retrieve the user's biometric data from the SIM card using other devices. This leverages the advantage of storing biometric data in a high-performance SIM card to achieve complex biometric data comparisons. When the SIM card returns data, it segments and encrypts the biometric metadata and biometric vectors in different ways. This enables key updates during the encryption process of biometric information with high security requirements, increasing its security. At the same time, it adds signature verification and message checksum to the overall encrypted data to ensure message integrity and non-repudiation.

[0107] This application also provides a user authentication method, as described in the embodiments below. Figure 2 , Figure 2 This is a flowchart illustrating the second embodiment of the user authentication method of this application.

[0108] In this embodiment, the method is applied to the platform side, and the user authentication method includes steps S21 to S24:

[0109] Step S21: Receive encrypted biometric data, first MAC value, and first signature value sent by a mobile phone or device.

[0110] It should be noted that in this embodiment, biometric data processing and authentication are performed on the backend data processing platform. The platform receives encrypted biometric data, a first MAC value, and a first signature value sent by the mobile phone or device, and processes, analyzes, compresses, and segments these raw images on the platform. The processed palmprint data is then securely downloaded to the user's super SIM card via the SIM card channel or BIP channel.

[0111] Step S22: Perform data integrity verification based on the first MAC value and the first signature value.

[0112] Understandably, the integrity of the message can be ensured by verifying the first MAC value and the first signature value.

[0113] Step S23: When the verification is successful, the encrypted biometric data is decrypted according to the preset encryption rules to obtain biometric metadata and biometric vector.

[0114] Understandably, after verifying the integrity of the message, the encrypted biometric data can be decrypted in reverse according to the encryption rules and procedures of the SIM card to obtain biometric metadata and biometric vectors.

[0115] Step S24: Compare the biometric metadata and the biometric vector with the pre-stored biometric information, and send the user authentication result back to the mobile phone or device.

[0116] After decrypting and obtaining the palmprint data feature vector and palmprint image metadata, the verification result is returned to the mobile phone or device by comparing it with the palmprint information stored in the database.

[0117] You can refer to this. Figure 3 The interaction flow of each side during the reading of biometric information in this application is described. Figure 3This is an interactive diagram illustrating the biometric data reading process in the user authentication method of this application. When a user needs to use palmprint information for authentication or transactions, the palmprint feature vector is read via NFC using a device or via a mobile app through the SIM card channel / BIP channel. After receiving the read command, the Super SIM card returns the encrypted palmprint data and calculated MAC address, encrypted using the national commercial cryptographic algorithm stored in the card, and uploads it to the platform via the network of the mobile phone or device. The platform receives the encrypted data transmitted by the device or app, verifies the obtained encrypted data MAC address, verifies the signature value, and then decrypts the encrypted data according to the encryption rules to obtain the palmprint feature vector and palmprint image metadata. By comparing it with the palmprint information stored in the database, the platform returns the verification result.

[0118] In this embodiment, the platform receives encrypted data transmitted by the device or APP, verifies the obtained encrypted data MAC, and verifies the signature value to ensure the integrity of the message. Then, the encrypted data is decrypted according to the encryption rules to obtain the palmprint data feature vector and palmprint image metadata. By comparing it with the palmprint information stored in the database, the verification result is returned.

[0119] This application also provides a user authentication method, as described in the embodiments below. Figure 4 , Figure 4 This is a flowchart illustrating the third embodiment of the user authentication method in this application.

[0120] In this embodiment, the method is applied to the platform side, and the user authentication method includes steps S31 to S40:

[0121] Step S31: Receive the encrypted user biometric metadata collected and encrypted by the device, and decrypt the encrypted user biometric metadata to obtain the user biometric metadata.

[0122] This embodiment describes the process by which the platform encrypts the user's biometric data received from the user. After filling in personal information such as name, ID number, and mobile phone number on a mobile app or mini-program interface and authorizing access, the user scans a QR code on the device to authorize it to collect their palmprint information. The user's authorized personal information is then encrypted and transmitted to the platform. The user places their hand on the device to collect a palmprint image, and the device encrypts the collected palmprint image information (i.e., the user's biometric metadata). The encrypted palmprint image is then uploaded to the platform via the device's IoT module. The platform receives the palmprint image transmitted by the device, decrypts the encrypted palmprint image, and binds the palmprint image information to the user's authorized personal information.

[0123] Step S32: Extract the user biometric vector based on the user biometric metadata.

[0124] Understandably, the platform preprocesses the palmprint image, extracts palmprint image features, and combines the extracted palmprint features and texture features into a feature vector (i.e., the user's biometric vector).

[0125] Step S33: The user biometric metadata, the user biometric vector, and the preset biometric information are formatted according to a preset format to obtain formatted biometric data.

[0126] It should be noted that the user biometric metadata, the user biometric vector, and the preset biometric information are formatted according to a preset format, as shown in the table below.

[0127] logo TAG LEN DATA Write data A0 XX (1 / 2 bytes) Length of written data Palmprint image metadata A1 XX (1 byte) User ID 11 XX (1 byte) Collection Date 12 XX (1 byte) Collection address 13 XX (1 byte) Feature vector dimension 14 XX (1 byte) Feature vector version information 15 XX (1 byte) ... ... ... ... Palmprint feature vector A2 XX (1 / 2 bytes)

[0128] Step S34: Generate an external authentication application protocol data unit instruction, send the external authentication application protocol data unit instruction to the SIM card side, establish a secure channel with the SIM card side, and receive the external authentication result fed back by the SIM card side.

[0129] Understandably, the platform organizes external authentication APDU commands used for external authentication with the Super SIM card. These commands are sent to the Super SIM card through the SIM card channel or BIP channel to establish a secure channel (ciphertext + MAC verification) to ensure the security of the channel through which subsequent data information is written. The SIM card then sends the external authentication result back to the platform.

[0130] Step S35: Generate a key writing instruction for the application protocol data unit. The key writing instruction for the application protocol data unit includes an encrypted key and a second MAC value. The encrypted key consists of a metadata symmetric key, an asymmetric public key, and a MAC symmetric key.

[0131] Understandably, a key can be generated and written into the APDU instruction, which includes an encrypted key and a second MAC value. The encrypted key consists of a metadata symmetric key, an asymmetric public key, and a MAC symmetric key.

[0132] In one feasible implementation, step S35 may include steps S351 to S356:

[0133] Step S351: Generate metadata symmetric key, asymmetric public key and MAC symmetric key according to preset data format.

[0134] It should be noted that three keys are generated according to the BER-TLV data format, which can be used for:

[0135] Metadata symmetric key M1: Decrypts palmprint image metadata (symmetric key);

[0136] Asymmetric public key M2: Verifies the signature of data when writing, and encrypts palmprint image metadata when reading;

[0137] MAC symmetric key M3: Calculates the MAC (symmetric key) of data during writing and reading;

[0138] All three keys are written in BER-TLV format, and different keys are distinguished by their TAGs for different usage scenarios.

[0139] Step S352: Generate a random number acquisition instruction and send the random number acquisition instruction to the SIM card side so that the SIM card side can return a random number and a SIM card side key.

[0140] It should be understood that the platform generates a random number acquisition command and sends the random number acquisition command to the SIM card side through the SIM card channel or BIP channel to obtain the random number from the card (ensuring the integrity of APDU command interaction) and the Super SIM card side key.

[0141] Step S353: Concatenate the obtained random number, metadata symmetric key, asymmetric public key and MAC symmetric key to obtain the key to be written.

[0142] The obtained random numbers and three BER-TLV format key data can be organized into a key to be written.

[0143] Step S354: Determine the second MAC value corresponding to the key to be written.

[0144] Understandably, in order to ensure the integrity of the transmitted data, it is also necessary to calculate the second MAC value corresponding to the key to be written.

[0145] Step S355: Encrypt the key to be written according to the SIM card side key to obtain the encrypted key to be written.

[0146] Step S356: Generate a key writing application protocol data unit instruction based on the second MAC value and the encrypted key to be written.

[0147] Understandably, the Super SIM card key is used to encrypt the key to be written, and a second MAC value is calculated to organize the complete key writing APDU instruction.

[0148] Step S36: Send the instruction to write the key to the application protocol data unit through the secure channel to the SIM card side, so that the SIM card side verifies the second MAC value and stores the decrypted metadata symmetric key, asymmetric public key and MAC symmetric key.

[0149] It is understandable that the key is written to the APDU command through the SIM card channel or BIP channel. The SIM card verifies the MAC and decrypts the written data ciphertext, and stores the three keys separately.

[0150] Step S37: Encrypt the formatted biometric data in segments according to the metadata symmetric key and the external authentication result to obtain the segmented encrypted biometric data.

[0151] Considering the different security requirements of palmprint image metadata and palmprint feature vectors, with palmprint image metadata having lower security requirements than palmprint feature vectors, the platform will encrypt palmprint data organized in different data formats into two segments according to their different security requirements.

[0152] In one feasible implementation, step S37 may include steps S371 to S374:

[0153] Step S371: Encrypt the user biometric metadata in the formatted biometric data according to a third-country commercial cryptographic algorithm and a metadata symmetric key to obtain encrypted user metadata.

[0154] It should be noted that the palmprint image metadata A0 and A1 (11-15), which have lower security requirements than palmprint feature vectors, are encrypted using the third country's commercial cryptographic algorithm SM4-ECB, and the encryption key is the metadata symmetric key M1.

[0155] Step S372: Concatenate the ciphertext data of the first preset number of bits in the external authentication result, the ciphertext data of the preset number of bytes in the encrypted user metadata, and the MAC data of the last preset number of bits in the external authentication result, and calculate the hash value of the concatenated data according to the hash function of the fourth national commercial cryptographic algorithm to obtain the ciphertext of the user biometric metadata.

[0156] Understandably, the process involves concatenating data using the SM3 hash function (a fourth-country commercial cryptographic algorithm), the first eight bytes of ciphertext data from the EXTERNAL AUTHENTICATE instruction for the Super SIM card transaction, the first 16 bytes of ciphertext calculated using 'a', and the last eight bytes of MAC data from the EXTERNAL AUTHENTICATE instruction for the transaction. This concatenated data is then hashed using SM3, and the hash value is used as the ciphertext for the user's biometric metadata.

[0157] Step S373: Encrypt the user biometric vector in the formatted biometric data according to the second national commercial cryptographic algorithm and the ciphertext of the user biometric metadata to obtain the ciphertext of the user biometric vector.

[0158] Understandably, the palmprint feature vector A2 is encrypted using the second national commercial cryptographic algorithm SM4-CBC, with the encryption key being the first 16-byte hash value calculated in step S373 and the IV being the last 16-byte hash value calculated in step S373.

[0159] Step S374: Generate segmented encrypted biometric data based on the encrypted user biometric metadata and the encrypted user biometric vector.

[0160] The encrypted metadata of the palmprint image and the encrypted palmprint feature vector are spliced ​​together to generate segmented encrypted biometric data.

[0161] In this embodiment, the palmprint image metadata with lower security requirements is encrypted using the national commercial cryptographic algorithm SM4-ECB, while the palmprint feature vector with higher security requirements is encrypted in segments using the hash function of the national commercial cryptographic algorithm SM3. The encryption process of biometric information with higher security requirements is implemented by updating the key to increase its security. At the same time, signature verification and message check code are added to the overall data ciphertext to ensure message integrity and non-repudiation.

[0162] Step S38: Determine the third MAC value and the second signature value corresponding to the segmented encrypted biometric data based on the asymmetric public key.

[0163] It should be understood that the third MAC value and the second signature value corresponding to the segmented encrypted biometric data are calculated based on the asymmetric public key M2.

[0164] Step S39: According to the preset instruction format, the segmented encrypted biometric data, the third MAC value and the second signature value are concatenated to generate a data writing instruction for the application protocol data unit.

[0165] It is worth noting that the encrypted palmprint image metadata, encrypted palmprint feature vector, signature value, and MAC are concatenated and divided into several data packets to generate a data write application protocol data unit instruction. The data write APDU instruction format is shown in the table below. The APDU instruction should be organized according to the format in the table to perform the data write operation.

[0166]

[0167] Step S40: The data writing application protocol data unit instruction is sent to the SIM card side through the secure channel, so that the SIM card side verifies the third MAC value and the second signature value according to the data writing application protocol data unit instruction, and decrypts and stores the segmented encrypted biometric data according to the preset encryption rules.

[0168] It is understandable that the data is written to the application protocol data unit through a secure channel and sent to the SIM card. After receiving the write instruction, the Super SIM card stores the DATA in the buffer area. After receiving the last piece of data, it verifies the MAC to ensure message integrity and verifies the signature value. Then, according to the encryption rules, it decrypts the received ciphertext data and stores the palmprint image metadata and palmprint feature vector in a TAG chain.

[0169] This application also provides a user authentication method, as described in the embodiments below. Figure 5 , Figure 5 This is a flowchart illustrating the fourth embodiment of the user authentication method in this application.

[0170] In this embodiment, the method is applied to the SIM card side, and the user authentication method includes steps S41 to S45:

[0171] Step S41: Upon receiving the external authentication application protocol data unit instruction sent by the platform side, establish a secure channel with the platform side and feed back the generated external authentication result to the platform side.

[0172] This section describes the process of writing biometric data to the SIM card. When the SIM card receives the external authentication application protocol data unit instruction sent by the platform, the platform establishes a secure channel and sends the generated external authentication result back to the platform.

[0173] Step S42: Receive the key writing application protocol data unit instruction sent by the platform side through the secure channel, and perform key integrity verification based on the second MAC value in the key writing application protocol data unit instruction.

[0174] Understandably, when the SIM card receives the key writing instruction sent by the platform through a secure channel to the application protocol data unit, the Super SIM card verifies the second MAC value to ensure the integrity of the transmitted data.

[0175] Step S43: When the key integrity verification passes, the encrypted key is decrypted, and the decrypted metadata symmetric key, asymmetric public key, and MAC symmetric key are stored in the storage area with the highest security level.

[0176] Understandably, when the key integrity verification passes, the encrypted key is decrypted according to the key encryption rules mentioned above to obtain three keys: the metadata symmetric key, the asymmetric public key, and the MAC symmetric key. Considering the high security requirements of the keys, the three keys can be stored in the highest security area of ​​the SIM card storage area, such as the non-volatile storage area of ​​the Super SIM card.

[0177] Step S44: Receive the data writing application protocol data unit instruction sent by the platform side through the secure channel, and perform data integrity verification based on the third MAC value and the second signature value in the data writing application protocol data unit instruction.

[0178] Understandably, the SIM card receives the data writing instruction sent by the platform through a secure channel. After receiving the write instruction, the SIM card verifies the third MAC value and verifies the second signature value to ensure message integrity.

[0179] Step S45: When the data integrity verification passes, the segmented encrypted biometric data is decrypted according to the preset encryption rules, and the decrypted biometric metadata and biometric vector are stored.

[0180] It should be understood that after the SIM card receives the write command, it stores the DATA in the buffer area. After receiving the last piece of data, it decrypts the received ciphertext data according to the encryption rules and stores the palmprint image metadata and palmprint feature vector in a TAG chain.

[0181] You can refer to this. Figure 6 This application describes the interaction process between each side during the writing of biometric information. Figure 6 This diagram illustrates the interaction of writing biometric data in the user authentication method of this application. The user fills in personal information on their mobile phone and authorizes the device to collect palmprint information. The device captures and extracts a clear palmprint image and securely transmits it to the backend processing platform. The platform preprocesses the palmprint image, extracts palmprint features, and combines the extracted palmprint features and texture features into a feature vector. The platform then organizes the palmprint feature vector data and additional information from the palmprint image into formatted data. The platform establishes a secure channel for external authentication with the SIM card. The platform encrypts the generated key and sends it to the SIM card for storage. The platform then sends the encrypted biometric data to be written to the SIM card for storage. Offline authentication or transactions can be performed by reading the palmprint information stored in the Super SIM card via NFC. Online authentication using palmprint information is completed by reading the palmprint information stored in the Super SIM card through the device-card channel or BIP channel.

[0182] In this embodiment, the SIM card establishes a secure channel with the platform when it receives an external authentication application protocol data unit instruction sent by the platform and feeds back the generated external authentication result to the platform. It receives a key writing application protocol data unit instruction sent by the platform through the secure channel and performs key integrity verification based on the second MAC value in the instruction. If the key integrity verification passes, the encrypted key is decrypted, and the decrypted metadata symmetric key, asymmetric public key, and MAC symmetric key are stored in the highest security area of ​​the storage region. The SIM card also receives a data writing application protocol data unit instruction sent by the platform through the secure channel and performs data integrity verification based on the third MAC value and second signature value in the instruction. If the data integrity verification passes, the segmented encrypted biometric data is decrypted according to preset encryption rules, and the decrypted biometric metadata and biometric vector are stored, thereby improving the security of user biometric data transmission and storage.

[0183] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the user authentication method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0184] This application also provides a user authentication device, which is applied to the SIM card side. Please refer to [reference needed]. Figure 7 The user authentication device includes:

[0185] Metadata encryption module 11 is used to perform asymmetric encryption on locally stored biometric metadata using a first national commercial cryptographic algorithm and an asymmetric public key when receiving a biometric data reading instruction sent by a mobile phone or device, to obtain encrypted ciphertext of the metadata.

[0186] The feature vector encryption module 12 is used to symmetrically encrypt the locally stored biometric vector and the preset public key using a second national commercial cryptographic algorithm and the metadata encryption ciphertext to obtain the feature vector encryption ciphertext.

[0187] The first signature calculation module 13 is used to concatenate the encrypted ciphertext of the metadata and the encrypted ciphertext of the feature vector, and perform signature calculation on the concatenated encrypted ciphertext according to the first national commercial cryptographic algorithm and the asymmetric public key to obtain the first signature value.

[0188] The biometric data splicing module 14 is used to splice the data written into the application protocol data unit instruction, the encrypted metadata ciphertext, the encrypted feature vector ciphertext and the first signature value to obtain encrypted biometric data.

[0189] The first MAC determination module 15 is used to determine the first MAC value corresponding to the encrypted biometric data by using the second national commercial cryptographic algorithm and the MAC symmetric key;

[0190] The data feedback module 16 is used to feed back the encrypted biometric data, the first MAC value and the first signature value to the mobile phone or device, so that the mobile phone or device can send the encrypted biometric data, the first MAC value and the first signature value to the platform side for user authentication.

[0191] This application also provides a user authentication device, which is applied on the platform side. Please refer to [reference needed]. Figure 8 The user authentication device includes:

[0192] Data receiving module 21 is used to receive encrypted biometric data, first MAC value and first signature value sent by mobile phone or device;

[0193] Data verification module 22 is used to perform data integrity verification based on the first MAC value and the first signature value;

[0194] The data decryption module 23 is used to decrypt the encrypted biometric data according to a preset encryption rule when the verification is successful, so as to obtain biometric metadata and biometric vector.

[0195] The data comparison module 24 is used to compare the biometric metadata and the biometric vector with the pre-stored biometric information, and to feed back the user authentication result to the mobile phone or device.

[0196] This application also provides a user authentication device, which is applied on the platform side. Please refer to [reference needed]. Figure 9 The user authentication device includes:

[0197] The data formatting module 31 is used to receive the encrypted user biometric metadata collected and encrypted by the device, and decrypt the encrypted user biometric metadata to obtain user biometric metadata; extract user biometric vectors based on the user biometric metadata; and format the user biometric metadata, the user biometric vectors, and preset biometric information according to a preset format to obtain formatted biometric data.

[0198] The external authentication module 32 is used to generate an external authentication application protocol data unit instruction, send the external authentication application protocol data unit instruction to the SIM card side, establish a secure channel with the SIM card side, and receive the external authentication result fed back by the SIM card side;

[0199] The key writing module 33 is used to generate a key writing application protocol data unit instruction, which includes an encrypted key and a second MAC value. The encrypted key consists of a metadata symmetric key, an asymmetric public key, and a MAC symmetric key. The key writing application protocol data unit instruction is sent to the SIM card side through the secure channel so that the SIM card side verifies the second MAC value and stores the decrypted metadata symmetric key, asymmetric public key, and MAC symmetric key.

[0200] The data writing module 34 is used to encrypt the formatted biometric data in segments according to the metadata symmetric key and the external authentication result to obtain segmented encrypted biometric data; determine the third MAC value and the second signature value corresponding to the segmented encrypted biometric data according to the asymmetric public key; concatenate the segmented encrypted biometric data, the third MAC value and the second signature value according to a preset instruction format to generate a data writing application protocol data unit instruction; and send the data writing application protocol data unit instruction to the SIM card side through the secure channel so that the SIM card side verifies the third MAC value and the second signature value according to the data writing application protocol data unit instruction, and decrypts and stores the segmented encrypted biometric data according to a preset encryption rule.

[0201] This application also provides a user authentication device, which is applied to the SIM card side. Please refer to [reference needed]. Figure 10 The user authentication device includes:

[0202] The external authentication module 41 is used to establish a secure channel with the platform side when it receives the external authentication application protocol data unit instruction sent by the platform side, and to feed back the generated external authentication result to the platform side; it receives the key writing application protocol data unit instruction sent by the platform side through the secure channel, and performs key integrity verification according to the second MAC value in the key writing application protocol data unit instruction;

[0203] The key writing module 42 is used to decrypt the encrypted key when the key integrity verification is passed, and store the decrypted metadata symmetric key, asymmetric public key and MAC symmetric key in the highest security area of ​​the storage area.

[0204] The data writing module 43 is used to receive the data writing application protocol data unit instruction sent by the platform side through the secure channel, and to perform data integrity verification according to the third MAC value and the second signature value in the data writing application protocol data unit instruction; when the data integrity verification is passed, the segmented encrypted biometric data is decrypted according to the preset encryption rules, and the decrypted biometric metadata and biometric vector are stored.

[0205] The user authentication device provided in this application, employing the user authentication method described in the above embodiments, can solve the technical problem. Compared with the prior art, the beneficial effects of the user authentication device provided in this application are the same as those of the user authentication method described in the above embodiments, and other technical features in the user authentication device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0206] This application provides a user authentication device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, which are executed by the at least one processor to enable the at least one processor to perform the user authentication method in Embodiment 1 above.

[0207] The following is for reference. Figure 11 The diagram illustrates a structural schematic of a user authentication device suitable for implementing embodiments of this application. The user authentication device in these embodiments may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 11 The user authentication device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0208] like Figure 11As shown, the user authentication device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.) that can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1003 into a random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the user authentication device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 1003 including, for example, magnetic tape, hard disk, etc.; and communication devices 1009. Communication device 1009 allows a user authentication device to communicate wirelessly or wiredly with other devices to exchange data. While user authentication devices with various systems are shown in the figures, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0209] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0210] The user authentication device provided in this application, employing the user authentication method described in the above embodiments, can solve the technical problem of user authentication. Compared with the prior art, the beneficial effects of the user authentication device provided in this application are the same as those of the user authentication method described in the above embodiments, and other technical features of this user authentication device are the same as those disclosed in the method of the previous embodiment, and will not be repeated here.

[0211] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0212] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0213] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to perform the user authentication method described in the above embodiments.

[0214] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0215] The aforementioned computer-readable storage medium may be included in a user authentication device; or it may exist independently and not assembled into a user authentication device.

[0216] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0217] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0218] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0219] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for performing the above-described user authentication method, thereby solving the technical problem. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the user authentication method provided in the above embodiments, and will not be repeated here.

[0220] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the user authentication method described above.

[0221] The computer program product provided in this application can solve the technical problem. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the user authentication method provided in the above embodiments, and will not be repeated here.

[0222] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A user authentication method, characterized in that, The method is applied to the SIM card side, and the method includes: When a biometric data reading instruction is received from a mobile phone or device, the locally stored biometric metadata is asymmetrically encrypted using a first national commercial cryptographic algorithm and an asymmetric public key to obtain the encrypted metadata ciphertext. The biometric vector stored locally and the preset public key are symmetrically encrypted using a second national commercial cryptographic algorithm and the aforementioned metadata encrypted ciphertext to obtain the feature vector encrypted ciphertext. The metadata encrypted ciphertext and the feature vector encrypted ciphertext are concatenated, and the concatenated encrypted ciphertext is signed using the first national commercial cryptographic algorithm and the asymmetric public key to obtain the first signature value; The data is written into the application protocol data unit instruction, the encrypted metadata ciphertext, the encrypted feature vector ciphertext and the first signature value are concatenated to obtain the encrypted biometric data. The first MAC value corresponding to the encrypted biometric data is determined by the second national commercial cryptographic algorithm and the MAC symmetric key; The encrypted biometric data, the first MAC value, and the first signature value are fed back to the mobile phone or device, so that the mobile phone or device can send the encrypted biometric data, the first MAC value, and the first signature value to the platform side for user authentication.

2. A user authentication method, characterized in that, The method is applied to the platform side, and the method includes: Receive encrypted biometric data, first MAC value, and first signature value sent by a mobile phone or device; Data integrity is verified based on the first MAC value and the first signature value; Upon successful verification, the encrypted biometric data is decrypted according to a preset encryption rule to obtain biometric metadata and biometric vectors. The biometric metadata and biometric vector are compared with the pre-stored biometric information, and the user authentication result is fed back to the mobile phone or device.

3. A user authentication method, characterized in that, The method is applied to the platform side, and the method includes: The receiving device collects and encrypts the encrypted user biometric metadata, and then decrypts the encrypted user biometric metadata to obtain the user biometric metadata. Extract the user's biometric vector based on the user's biometric metadata; The user biometric metadata, the user biometric vector, and the preset biometric information are formatted according to a preset format to obtain formatted biometric data; Generate an external authentication application protocol data unit instruction, send the external authentication application protocol data unit instruction to the SIM card side, establish a secure channel with the SIM card side, and receive the external authentication result fed back by the SIM card side; A key is generated and written to an application protocol data unit. The key is written to an application protocol data unit and includes an encrypted key and a second MAC value. The encrypted key consists of a metadata symmetric key, an asymmetric public key, and a MAC symmetric key. The key is written to the application protocol data unit instruction through the secure channel and sent to the SIM card side so that the SIM card side can verify the second MAC value and store the decrypted metadata symmetric key, asymmetric public key and MAC symmetric key; The formatted biometric data is segmented and encrypted based on the metadata symmetric key and the external authentication result to obtain segmented encrypted biometric data. The third MAC value and the second signature value corresponding to the segmented encrypted biometric data are determined based on the asymmetric public key. According to the preset instruction format, the segmented encrypted biometric data, the third MAC value and the second signature value are concatenated to generate a data writing instruction for the application protocol data unit. The data is written to the application protocol data unit through the secure channel and the instruction is sent to the SIM card side so that the SIM card side can verify the third MAC value and the second signature value according to the data written to the application protocol data unit instruction, and decrypt and store the segmented encrypted biometric data according to the preset encryption rules.

4. The user authentication method as described in claim 3, characterized in that, The step of generating the key and writing it into the application protocol data unit instruction includes: Generate metadata symmetric key, asymmetric public key, and MAC symmetric key according to the preset data format; A random number acquisition instruction is generated and sent to the SIM card side so that the SIM card side can return a random number and a SIM card side key; The obtained random number, metadata symmetric key, asymmetric public key, and MAC symmetric key are concatenated to obtain the key to be written; Determine the second MAC value corresponding to the key to be written; The key to be written is encrypted using the SIM card side key to obtain the encrypted key to be written. Generate a key writing application protocol data unit instruction based on the second MAC value and the encrypted key to be written.

5. The user authentication method as described in claim 3, characterized in that, The step of segmenting and encrypting the formatted biometric data according to the metadata symmetric key and the external authentication result to obtain segmented encrypted biometric data includes: The user's biometric metadata in the formatted biometric data is encrypted using a third-country commercial cryptographic algorithm and a metadata symmetric key to obtain encrypted user metadata. The ciphertext data of the first preset number of bits in the external authentication result, the ciphertext data of the preset number of bytes in the encrypted user metadata, and the MAC data of the last preset number of bits in the external authentication result are concatenated, and the hash value of the concatenated data is calculated according to the hash function of the fourth national commercial cryptographic algorithm to obtain the ciphertext of the user's biometric metadata. The user biometric vector in the formatted biometric data is encrypted using the second national commercial cryptographic algorithm and the ciphertext of the user biometric metadata to obtain the ciphertext of the user biometric vector. Segmented encrypted biometric data is generated based on the encrypted user biometric metadata and the encrypted user biometric vector.

6. A user authentication method, characterized in that, The method is applied to the SIM card side, and the method includes: Upon receiving an external authentication application protocol data unit instruction from the platform side, a secure channel is established with the platform side, and the generated external authentication result is fed back to the platform side. The system receives a key writing application protocol data unit instruction sent by the platform through the secure channel, and performs key integrity verification based on the second MAC value in the key writing application protocol data unit instruction. When the key integrity verification passes, the encrypted key is decrypted, and the decrypted metadata symmetric key, asymmetric public key, and MAC symmetric key are stored in the highest security area of ​​the storage area. The system receives a data writing instruction sent by the platform through the secure channel and performs data integrity verification based on the third MAC value and the second signature value in the data writing instruction. When the data integrity verification passes, the segmented encrypted biometric data is decrypted according to the preset encryption rules, and the decrypted biometric metadata and biometric vector are stored.

7. A user authentication device, characterized in that, The user authentication device is applied to the SIM card side, and the user authentication device includes: The metadata encryption module is used to perform asymmetric encryption on the locally stored biometric metadata using a first national commercial cryptographic algorithm and an asymmetric public key when it receives a biometric data reading instruction sent by a mobile phone or device, so as to obtain the encrypted ciphertext of the metadata. The feature vector encryption module is used to symmetrically encrypt the locally stored biometric vector and the preset public key using a second national commercial cryptographic algorithm and the metadata encryption ciphertext to obtain the feature vector encryption ciphertext. The first signature calculation module is used to concatenate the encrypted ciphertext of the metadata and the encrypted ciphertext of the feature vector, and perform signature calculation on the concatenated encrypted ciphertext according to the first national commercial cryptographic algorithm and the asymmetric public key to obtain the first signature value. The biometric data splicing module is used to splice data written into the application protocol data unit instruction, the encrypted metadata ciphertext, the encrypted feature vector ciphertext and the first signature value to obtain encrypted biometric data. The first MAC determination module is used to determine the first MAC value corresponding to the encrypted biometric data using the second national commercial cryptographic algorithm and the MAC symmetric key. The data feedback module is used to feed back the encrypted biometric data, the first MAC value, and the first signature value to the mobile phone or device, so that the mobile phone or device can send the encrypted biometric data, the first MAC value, and the first signature value to the platform side for user authentication.

8. A user authentication device, characterized in that, The user authentication device is applied on the platform side, and the user authentication device includes: The data receiving module is used to receive encrypted biometric data, a first MAC value, and a first signature value sent by a mobile phone or device. The data verification module is used to perform data integrity verification based on the first MAC value and the first signature value; The data decryption module is used to decrypt the encrypted biometric data according to a preset encryption rule when the verification is successful, so as to obtain biometric metadata and biometric vector. The data comparison module is used to compare the biometric metadata and the biometric vector with the pre-stored biometric information, and to send the user authentication result back to the mobile phone or device.

9. A user authentication device, characterized in that, The user authentication device is applied on the platform side, and the user authentication device includes: The data formatting module is used to receive encrypted user biometric metadata collected and encrypted by the device, and decrypt the encrypted user biometric metadata to obtain user biometric metadata; extract user biometric vectors based on the user biometric metadata; and format the user biometric metadata, the user biometric vectors, and preset biometric information according to a preset format to obtain formatted biometric data. The external authentication module is used to generate external authentication application protocol data unit instructions, send the external authentication application protocol data unit instructions to the SIM card side, establish a secure channel with the SIM card side, and receive the external authentication results fed back by the SIM card side; A key writing module is used to generate a key writing application protocol data unit instruction. The key writing application protocol data unit instruction includes an encrypted key and a second MAC value. The encrypted key consists of a metadata symmetric key, an asymmetric public key, and a MAC symmetric key. The key writing application protocol data unit instruction is sent to the SIM card side through the secure channel so that the SIM card side verifies the second MAC value and stores the decrypted metadata symmetric key, asymmetric public key, and MAC symmetric key. The data writing module is used to encrypt the formatted biometric data in segments according to the metadata symmetric key and the external authentication result to obtain segmented encrypted biometric data; determine the third MAC value and second signature value corresponding to the segmented encrypted biometric data according to the asymmetric public key; concatenate the segmented encrypted biometric data, the third MAC value and the second signature value according to a preset instruction format to generate a data writing application protocol data unit instruction; and send the data writing application protocol data unit instruction to the SIM card side through the secure channel, so that the SIM card side verifies the third MAC value and the second signature value according to the data writing application protocol data unit instruction, and decrypts and stores the segmented encrypted biometric data according to a preset encryption rule.

10. A user authentication device, characterized in that, The user authentication device is applied to the SIM card side, and the user authentication device includes: The external authentication module is used to establish a secure channel with the platform side when it receives the external authentication application protocol data unit instruction sent by the platform side, and to feed back the generated external authentication result to the platform side; it also receives the key writing application protocol data unit instruction sent by the platform side through the secure channel, and performs key integrity verification based on the second MAC value in the key writing application protocol data unit instruction. The key writing module is used to decrypt the encrypted key when the key integrity verification passes, and store the decrypted metadata symmetric key, asymmetric public key and MAC symmetric key in the highest security area of ​​the storage area. The data writing module is used to receive the data writing application protocol data unit instruction sent by the platform side through the secure channel, and to perform data integrity verification according to the third MAC value and the second signature value in the data writing application protocol data unit instruction; when the data integrity verification passes, the segmented encrypted biometric data is decrypted according to the preset encryption rules, and the decrypted biometric metadata and biometric vector are stored.

11. A user authentication device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the user authentication method as described in claim 1, claim 2, any one of claims 3 to 5, or claim 6.

12. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, on which a computer program is stored, which, when executed by a processor, implements the steps of the user authentication method as described in claim 1, claim 2, any one of claims 3 to 5, or claim 6.

13. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the steps of the user authentication method as described in claim 1, claim 2, any one of claims 3 to 5, or claim 6.

Images