A secure hash generation method against similarity attacks based on generative adversarial networks

Abstract

The present invention discloses a secure hash generation method based on a generative adversarial network that is resistant to similarity attacks, including: 1) scaling the biometric images of registered users and dividing the biometric image training set and the biometric image test set; 2) extracting the corresponding biometric feature vector using a feature extractor, and constructing an ideal secure hash code according to the label of the biometric image, which together constitute a biometric feature data set; 3) constructing a generative adversarial network, training the generative adversarial network until the network converges, and obtaining a hash code generator; 4) generating a secure hash code that is resistant to similarity attacks and has a high recognition accuracy corresponding to the biometric images of the test set. The present invention combines the essential mechanism of similarity attacks, builds a generative adversarial network to learn and obtain a hash code generator that is resistant to similarity attacks, and at the same time ensures the high accuracy of biometric recognition and a strong ability to resist similarity attacks, providing a good solution for privacy-protected biometric recognition applications.

Description

Technical Field

[0001] The present invention relates to the technical field of multimedia processing, and in particular to a secure hash generation method based on a generative adversarial network that is resistant to similarity attacks. Background Art

[0002] Biometrics has become one of the most widely used technologies in authentication systems. With the development and promotion of cloud technology, more and more biometric systems use database outsourcing to efficiently store large-scale image databases. Due to the uniqueness and persistence of biometric data (such as iris and face images), once leaked, attackers can easily access user devices, sensitive files, and finances. Therefore, protecting biometric data is particularly urgent, and privacy-protecting biometrics has emerged.

[0003] In order to accurately complete the biometric identification task without leaking private data, privacy-preserving biometric identification needs to balance accuracy, security, and efficiency. A direct approach to privacy-preserving biometric identification is standard encryption, such as MD5 and SHA-3. However, due to the avalanche effect of standard encryption, it must be decrypted before the comparison of biometric data, thereby exposing the biometric data. In order to avoid decryption before comparison, another possible encryption method to protect biometric data is homomorphic encryption. By encrypting the biometrics using homomorphic encryption technology, the biometric identification task can be completed in the ciphertext, but this process requires high computational and communication overhead. In addition to encryption methods, another privacy-preserving biometric identification method is an encoding-based method that maps the input space to the encoding space. Among them, the binary hashing method maps the high-dimensional real-valued input biometric data into a compact binary hash code. Since it is difficult to guess the input biometric data from a relatively low-dimensional binary hash code, the binary hashing method is considered to be an irreversible and secure conversion method. In addition, due to the fast similarity calculation and comparison in the Hamming space, the hashing method has been widely used in privacy-preserving biometric identification.

[0004] Existing hashing methods can be roughly divided into data-independent and data-dependent hashing methods. Data-independent hashing methods usually generate hash functions based on random matrices to maintain the distance relationship between the input space and the hash space. Data-dependent hashing methods, also known as learning-based hashing methods, use training data to learn hash functions. The goal of the learned hash functions is to generate hash codes that maintain the similarity relationship between the hash space and the high-dimensional input space. However, this property of maintaining similarity relationships brings the risk of exposing biometric data. In recent years, attacks that use this property of maintaining similarity relationships to reconstruct input biometric data have emerged in an endless stream, and these reconstructed biometric data can be successfully identified as target objects by biometric recognition systems. This attack is called a "similarity attack" (or "known sample attack"). This similarity attack poses a serious security threat to existing biometric recognition systems. Obviously, it is very urgent and important to design a hashing method to solve the security risks brought about by the similarity-maintaining property, but so far, few hashing methods have taken this security issue into consideration. Summary of the invention

[0005] The purpose of the present invention is to overcome the shortcomings and deficiencies of the prior art, and proposes a secure hash generation method that is resistant to similarity attacks based on a generative adversarial network. The method can combine the essential mechanism of similarity attacks, parse the proposed hash coding model into a learning objective that can be optimized by a deep network, and build a hash code generator that is resistant to similarity attacks through generative adversarial network learning. The present invention can simultaneously ensure the high accuracy of biometric recognition and strong resistance to similarity attacks, and provide a good solution for privacy-protected biometric recognition applications.

[0006] To achieve the above object, the technical solution provided by the present invention is: a secure hash generation method based on a generative adversarial network that is resistant to similarity attacks, comprising the following steps:

[0007] 1) Scaling the biological images of registered users and dividing them into biological image training set and biological image test set;

[0008] 2) Use a feature extractor to extract the corresponding biometric vectors from the biological image training set, and construct an ideal secure hash code based on its label to form a biometric dataset;

[0009] 3) Construct a generative adversarial network and train it using a biometric dataset until the network converges to obtain a hash code generator for generating secure hash codes that are resistant to similarity attacks and have high recognition accuracy;

[0010] 4) Use a feature extractor to extract biometric feature vectors from the biometric images in the biometric image test set, and input the biometric feature vectors into the trained hash code generator to generate corresponding secure hash codes that are resistant to similarity attacks and have high recognition accuracy.

[0011] Further, in step 1), the biological images of the registered users are scaled to image pixels suitable for the input size of the neural network, and then 70% of the scaled biological images of each registered user are divided into a biological image training set, and the remaining 30% of the scaled biological images are divided into a biological image test set, wherein the biological image training set refers to a data set for network training consisting of the biological images of the registered users and their corresponding category labels, i.e., which user they belong to, and is expressed as:

[0012] D biometric ={(o i ,c i )|i∈1,2,3,...,N;c i ∈1,2,3,...,C}

[0013] Where D biometric represents the biological image training set, o i refers to the i-th biological image, c i It means o i It belongs to c i There are C registered users in total, and N biological images in the biological image training set.

[0014] Furthermore, in step 2), the feature extractor f(·) is a neural network based on the ResNet network structure, and the ResNet network has been pre-trained on the ImageNet dataset, and its input is o i , the output is the corresponding feature vector, expressed as:

[0015] x i =f(o i ),i∈1,2,3,...,N

[0016] In the formula, o i refers to the i-th biological image in the biological image training set, x i It means o i The corresponding eigenvector, refers to the real number threshold, m refers to the dimension of the feature vector, which is a positive integer greater than 0; input o1, o2, ..., o in the feature extractor in sequence. N There are N biological images in total, and N biological feature vector data sets X = {x i |i∈1,2,3,...,N};

[0017] An ideal secure hash code refers to a secure hash code tag that takes into account both the ability to resist similarity attacks and high recognition accuracy. Its construction includes the following steps:

[0018] 2.1) Randomly generate C different random seeds, which together form a random seed set K, expressed as:

[0019] K={k j |j∈1,2,3,...,C}

[0020] In the formula, k j represents the jth random seed, C is the number of registered users;

[0021] 2.2) Use the biological image training set D in turn biometric The label of each sample in generates the corresponding ideal secure hash code, which is expressed as:

[0022]

[0023] In the formula, It is a biological image. i The n-dimensional ideal secure hash code, c i It means o i It belongs to c i Biometric images of registered users, Indicates the c i random seeds, Random(·) is a one-to-one random function that generates an n-dimensional random vector from a random seed, and sign(·) is a sign function; thus, an ideal secure hash code dataset consisting of N ideal secure hash codes is obtained. Furthermore, the biometric vector dataset X is Together they form a biometric dataset

[0024] Furthermore, in step 3), the hash code generator G(·) is composed of several layers of fully connected layers plus tanh(·), where the input of the first fully connected layer is composed of m neurons, and the output of the last fully connected layer is composed of n neurons. Tanh(·) is a hyperbolic tangent function, which is defined as:

[0025]

[0026] Where a is an arbitrary real number. The discriminator D(·) consists of several layers of fully connected layers plus sigmoid(·). The input of the first fully connected layer consists of n neurons, and the output of the last fully connected layer consists of 1 neuron. Sigmoid(·) is the Sigmoid function, which is defined as:

[0027]

[0028] Where b is an arbitrary real number, G(·) and D(·) together constitute the generative adversarial network ASAH-GAN. The training of ASAH-GAN includes the following steps:

[0029] 3.1) Initialize the ASAH-GAN network parameters, including the network parameters θ of the hash code generator G and the network parameters θ of the discriminator D , then use the biometric dataset D feature Train the generative adversarial network and initialize the number of iterations e = 1;

[0030] 3.2) Determine whether e≤E is satisfied, where E is the number of times the entire data set needs to be repeatedly trained, that is, the number of epochs. If the condition is not met, end the iteration and go to step 3.7), otherwise continue to the next step;

[0031] 3.3) From the biometric dataset D feature Randomly select B biological feature vectors that have not been trained in the e-th iteration and the corresponding ideal secure hash code Where X is the biometric vector dataset, For an ideal secure hash code dataset, if the number of untrained biometric feature vectors is less than B, go to step 3.6), otherwise continue to the next step;

[0032] 3.4) Fix the hash code generator and optimize the adversarial loss function L adv :

[0033]

[0034] In the formula, x (k) is the kth biological feature vector sampled in this round of training, For x (k) The ideal secure hash code of ; through back propagation, the discriminator network parameters θ are updated based on the adaptive moment estimation (ADAM) update rule D ;

[0035] 3.5) Fix the discriminator and optimize the generator loss function L G :

[0036]

[0037] Where, L Feature is the feature matching loss, L Content is the content loss, λ is the regularization parameter and refers to the real threshold, where the feature matching loss L Featureis defined as:

[0038]

[0039] Where Φ(·) is the output of the penultimate fully connected layer in the discriminator. is the two-norm, content loss L Content is defined as:

[0040]

[0041] Through back-propagation, the hash code generator network parameters θ are updated based on the adaptive moment estimation (ADAM) update rule G ;

[0042] 3.6) Update the number of iterations e = e + 1;

[0043] 3.7) Save the network parameters as θ G The hash code generator G(·) of .

[0044] Furthermore, in step 4), for any biological image o in the biological image test set, its corresponding n-dimensional secure hash code y that is resistant to similarity attacks and has high recognition accuracy is generated, and the process is expressed as:

[0045] y=sign(G(f(o)))

[0046] Where f(·) is the feature extractor, G(·) is the hash code generator, and sign(·) is the sign function.

[0047] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0048] 1. The present invention proposes for the first time to use a random generation method to generate an ideal and secure hash code distribution, and adopts a generative adversarial network to learn a hash code generator that can generate a hash code distribution that is close to the ideal and secure hash code distribution, thus avoiding the dilemma that other privacy-preserving biometric recognition methods are difficult to strike a balance between accuracy, security and efficiency.

[0049] 2. Compared with other hash generation methods, the present invention improves the ability to resist similarity attacks and recognition accuracy.

[0050] 3. The method of the present invention is easy to implement and can be further expanded into a revocable biological template protection system, while satisfying revocability, high verification performance, irreversibility and unlinkability. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 The figure is a logical flow diagram of the method of the present invention.

[0052] Figure 2This is a network architecture diagram of the method of the present invention. DETAILED DESCRIPTION

[0053] The present invention is further described in detail below in conjunction with embodiments and drawings, but the embodiments of the present invention are not limited thereto.

[0054] See also Figure 1 and Figure 2 As shown, this embodiment provides a secure hash generation method based on a generative adversarial network that is resistant to similarity attacks, which includes the following steps:

[0055] 1) The biological images of registered users are divided into biological image training set and biological image test set, as follows:

[0056] The dataset selected in this example is the CASIA-Iris-Interval iris dataset of the Chinese Academy of Sciences. The dataset includes 2639 iris images of 320×280 (indicates that the image is 320 pixels long and 280 pixels wide) of 249 users. The images in the dataset are scaled to 224×224. Then, 70% of the iris images of these 249 users are randomly selected, totaling 1847 iris images, as the biological image training set, and the remaining 30% of the iris images of each user, totaling 792 iris images, as the biological image test set. The biological image training set refers to a dataset for network training consisting of registered users' biological images and their corresponding category labels (i.e., which user they belong to), expressed as:

[0057] D biometric ={(o i ,c i )|i∈1,2,3,...,1847;c i ∈1,2,3,...,249}

[0058] Among them, D biometric represents the biological image training set, o i refers to the i-th 224×224 biological image, c i It means o i It belongs to c i There are 249 registered users in total, and 1847 iris images in the biological image training set.

[0059] 2) Use the feature extractor to extract the corresponding biometric vectors from the biological image training set divided in step 1), and construct an ideal security hash code based on its label. The biometric vectors and the ideal security hash code together constitute the biometric dataset, which is as follows:

[0060] The feature extractor f(·) is a convolutional neural network of ResNet101 without the last fully connected layer and softmax layer, and the ResNet101 network is pre-trained on the ImageNet dataset, with the input being an image of size 224×224 o i , the output is a 2048-dimensional feature vector, expressed as:

[0061] x i =f(o i ),i∈1,2,3,...,1847

[0062] In the formula, o i refers to the i-th 224×224 biological image in the biological image training set, x i It means o i The corresponding 1024-dimensional feature vector, It refers to the real number threshold, which is a positive integer greater than 0. Input o1, o2, ..., o in the feature extractor in sequence. 1847 There are 1847 biological images in total, and 1847 biological feature vector datasets X = {x i |i∈1,2,3,...,1847}.

[0063] An ideal secure hash code refers to a secure hash code tag that takes into account both the ability to resist similarity attacks and high recognition accuracy. Its construction includes the following steps:

[0064] 2.1) Randomly generate 249 different random seeds. These 249 random seeds together constitute a random seed set, expressed as:

[0065] K={k j |j∈1,2,3,...,249}

[0066] In the formula, k j represents the jth random seed, 249 is the number of registered users;

[0067] 2.2) Use the biological image training set D biometric The label of each sample in generates the corresponding ideal secure hash code, which is expressed as:

[0068]

[0069] In the formula, It is a biological image i The 256-dimensional ideal secure hash code, c i It means o i It belongs to c i Biometric images of registered users, Indicates the c iRandom seeds, Random(·) is a one-to-one random function that generates a 256-dimensional random vector from a random seed, and sign(·) is a sign function. So far, we can get an ideal secure hash code dataset consisting of 1847 ideal secure hash codes. Furthermore, the biometric vector dataset X is Together they form a biometric dataset

[0070] 3) Construct a generative adversarial network and train the generative adversarial network using the biometric dataset obtained in step 2) until the network converges to obtain a hash code generator for generating a biometric hash code that is resistant to similarity attacks and has high recognition accuracy. Figure 2 As shown, it consists of a hash code generator and a discriminator, the details are as follows:

[0071] The hash code generator G(·) consists of 4 fully connected layers plus tanh(·). In the network consisting of 4 fully connected layers, the first to third fully connected layers are composed of linear layers with 2048 neurons in input and output, batch normalization layers (BatchNormalization) and rectified linear units (Leaky-ReLU). The fourth fully connected layer is composed of a linear layer with 2048 neurons in input and 256 neurons in output. Tanh(·) is a hyperbolic tangent function, which is defined as:

[0072]

[0073] Where a is an arbitrary real number. The discriminator D(·) consists of three fully connected layers plus sigmoid(·). In the network consisting of three fully connected layers, the first and second fully connected layers are both composed of a linear layer with 256 neurons in input and output, a batch normalization layer (Batch Normalization) and a rectified linear unit (Leaky-ReLU). The last fully connected layer is composed of a linear layer with 256 neurons in input and 1 neuron in output. Sigmoid(·) is the Sigmoid function, which is defined as:

[0074]

[0075] Where b is an arbitrary real number, G(·) and D(·) together constitute the generative adversarial network ASAH-GAN. The training of ASAH-GAN includes the following steps:

[0076] 3.1) Initialize the ASAH-GAN network parameters, including the network parameters θ of the hash code generator G and the network parameters θ of the discriminator D,Then use the biometric dataset to train the generative adversarial network, and initialize the number of iterations e = 1;

[0077] 3.2) Determine whether e≤E is satisfied, where E is the number of times the entire data set needs to be repeatedly trained (i.e., the number of epochs). In this embodiment, E=40. If the condition is not satisfied, end the iteration and go to step 3.7), otherwise proceed to the next step;

[0078] 3.3) From the biometric dataset D feature Randomly select B biological feature vectors that have not been trained in the e-th iteration and the corresponding ideal secure hash code In this embodiment, B=128. If the number of untrained biometric feature vectors is less than 128, go to step 3.6), otherwise proceed to the next step;

[0079] 3.4) Fix the hash code generator and optimize the adversarial loss function L adv :

[0080]

[0081] In the formula, x (k) is the kth biological feature vector sampled in this round of training, For x (k) The ideal secure hash code; through back propagation, the discriminator network parameters θ are updated based on the adaptive moment estimation (ADAM) update rule with a learning rate of 0.001 in this embodiment D ;

[0082] 3.5) Fix the discriminator and optimize the generator loss function:

[0083]

[0084] Where, L Feature is the feature matching loss, L Content is the content loss, λ is the regularization parameter, and in this embodiment, λ=1 is set to balance the feature matching loss and the content loss, where the feature matching loss L Feature is defined as:

[0085]

[0086] Where Φ(·) is the 256-dimensional discriminator feature output by the penultimate fully connected layer in the discriminator. is the two-norm, content loss L Content is defined as:

[0087]

[0088] Through back-propagation, the hash code generator network parameters θ are updated based on the adaptive moment estimation (ADAM) update rule with a learning rate of 0.001 G ;

[0089] 3.6) Update the number of iterations e = e + 1;

[0090] 3.7) Save the network parameters as θ G The hash code generator G(·) of .

[0091] 4) Use the feature extractor to extract 2048-dimensional biometric feature vectors from the 792 224×224 iris images in the biometric image test set divided in step 1), and then input the biometric feature vectors into the trained hash code generator to generate the corresponding 792 256-dimensional secure hash codes y that are resistant to similarity attacks and have high recognition accuracy. The process is expressed as:

[0092] y=sign(G(f(o)))

[0093] Where f(·) is the feature extractor, G(·) is the hash code generator, and sign(·) is the sign function.

[0094] Experimental results:

[0095] In this example, in the CASIA-Iris-Interval dataset, the equal error rate (the smaller the error, the more accurate the identification) of the generated 256-bit hash code recognition is only 2.52%, which is 13.08% lower than the equal error rate of the Biohash method commonly used in industry; the Pearson coefficient between the inter-class biometric features and their hash codes (the smaller the error, the stronger the ability to resist similarity attacks) is only 0.22, which is 0.49 lower than Biohash.

[0096] In summary, the present invention can simultaneously ensure high accuracy of biometric recognition and strong resistance to similarity attacks, provide a good solution for privacy-preserving biometric recognition applications, achieve good results on iris datasets, and is worthy of promotion.

[0097] The above embodiments are preferred implementation modes of the present invention, but the implementation modes of the present invention are not limited to the above embodiments. Any other changes, modifications, substitutions, combinations, and simplifications that do not deviate from the spirit and principles of the present invention should be equivalent replacement methods and are included in the protection scope of the present invention.

Claims

1. A secure hash generation method based on a generative adversarial network that is resistant to similarity attacks, characterized in that: The following steps are involved: 1) Scaling the biological images of registered users and dividing them into biological image training set and biological image test set; 2) Use a feature extractor to extract the corresponding biometric vectors from the biological image training set, and construct an ideal secure hash code based on its label to form a biometric dataset; The feature extractor f(·) is a neural network based on the ResNet network structure, and the ResNet network has been pre-trained on the ImageNet dataset. Its input is o i , the output is the corresponding feature vector, expressed as: x i =f(o i ),i∈1,2,3,...,N In the formula, o i refers to the i-th biological image in the biological image training set, x i It means o i The corresponding eigenvector, refers to the real number threshold, m refers to the dimension of the feature vector, which is a positive integer greater than 0; input o1, o2, ..., o in the feature extractor in sequence. N There are N biological images in total, and N biological feature vector data sets X = {x i |i∈1,2,3,...,N}; An ideal secure hash code refers to a secure hash code tag that takes into account both the ability to resist similarity attacks and high recognition accuracy. Its construction includes the following steps: 2.1) Randomly generate C different random seeds, which together form a random seed set K, expressed as: K={k j |j∈1,2,3,...,C} In the formula, k j represents the jth random seed, C is the number of registered users; 2.2) Use the biological image training set D biometric The label of each sample in generates the corresponding ideal secure hash code, which is expressed as: In the formula, It is a biological image i The n-dimensional ideal secure hash code, c i It means o i It belongs to c i Biometric images of registered users, Indicates the c i random seeds, Random(·) is a one-to-one random function that generates an n-dimensional random vector from a random seed, and sign(·) is a sign function; thus, an ideal secure hash code dataset consisting of N ideal secure hash codes is obtained. Furthermore, the biometric vector dataset X is Together they form a biometric dataset 3) Construct a generative adversarial network and train it using a biometric dataset until the network converges to obtain a hash code generator for generating secure hash codes that are resistant to similarity attacks and have high recognition accuracy; The hash code generator G(·) consists of several layers of fully connected layers plus tanh(·), where the input of the first fully connected layer consists of m neurons, and the output of the last fully connected layer consists of n neurons. Tanh(·) is a hyperbolic tangent function, which is defined as: Where a is an arbitrary real number. The discriminator D(·) consists of several layers of fully connected layers plus sigmoid(·). The input of the first fully connected layer consists of n neurons, and the output of the last fully connected layer consists of 1 neuron. Sigmoid(·) is the Sigmoid function, which is defined as: Where b is an arbitrary real number, G(·) and D(·) together constitute the generative adversarial network ASAH-GAN. The training of ASAH-GAN includes the following steps: 3.1) Initialize the ASAH-GAN network parameters, including the network parameters θ of the hash code generator G and the network parameters θ of the discriminator D , then use the biometric dataset D feature Train the generative adversarial network and initialize the number of iterations e = 1; 3.2) Determine whether e≤E is satisfied, where E is the number of times the entire data set needs to be repeatedly trained, that is, the number of epochs. If the condition is not met, end the iteration and go to step 3.7), otherwise continue to the next step; 3.3) From the biometric dataset D feature Randomly select B biological feature vectors that have not been trained in the e-th iteration and the corresponding ideal secure hash code Where X is the biometric vector dataset, For an ideal secure hash code dataset, if the number of untrained biometric feature vectors is less than B, go to step 3.6), otherwise continue to the next step; 3.4) Fix the hash code generator and optimize the adversarial loss function L adv : In the formula, x (k) is the kth biological feature vector sampled in this round of training, For x (k) The ideal secure hash code of is; through back propagation, the discriminator network parameters θ are updated based on the adaptive moment estimation update rule D ; 3.5) Fix the discriminator and optimize the generator loss function L G : Where, L Feature is the feature matching loss, L Content is the content loss, λ is the regularization parameter and refers to the real threshold, where the feature matching loss L Feature is defined as: Where Φ(·) is the output of the penultimate fully connected layer in the discriminator. is the two-norm, content loss L Content is defined as: Through back propagation, the hash code generator network parameters θ are updated based on the adaptive moment estimation update rule. G ; 3.6) Update the number of iterations e = e + 1; 3.7) Save the network parameters as θ G The hash code generator G(·) of 4) Use a feature extractor to extract biometric feature vectors from the biometric images in the biometric image test set, and input the biometric feature vectors into the trained hash code generator to generate corresponding secure hash codes that are resistant to similarity attacks and have high recognition accuracy.

2. The secure hash generation method based on a generative adversarial network that is resistant to similarity attacks according to claim 1, characterized in that: In step 1), the registered user's biological image is scaled to image pixels suitable for the neural network input size, and then 70% of the scaled biological images of each registered user are divided into a biological image training set, and the remaining 30% of the scaled biological images are divided into a biological image test set, wherein the biological image training set refers to a data set composed of the registered user's biological image and its corresponding category label, that is, which user it belongs to, for network training, and is expressed as: D biometric ={(o i ,c i )|i∈1,2,3,...,N;c i ∈1,2,3,...,C} Where D biometric represents the biological image training set, o i refers to the i-th biological image, c i It means o i It belongs to c i There are C registered users in total, and N biological images in the biological image training set.

3. The secure hash generation method based on a generative adversarial network that is resistant to similarity attacks according to claim 1, characterized in that: In step 4), for any biological image o in the biological image test set, generate its corresponding n-dimensional secure hash code y that is resistant to similarity attacks and has high recognition accuracy. The process is expressed as: y=sign(G(f(o))) Where f(·) is the feature extractor, G(·) is the hash code generator, and sign(·) is the sign function.

Images