Multi-modal biometric identification method on card and integrated circuit card, storage medium

Abstract

The application provides a card multi-modal biometric identification method, an integrated circuit card and a computer readable storage medium. The method comprises the following steps: in response to a multi-modal biometric verification instruction, randomly determining a plurality of specified biometric templates and an identification order of the plurality of specified biometric templates from a plurality of available biometric templates; acquiring a biometric probe corresponding to each specified biometric template according to the identification order one by one, and comparing each specified biometric template with the corresponding biometric probe; the comparison operation corresponding to a subsequent specified biometric template in the identification order is performed after the comparison operation of a previous specified biometric template is passed; and when all the specified biometric templates and the biometric probe are compared and passed, it is determined that the identity feature recognition is passed. According to the application, the biometric templates used for identification each time are different, and the selected biometric templates each time are random, so that the difficulty of biometric forgery and counterfeiting is improved.

Description

Technical Field

[0001] This application relates to the field of identity feature recognition technology, and in particular to a multimodal biometric recognition method on a card, an integrated circuit card, and a computer-readable storage medium. Background Technology

[0002] Integrated Circuit Cards (IC Cards) with signature functionality, such as tax control IC cards and financial transaction IC cards, typically verify the user's identity using a PIN (Personal Identification Number) code to unlock the user's private information (such as private keys) within the IC card. Additionally, some IC cards based on biometric recognition technology can achieve more secure and convenient identity verification. However, PIN-based IC cards are vulnerable to PIN code leakage, while biometric-based IC cards face the risk of biometric features (such as fingerprints and facial images) being forged. Summary of the Invention

[0003] The purpose of this application is to provide a multimodal biometric identification method on a card, as well as an integrated circuit card and a computer-readable storage medium, which achieves highly secure identity feature identification.

[0004] On the one hand, this application provides a multimodal biometric identification method for cards, applied to integrated circuit cards, including:

[0005] In response to a multimodal biometric verification command, a plurality of specified biometric templates are randomly determined from a plurality of available biometric templates, and the recognition order of the plurality of specified biometric templates is determined.

[0006] According to the identification order, the biometric probes corresponding to each specified biometric template are obtained one by one, and each specified biometric template is compared with its corresponding biometric probe; wherein, the comparison operation of the later specified biometric template in the identification order is performed after the comparison of the previous specified biometric template is passed.

[0007] When all specified biometric templates and biometric probes pass the comparison, the identity recognition is confirmed to be successful.

[0008] In one embodiment, before the step of randomly determining a plurality of specified biometric templates from a plurality of available biometric templates in response to a multimodal biometric verification command, and the identification order of the plurality of specified biometric templates, the method further includes:

[0009] After establishing a trusted connection with the external system, obtain the master control key;

[0010] Obtain the feature parameters to be compared from the external system;

[0011] The encrypted master control feature parameters are decrypted locally using the master control key to obtain the master control feature parameters.

[0012] The comparison between the feature parameters to be compared and the master control feature parameters is performed. If the comparison passes, the multimodal biometric verification instruction is generated.

[0013] In one embodiment, before randomly determining a plurality of specified biometric templates from a plurality of available biometric templates, and the identification order of the plurality of specified biometric templates, the method further includes:

[0014] Check whether each registered biometric template has a corresponding biometric acquisition device;

[0015] If any registered biometric template has a corresponding biometric acquisition device, the registered biometric template is determined to be a usable biometric template.

[0016] In one embodiment, the step of randomly determining a plurality of specified biometric templates from a plurality of available biometric templates, and the identification order of the plurality of specified biometric templates, includes:

[0017] Generate a corresponding random number for each available biometric template;

[0018] Arrange the random numbers corresponding to multiple available biometric templates in ascending order, and select a specified number of random numbers based on the arrangement.

[0019] Select the available biometric template corresponding to the selected random number as the specified biometric template to obtain multiple specified biometric templates;

[0020] The order in which the random numbers corresponding to the multiple specified biometric templates are arranged is used as the recognition order.

[0021] In one embodiment, the step of sequentially acquiring the biometric probe corresponding to each specified biometric template according to the identification order, and comparing each specified biometric template with its corresponding biometric probe, includes:

[0022] Select the first specified biometric template in the recognition sequence as the target biometric template;

[0023] Based on the template key corresponding to the target biometric template, the encrypted target biometric template is decrypted to obtain the target biometric template;

[0024] Biometric probes are collected using a biometric acquisition device corresponding to the target biometric template.

[0025] The target biometric template is compared with its corresponding biometric probe;

[0026] If the comparison passes, the next specified biometric template in the identification sequence is selected as the target biometric template, and the step of decrypting the encrypted target biometric template according to the template key corresponding to the target biometric template to obtain the target biometric template is returned.

[0027] In one embodiment, after comparing the target biometric template with its corresponding biometric probe, the method further includes:

[0028] If the comparison fails, the biometric probe is collected again using the biometric acquisition device corresponding to the target biometric template;

[0029] The recognition process stops when the number of failed comparisons reaches a preset threshold.

[0030] In one embodiment, the method further includes:

[0031] After any specified biometric template passes the comparison with the biometric probe corresponding to the specified biometric template, the private key fragment corresponding to the specified biometric template is decrypted according to the private key fragment key corresponding to the specified biometric template to obtain the private key fragment corresponding to the specified biometric template.

[0032] Once the private key fragments corresponding to all specified biometric templates are obtained, the complete private key file is reconstructed from the multiple private key fragments.

[0033] The business process corresponding to the integrated circuit card is executed through the private key file.

[0034] In one embodiment, after determining a plurality of specified biometric templates from a plurality of available biometric templates, and the identification order of the plurality of specified biometric templates, the method further includes:

[0035] For the multiple specified biometric templates, establish a one-to-one association with multiple encrypted private key fragments.

[0036] On the other hand, this application provides an integrated circuit card, the integrated circuit card comprising:

[0037] processor;

[0038] Memory used to store processor-executable instructions;

[0039] The processor is configured to execute the on-card multimodal biometric recognition method described above.

[0040] Furthermore, this application provides a computer-readable storage medium storing a computer program that can be executed by a processor to perform the above-described on-card multimodal biometric identification method.

[0041] The proposed solution determines multiple designated biometric templates from multiple available biometric templates, as well as the recognition order of the multiple designated biometric templates. Then, it can obtain the biometric probes corresponding to the designated biometric templates one by one according to the recognition order, and compare each designated biometric template with its corresponding biometric probe. When all designated biometric templates and biometric probes pass the comparison, it can be determined that the identity feature recognition has been successful.

[0042] Because multiple specified biometric templates can be redefined in each identification process, and the biometric templates used in each identification are different and random, it makes it difficult for counterfeiters to easily determine the biometric probes they need to counterfeit, thus increasing the difficulty of biometric counterfeiting and forgery. Furthermore, the identification process compares the specified biometric templates and biometric probes one by one, and in the identification sequence, the next template is compared after the previous template has passed the comparison, which improves the security and reliability of identity feature identification. Attached Figure Description

[0043] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly described below.

[0044] Figure 1 A schematic diagram illustrating an application scenario of the on-card multimodal biometric recognition method provided in an embodiment of this application;

[0045] Figure 2 A schematic diagram of a biometric comparison process provided in an embodiment of this application;

[0046] Figure 3 A schematic diagram of a biometric comparison process provided in another embodiment of this application;

[0047] Figure 4 This is a schematic diagram of the structure of an integrated circuit card provided in an embodiment of this application;

[0048] Figure 5 A flowchart illustrating a card-based multimodal biometric identification method provided in an embodiment of this application;

[0049] Figure 6 A flowchart illustrating a method for generating multimodal biometric verification instructions according to an embodiment of this application;

[0050] Figure 7 Provided for an embodiment of this application Figure 5 A detailed flowchart of step 510 is shown below;

[0051] Figure 8 Provided for an embodiment of this application Figure 5 A detailed flowchart of step 520 is shown below;

[0052] Figure 9 A block diagram of an on-card multimodal biometric identification device provided in an embodiment of this application. Detailed Implementation

[0053] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0054] Similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0055] Figure 1 This is a schematic diagram illustrating an application scenario of the on-card multimodal biometric recognition method provided in this application embodiment. For example... Figure 1 As shown, the application scenario includes an IC card 20 and an external system 30. The external system 30 can be a business terminal, a card reader, etc., used to provide the IC card 20 with the feature parameters to be compared. After comparing the feature parameters to be compared, the IC card 20 performs biometric identification based on the various biometric probes it has collected.

[0056] Figure 2 This is a schematic diagram of a biometric comparison process provided in an embodiment of this application, as shown below. Figure 2As shown, after the IC card is connected to an external system, the external system can collect sample images (such as face images, fingerprint images, iris images, etc.) and extract biometric features from the sample images to form biometric probes. Here, biometric probes are numerical values ​​or markers (such as the coordinates and orientation of fingerprint endpoints) extracted from biometric samples (such as sample images) for comparison. The external system can transmit the biometric probes to the IC card, and the IC card can compare the biometric probes with a biometric template. Here, the biometric template is a collection of registered and stored biometric features that can be directly compared with the biometric probes. After the comparison, the IC card can make a decision, that is, decide whether to accept or reject the comparison result based on parameters, thresholds, and security policies. If the comparison result is accepted, the identity feature comparison is considered successful. At this time, the IC card can change the security state, thereby authorizing the program within the IC card to access the user's private files (such as private key files) within the IC card.

[0057] Figure 3 A schematic diagram of a biometric comparison process provided in another embodiment of this application is shown below. Figure 3 As shown, the collection, processing, storage, comparison, decision-making, and authorization of biometric samples are all completed on the IC card. In this case, biometric data does not need to be collected by an external system, thus avoiding the leakage of biometric data.

[0058] This application solution further enhances the security of the comparison method based on the two identity feature comparison methods mentioned above.

[0059] like Figure 4 As shown, this embodiment provides an integrated circuit card 1, including: at least one processor 11 and a memory 12. Figure 2 Taking a processor 11 as an example, the processor 11 and the memory 12 are connected via a bus 10. The memory 12 stores instructions that can be executed by the processor 11. The instructions are executed by the processor 11 to enable the integrated circuit card 1 to perform all or part of the process of the method in the following embodiments. In one embodiment, the integrated circuit card 1 may be the aforementioned IC card 20, used to execute the multimodal biometric identification method on the card.

[0060] The memory 12 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable red-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0061] This application also provides a computer-readable storage medium storing a computer program that can be executed by a processor 11 to perform the on-card multimodal biometric identification method provided in this application.

[0062] See Figure 5 This is a flowchart illustrating a card-based multimodal biometric identification method according to an embodiment of this application. Figure 5 As shown, the method may include the following steps 510-530.

[0063] Step 510: In response to the multimodal biometric verification command, randomly determine multiple specified biometric templates from multiple available biometric templates, and the recognition order of the multiple specified biometric templates.

[0064] The multimodal biometric verification instruction is used to indicate the entry into the multimodal biometric identification process to verify the user's identity.

[0065] Available biometric templates are local biometric templates that can be used in the identification process. Specified biometric templates are the biometric templates used in this identification process.

[0066] IC cards (integrated circuit cards) can respond to multimodal biometric verification commands, randomly select multiple designated biometric templates from multiple available local biometric templates for this identification process, and determine the identification order of the multiple designated biometric templates in this identification process.

[0067] For example, the IC card can randomly select some or all of the available biometric templates from multiple available biometric templates as designated biometric templates, and randomly determine the recognition order of each designated biometric template in the recognition process.

[0068] Step 520: Obtain the biometric probe corresponding to each specified biometric template one by one according to the recognition order, and compare each specified biometric template with its corresponding biometric probe; wherein, the comparison operation corresponding to the later specified biometric template in the recognition order is performed after the comparison of the previous specified biometric template is passed.

[0069] Step 530: When all specified biometric templates and biometric probes pass the comparison, the identity feature recognition is confirmed to be successful.

[0070] The IC card can sequentially acquire the biometric probes corresponding to each specified biometric template according to the recognition order, and compare each specified biometric template with its corresponding biometric probe. For example, there are three specified biometric templates: the biometric template corresponding to the thumb fingerprint, the biometric template corresponding to the face image, and the biometric template corresponding to the index finger fingerprint. The IC card can first acquire the biometric probe for the thumb fingerprint and compare it with the corresponding biometric template and the thumb fingerprint probe. If the comparison passes, it continues to acquire the biometric probe for the face image and compare it with the corresponding biometric template and the face image probe. If the comparison passes, it can continue to acquire the biometric probe for the index finger fingerprint and compare it with the corresponding biometric template and the index finger fingerprint probe. During the comparison process, if any specified biometric template fails to match the biometric probe, the comparison process can be terminated.

[0071] When all specified biometric templates and biometric probes pass the comparison, the identity recognition can be confirmed.

[0072] Through the above measures, in the process of multimodal biometric recognition on the card, after selecting multiple designated biometric templates for this recognition, the designated biometric templates and the corresponding biometric probes are compared one by one during the recognition process. After the previous designated biometric template is successfully compared, the next designated biometric template in the recognition sequence is compared, and so on, increasing the difficulty of biometric imitation and forgery and improving the security of identity recognition.

[0073] In one embodiment, see Figure 6 This is a flowchart illustrating a method for generating multimodal biometric verification instructions according to an embodiment of this application. Figure 6 As shown, the multimodal biometric verification command can be obtained through the following steps 610-640.

[0074] Step 610: After establishing a mutual trust connection with the external system, obtain the master control key.

[0075] IC cards can establish connections with external systems through a mutual trust mechanism. During the connection establishment process, one party—the IC card or the external system—generates a session key, encrypts it using their respective symmetric keys, and then transmits the encrypted session key to the other party. The receiving party can decrypt the encrypted session key using their symmetric key to obtain the actual session key. Subsequent data transmission between the IC card and the external system can then be encrypted using this session key.

[0076] Once the IC card establishes a trusted connection with an external system, it can confirm its access to the local master control key. This master control key is used to decrypt encrypted master control characteristic parameters.

[0077] Step 620: Obtain the feature parameters to be compared from the external system.

[0078] The feature parameters to be compared are obtained from an external system. Users submit these feature parameters through the external system to request basic access to the IC card. For example, the feature parameters to be compared can be a PIN code or a biometric probe. Users can directly enter a PIN code into the external system as the PIN code to be compared. Users can also submit sample images to the external system, from which the external system extracts biometric probes as the biometric probes to be compared.

[0079] IC cards can obtain the feature parameters to be compared from external systems.

[0080] Step 630: Decrypt the locally encrypted master control feature parameters using the master control key to obtain the master control feature parameters.

[0081] To prevent the leakage of master control feature parameters, the master control feature parameters are stored locally on the IC card after encryption. One or more encrypted master control feature parameters can be stored on the IC card. Here, the master control feature parameter can be a master control PIN code or a master control biometric template.

[0082] After obtaining the feature parameters to be compared, the IC card can gain access to the master control key. When the IC card stores multiple encrypted master control feature parameters, it can select the corresponding master control key based on the data type of the feature parameters to be compared, thereby decrypting and obtaining master control feature parameters of the same type as the feature parameters to be compared.

[0083] Step 640: Compare the comparison feature parameters and the master control feature parameters. If the comparison passes, determine the generation of multimodal biometric verification instructions.

[0084] After decrypting the master control feature parameters, the IC card can compare the feature parameters to be compared with the master control feature parameters to obtain their similarity. Based on a preset similarity threshold, it can determine whether the similarity meets the requirements. On one hand, if the similarity does not reach the threshold, the comparison fails, and no action is taken; alternatively, an external system can output a prompt indicating an error in the feature parameters to be compared. On the other hand, if the similarity reaches the threshold, the comparison passes, and a multimodal biometric verification command can be generated. After generating the multimodal biometric verification command, the user gains initial access to the IC card, allowing them to continue executing the identification process from steps 510 to 530.

[0085] Through the above measures, the external features and on-card features of the IC card can be processed and compared collaboratively, and after the comparison is successful, the card enters the multimodal biometric identification process.

[0086] In one embodiment, before performing step 510 above, the IC card can identify multiple available biometric templates. The IC card can check whether each registered biometric template has a corresponding biometric acquisition device. The registered biometric templates are locally stored biometric templates, and the IC card can identify each registered biometric template using a unique identifier. In this application, the identifier for a biometric template can be represented by a BID.

[0087] A biometric data acquisition device is used to collect biometric data. For example, the biometric data acquisition device on an IC card can be one or more combinations of a fingerprint sensor, a camera sensor, a microphone, etc.

[0088] For each registered biometric template, the IC card can determine whether a corresponding biometric acquisition device exists locally. The biometric acquisition device corresponding to the registered biometric template can collect biometric probes of the same type as the registered biometric template. For example, if the registered biometric template is a fingerprint, the IC card can determine whether a fingerprint sensor exists locally.

[0089] On the one hand, if no biometric acquisition device exists corresponding to the registered biometric template, it is impossible to acquire the same type of biometric probes. In this case, the registered biometric template cannot be used during the identification process. On the other hand, if a biometric acquisition device exists corresponding to the registered biometric template, it can acquire the same type of biometric probes. In this case, the registered biometric template can be used during the identification process, and the IC card can identify the registered biometric template as a usable biometric template.

[0090] In one embodiment, see Figure 7This is provided as an embodiment of the present application. Figure 5 A detailed flowchart of step 510 is shown below. Figure 7 As shown, step 510 may include steps 511-514.

[0091] Step 511: Generate a corresponding random number for each available biometric template.

[0092] The IC card can generate a corresponding random number for each available biometric template. For ease of processing, a random number can be selected from a preset value range (e.g., 1 to 100). The IC card can establish a relationship between the BID of the available biometric template and the random number, thereby recording the random number assigned to the available biometric template.

[0093] Step 512: Arrange the random numbers corresponding to multiple available biometric templates in ascending order, and select a specified number of random numbers based on the arrangement.

[0094] Step 513: Use the available biometric template corresponding to the selected random number as the specified biometric template to obtain multiple specified biometric templates.

[0095] Here, the specified quantity is the number of biometric templates required for one identification process, which can be a pre-configured empirical value.

[0096] The IC card arranges the random numbers corresponding to each available biometric template in ascending order, and then selects a specified number of random numbers based on the arrangement. For example, it can select the first specified number of random numbers in the arrangement (i.e., the smallest specified number); or it can select the last specified number of random numbers in the arrangement (i.e., the largest specified number); or it can select the middle specified number; or it can select the largest or smallest specified number of random numbers from odd or even positions. For example, if there are 7 available biometric templates and the specified number is 3, after sorting the 7 random numbers in ascending order, the first 3 random numbers are selected, which are the 3 smallest random numbers.

[0097] After selecting a random number, the available biometric template corresponding to each selected random number can be used as the specified biometric template to obtain a specified number of specified biometric templates.

[0098] Step 514: The order in which the random numbers corresponding to the multiple specified biometric templates are arranged is used as the recognition order.

[0099] After determining multiple specified biometric templates, the IC card can use the order of the random numbers corresponding to each specified biometric template as the recognition order for this recognition process. For example, if the specified biometric templates include the biometric template corresponding to the thumb fingerprint, the biometric template corresponding to the index finger fingerprint, and the biometric template corresponding to the face image, and the random numbers corresponding to the three are 9, 7, and 12 respectively, then the recognition order is: biometric template corresponding to the index finger fingerprint, biometric template corresponding to the thumb fingerprint, and biometric template corresponding to the face image.

[0100] Through the above measures, the designated biometric template can be randomly determined for each identification process, and the order in which each designated biometric template is used in the identification process can be randomly determined, thereby increasing the difficulty of biometric imitation and forgery and improving the security of identity recognition.

[0101] In one embodiment, see Figure 8 This is provided as an embodiment of the present application. Figure 5 A detailed flowchart of step 520 is shown below. Figure 8 As shown, step 520 may include steps 521-525.

[0102] Step 521: Select the first specified biometric template in the recognition sequence as the target biometric template.

[0103] When starting the identification process, the IC card can use the first designated biometric template in the identification sequence as the target biometric template. Here, the target biometric template is the biometric template currently used for the identification task.

[0104] Step 522: Decrypt the encrypted target biometric template using the template key corresponding to the target biometric template to obtain the target biometric template.

[0105] In this application, to prevent the leakage of biometric templates stored on the IC card, each biometric template can be encrypted separately, and the template keys used for each biometric template are different. Here, the template key is used to encrypt and decrypt the biometric template.

[0106] When an IC card needs to use a target biometric template, it has the authority to use the template key corresponding to the target biometric template, thereby decrypting the encrypted target biometric template with the template key and obtaining the target biometric template.

[0107] Step 523: Collect biometric probes using a biometric acquisition device corresponding to the target biometric template.

[0108] The IC card can collect biometric probes through a biometric acquisition device corresponding to the target biometric template. For example, if the target biometric template is the user's voiceprint feature, the IC card can collect biometric probes corresponding to the user's voice through a local microphone.

[0109] Step 524: Compare the target biometric template with its corresponding biometric probe.

[0110] The IC card can compare the target biometric template with the corresponding biometric probe.

[0111] After comparing the target biometric template and the biometric probe, the similarity between the two can be obtained. Based on the similarity threshold, it can be determined whether the similarity meets the requirements. On the one hand, if the similarity does not reach the similarity threshold, it can be determined that the comparison has failed. On the other hand, if the similarity reaches the similarity threshold, it can be determined that the comparison has passed, and the IC card can continue to step 525.

[0112] Step 525: If the comparison passes, select the next specified biometric template in the identification sequence as the target biometric template, and return to the step of decrypting the encrypted target biometric template according to the template key corresponding to the target biometric template to obtain the target biometric template.

[0113] After the target biometric template and its corresponding biometric probe pass the comparison, the IC card can select the next specified biometric template in the recognition sequence as the target biometric template and return to step 522. This process is repeated until all specified biometric templates indicated by the recognition sequence are recognized successfully, or until any specified biometric template in the recognition sequence fails to be recognized.

[0114] During the identification process, after the previous designated biometric template is successfully identified, the IC card can obtain the template key corresponding to the next designated biometric template, thereby unlocking the currently selected biometric template. For the first designated biometric template, since the IC card is capable of multimodal biometric identification, it can directly obtain the template key of the first designated biometric template to unlock it.

[0115] In one embodiment, during the multimodal biometric identification process, if the target biometric template fails to match its corresponding biometric probe, the IC card can re-acquire the biometric probe through the biometric acquisition device corresponding to the target biometric template. At this time, the IC card can output a prompt message through a local display screen or speaker, instructing the user to resubmit the biometric probe through the biometric acquisition device.

[0116] After the IC card re-collects the biometric probe, it can re-compare the biometric probe with the target biometric template.

[0117] The number of comparisons of a target biometric template can be limited by a preset threshold, which can be an empirical value (e.g., 3 times). Once the number of failed comparisons for the same target biometric template reaches the threshold, the IC card can stop the recognition process.

[0118] This measure allows for multiple comparisons during the comparison process, avoiding potential errors in feature acquisition during a single comparison. Furthermore, by limiting the number of comparisons for a single biometric feature, it reduces the risk of biometric features being massively forged for brute-force attacks.

[0119] In one embodiment, after determining multiple specified biometric templates and their identification order, the IC card can establish a one-to-one association between the multiple specified biometric templates and multiple encrypted private key fragments. Here, the private key fragment is the data used to assemble a complete private key file. The number of private key fragments is the same as the number of specified biometric templates. The IC card can associate each encrypted private key fragment with a specified biometric template, and the specified biometric templates associated with each private key fragment are different.

[0120] The IC card can establish a relationship between the BID of a specified biometric template and the KID of the corresponding private key fragment key, thereby recording the private key fragment assigned to each specified biometric template. Here, the private key fragment key is used to encrypt the private key fragment. Multiple private key fragments on the IC card are encrypted with different private key fragment keys and then stored separately, thereby reducing the risk of leakage of the complete private key file for subsequent business processes.

[0121] With this measure, when the identification process is executed subsequently, after each specified biometric template is successfully compared, the corresponding private key fragment can be obtained to decrypt and obtain the private key fragment corresponding to the specified biometric template.

[0122] In one embodiment, in the multimodal biometric identification process, after any designated biometric template passes the comparison with the biometric probe corresponding to the designated biometric template, the IC card can obtain the access permission to use the private key fragment key corresponding to the designated biometric template, thereby decrypting the encrypted private key fragment with the private key fragment key to obtain the private key fragment corresponding to the designated biometric template.

[0123] After obtaining the private key fragments corresponding to all specified biometric templates, the IC card can combine multiple private key fragments to reconstruct the complete private key file. Once all specified biometric templates have been successfully compared, the multimodal biometric identification is considered successful; in other words, the user's identity is confirmed, and they can use the complete private key file on the IC card to execute subsequent business processes.

[0124] After obtaining the complete private key file, the IC card can execute its corresponding business process using the private key file. The IC card can perform operations such as signing and encryption / decryption using the private key file, thereby executing IC card transaction business processes, such as transfers, withdrawals, and payments.

[0125] Through the above measures, multiple private key fragments constituting the private key file are stored separately and encrypted using their respective private key fragment keys, thus improving the storage security of the private key file. Furthermore, to execute business processes on the IC card, multi-level biometric verification is required. After successful verification, the corresponding private key fragment key is obtained to decrypt the private key fragment, thereby reconstructing the complete private key file from multiple fragments. At this point, access to the private key file is granted. In this scenario, the security of IC card services is greatly enhanced.

[0126] The following example illustrates the complete process. In this example, the complete private key file is divided into three encrypted private key fragments and stored separately. When the IC card communicates with an external system, one party generates a session key, which is then encrypted using the inter-system authentication key and sent to the other party. Subsequent communication data is encrypted and decrypted using the session key.

[0127] External systems (such as card readers) can capture facial images and generate facial feature probes, which are then sent to the IC card as feature parameters to be compared.

[0128] After receiving the facial feature probe, the IC card decrypts the locally encrypted facial feature template using the master control key and compares the facial feature probe with the facial feature template. In one scenario, if the comparison fails and the number of comparisons reaches a threshold, the recognition process can be terminated. In another scenario, if the comparison succeeds, the IC card can proceed with the multimodal biometric recognition process.

[0129] The IC card can check whether each registered biometric template has a corresponding biometric acquisition device. When any registered biometric template has a corresponding biometric acquisition device, it is used as a usable biometric template, thus obtaining multiple usable biometric templates.

[0130] The IC card assigns a random number to each available biometric template. After arranging multiple random numbers, the three smallest are selected, and the available biometric template corresponding to the selected random number is used as the designated biometric template. The order in which the random numbers corresponding to the designated biometric templates are arranged determines the order in which each designated biometric template is used in the recognition process. The designated biometric templates, arranged in recognition order, are: first fingerprint template, second fingerprint template, and face feature template.

[0131] The IC card decrypts the encrypted first fingerprint template using the template key of the first fingerprint template, obtaining the first fingerprint template. The IC card compares the first fingerprint template with the first fingerprint feature probe; if the comparison is successful, it obtains the private key fragment key corresponding to the first fingerprint template, and then uses this private key fragment key to decrypt and obtain the first private key fragment. Additionally, the IC card can obtain access to the template key of the second fingerprint template.

[0132] The IC card can decrypt the encrypted second fingerprint template using the template key of the second fingerprint template to obtain the second fingerprint template. The IC card compares the second fingerprint template with the second fingerprint feature probe; if the comparison is successful, it can obtain the private key fragment key corresponding to the second fingerprint template, and then use this private key fragment key to decrypt and obtain the second private key fragment. Additionally, the IC card can obtain access to the template key of the facial feature template.

[0133] The IC card can decrypt the encrypted facial feature template using the template key to obtain the facial feature template. The IC card compares the facial feature template with the facial feature probe. If the comparison is successful, it can obtain the private key fragment key corresponding to the facial feature template, and then use this private key fragment key to decrypt and obtain the third private key fragment.

[0134] The IC card can be reconstructed by merging the first, second, and third private key fragments. The IC card can then use this private key file to execute its corresponding business processes.

[0135] Figure 9 This is a block diagram of an on-card multimodal biometric identification device according to an embodiment of the present invention, such as... Figure 9 As shown, the device may include:

[0136] The first determining module 910 is configured to, in response to a multimodal biometric verification command, randomly determine a plurality of specified biometric templates from a plurality of available biometric templates, and the recognition order of the plurality of specified biometric templates;

[0137] The comparison module 920 is used to acquire the biometric probes corresponding to each specified biometric template according to the recognition order, and compare each specified biometric template with its corresponding biometric probe; wherein, the comparison operation of the later specified biometric template in the recognition order is performed after the previous specified biometric template has passed the comparison.

[0138] The second determining module 930 is used to determine that the identity feature recognition has passed when all specified biometric templates and biometric probes have passed the comparison.

[0139] The specific implementation process of the functions and roles of each module in the above-mentioned device can be found in the implementation process of the corresponding steps in the above-mentioned card-based multimodal biometric recognition method, and will not be repeated here.

[0140] The apparatuses and methods disclosed in the several embodiments provided in this application can also be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatuses, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0141] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0142] If a function is implemented as a software module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

Claims

1. A multimodal biometric identification method for cards, applied to integrated circuit cards, characterized in that, include: In response to a multimodal biometric verification command, a plurality of specified biometric templates are randomly selected from a plurality of available biometric templates, and the recognition order of the plurality of specified biometric templates is randomly determined; According to the identification order, the biometric probes corresponding to each specified biometric template are obtained one by one, and each specified biometric template is compared with its corresponding biometric probe; wherein, the comparison operation of the later specified biometric template in the identification order is performed after the comparison of the previous specified biometric template is passed. When all specified biometric templates and biometric probes pass the comparison, the identity recognition is confirmed to be successful. The method further includes, prior to the steps of randomly determining multiple specified biometric templates from multiple available biometric templates in response to a multimodal biometric verification command, and randomly determining the recognition order of the multiple specified biometric templates: After establishing a trusted connection with the external system, the master control key is obtained based on the data type of the feature parameters to be compared. Obtain the feature parameters to be compared from the external system; The encrypted master control feature parameters are decrypted locally using the master control key to obtain the master control feature parameters. The comparison between the feature parameters to be compared and the main control feature parameters is performed. If the comparison passes, the multimodal biometric verification instruction is generated. The method further includes: After any specified biometric template passes the comparison with the biometric probe corresponding to the specified biometric template, the private key fragment corresponding to the specified biometric template is decrypted according to the private key fragment key corresponding to the specified biometric template to obtain the private key fragment corresponding to the specified biometric template. Once the private key fragments corresponding to all specified biometric templates are obtained, the complete private key file is reconstructed from the multiple private key fragments. The business process corresponding to the integrated circuit card is executed through the private key file; The private key fragments that make up the private key file are stored separately.

2. The method according to claim 1, characterized in that, Before randomly determining multiple specified biometric templates from multiple available biometric templates, and before randomly determining the recognition order of the multiple specified biometric templates, the method further includes: Check whether each registered biometric template has a corresponding biometric acquisition device; If any registered biometric template has a corresponding biometric acquisition device, the registered biometric template is determined to be a usable biometric template.

3. The method according to claim 1, characterized in that, The step of randomly determining multiple specified biometric templates from multiple available biometric templates, and randomly determining the recognition order of the multiple specified biometric templates, includes: Generate a corresponding random number for each available biometric template; Arrange the random numbers corresponding to multiple available biometric templates in ascending order, and select a specified number of random numbers based on the arrangement. Select the available biometric template corresponding to the selected random number as the specified biometric template to obtain multiple specified biometric templates; The order in which the random numbers corresponding to the multiple specified biometric templates are arranged is used as the recognition order.

4. The method according to claim 1, characterized in that, The step of acquiring the biometric probe corresponding to each specified biometric template one by one according to the identification order, and comparing each specified biometric template with its corresponding biometric probe, includes: Select the first specified biometric template in the recognition sequence as the target biometric template; Based on the template key corresponding to the target biometric template, the encrypted target biometric template is decrypted to obtain the target biometric template; Biometric probes are collected using a biometric acquisition device corresponding to the target biometric template. The target biometric template is compared with its corresponding biometric probe; If the comparison passes, the next specified biometric template in the identification sequence is selected as the target biometric template, and the step of decrypting the encrypted target biometric template according to the template key corresponding to the target biometric template to obtain the target biometric template is returned.

5. The method according to claim 4, characterized in that, After comparing the target biometric template with its corresponding biometric probe, the method further includes: If the comparison fails, the biometric probe is collected again using the biometric acquisition device corresponding to the target biometric template; The recognition process stops when the number of failed comparisons reaches a preset threshold.

6. The method according to claim 1, characterized in that, After determining multiple specified biometric templates from multiple available biometric templates, and the identification order of the multiple specified biometric templates, the method further includes: For the multiple specified biometric templates, establish a one-to-one association with multiple encrypted private key fragments.

7. An integrated circuit card, characterized in that, The integrated circuit card includes: processor; Memory used to store processor-executable instructions; The processor is configured to execute the on-card multimodal biometric identification method according to any one of claims 1-6.

8. A computer-readable storage medium, characterized in that, The storage medium stores a computer program that can be executed by a processor to perform the on-card multimodal biometric identification method according to any one of claims 1-6.

Images