Biological characteristic template protection method and device, equipment and storage medium

Abstract

The invention discloses a biological characteristic template protection method and device, equipment and a storage medium. The biological characteristic template protection method comprises the following steps: grouping first biological characteristics in a bit string form according to a target operation parameter; the target operation parameters comprise the number of bits contained in each code word, the number of code words contained in each group and the number of code words corrected by each group; based on each first group in the first biological characteristics, generating a first key corresponding to the first group, and determining auxiliary data of the first group according to the first key; grouping the second biological characteristics in the bit string form according to the target operation parameters; and performing matching verification on the first biological feature and the second biological feature based on the second group in the second biological feature and the auxiliary data of the first group at the corresponding position in the first biological feature. According to the technical scheme provided by the embodiment of the invention, the efficiency loss caused by overlong features is avoided, and the matching efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of biometric technology, and in particular to a biometric template protection method, device, equipment and storage medium. Background Art

[0002] Biometric technology can quickly and accurately verify personal identity through a variety of means such as fingerprint recognition, facial recognition, iris recognition or voice recognition. However, this also raises potential security issues. Once biometric information is leaked, the consequences may be more serious than traditional password or user name leaks. Since biometrics are immutable, once abused, the victim will not be able to solve the problem by simply changing the password. Therefore, it is particularly important to ensure the security of biometric information.

[0003] In order to protect the security of biometric information, researchers have designed a biometric template protection scheme to achieve secure comparison and privacy storage of biometric information. The commonly used fuzzy commitment technology combines the biometric template with the key to generate auxiliary data, which replaces the key storage in the form of storing auxiliary data, which can effectively solve the key storage problem.

[0004] When the biometric feature is long, the current fuzzy commitment scheme has low implementation efficiency, resulting in insufficient practicality of the scheme. Therefore, how to improve the efficiency of the scheme while ensuring the protection of the biometric template and the key generation function has attracted the attention of technicians. Summary of the invention

[0005] The present invention provides a biometric template protection method, device, equipment and storage medium to solve the problem of low execution efficiency of the biometric template protection scheme when the biometric is long.

[0006] According to one aspect of the present invention, a biometric template protection method is provided, comprising:

[0007] The first biometric feature in the form of a bit string is grouped according to target operation parameters, wherein the target operation parameters include the number of bits contained in each codeword, the number of codewords contained in each group, and the number of codewords corrected in each group;

[0008] Based on each first group in the first biometric feature, generate a first key corresponding to the first group, and determine auxiliary data of the first group according to the first key;

[0009] grouping the second biometric feature in the form of a bit string according to the target operating parameter;

[0010] Based on the second group in the second biometric feature and the auxiliary data of the first group at the corresponding position in the first biometric feature, the first biometric feature and the second biometric feature are matched and verified.

[0011] According to another aspect of the present invention, there is provided a biometric template protection device, comprising:

[0012] A first grouping module, configured to group the first biometric feature in the form of a bit string according to a target operation parameter; the target operation parameter includes the number of bits contained in each codeword, the number of codewords contained in each group, and the number of error-corrected codewords in each group;

[0013] an auxiliary data determination module, configured to generate a first key corresponding to the first group based on each first group in the first biometric feature, and determine auxiliary data of the first group according to the first key;

[0014] A second grouping module, configured to group the second biometric features in the form of bit strings according to the target operating parameters;

[0015] The matching verification module is used to perform matching verification on the first biometric feature and the second biometric feature based on the second group in the second biometric feature and the auxiliary data of the first group at the corresponding position in the first biometric feature.

[0016] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0017] at least one processor; and

[0018] a memory communicatively connected to the at least one processor; wherein,

[0019] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the biometric template protection method described in any embodiment of the present invention.

[0020] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the biometric template protection method described in any embodiment of the present invention when executed.

[0021] According to another aspect of the present invention, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the biometric template protection method of any embodiment of the present disclosure is implemented.

[0022] The technical solution of the embodiment of the present invention groups the first biometric feature in the form of a bit string according to the target operating parameters, and then generates a first key corresponding to the first group based on each first group in the first biometric feature, and determines the auxiliary data of the first group according to the first key. Furthermore, according to the target operating parameters, the second biometric feature in the form of a bit string is grouped, and the first biometric feature and the second biometric feature are matched and verified based on the second group in the second biometric feature and the auxiliary data of the first group at the corresponding position in the first biometric feature. By grouping the biometric features, the efficiency loss caused by the excessive length of the features is avoided, the computing resources are saved, and the matching efficiency is improved.

[0023] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 is a flow chart of a biometric template protection method provided according to Embodiment 1 of the present invention;

[0026] Figure 2a is a flow chart of a biometric template protection method provided according to Embodiment 2 of the present invention;

[0027] Figure 2b is a schematic diagram of feature grouping provided according to Embodiment 2 of the present invention;

[0028] Figure 2c is a schematic diagram of auxiliary data generation provided by Embodiment 2 of the present invention;

[0029] Figure 3 is a schematic structural diagram of a biometric template protection device provided according to Embodiment 3 of the present invention;

[0030] Figure 4 It is a schematic diagram of the structure of an electronic device for implementing the biometric template protection method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0032] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0033] Embodiment 1

[0034] Figure 1 A flowchart of a biometric template protection method is provided for the first embodiment of the present invention. This embodiment is applicable to the case of grouping biometrics. The method can be executed by a biometric template protection device. The biometric template protection device can be implemented in the form of hardware and / or software. The biometric template protection device can be configured in various general computing devices. Figure 1 As shown, the method includes:

[0035] S110. Group the first biometric feature in the form of a bit string according to target operation parameters; the target operation parameters include the number of bits contained in each codeword, the number of codewords contained in each group, and the number of error-corrected codewords in each group.

[0036] The target operation parameters are the parameters required to execute the biometric template protection scheme, including the number of bits contained in each codeword, the number of codewords contained in each group, and the number of codewords corrected in each group. Among them, the number of bits contained in each codeword and the number of codewords contained in each group are used to group the biometrics in the form of bit strings to improve the efficiency of the scheme execution, and the number of codewords corrected in each group is used to constrain the number of differences in the codewords in each group.

[0037] When the first biometric feature in the form of a bit string is a long feature, the existing fuzzy commitment technology is too inefficient and a new solution that adapts to long features needs to be designed. Because the traditional fuzzy commitment technology uses error correction codes to eliminate the differences in biometric features collected multiple times from the same person, when the length of the biometric feature extracted by the biometric feature extraction algorithm is long, the threshold used to distinguish whether two biometric features belong to the same person is often large. The large threshold requires the error correction code to have a strong error correction capability, which consumes a lot of computing resources when correcting errors, resulting in insufficient system operation efficiency.

[0038] In an embodiment of the present invention, in order to solve the problem of low efficiency of the existing fuzzy commitment technology when processing long features, the first biometric feature in the form of a bit string is grouped according to a predetermined target operation parameter. Specifically, the first biometric feature in the form of a bit string can be divided into codewords according to the number of bits contained in each codeword contained in the target operation parameter to obtain a codeword string containing at least one codeword. Furthermore, the codeword string can be further divided according to the number of codewords contained in each group contained in the target operation parameter to obtain a group string containing at least one group.

[0039] The number of groups can be determined based on the number of bits contained in each codeword, the number of codewords contained in each group, and the bit string length of the first biometric feature. The key byte length of each group can be determined based on the number of codewords corrected in each group and the number of codewords contained in each group.

[0040] In a specific example, the first biometric feature in the form of a bit string is bits_stream, and the length of the first biometric feature bit string is bits_stream_length. The predetermined target operating parameters include the number of bits contained in each codeword bits_per_word, the number of codewords contained in each group words_per_block, and the number of error-correcting codewords in each group error_correcting_code_num_per_block. The codeword string words_stream is divided into a group of bits_per_word bits, that is, words_stream[i]=bits_stream[bits_per_word*i],...,bits_stream[bits_per_word*i+bits_per_word-1]. Then, the words_stream is divided into a group string blocks_stream according to the words_per_block words as a group, that is, blocks_stream[i]=words_stream[words_per_block*i],...,words_stream[words_per_block*i+words_per_block-1].

[0041] The key byte length of each block key_length_per_block = MAX(16, words_per_block - error_correcting_code_num_per_block * 2). The number of blocks_stream_length = bits_stream_length / bits_per_word / words_per_block.

[0042] S120. Generate a first key corresponding to each first group in the first biometric feature, and determine auxiliary data of the first group according to the first key.

[0043] In an embodiment of the present invention, for each first group in the first biometric feature, the commitment stage in the fuzzy commitment scheme is processed to generate a first key corresponding to each first group, and the auxiliary data of the first group is determined based on the first key. Specifically, a random bit string corresponding to each first group is generated as the key of the first group, and a hash calculation is performed on each group of first keys to obtain a first key hash value. Each group of first keys is encoded, and the encoding result and the biometric feature of the first group corresponding to the first key are XORed to obtain a commitment value. Finally, the first key is output, and the first key hash value and the commitment value are disclosed as the auxiliary data of the first group. Exemplarily, Reed-Solomon codes (RS codes for short) are used for encoding.

[0044] S130. Group the second biometric features in the form of bit strings according to the target operating parameters.

[0045] In an embodiment of the present invention, after the first biometric feature is grouped and the corresponding auxiliary data is obtained, the recovery phase of the fuzzy commitment scheme is processed, and the first biometric feature and the second biometric feature are matched and verified according to the second biometric feature in the form of a bit string and the above-mentioned auxiliary data. First, the second biometric feature in the form of a bit string is grouped according to the target operation parameter. Specifically, the second biometric feature in the form of a bit string is first divided into codewords according to the number of bits contained in each codeword contained in the target operation parameter to obtain a codeword string containing at least one codeword. Furthermore, the codeword string is further divided according to the number of codewords contained in each group contained in the target operation parameter to obtain a group string containing at least one group.

[0046] In a specific example, the second biometric feature bits_stream in the form of a bit string is input, and is divided into a code word string words_stream according to bits_per_word as a group, that is, words_stream[i]=bits_stream[bits_per_word*i],...,bits_stream[bits_per_word*i+bits_per_word-1]. Then, words_stream is divided into a block string blocks_stream according to words_per_block as a group, that is, blocks_stream[i]=words_stream[words_per_block*i],...,words_stream[words_per_block*i+words_per_block-1].

[0047] S140: Based on the second group in the second biometric feature and the auxiliary data of the first group at the corresponding position in the first biometric feature, perform matching verification on the first biometric feature and the second biometric feature.

[0048] In an embodiment of the present invention, the first biometric and the second biometric are matched and verified based on the second group in the second biometric and the auxiliary data of the first group at the corresponding position in the first biometric. Specifically, a commitment value is obtained from the auxiliary data, and the commitment value and the biometric of the second group at the corresponding position are XORed to obtain an encoded second key. Further, the encoded second key is decoded to obtain the second key. Finally, a hash value is calculated for the second key to obtain a second key hash value. The second key hash value is compared with the first key hash value. When the two are consistent, it indicates that the first biometric and the second biometric are from the same biological individual. Exemplarily, RS codes are used for decoding.

[0049] The technical solution of the embodiment of the present invention groups the first biometric feature in the form of a bit string according to the target operating parameters, and then generates a first key corresponding to the first group based on each first group in the first biometric feature, and determines the auxiliary data of the first group according to the first key. Furthermore, according to the target operating parameters, the second biometric feature in the form of a bit string is grouped, and the first biometric feature and the second biometric feature are matched and verified based on the second group in the second biometric feature and the auxiliary data of the first group at the corresponding position in the first biometric feature. By grouping the biometric features, the efficiency loss caused by the excessive length of the features is avoided, the computing resources are saved, and the matching efficiency is improved.

[0050] Embodiment 2

[0051] Figure 2a This is a flowchart of a biometric template protection method provided in Embodiment 2 of the present invention. This embodiment further refines the above embodiment and provides specific steps of generating a first key corresponding to the first group based on each first group in the first biometric, and determining the auxiliary data of the first group based on the first key, and specific steps of matching and verifying the first biometric and the second biometric based on the second group in the second biometric and the auxiliary data of the first group at the corresponding position in the first biometric. Figure 2a As shown, the method includes:

[0052] S210. Group the first biometric feature in the form of a bit string according to target operation parameters; the target operation parameters include the number of bits contained in each codeword, the number of codewords contained in each group, and the number of error-corrected codewords in each group.

[0053] Optionally, before grouping the first biometric feature in the bit string form according to the target operation parameter, the method further includes:

[0054] Using the initial operating parameters as current operating parameters, and based on the current operating parameters, performing a plurality of matching verification operations of the first biometric feature and the second biometric feature to determine the execution performance corresponding to the current operating parameters;

[0055] According to the current operating parameters, performing feature comparison operations on multiple pairs of the first biometric feature and the second biometric feature to determine the matching accuracy corresponding to the current operating parameters;

[0056] When the execution performance does not meet the requirements but the matching accuracy meets the requirements, the number of bits contained in each codeword in the current operating parameters is increased, or the number of codewords contained in each group is reduced to obtain new current operating parameters, and the execution is returned to perform matching verification operations on multiple pairs of the first biometric feature and the second biometric feature based on the current operating parameters until the current operating parameters that meet the requirements in both execution performance and matching accuracy are determined as the target operating parameters.

[0057] In this optional embodiment, a specific method for determining the target operating parameters is provided: first, the initial operating parameters are used as the current operating parameters, and based on the current operating parameters, multiple matching and verification operations of the first biometric feature and the second biometric feature are performed, and the execution performance corresponding to the current operating parameters is determined according to the time taken for each matching and verification operation.

[0058] The matching verification operation specifically includes: grouping the first biometric feature in the form of a bit string according to the target operation parameters; the target operation parameters include the number of bits contained in each codeword, the number of codewords contained in each group, and the number of codewords corrected in each group; executing the commitment phase: based on each first group in the first biometric feature, generating a first key corresponding to the first group, and determining the auxiliary data of the first group according to the first key; executing the recovery phase: grouping the second biometric feature in the form of a bit string according to the target operation parameters; matching and verifying the first biometric feature and the second biometric feature based on the second group in the second biometric feature and the auxiliary data of the first group at the corresponding position in the first biometric feature. When recording the matching verification operation of each team of the first biometric feature and the second biometric feature, the average time consumed in the commitment phase and the recovery phase can be recorded respectively, and the average time consumed in the two phases can be used together as the execution performance.

[0059] Further, according to the current operating parameters, multiple feature comparison operations are performed on the first biometric feature and the second biometric feature to determine the matching accuracy corresponding to the current operating parameters. Specifically, the first biometric feature and the second biometric feature can be divided into code words and groups according to the current operating parameters. Then, the differences in the code words in the groups at the corresponding positions of the first biometric feature and the second biometric feature are compared. If the number of code word differences does not exceed the number of code words for group error correction, it is determined that the first biometric feature and the second biometric feature are from the same biological subject, otherwise, it is determined that they belong to different biological subjects. According to the matching results, the false recognition rate and false rejection rate of the current operating parameters are determined as the matching accuracy.

[0060] Finally, when the execution performance does not meet the requirements and the matching accuracy meets the requirements, the number of bits contained in each codeword in the current operation parameters is increased, or the number of codewords contained in each group is reduced to obtain new current operation parameters, and the execution is returned to perform multiple matching verification operations on the first biometric feature and the second biometric feature based on the current operation parameters, until the current operation parameters that meet the requirements of both the execution performance and the matching accuracy are determined as the target operation parameters. During this period, the binary search method is used to obtain the number of codewords for group error correction that meets the accuracy requirements. If the execution performance and matching accuracy do not meet the requirements, an error is reported and the system exits. The technical solution of the embodiment of the present invention no longer uses the existing method of correcting the entire biometric data in bit units, but uses the above-mentioned parameter search method to perform group error correction by dividing codewords and groups, and achieves a trade-off between execution performance and matching accuracy, thereby obtaining target operation parameters that meet the execution performance and matching accuracy requirements.

[0061] In a specific example, the length of the first biometric bit string is bits_stream_length, the number of bits contained in each codeword is bits_per_word, the number of codewords contained in each group is words_per_block, and the number of error-correcting codewords in each group is error_correcting_code_num_per_block. Initially, bits_stream_length is determined by the specific biometric, bits_per_word=1, words_per_block=bits_stream_length, error_correcting_code_num_per_block=the threshold of the Hamming distance. Next, the key byte length of each group is calculated as key_length_per_block=MAX(16, words_per_block-error_correcting_code_num_per_block*2), and the number of groups is calculated as blocks_stream_length=bits_stream_length / bits_per_word / words_per_block.

[0062] Furthermore, a performance test is performed: using the current operating parameters, multiple biometric features are randomly selected, and after grouping the biometric features, the commitment phase and the recovery phase in the fuzzy commitment are executed separately, and the average time consumption of the commitment phase and the average time consumption of the recovery phase are obtained as the execution performance.

[0063] Furthermore, a matching accuracy test is performed: using the current operating parameters, multiple features are randomly selected, and feature grouping and feature comparison are performed respectively, and the false recognition rate and false rejection rate corresponding to the current operating parameters are calculated as the matching accuracy.

[0064] The feature grouping is Figure 2bAs shown: the input biometric feature bits_stream1 in the form of a bit string is divided into a codeword string words_stream1 according to bits_per_word as a group, that is, words_stream1[i]=bits_stream1[bits_per_word*i],...,bits_stream1[bits_per_word*i+bits_per_word-1]. Then, words_stream1 is divided into a block string blocks_stream1 according to words_per_block as a group, that is, blocks_stream1[i]=words_stream1[words_per_block*i],...,words_stream1[words_per_block*i+words_per_block-1]. Similarly, bits_stream2 is converted into blocks_stream2.

[0065] Feature comparison includes: comparing the codewords of each group in blocks_stream1 and blocks_stream2. If the difference between each group of codewords does not exceed the number of error-correcting codewords per block, the two features are considered to belong to the same biological subject; otherwise, they are considered to belong to different biological subjects.

[0066] If both the execution performance and the matching accuracy meet the requirements, exit and output the current running parameters as the target running parameters. If the execution performance does not meet the requirements but the matching accuracy meets the requirements, increase bits_per_word or decrease words_per_block, repeat the above execution performance and matching accuracy tests, and try to use the binary search method to obtain the error_correcting_code_num_per_block that meets the accuracy requirements. If neither the execution performance nor the matching accuracy can be met, report an error and exit.

[0067] Optionally, performing feature comparison operations on multiple pairs of the first biometric feature and the second biometric feature according to the current operating parameters to determine the matching accuracy corresponding to the current operating parameters includes:

[0068] Grouping multiple pairs of biometric features in bit string form according to current operating parameters;

[0069] In each group of corresponding positions of a pair of biometric features, the codewords are compared one by one, and the matching accuracy corresponding to the current operating parameters is determined based on the comparison results.

[0070] In this optional embodiment, according to the current operating parameters, multiple pairs of feature comparison operations of the first biometric feature and the second biometric feature are performed to determine the matching accuracy corresponding to the current operating parameters. Specifically, the following are included: according to the current operating parameters, multiple pairs of biometric features in the form of bit strings are divided into code words and groups. In the groups of the corresponding positions of each pair of biometric features, the code words are compared one by one, and the matching accuracy corresponding to the current operating parameters is determined according to the comparison results. Specifically, if the code word difference of each group does not exceed the number of code words for group error correction, it is determined that the two features belong to the same biological subject, otherwise they are considered to belong to different biological subjects. By using the one-to-one correspondence between the biometric feature comparison distance and the required error correction capability of the error correction code, the accuracy is tested by comparing the distance instead of detecting whether the recovery is successful, which speeds up the search speed of the target operating parameters.

[0071] S220. Determine the key byte length of each group according to the number of code words contained in each group and the number of code words for error correction of each group in the target operation parameters.

[0072] In the embodiment of the present invention, when generating a key, the key byte length key_length_per_block of each group is determined according to the number of code words_per_block contained in each group and the number of error-correcting code words error_correcting_code_num_per_block of each group in the target operation parameter. Specifically, key_length_per_block=MAX(16, words_per_block-error_correcting_code_num_per_block*2).

[0073] S230. Based on each first group in the first biometric feature and according to the key byte length, generate a random bit string as a first key corresponding to the first group.

[0074] In the embodiment of the present invention, based on each first group in the first biometric feature, a random bit string is generated as the first group corresponding to the first key according to the key byte length. Specifically, blocks_stream_length groups of random bit strings are generated as the first key key, each first key group length is key_length_per_block bits, and the total length is blocks_stream_length*key_length_per_block bits.

[0075] S240: Perform a hash calculation on the first key to obtain a first key hash value.

[0076] In the embodiment of the present invention, a hash calculation is performed on each group of first keys corresponding to the first biometric feature to obtain a first key hash value. A hash calculation is performed on each group of first keys key to obtain a first key hash value hash_keys, that is, hash_keys[i]=H(key[i]).

[0077] S250. Bind the biometric feature of the first group and the first key corresponding to the first group to obtain a commitment value of the first group, and use the first key hash value and the commitment value as auxiliary data of the first group.

[0078] In the embodiment of the present invention, after obtaining the first key corresponding to each first group, the biometric feature of the first group and the first key corresponding to the first group are bound to obtain the commitment value of the first group, and the commitment value and the first key hash are used together as the auxiliary feature of the first group. Specifically, the first key corresponding to each first group can be encoded to obtain a first encoding key, and then the first encoding key and the biometric feature of the first group are XORed to obtain the commitment value of the first group.

[0079] Optionally, binding the biometric feature of the first group and the first key corresponding to the first group to obtain the commitment value of the first group includes:

[0080] Encode the first key corresponding to each first group to obtain a first encoded key;

[0081] An XOR operation is performed on the first encoding key and the biometric feature of the first group to obtain a commitment value of the first group.

[0082] In this optional embodiment, a specific method is provided for binding the biometric feature of the first group and the first key corresponding to the first group to obtain the commitment value of the first group: first, the input key is divided into a code word of 8 bits to obtain a key code string, and each first key in the key code string is encoded to obtain a first coded key. Exemplarily, the first coded key can be obtained by encoding through RS codes.

[0083] Furthermore, an XOR operation is performed on the first encoding key and the biometric feature of the first group to obtain a commitment value of the first group.

[0084] In a specific example, Figure 2cAs shown, blocks_stream_length groups of random bit strings are generated as the first key, each group is key_length_per_block bits long, and the total length is blocks_stream_length*key_length_per_block bits. A hash operation is performed on each group of the first key to obtain the first key hash value hash_keys, that is, hash_keys[i]=H(key[i]).

[0085] Furthermore, key binding is performed: input the key key, and divide it into 8 bits per codeword to obtain the first key codeword string key_words_stream. Then, use Reed-Solomon code to encode each group of codewords to obtain encoded_keys, that is, encoded_keys[i] = Encode(key_words_stream[key_length_per_block*i],...,key_words_stream[key_length_per_block*i+key_length_per_block-1]). For each group of blocks_stream and encoded_keys, perform XOR on them to obtain encoded_keys', that is, encoded_keys'[i] = XOR(blocks_stream[i], encoded_keys[i]). Finally, encode_keys'[i] and hash_keys are used as auxiliary data.

[0086] S260. Group the second biometric features in the form of bit strings according to the target operating parameters.

[0087] S270. Based on each second group in the second biometric feature, perform an XOR operation on the second group and the commitment value of the first group at the corresponding position to obtain an encoded second key.

[0088] In the embodiment of the present invention, after obtaining the grouping of the second biometric feature, based on each second group in the second biometric feature, an XOR operation is performed on the second group and the commitment value of the first group at the corresponding position to obtain the encoded second key.

[0089] In a specific example, the blocks_stream of the second biometric feature and the encoded_keys' of the first biometric feature are input, and based on each group of blocks_stream and encoded_keys' at the corresponding position, they are XORed pairwise to obtain the encoded second key encoded_keys, that is, encoded_keys[i]=XOR(blocks_stream[i], encoded_keys'[i]).

[0090] S280. Decode the encoded second key to obtain the second key.

[0091] In an embodiment of the present invention, the encoded second key is decoded to obtain the second key. Exemplarily, each group of codewords is decoded using a Reed-Solomon code to obtain a key codeword string key_words_stream, that is, key_words_stream = Decode(encode_keys[0]),...,Decode(encode_keys[blocks_stream_length-1]). If the decoding fails, or the codeword value in key_words_stream is not between [0,255], an error is reported and the program exits; otherwise, key_words_stream is converted into the second key key.

[0092] S290, calculating a second key hash value of the second key, and comparing the second key hash value with the first key hash value at a corresponding position, and determining whether the first biometric feature matches the second biometric feature according to the comparison result.

[0093] In the embodiment of the present invention, after obtaining the second key, the second key is hashed to obtain the second key hash value, and the second key hash value is compared with the first key hash value at the corresponding position, and whether the first biometric and the second biometric match is determined based on the comparison result. In the commitment stage and the recovery stage, the input biometric bit string is divided into codewords and groups, and data error correction is performed on each group of biometrics in units of codewords, thereby avoiding efficiency loss due to excessively long features, saving computing resources and improving efficiency while ensuring the realization of biometric template protection and key generation functions.

[0094] The technical solution of the embodiment of the present invention groups the first biometric feature in the form of a bit string according to the target operating parameters, and then generates a first key corresponding to the first group based on each first group in the first biometric feature, and determines the auxiliary data of the first group based on the first key. Furthermore, according to the target operating parameters, the second biometric feature in the form of a bit string is grouped, and the first biometric feature and the second biometric feature are matched and verified based on the second group in the second biometric feature and the auxiliary data of the first group at the corresponding position in the first biometric feature. By grouping the biometric features, higher efficiency is achieved in processing long features with less precision loss.

[0095] Embodiment 3

[0096] Figure 3 This is a schematic diagram of the structure of a biometric template protection device provided in Embodiment 3 of the present invention. Figure 3 As shown, the device comprises:

[0097] A first grouping module 310, configured to group the first biometric feature in the form of a bit string according to target operating parameters; the target operating parameters include the number of bits contained in each codeword, the number of codewords contained in each group, and the number of error-corrected codewords in each group;

[0098] The auxiliary data determination module 320 is used to generate a first key corresponding to the first group based on each first group in the first biometric feature, and determine the auxiliary data of the first group according to the first key;

[0099] A second grouping module 330, for grouping the second biometric features in the form of bit strings according to the target operating parameters;

[0100] The matching verification module 340 is used to perform matching verification on the first biometric feature and the second biometric feature based on the second group in the second biometric feature and the auxiliary data of the first group at the corresponding position in the first biometric feature.

[0101] The technical solution of the embodiment of the present invention groups the first biometric feature in the form of a bit string according to the target operating parameters, and then generates a first key corresponding to the first group based on each first group in the first biometric feature, and determines the auxiliary data of the first group according to the first key. Furthermore, according to the target operating parameters, the second biometric feature in the form of a bit string is grouped, and the first biometric feature and the second biometric feature are matched and verified based on the second group in the second biometric feature and the auxiliary data of the first group at the corresponding position in the first biometric feature. By grouping the biometric features, the efficiency loss caused by the excessive length of the features is avoided, the computing resources are saved, and the matching efficiency is improved.

[0102] Optionally, the auxiliary data determination module 320 includes:

[0103] A key length determination unit, used to determine the key byte length of each group according to the number of code words contained in each group and the number of code words for error correction of each group in the target operation parameter;

[0104] The first key generating unit is used to generate a random bit string as a first key corresponding to the first group based on each first group in the first biometric feature and according to the key byte length.

[0105] Optionally, the auxiliary data determination module 320 further includes:

[0106] A first key hash determination unit, configured to perform hash calculation on the first key to obtain a first key hash value;

[0107] The auxiliary data determination unit is used to bind the biometric feature of the first group and the first key corresponding to the first group to obtain the commitment value of the first group, and use the first key hash value and the commitment value as auxiliary data of the first group.

[0108] Optionally, the auxiliary data determination unit is specifically used to:

[0109] Encode the first key corresponding to each first group to obtain a first encoded key;

[0110] An XOR operation is performed on the first encoding key and the biometric feature of the first group to obtain a commitment value of the first group.

[0111] Optionally, the matching verification module 340 is specifically used for:

[0112] Based on each second group in the second biometric feature, perform an XOR operation on the second group and the commitment value of the first group at the corresponding position to obtain an encoded second key;

[0113] Decoding the encoded second key to obtain a second key;

[0114] A second key hash value of the second key is calculated, and the second key hash value is compared with the first key hash value at a corresponding position, and according to the comparison result, it is determined whether the first biometric feature matches the second biometric feature.

[0115] Optionally, the biometric template protection device also includes:

[0116] a performance determination module, configured to use the initial operation parameter as the current operation parameter before grouping the first biometric feature in the form of a bit string according to the target operation parameter, and perform a plurality of matching verification operations on the first biometric feature and the second biometric feature based on the current operation parameter to determine the execution performance corresponding to the current operation parameter;

[0117] an accuracy determination module, configured to perform a plurality of feature comparison operations on the first biometric feature and the second biometric feature according to the current operating parameters, and determine a matching accuracy corresponding to the current operating parameters;

[0118] The target operating parameter determination module is used to increase the number of bits contained in each codeword in the current operating parameters, or reduce the number of codewords contained in each group, to obtain new current operating parameters when the execution performance does not meet the requirements but the matching accuracy meets the requirements, and return to execute the matching verification operations of multiple pairs of the first biometric feature and the second biometric feature based on the current operating parameters until the current operating parameters that meet the requirements of both execution performance and matching accuracy are determined as the target operating parameters.

[0119] Optional, precision determination module, specifically used for:

[0120] grouping a plurality of pairs of biometric features in bit string form according to the current operating parameters;

[0121] In each group of corresponding positions of a pair of biometric features, the codewords are compared one by one, and the matching accuracy corresponding to the current operating parameters is determined according to the comparison result.

[0122] The biometric template protection device provided in the embodiment of the present invention can execute the biometric template protection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0123] In the technical solution of the present invention, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0124] Embodiment 4

[0125] According to an embodiment of the present invention, the present invention also provides an electronic device, a readable storage medium and a computer program product.

[0126] Figure 4A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, applicators, blade applicators, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0127] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0128] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0129] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 performs the various methods and processes described above, such as a biometric template protection method.

[0130] In some embodiments, the biometric template protection method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the biometric template protection method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the biometric template protection method in any other appropriate manner (e.g., by means of firmware).

[0131] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0132] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or application.

[0133] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0134] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0135] The systems and techniques described herein may be implemented in a computing system that includes a backend component (e.g., as a data applier), or a computing system that includes a middleware component (e.g., an application applier), or a computing system that includes a frontend component (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0136] A computing system may include a client and an application server. The client and the application server are generally remote from each other and usually interact through a communication network. The relationship between the client and the application server is generated by computer programs running on corresponding computers and having a client-application server relationship with each other. The application server may be a cloud application server, also known as a cloud computing application server or a cloud host, which is a host product in a cloud computing application system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS applications.

[0137] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0138] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A biometric template protection method, characterized in that: include: grouping the first biometric feature in the form of a bit string according to the target operating parameter; The target operating parameters include the number of bits contained in each codeword, the number of codewords contained in each group, and the number of codewords corrected in each group; Based on each first group in the first biometric feature, generate a first key corresponding to the first group, and determine auxiliary data of the first group according to the first key; grouping the second biometric feature in the form of a bit string according to the target operating parameter; Based on the second group in the second biometric feature and the auxiliary data of the first group at the corresponding position in the first biometric feature, the first biometric feature and the second biometric feature are matched and verified.

2. The method according to claim 1, characterized in that Generating a first key corresponding to each first group in the first biometric feature includes: Determine the key byte length of each group according to the number of code words contained in each group and the number of code words corrected by each group in the target operation parameter; Based on each first group in the first biometric feature, a random bit string is generated according to the key byte length as a first key corresponding to the first group.

3. The method according to claim 1, characterized in that Determining auxiliary data of a first group according to the first key includes: Performing hash calculation on the first key to obtain a first key hash value; The biometric feature of the first group is bound to the first key corresponding to the first group to obtain a commitment value of the first group, and the first key hash value and the commitment value are used as auxiliary data of the first group.

4. The method according to claim 3, characterized in that Binding the biometric feature of the first group and the first key corresponding to the first group to obtain a commitment value of the first group includes: Encode the first key corresponding to each first group to obtain a first encoded key; An XOR operation is performed on the first encoding key and the biometric feature of the first group to obtain a commitment value of the first group.

5. The method according to claim 3, characterized in that Based on the second group in the second biometric feature and the auxiliary data of the first group at the corresponding position in the first biometric feature, matching verification is performed on the first biometric feature and the second biometric feature, including: Based on each second group in the second biometric feature, perform an XOR operation on the second group and the commitment value of the first group at the corresponding position to obtain an encoded second key; Decoding the encoded second key to obtain a second key; A second key hash value of the second key is calculated, and the second key hash value is compared with the first key hash value at a corresponding position, and according to the comparison result, it is determined whether the first biometric feature matches the second biometric feature.

6. The method according to claim 1, characterized in that Before grouping the first biometric feature in the bit string form according to the target operation parameter, the method further includes: Using the initial operating parameters as current operating parameters, and based on the current operating parameters, performing a plurality of matching verification operations of the first biometric feature and the second biometric feature to determine the execution performance corresponding to the current operating parameters; According to the current operating parameters, performing feature comparison operations on a plurality of pairs of first biometric features and second biometric features to determine a matching accuracy corresponding to the current operating parameters; When the execution performance does not meet the requirements but the matching accuracy meets the requirements, the number of bits contained in each codeword in the current operating parameters is increased, or the number of codewords contained in each group is reduced to obtain new current operating parameters, and the execution is returned to perform matching verification operations on multiple pairs of the first biometric feature and the second biometric feature based on the current operating parameters until the current operating parameters that meet the requirements in both execution performance and matching accuracy are determined as the target operating parameters.

7. The method according to claim 6, characterized in that According to the current operating parameters, performing a plurality of feature comparison operations on the first biometric feature and the second biometric feature to determine a matching accuracy corresponding to the current operating parameters includes: grouping a plurality of pairs of biometric features in bit string form according to the current operating parameters; In each group of corresponding positions of a pair of biometric features, the codewords are compared one by one, and the matching accuracy corresponding to the current operating parameters is determined according to the comparison result.

8. A biometric template protection device, characterized in that: include: A first grouping module, configured to group the first biometric feature in the form of a bit string according to the target operating parameter; The target operating parameters include the number of bits contained in each codeword, the number of codewords contained in each group, and the number of codewords corrected in each group; an auxiliary data determination module, configured to generate a first key corresponding to the first group based on each first group in the first biometric feature, and determine auxiliary data of the first group according to the first key; A second grouping module, configured to group the second biometric features in the form of bit strings according to the target operating parameters; The matching verification module is used to perform matching verification on the first biometric feature and the second biometric feature based on the second group in the second biometric feature and the auxiliary data of the first group at the corresponding position in the first biometric feature.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the biometric template protection method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the biometric template protection method according to any one of claims 1 to 7 when executed.

Images