A secure face authentication method and system based on honeypot technology

Abstract

The present invention provides a secure face authentication method and system based on honeypot technology, the secure face authentication method comprising: (1) registration phase: extracting face features and encrypting them into face feature templates; (2) authentication phase: based on honeypot technology, using the encrypted face feature templates to perform leakage detection and complete face authentication for the face data to be authenticated. The present invention first encrypts the face features to provide revocability of the face feature templates while improving security, and then implements leakage detection of the face feature templates based on honeypot technology. Once the face feature template is detected to be leaked, the leaked face feature template can be revoked and a new face feature template can be regenerated, thereby greatly improving the security of the system.

Description

Technical Field

[0001] The present invention relates to the field of face authentication technology, and in particular to a safe face authentication method and system based on honeypot technology. Background Art

[0002] Biometric authentication is considered one of the most reliable identity authentication methods, but there is also a problem that biometrics cannot be changed. If they are damaged, the loss of privacy is permanent. Biometric template protection schemes can provide privacy protection. From the user's perspective, protected biometric templates can greatly reduce the leakage of biometric information, but from the system's perspective, protected biometric templates leaked from the database will still pose a serious threat to system security.

[0003] The biometric template protection scheme based on hashing can effectively perform repeatable and irreversible transformations on facial features. By using encrypted hash calculations for template verification, it solves the privacy leakage problem of ordinary biometric template storage in the database. However, encrypted hashing only has computational security. If it is cracked, biometric information will be leaked, causing serious consequences. In addition, existing biometric template protection schemes can rarely detect whether the biometric template has been leaked from the database during the verification process, which is a huge hidden danger for users whose biometric templates have been leaked. Summary of the invention

[0004] The present invention aims to provide a safe face authentication method and system based on honeypot technology to solve the problem of information leakage of face feature templates used in face authentication.

[0005] The present invention provides a secure face authentication method based on honeypot technology, comprising:

[0006] (1) Registration phase: extracting facial features and encrypting them into facial feature templates;

[0007] (2) Authentication phase: Based on honeypot technology, encrypted facial feature templates are used for leakage detection and facial authentication is completed on the facial data to be authenticated.

[0008] Furthermore, the execution process of the registration phase includes the following steps:

[0009] Step S11, collecting face data and extracting face features therefrom; wherein the face data refers to face image data;

[0010] Step S12, generating a random matrix as a mapping matrix and storing it in the token, converting the mapping matrix into a vector and generating a key k with the same length as the facial feature through error correction coding;

[0011] Step S13, using the mapping matrix stored in the token, the facial features extracted in step S11 are mapped and encrypted into a facial feature template B through a random orthogonal matrix;

[0012] Step S14, define the deviation between the face feature template B and the key k as auxiliary data A(D), give a fuzzy commitment {A(D), Hash(k)} and input it into the honeypot system, that is, generate a sugar template;

[0013] Step S15, randomly synthesizing n-1 pseudo face data, and generating n-1 honey templates according to steps S11 to S14 for the n-1 pseudo face data;

[0014] Step S16, hide the sugar template into n-1 honey templates, and record the index L of the sugar template i ;

[0015] Step S17, storing the sugar template and the honey template in the template database, and storing the index of the sugar template and the user ID of the collected face data in the detection database.

[0016] Furthermore, the elements in the random matrix generated in step S12 obey Gaussian distribution.

[0017] Furthermore, the execution process of the authentication phase includes the following steps:

[0018] Step S21, collecting face data to be authenticated and extracting face features from it;

[0019] Step S22, using the mapping matrix stored in the token during the registration phase, the facial features extracted in step S21 are mapped and encrypted into a facial feature template B' through a random orthogonal matrix, and the deviation between the facial feature template B' and the key k is calculated as the auxiliary data A(D) to be authenticated, and finally the auxiliary data A(D) to be authenticated is submitted to the honeypot system together with the user ID of the facial data to be authenticated;

[0020] Step S23, extracting the corresponding honeypot from the template database according to the user ID;

[0021] Step S24, calculate the deviation between the auxiliary data A(D) to be authenticated and the auxiliary data A(D)i extracted from the honeypot, find the one with the smallest deviation, and return the index index of the sugar template corresponding to the smallest deviation i ;

[0022] Step S25, searching the detection database for the index L of the sugar template corresponding to the user ID i , the index L i with index i To compare:

[0023] If they are equal, the first authentication is passed, the auxiliary data A(D)i and the Hash(k) of the sugar template are submitted and step S26 is executed;

[0024] If they are not equal, it means that the user's facial feature data has been leaked;

[0025] Step S26, using fuzzy commitment to recover key k' from the auxiliary data A(D)i submitted in step S25 and Hash(k) of the sugar template, and checking whether the hash value Hash(k') of the recovered key k' is equal to Hash(k) in the sugar template:

[0026] If they are equal, the face authentication is successful;

[0027] If they are not equal, face authentication fails.

[0028] Furthermore, the authentication process also includes:

[0029] Step S27, the result of face authentication success or face authentication failure is fed back to the user.

[0030] Furthermore, calculating the deviation between the auxiliary data A(D) to be authenticated and the auxiliary data A(D)i in the honeypot in step S24 refers to calculating the Hamming distance between the auxiliary data A(D) to be authenticated and the auxiliary data A(D)i in the honeypot.

[0031] The present invention also provides a secure face authentication system based on honeypot technology, the secure face authentication system comprising:

[0032] A client, the client is used to execute steps S11 to S14 of the registration phase and steps S21 to S22 of the authentication phase in the secure face authentication method based on honeypot technology described in claim 4;

[0033] The server is used to execute steps S15 to S17 of the registration phase and steps S23 to S26 of the authentication phase in the secure face authentication method based on honeypot technology described in claim 4.

[0034] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0035] The present invention first encrypts the facial features to provide revocability of the facial feature template while improving security, and then implements leakage detection of the facial feature template based on the honeypot technology. Once the leakage of the facial feature template is detected, the leaked facial feature template can be revoked and a new facial feature template can be regenerated, thereby greatly improving the security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0037] Figure 1 The figure is an overall flow chart of a secure face authentication method based on honeypot technology according to an embodiment of the present invention.

[0038] Figure 2a Flow chart of the registration phase of an embodiment of the present invention.

[0039] Figure 2b 4 is a system schematic diagram of the registration phase of an embodiment of the present invention.

[0040] Figure 3a Flow chart of the authentication phase of an embodiment of the present invention.

[0041] Figure 3b 4 is a system schematic diagram of the authentication phase of an embodiment of the present invention. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0043] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0044] Example

[0045] like Figure 1 As shown, this embodiment proposes a secure face authentication method based on honeypot technology, including:

[0046] (1) Registration phase: extract facial features and encrypt them into facial feature templates; first encrypt the facial features to provide revocability of the facial feature template while improving security;

[0047] (2) Authentication stage: Based on honeypot technology, encrypted facial feature templates are used for leakage detection and facial authentication is completed on the facial data to be authenticated. Based on honeypot technology, facial feature template leakage detection is implemented. Once the facial feature template leakage is detected, the leaked facial feature template can be revoked and a new facial feature template can be regenerated, which greatly improves the security of the system.

[0048] Specifically:

[0049] (1) Figure 2a , Figure 2b As shown, the execution process of the registration phase includes the following steps:

[0050] Step S11, collecting face data and extracting face features therefrom;

[0051] Step S12, generating a random matrix as a mapping matrix and storing it in the token, converting the mapping matrix into a vector and generating a key k with the same length as the facial features through error correction coding; wherein the elements in the generated random matrix obey Gaussian distribution;

[0052] Step S13, using the mapping matrix stored in the token, the facial features extracted in step S11 are mapped and encrypted into a facial feature template B through a random orthogonal matrix; if the user needs to change the facial feature template, only a new random matrix needs to be generated and then steps S12 to S13 are executed;

[0053] Step S14, define the deviation between the face feature template B and the key k as auxiliary data A(D), give a fuzzy commitment {A(D), Hash(k)} and input it into the honeypot system, that is, generate a sugar template;

[0054] Step S15, (based on the face synthesis platform) randomly synthesize n-1 pseudo face data, and generate n-1 honey templates according to steps S11 to S14 for the n-1 pseudo face data;

[0055] Step S16, hide the sugar template into n-1 honey templates, and record the index L of the sugar template i ;

[0056] Step S17, storing the sugar template and the honey template in the template database, and storing the index of the sugar template and the user ID of the collected face data in the detection database.

[0057] At this point, the registration phase in the secure face authentication method is completed.

[0058] (2) Figure 3a , Figure 3b As shown in the figure, the execution process of the authentication phase includes the following steps:

[0059] Step S21, collecting face data to be authenticated and extracting face features from it;

[0060] Step S22, using the mapping matrix stored in the token during the registration phase, the facial features extracted in step S21 are mapped and encrypted into a facial feature template B' through a random orthogonal matrix, and the deviation between the facial feature template B' and the key k is calculated as the auxiliary data A(D) to be authenticated, and finally the auxiliary data A(D) to be authenticated is submitted to the honeypot system together with the user ID of the facial data to be authenticated;

[0061] Step S23, extracting the corresponding honeypot from the template database according to the user ID;

[0062] Step S24, calculate the deviation between the auxiliary data A(D) to be authenticated and the auxiliary data A(D)i extracted from the honeypot, find the one with the smallest deviation, and return the index index of the sugar template corresponding to the smallest deviation i ; Calculating the deviation between the auxiliary data A(D) to be authenticated and the auxiliary data A(D)i in the honeypot refers to calculating the Hamming distance between the auxiliary data A(D) to be authenticated and the auxiliary data A(D)i in the honeypot. The calculation method of the Hamming distance is a prior art and will not be described in detail here.

[0063] Step S25, searching the detection database for the index L of the sugar template corresponding to the user ID i , the index L i with index i To compare:

[0064] If they are equal, the first authentication is passed, the auxiliary data A(D)i and the Hash(k) of the sugar template are submitted and step S26 is executed;

[0065] If they are not equal, it means that someone has used the original face data calculated by the honey template to challenge the system, indicating that the user's facial feature data has been leaked;

[0066] Step S26, using fuzzy commitment to recover key k' from the auxiliary data A(D)i submitted in step S25 and Hash(k) of the sugar template, and checking whether the hash value Hash(k') of the recovered key k' is equal to Hash(k) in the sugar template:

[0067] If they are equal, the face authentication is successful and the next decision can be made;

[0068] If they are not equal, face authentication fails;

[0069] Step S27, the result of face authentication success or face authentication failure is fed back to the user.

[0070] At this point, the authentication phase in the secure face authentication method is completed.

[0071] like Figure 1 , Figure 2b , Figure 3b As shown, this embodiment also provides a secure face authentication system based on honeypot technology, and the secure face authentication system includes:

[0072] A client, the client is used to execute steps S11 to S14 of the registration phase and steps S21 to S22 of the authentication phase in the above-mentioned secure face authentication method based on honeypot technology;

[0073] The server is used to execute steps S15 to S17 of the registration phase and steps S23 to S26 of the authentication phase in the above-mentioned secure face authentication method based on honeypot technology.

[0074] The above-mentioned secure face authentication method and system based on honeypot technology realizes:

[0075] Firstly, the present invention encrypts the original facial features to achieve privacy protection while retaining the accuracy of the Hamming distance and the authentication results, and provides the revocability of the facial feature template. The encrypted facial feature template is fuzzily committed, which can improve the security of the system.

[0076] Secondly, the present invention uses honeypot technology to provide the system with attack detection capabilities, and makes the system security not only rely on computational complexity, but also resort to probability (i.e., information-theoretic security) to deal with crackable hash assumptions. Since the present invention has attack detection capabilities, even if the attacker obtains all the face feature templates in the honeypot, he only has one chance to challenge the system, because as long as he fails once, the system will detect it and take corresponding measures. Therefore, if there are N face feature templates in the system, there are The probability of detecting the leakage of facial feature template is low, which will seriously hinder the attacker from trying his luck to launch a camouflage attack.

[0077] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A secure face authentication method based on honeypot technology, characterized in that: include: (1) Registration phase: extracting facial features and encrypting them into facial feature templates; (2) Authentication phase: Based on honeypot technology, encrypted facial feature templates are used for leakage detection and facial authentication is completed using the authenticated facial data; The execution process of the registration phase includes the following steps: Step S11, collecting face data and extracting face features therefrom; Step S12, generating a random matrix as a mapping matrix and storing it in the token, converting the mapping matrix into a vector and generating a key k with the same length as the facial feature through error correction coding; Step S13, using the mapping matrix stored in the token, the facial features extracted in step S11 are mapped and encrypted into a facial feature template B through a random orthogonal matrix; Step S14, define the deviation between the face feature template B and the key k as auxiliary data A(D), give a fuzzy commitment {A(D), Hash(k)} and input it into the honeypot system, that is, generate a sugar template; Step S15, random synthesis n -1 pseudo face data, and generate n-1 pseudo face data according to steps S11 to S14 n - 1 honey template; Step S16, hide the sugar template to n -1 honey template, and record the index of the sugar template L i ; Step S17, storing the sugar template and the honey template in the template database, and storing the index of the sugar template and the user ID of the collected face data in the detection database; The execution process of the authentication phase includes the following steps: Step S21, collecting face data to be authenticated and extracting face features from it; Step S22, using the mapping matrix stored in the token during the registration phase, the facial features extracted in step S21 are mapped and encrypted into a facial feature template B' through a random orthogonal matrix, and the deviation between the facial feature template B' and the key k is calculated as the auxiliary data A(D) to be authenticated, and finally the auxiliary data A(D) to be authenticated is submitted to the honeypot system together with the user ID of the facial data to be authenticated; Step S23, extracting the corresponding honeypot from the template database according to the user ID; Step S24, calculate the deviation between the auxiliary data A(D) to be authenticated and the auxiliary data A(D)i extracted from the honeypot, find the one with the smallest deviation, and return the index index of the sugar template corresponding to the smallest deviation i ; Step S25, searching the detection database for the index of the sugar template corresponding to the user ID L i , the index L i with index i To compare: If they are equal, the first authentication is passed, the auxiliary data A(D)i and the Hash(k) of the sugar template are submitted and step S26 is executed; If they are not equal, it means that the user's facial feature data has been leaked; Step S26, using fuzzy commitment to recover key k' from the auxiliary data A(D)i submitted in step S25 and Hash(k) of the sugar template, and checking whether the hash value Hash(k') of the recovered key k' is equal to Hash(k) in the sugar template: If they are equal, the face authentication is successful; If they are not equal, face authentication fails.

2. The secure face authentication method based on honeypot technology according to claim 1, characterized in that: The elements in the random matrix generated in step S12 obey Gaussian distribution.

3. The secure face authentication method based on honeypot technology according to claim 1, characterized in that: The authentication process also includes: Step S27, the result of face authentication success or face authentication failure is fed back to the user.

4. The secure face authentication method based on honeypot technology according to claim 1 or 3, characterized in that: Calculating the deviation between the auxiliary data A(D) to be authenticated and the auxiliary data A(D)i in the honeypot in step S24 refers to calculating the Hamming distance between the auxiliary data A(D) to be authenticated and the auxiliary data A(D)i in the honeypot.

5. A secure face authentication system based on honeypot technology, characterized in that: The secure face authentication system comprises: A client, the client is used to execute steps S11 to S14 of the registration phase and steps S21 to S22 of the authentication phase in the secure face authentication method based on honeypot technology described in claim 1; The server is used to execute steps S15 to S17 of the registration phase and steps S23 to S26 of the authentication phase in the secure face authentication method based on honeypot technology described in claim 1.

Images