A secure iris recognition method, system, device and storage medium

Abstract

The application discloses a kind of safe iris identification method, system, equipment and storage medium, including receiving user ID from authentication server, user iris feature data ciphertext, database's iris feature ciphertext and special library key index, according to special library key index, key matching is generated corresponding symmetric key, according to symmetric key decryption database's iris feature ciphertext, obtain the iris feature plaintext of database, according to user ID, key matching is obtained with user private key corresponding user public key, according to user public key decryption user iris feature data ciphertext, obtain the iris feature data plaintext of user, compare user iris feature data plaintext with the iris feature plaintext of database, obtain iris recognition result, by only in iris feature data comparison time data decryption reduces the risk of information leakage in the use process of iris recognition, improves the security of privacy data.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of iris recognition, and in particular to a secure iris recognition method, system, device and storage medium. BACKGROUND

[0002] With the vigorous development of information security technology and the rapid updating of security concept, the application of human biometric technology in the field of information security and identity authentication is in full swing, and it is increasingly valued by governments around the world. In the internationally accepted technical standards of information security level, human biometric authentication has been determined as an identity authentication technology for high-level information security systems. The industry generally believes that human biometric recognition is gradually replacing traditional identity authentication technology, and as a representative of human biometric technology, iris recognition technology is playing an increasingly leading role with its high accuracy, high uniqueness and reliability.

[0003] As a human individual characteristic, the iris belongs to personal privacy data and is closely related to personal rights and interests. If iris information is leaked, it will cause great loss to the personal information security. Therefore, how to prevent information leakage during the use of iris recognition and protect personal iris privacy information is a technical problem to be solved in identity authentication. SUMMARY

[0004] The present application aims to at least solve the technical problems existing in the prior art. To this end, the present application provides a secure iris recognition method, system, device and storage medium, which can prevent information leakage during the use of iris recognition and improve the security of privacy data.

[0005] In a first aspect of the present application, a secure iris recognition method is provided for a comparison server, comprising the following steps:

[0006] receiving a user ID, user iris feature data ciphertext, database iris feature ciphertext and topic library key index from an authentication server, wherein the user ID and the user iris feature data ciphertext are sent by a terminal to the authentication server, and the user iris feature data ciphertext is obtained by encrypting user iris feature data with a pre-stored user private key; the topic library key index and the database iris feature ciphertext are sent by a database to the authentication server, and the database iris feature ciphertext corresponds to the user ID;

[0007] performing key matching according to the topic library key index to generate a corresponding symmetric key;

[0008] decrypting the database iris feature ciphertext according to the symmetric key to obtain the database iris feature plaintext;

[0009] According to the user ID, a user public key corresponding to the user private key is obtained through key matching;

[0010] According to the user public key, the user iris feature data ciphertext is decrypted to obtain user iris feature data plaintext;

[0011] The user iris feature data plaintext is compared with the iris feature plaintext of the database to obtain an iris recognition result.

[0012] According to the control method, at least the following beneficial effects are achieved:

[0013] The method receives the user ID, the user iris feature data ciphertext, the iris feature ciphertext of the database, and the topic library key index from the authentication server, performs key matching according to the topic library key index to generate a corresponding symmetric key, decrypts the iris feature ciphertext of the database according to the symmetric key to obtain the iris feature plaintext of the database, performs key matching according to the user ID to obtain the user public key corresponding to the user private key, decrypts the user iris feature data ciphertext according to the user public key to obtain the user iris feature data plaintext, and compares the user iris feature data plaintext with the iris feature plaintext of the database to obtain the iris recognition result. The method reduces the risk of information leakage in the process of iris recognition by decrypting data only when the iris feature data is compared, and improves the security of private data.

[0014] According to some embodiments of the present application, after the comparison of the user iris feature data plaintext and the iris feature plaintext of the database to obtain the iris recognition result, the method further includes:

[0015] The iris recognition result is sent to the authentication server, so that the authentication server sends the iris recognition result to the terminal according to the user ID.

[0016] According to some embodiments of the present application, the terminal obtains the user iris feature data ciphertext in the following manner:

[0017] The user private key sent by the comparison server is received;

[0018] The user iris image is collected, and the user iris feature data is extracted from the user iris image;

[0019] The user iris feature data is encrypted by the user private key to obtain the user iris feature data ciphertext.

[0020] According to some embodiments of the present application, the database obtains the topic library key index in the following manner:

[0021] A topic library key index acquisition request sent by the authentication server is received;

[0022] obtaining the topic library key index according to the topic library key index acquisition request.

[0023] According to some embodiments of the present application, the database obtains the database iris feature ciphertext by the following way, comprising:

[0024] receiving the user ID sent by the authentication server;

[0025] performing data matching according to the user ID to obtain the database iris feature ciphertext.

[0026] According to some embodiments of the present application, the key matching according to the topic library key index to generate the corresponding symmetric key comprises:

[0027] performing key matching according to the topic library key index to generate the corresponding symmetric key through KMS.

[0028] According to some embodiments of the present application, before the key matching according to the user ID to obtain the user public key corresponding to the user private key, further comprising:

[0029] generating the user private key and the user public key corresponding to the user private key through an asymmetric encryption algorithm.

[0030] The second aspect of the present application provides a secure iris recognition system for a comparison server, comprising:

[0031] a data acquisition module, configured to receive a user ID, user iris feature data ciphertext, database iris feature ciphertext and topic library key index from an authentication server, wherein the user ID and the user iris feature data ciphertext are sent to the authentication server by a terminal, and the user iris feature data ciphertext is obtained by encrypting user iris feature data by a pre-stored user private key; the topic library key index and the database iris feature ciphertext are sent to the authentication server by a database, and the database iris feature ciphertext corresponds to the user ID;

[0032] a symmetric key matching module, configured to perform key matching according to the topic library key index to generate a corresponding symmetric key;

[0033] a database ciphertext decryption module, configured to decrypt the database iris feature ciphertext according to the symmetric key to obtain the database iris feature plaintext;

[0034] a key matching module, configured to perform key matching according to the user ID to obtain a user public key corresponding to the user private key;

[0035] a user data decryption module configured to decrypt the user iris feature data ciphertext according to the user public key to obtain user iris feature data plaintext;

[0036] an iris recognition module configured to compare the user iris feature data plaintext with the database iris feature plaintext to obtain an iris recognition result.

[0037] The system receives a user ID, user iris feature data ciphertext, database iris feature ciphertext and topic library key index from an authentication server, performs key matching according to the topic library key index, generates a corresponding symmetric key, decrypts the database iris feature ciphertext according to the symmetric key to obtain database iris feature plaintext, performs key matching according to the user ID to obtain a user public key corresponding to a user private key, decrypts the user iris feature data ciphertext according to the user public key to obtain user iris feature data plaintext, compares the user iris feature data plaintext with the database iris feature plaintext to obtain an iris recognition result, and reduces the risk of information leakage in the process of iris recognition by decrypting data only when iris feature data is compared, thereby improving the security of private data.

[0038] In a third aspect, the present application provides a secure iris recognition electronic device, comprising at least one control processor and a memory connected in communication with the at least one control processor; the memory stores instructions executable by the at least one control processor, and the instructions are executed by the at least one control processor to enable the at least one control processor to perform the secure iris recognition method described above.

[0039] In a fourth aspect, the present application provides a computer readable storage medium storing computer executable instructions for causing a computer to perform the secure iris recognition method described above.

[0040] It should be noted that the beneficial effects of the second to fourth aspects of the present application and the prior art are the same as those of the above-mentioned secure iris recognition system and the prior art, which will not be described here.

[0041] Additional aspects and advantages of the present application will be in part apparent and in part pointed out hereinafter in the description of the application. BRIEF DESCRIPTION OF DRAWINGS

[0042] The above and / or additional aspects and advantages of the present application will become apparent and be readily appreciated from the description of the embodiments, given in conjunction with the following drawings, in which:

[0043] Figure 1 is a flowchart of a secure iris recognition method according to an embodiment of the present application;

[0044] Figure 2 is a general flowchart of a secure iris recognition method provided by an embodiment of the present application;

[0045] Figure 3 is a structural schematic diagram of a secure iris recognition system according to an embodiment of the present application. DETAILED DESCRIPTION

[0046] Embodiments of the present application are described in detail below with reference to the accompanying drawings, in which the same or similar elements or elements having the same or similar functions are denoted by the same or similar reference numerals throughout. The embodiments described below by reference to the accompanying drawings are exemplary and are only used to explain the present application and cannot be understood as a limitation of the present application.

[0047] In the description of the present application, if the first, second, etc. are described, it is only for the purpose of distinguishing technical features and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features or the sequence of indicated technical features.

[0048] In the description of the present application, it should be understood that the orientation description, such as the upper, lower, etc. indicated orientation or position relationship is based on the orientation or position relationship shown in the drawings, only for the convenience of describing the present application and simplifying the description, and is not intended to indicate or imply that the device or element referred to must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as a limitation of the present application.

[0049] In the description of the present application, it should be noted that, unless otherwise explicitly limited, the words such as setting, installing, connecting, etc. should be broadly understood, and those skilled in the art can reasonably determine the specific meaning of the above words in the present application in combination with the specific content of the technical solution.

[0050] With the vigorous development of information security technology and the rapid updating of security concepts, the application of human body biometric technology in the field of information security and identity authentication is in full swing, and more and more attention is paid by governments around the world. In the internationally accepted technical standards of information security level, human body biometric authentication has been determined as an identity authentication technology used in high-level information security systems. The industry generally believes that human body biometric recognition is gradually replacing traditional identity authentication technology, and as a representative of human body biometric technology, iris recognition technology is playing an increasingly dominant role with its high accuracy, high uniqueness and reliability.

[0051] The iris is a personal privacy data as a human individual feature, and is closely related to personal rights and interests. If the iris information is leaked, great loss will be caused to the information security of the individual. Therefore, how to prevent information leakage in the iris recognition use process and protect the personal iris privacy information is a technical problem to be solved in identity authentication.

[0052] In order to solve the above technical defects, with reference to Figure 1 The application provides a safe iris recognition method for a comparison server, comprising the following steps:

[0053] In step S101, a user ID, user iris feature data ciphertext, database iris feature ciphertext and special library key index are received from an authentication server, wherein the user ID and the user iris feature data ciphertext are sent to the authentication server by a terminal, the user iris feature data ciphertext is obtained by encrypting user iris feature data by a pre-stored user private key; the special library key index and the database iris feature ciphertext are sent to the authentication server by a database, and the database iris feature ciphertext corresponds to the user ID;

[0054] In step S102, key matching is performed according to the special library key index to generate a corresponding symmetric key.

[0055] In step S103, the database iris feature ciphertext is decrypted according to the symmetric key to obtain database iris feature plaintext.

[0056] In step S104, key matching is performed according to the user ID to obtain a user public key corresponding to the user private key.

[0057] In step S105, the user iris feature data ciphertext is decrypted according to the user public key to obtain user iris feature data plaintext.

[0058] In step S106, the user iris feature data plaintext is compared with the database iris feature plaintext to obtain an iris recognition result.

[0059] The method receives the user ID, the user iris feature data ciphertext, the database iris feature ciphertext and the special library key index from the authentication server, performs key matching according to the special library key index to generate a corresponding symmetric key, decrypts the database iris feature ciphertext according to the symmetric key to obtain database iris feature plaintext, performs key matching according to the user ID to obtain a user public key corresponding to the user private key, decrypts the user iris feature data ciphertext according to the user public key to obtain user iris feature data plaintext, compares the user iris feature data plaintext with the database iris feature plaintext to obtain an iris recognition result, and reduces the risk of information leakage in the iris recognition use process by decrypting data only when the iris feature data is compared, thereby improving the security of the privacy data.

[0060] In some embodiments, after obtaining the iris recognition result by comparing the user iris feature data plaintext with the iris feature plaintext of the database, the method further comprises:

[0061] sending the iris recognition result to the authentication server, so that the authentication server sends the iris recognition result to the terminal according to the user ID.

[0062] In some embodiments, the terminal obtains the user iris feature data ciphertext by the following method, comprising:

[0063] receiving the user private key sent by the comparison server;

[0064] collecting the user iris image, and extracting the user iris feature data from the user iris image;

[0065] encrypting the user iris feature data by using the user private key to obtain the user iris feature data ciphertext.

[0066] In some embodiments, the database obtains the topic library key index by the following method, comprising:

[0067] receiving the topic library key index acquisition request sent by the authentication server;

[0068] acquiring the topic library key index according to the topic library key index acquisition request.

[0069] In some embodiments, the database obtains the iris feature ciphertext of the database by the following method, comprising:

[0070] receiving the user ID sent by the authentication server;

[0071] performing data matching according to the user ID to obtain the iris feature ciphertext of the database.

[0072] In some embodiments, the corresponding symmetric key is generated by key matching according to the topic library key index, comprising:

[0073] performing key matching according to the topic library key index, and generating the corresponding symmetric key by KMS.

[0074] In some embodiments, before performing key matching according to the user ID to obtain the user public key corresponding to the user private key, the method further comprises:

[0075] generating the user private key and the user public key corresponding to the user private key by using an asymmetric encryption algorithm.

[0076] Referring to Figure 2 , in order to facilitate the understanding of the person skilled in the art, a set of best embodiments are provided as follows:

[0077] The comparison server is divided into an authentication agent service module, a password service module, an iris feature service comparison module and a key management module.

[0078] Step 1. Receiving the user private key sent by the comparison server; collecting the user iris image, extracting the user iris feature data from the user iris image; encrypting the user iris feature data using the user private key to obtain the user iris feature data ciphertext, and submitting the ciphertext data of the user iris feature and the user ID to the authentication server through the "collection service interface".

[0079] Step 2. The authentication server obtains the iris topic library key index through the "topic library key index acquisition interface".

[0080] Step 3. The database returns the iris topic library key index to the authentication server.

[0081] Step 4. The authentication server determines the database and submits the user ID to the database through the "information retrieval service interface".

[0082] Step 5. The database returns the database iris feature ciphertext to the authentication server through the user ID.

[0083] Step 6. The authentication server submits the user ID, the user iris feature data ciphertext, the database iris feature ciphertext and the iris topic library key index to the authentication agent service module through the "authentication service interface".

[0084] Step 7. The authentication agent service module submits the user ID and the user iris feature data ciphertext to the password service module.

[0085] Step 8. The password service module submits the user ID to the key management module.

[0086] Step 9. The key management module returns the user public key to the password service module.

[0087] Step 10. The password service module returns the user iris feature data plaintext to the authentication agent service module after decrypting the user iris feature data ciphertext using the user public key.

[0088] Step 11. The authentication agent service module submits the database iris feature ciphertext and the iris topic library key index information to the password service module.

[0089] Step 12. The password service module submits the iris topic library key index to the key management module.

[0090] Step 13. The key management module returns the symmetric key corresponding to the key index to the password service module.

[0091] Step 14. The password service module decrypts the database's iris feature ciphertext with the symmetric key and returns to the authentication agent service module.

[0092] Step 15. The authentication agent service module submits the user's iris feature data plaintext and the database's iris feature plaintext to the iris feature service comparison module.

[0093] Step 16. The iris feature comparison service module compares the data through the iris feature comparison service and returns the iris feature comparison result to the authentication agent service module.

[0094] Step 17. The authentication agent service module returns the authentication result to the authentication server.

[0095] Step 18. The authentication server returns the authentication result to the application terminal and displays the final result.

[0096] In addition, with reference to Figure 3 , one embodiment of the present application provides a secure iris recognition system for a comparison server, comprising a data acquisition module 1100, a symmetric key matching module 1200, a database ciphertext decryption module 1300, a key matching module 1400, a user data decryption module 1500, and an iris recognition module 1600, wherein:

[0097] The data acquisition module 1100 is configured to receive a user ID, user iris feature data ciphertext, database's iris feature ciphertext, and a topic library key index from an authentication server, wherein the user ID and the user iris feature data ciphertext are sent to the authentication server by a terminal, and the user iris feature data ciphertext is obtained by encrypting user iris feature data with a pre-stored user private key; the topic library key index and the database's iris feature ciphertext are sent to the authentication server by a database, and the database's iris feature ciphertext corresponds to the user ID;

[0098] The symmetric key matching module 1200 is configured to perform key matching according to the topic library key index to generate a corresponding symmetric key.

[0099] The database ciphertext decryption module 1300 is configured to decrypt the database's iris feature ciphertext according to the symmetric key to obtain database's iris feature plaintext.

[0100] The key matching module 1400 is configured to perform key matching according to the user ID to obtain a user public key corresponding to the user private key.

[0101] The user data decryption module 1500 is configured to decrypt the user iris feature data ciphertext according to the user public key to obtain user iris feature data plaintext.

[0102] The iris recognition module 1600 is configured to compare the user iris feature data plaintext with the database iris feature plaintext to obtain an iris recognition result.

[0103] The system receives the user ID, the user iris feature data ciphertext, the database iris feature ciphertext and the topic library key index from the authentication server, performs key matching according to the topic library key index, generates a corresponding symmetric key, decrypts the database iris feature ciphertext according to the symmetric key to obtain the database iris feature plaintext, performs key matching according to the user ID to obtain a user public key corresponding to the user private key, decrypts the user iris feature data ciphertext according to the user public key to obtain the user iris feature data plaintext, compares the user iris feature data plaintext with the database iris feature plaintext to obtain an iris recognition result, and reduces the risk of information leakage in the use of iris recognition by decrypting data only when the iris feature data is compared, thereby improving the security of private data.

[0104] It should be noted that the system embodiment and the above-mentioned system embodiment are based on the same inventive concept, and therefore the related content of the above-mentioned method embodiments is also applicable to the system embodiment, which will not be described here.

[0105] The application further provides a secure iris recognition electronic device, comprising a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor implements the secure iris recognition method as described above when executing the computer program.

[0106] The processor and the memory can be connected through a bus or other means.

[0107] The memory, as a non-transitory computer readable storage medium, can be used to store non-transitory software programs and non-transitory computer executable programs. In addition, the memory can include a high-speed random access memory, and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory can optionally include a memory disposed remotely relative to the processor, and these remote memories can be connected to the processor through a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0108] The non-transitory software programs and instructions required to implement the secure iris recognition method of the above-mentioned embodiments are stored in the memory, and when executed by the processor, the secure iris recognition method in the above-mentioned embodiments is executed, for example, the method steps S101 to S106 in the above-described Figure 1 are executed.

[0109] The application further provides a computer readable storage medium storing computer executable instructions for performing the secure iris recognition method as described above.

[0110] The computer readable storage medium stores computer executable instructions, which are executed by a processor or a controller, for example, by a processor in the electronic device embodiment described above, so as to enable the processor to perform the secure iris recognition method in the embodiments described above, for example, to perform the method steps S101 to S106 in the above described Figure 1

[0111] Those skilled in the art can understand that all or some steps in the method disclosed above can be implemented as software, firmware, hardware and appropriate combinations thereof. Some or all physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor or a microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit. Such software can be distributed on a computer readable medium, which can include computer storage media (or non-transitory media) and communication media (or transitory media). As known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program units or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. In addition, it is known to those skilled in the art that communication media generally includes computer readable instructions, data structures, program units or other data in a modulated data signal carrier or other transmission mechanism, and can include any information delivery medium.

[0112] The embodiments of the application are described in detail above with reference to the accompanying drawings, but the application is not limited to the above described embodiments, and various changes can be made within the knowledge of those skilled in the art without departing from the purpose of the application.​

Claims

1. A secure iris recognition method, characterized by, The secure iris recognition method comprises the following steps of: Receiving a user ID, user iris feature data ciphertext, database iris feature ciphertext and a topic library key index from an authentication server, wherein the user ID and the user iris feature data ciphertext are sent by a terminal to the authentication server, and the user iris feature data ciphertext is obtained by encrypting user iris feature data by a pre-stored user private key; the topic library key index and the database iris feature ciphertext are sent by a database to the authentication server, and the database iris feature ciphertext corresponds to the user ID, and the database is obtained by receiving the user ID sent by the authentication server; and data matching is performed according to the user ID to obtain the database iris feature ciphertext; Key matching is performed according to the topic library key index to generate a corresponding symmetric key, specifically as follows: The key matching is performed according to the topic library key index, and a corresponding symmetric key is generated by KMS; The database iris feature ciphertext is decrypted according to the symmetric key to obtain the database iris feature plaintext; Key matching is performed according to the user ID to obtain a user public key corresponding to the user private key; The user iris feature data ciphertext is decrypted according to the user public key to obtain user iris feature data plaintext; The user iris feature data plaintext and the database iris feature plaintext are compared to obtain an iris recognition result.

2. The method of claim 1, wherein, After the comparison of the user iris feature data plaintext and the database iris feature plaintext to obtain the iris recognition result, the method further comprises the following steps of: The iris recognition result is sent to the authentication server, so that the authentication server sends the iris recognition result to the terminal according to the user ID.

3. The method of claim 1, wherein the step of obtaining the iris image comprises the steps of: obtaining a plurality of iris images of the eye; and selecting one of the plurality of iris images as the iris image. The terminal obtains the user iris feature data ciphertext by the following method, comprising the following steps of: Receiving a user private key sent by the comparison server; Collecting a user iris image, and extracting the user iris feature data from the user iris image; Encrypting the user iris feature data by the user private key to obtain the user iris feature data ciphertext.

4. The method of claim 1, wherein the step of obtaining the iris image comprises the steps of: obtaining a plurality of iris images of the eye; and selecting one of the plurality of iris images as the iris image. The database obtains the topic library key index by the following method, comprising the following steps of: Receiving a topic library key index acquisition request sent by the authentication server; Acquiring the topic library key index according to the topic library key index acquisition request.

5. The method of claim 1, wherein the step of identifying the iris is performed by using a method of identifying the iris according to claim 1. Before the key matching according to the user ID to obtain a user public key corresponding to the user private key, the method further comprises the following steps of: Generating the user private key and the user public key corresponding to the user private key by an asymmetric encryption algorithm.

6. A secure iris recognition system characterized by, The secure iris recognition system comprises the following steps of: The data acquisition module is configured to receive a user ID, user iris feature data ciphertext, database iris feature ciphertext and a special topic database key index from an authentication server, wherein the user ID and the user iris feature data ciphertext are sent to the authentication server by a terminal, and the user iris feature data ciphertext is obtained by encrypting user iris feature data by a pre-stored user private key; the special topic database key index and the database iris feature ciphertext are sent to the authentication server by a database, the database iris feature ciphertext corresponds to the user ID, and the database receives the user ID sent by the authentication server; and data matching is performed according to the user ID to obtain the database iris feature ciphertext; The symmetric key matching module is configured to perform key matching according to the special topic database key index to generate a corresponding symmetric key, specifically as follows: The symmetric key matching module is configured to perform key matching according to the special topic database key index to generate a corresponding symmetric key, specifically as follows: The database ciphertext decryption module is configured to decrypt the database iris feature ciphertext according to the symmetric key to obtain database iris feature plaintext. The key matching module is configured to perform key matching according to the user ID to obtain a user public key corresponding to the user private key. The user data decryption module is configured to decrypt the user iris feature data ciphertext according to the user public key to obtain user iris feature data plaintext. The iris recognition module is configured to compare the user iris feature data plaintext with the database iris feature plaintext to obtain an iris recognition result.

7. A secure iris recognition device, characterized by The computer readable storage medium stores computer executable instructions, and the computer executable instructions are used to make the computer execute the secure iris recognition method in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that: The computer readable storage medium stores computer executable instructions, and the computer executable instructions are used to make the computer execute the secure iris recognition method in any one of claims 1 to 5.

Images