Biometric-based data signing method and apparatus, computer device, and medium

Abstract

The application relates to the technical field of data signature, in particular to a data signature method and device based on biological characteristics, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: collecting at least one biological characteristic of a user in the case that user login authentication is passed; generating an SM2 public key according to the at least one biological characteristic of the user, and registering the SM2 public key to a cloud platform; collecting real-time biological characteristics of the user before data signature; generating real-time private keys of the user according to the real-time biological characteristics and the SM2 public key; and performing data signature by using the real-time private keys. By using the method, a data signature mode without storing private keys can be realized, so that the data security is improved, and the private key management problem is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data signature, in particular to a data signature method and device based on biological characteristics, computer equipment, computer readable storage medium and computer program product. BACKGROUND

[0002] In today's digital age, data security has become a global focus. SM2 encryption algorithm, as a kind of public key cryptography technology based on elliptic curve, plays an important role in the field of information security with its high security and efficiency.

[0003] However, the storage and management of private keys in traditional encryption technology has always been a problem. Once the private key is lost or stolen, it will seriously threaten data security. Therefore, it is urgent to provide a data signature method, device, computer equipment, computer readable storage medium and computer program product based on biological characteristics, which can realize the data signature method without storing the private key, thereby improving the data security and solving the problem of private key management. SUMMARY

[0004] Therefore, it is necessary to provide a data signature method, device, computer equipment, computer readable storage medium and computer program product based on biological characteristics, which can realize the data signature method without storing the private key, thereby improving the data security and solving the problem of private key management.

[0005] In a first aspect, the present application provides a data signature method based on biological characteristics, comprising:

[0006] In the case that the user login authentication is passed, at least one user's biological characteristics are collected;

[0007] According to at least one user's biological characteristics, an SM2 public key is generated, and the SM2 public key is registered in the cloud platform;

[0008] Before data signature, the real-time biological characteristics of the user are collected;

[0009] According to the real-time biological characteristics and the SM2 public key, the real-time private key of the user is generated;

[0010] The real-time private key is used for data signature.

[0011] In one embodiment, the SM2 public key is generated according to at least one user's biological characteristics, comprising:

[0012] The data cleaning and data correction are performed on at least one user's biological characteristics to obtain public biological characteristics;

[0013] The feature coding is performed on the public biological characteristics to obtain the SM2 private key;

[0014] According to the SM2 private key, an SM2 public key corresponding to the SM2 private key in the SM2 key pair is generated by using an SM2 encryption algorithm.

[0015] In one of the embodiments, after the data cleaning and data correction of the biological characteristics of the at least one user are performed and the public biological characteristics are obtained, the method further comprises:

[0016] According to the public biological characteristics and the biological characteristics of the at least one user, a graph correction parameter of the biological characteristics is obtained, and the graph correction parameter is uploaded to the cloud platform.

[0017] In one of the embodiments, before the real-time private key of the user is generated according to the real-time biological characteristics and the SM2 public key, the method further comprises:

[0018] The real-time biological characteristics are data cleaned, and the data cleaned real-time biological characteristics are data corrected according to the graph correction parameter.

[0019] In one of the embodiments, the real-time private key of the user is generated according to the real-time biological characteristics and the SM2 public key, which comprises:

[0020] The biological characteristic data and the SM2 public key are mapped to a feature space;

[0021] The biological characteristic data is converted into key data by using a key derivation function;

[0022] The corresponding SM2 public key and the key data are collided in the feature space by using a key collision algorithm, so as to obtain the real-time private key of the user.

[0023] In one of the embodiments, the SM2 public key is represented by 64 bytes of feature data, and the SM2 private key is represented by 32 bytes of feature data.

[0024] In a second aspect, the application further provides a biological characteristic-based data signature device, which comprises:

[0025] A biological characteristic acquisition module is configured to acquire biological characteristics of at least one user in the case that the user login authentication is passed;

[0026] A key calculation module is configured to generate an SM2 public key according to the biological characteristics of the at least one user, and an uploading module is configured to register the SM2 public key to a cloud platform;

[0027] The biological characteristic acquisition module is further configured to acquire real-time biological characteristics of the user before data signature is performed;

[0028] The key calculation module is further configured to generate a real-time private key of the user according to the real-time biometric feature and the SM2 public key;

[0029] The signature module is configured to perform data signature by using the real-time private key.

[0030] In a third aspect, the present application provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0031] collecting at least one biometric feature of the user in the case that the user login authentication is passed;

[0032] generating an SM2 public key according to the at least one biometric feature of the user, and registering the SM2 public key into a cloud platform;

[0033] collecting a real-time biometric feature of the user before performing data signature;

[0034] generating a real-time private key of the user according to the real-time biometric feature and the SM2 public key;

[0035] performing data signature by using the real-time private key.

[0036] In a fourth aspect, the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the following steps:

[0037] collecting at least one biometric feature of the user in the case that the user login authentication is passed;

[0038] generating an SM2 public key according to the at least one biometric feature of the user, and registering the SM2 public key into a cloud platform;

[0039] collecting a real-time biometric feature of the user before performing data signature;

[0040] generating a real-time private key of the user according to the real-time biometric feature and the SM2 public key;

[0041] performing data signature by using the real-time private key.

[0042] In a fifth aspect, the present application provides a computer program product, comprising a computer program, and the computer program is executed by a processor to implement the following steps:

[0043] collecting at least one biometric feature of the user in the case that the user login authentication is passed;

[0044] generating an SM2 public key according to the at least one biometric feature of the user, and registering the SM2 public key into a cloud platform;

[0045] acquiring real-time biometric features of the user before data signing;

[0046] generating a real-time private key of the user according to the real-time biometric features and the SM2 public key;

[0047] performing data signing by using the real-time private key.

[0048] The above-mentioned biometric feature-based data signing method, device, computer equipment, computer readable storage medium and computer program product, in traditional encryption technology, the storage and management of the private key is a challenge. The present method combines biometric features and SM2 encryption algorithm to generate a private key in real time, avoiding long-term storage of the private key, simplifying private key management, reducing the risk of private key leakage, and enhancing data security. In the data signing process, real-time biometric features of the user are collected to generate a real-time private key. This method has high real-time and dynamic performance, making each signature based on the user's current biometric features, increasing the security of the signature. User login authentication is performed using biometric features, improving the strength of identity verification, as biometric features are unique and difficult to copy and forge. This method reflects the latest developments in data security technology, such as the combination of biometric recognition technology and asymmetric cryptography, and the use of the high security and efficiency of the SM2 algorithm, promoting the development of data security technology.

[0049] In summary, the biometric feature-based data signing method combines advanced biometric recognition technology and SM2 encryption algorithm, not only improving data security and solving the problem of private key management, but also enhancing the strength of user identity authentication, with high practical value and broad application prospects. BRIEF DESCRIPTION OF DRAWINGS

[0050] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the following will briefly introduce the drawings needed to be used in the description of the embodiments of the present application or the related art. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0051] Figure 1 An application environment diagram of the biometric feature-based data signing method in one embodiment;

[0052] Figure 2 A flowchart of the biometric feature-based data signing method in one embodiment;

[0053] Figure 3 A flowchart of the biometric feature-based data signing method in another embodiment;

[0054] Figure 4 The overall timing interaction diagram of the biometric feature based data signature method in the most detailed embodiment;

[0055] Figure 5 The flowchart of the data signature in the most detailed embodiment;

[0056] Figure 6 The structural block diagram of the biometric feature based data signature device in an embodiment;

[0057] Figure 7 The internal structure diagram of the computer device in an embodiment. DETAILED DESCRIPTION

[0058] In order to make the purposes, technical solutions and advantages of the present application clearer, the present application is further described in detail below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0059] The biometric feature based data signature method provided by the embodiments of the present application can be applied in the application environment as shown in the figure. Figure 1 The terminal 102 communicates with the server 104 through the network. The data storage system can store the data required to be processed by the server 104. The data storage system can be integrated on the server 104, or placed on the cloud or other network servers.

[0060] In the case that the user login authentication is passed, at least one user's biometric feature is collected by the terminal 102; the server 104 generates an SM2 public key according to the at least one user's biometric feature, and registers the SM2 public key to the cloud platform; before data signature, the real-time biometric feature of the user is collected by the terminal 102; the server 104 generates the real-time private key of the user according to the real-time biometric feature and the SM2 public key; and the data signature is performed by using the real-time private key.

[0061] The terminal 102 can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things device can be a smart speaker, a smart television, a smart air conditioner, a smart vehicle device, a projection device, etc. The portable wearable device can be a smart watch, a smart bracelet, a head-mounted device, etc. The head-mounted device can be a virtual reality (VR) device, an augmented reality (AR) device, smart glasses, etc. The server 104 can be a stand-alone physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0062] In one exemplary embodiment, as shown in Figure 2 a biometric-based data signing method is provided, which is applied to the server 104 in Figure 1 for example, including the following steps S202 to S210. Among them:

[0063] Step S202, in the case of user login authentication, at least one user's biometric features are collected.

[0064] Specifically, the user first needs to log in and authenticate through the identity management platform (which can be a cloud platform in this application). This usually involves traditional authentication methods such as username and password, SMS verification code, secondary verification, etc. to ensure the authenticity of the user's identity.

[0065] After the user successfully logs in, the system will ask the user to collect at least one biometric data. "At least one" here means that one or more biometric features can be collected to increase security and reliability. Biometric features may include but are not limited to fingerprints, iris, facial recognition, voiceprint, etc.

[0066] The collected biometric data will be used in the subsequent key generation and data signing process. The purpose of this step is to ensure that only authenticated users can generate private keys related to their biometric features, thereby signing data. Biometric features are unique to users and difficult to copy and fake, so using biometric features as the basis for generating keys can improve the security of the entire signing process.

[0067] Step S204, according to at least one user's biometric features, generate an SM2 public key, and register the SM2 public key to the cloud platform.

[0068] Specifically, after the user logs in and passes the identity authentication, the system will collect the user's biometric data. Analyze these biometric data and extract key feature values from them. Using these feature values, the key calculation module will generate an SM2 private key and generate a corresponding SM2 public key based on this private key.

[0069] SM2 is an elliptic curve-based public-key cryptography algorithm that can generate a unique public key for each private key. The public key can be publicly disclosed for encrypting data or verifying data signed by the corresponding private key. The user sends the generated SM2 public key to the cloud platform. The cloud platform receives the public key and binds it with the user's account or identity information, completing the registration process. This step ensures the association of the public key with the user's identity, allowing the public key to be trusted for subsequent data signature verification. Registering the public key with the cloud platform ensures the verifiability and non-repudiation of the public key. The cloud platform can serve as a trusted third party to store and manage user public keys, while providing public key query and verification services. The registered SM2 public key will be used in the data signature verification process. When the user signs data using the private key, anyone can use the corresponding public key to verify the validity of the signature.

[0070] Step S206, before data signing, real-time biometric features of the user are collected.

[0071] Specifically, when the data signing operation occurs, real-time biometric data of the user needs to be collected. This means that each time data signing is performed, the user needs to provide their biometric features, such as fingerprints, facial recognition, iris scanning, etc., on site.

[0072] Real-time collection of biometric features can ensure that the signing operation is performed by the user themselves, thereby enhancing the security of the signature. This approach can effectively prevent private keys from being misused or copied, as each signature requires the user to personally provide their biometric features. The collected real-time biometric data will be used to generate or restore the user's private key.

[0073] Before data signing, the system will verify whether the collected biometric features match the previously registered biometric features. This verification process ensures that only authenticated users can perform data signing. Since each signature is based on the user's real-time biometric features, it means that each generated private key may be unique, thereby achieving one-time use of the private key, which helps prevent the private key from being reused or misused.

[0074] Step S208, according to the real-time biometric features and the SM2 public key, a real-time private key of the user is generated.

[0075] Specifically, the SM2 public key is the one previously registered by the user to the cloud platform and is bound to the user's identity. The public key can be publicly disclosed for encrypting data or verifying data signed by the corresponding private key. Using the user's real-time biometric feature data and the SM2 public key, a corresponding real-time private key is generated through a specific key generation algorithm. Each generated private key is only used for the current signing operation and is not used thereafter, which helps prevent the private key from being reused or misused, reduces the risk of private key leakage, and improves the security and privacy protection of data.

[0076] The key generation algorithm involves biometric recognition technology, cryptographic algorithms, key derivation functions (KDF), etc., which collectively act on the conversion of biometric data into a private key.

[0077] At step S210, data signing is performed using the real-time private key.

[0078] Specifically, in a public key cryptography system, a private key is used to encrypt data or generate a digital signature. The private key is confidential and only known to the data signer and verifier. In a biometric-based data signing method, the private key is not pre-generated and stored, but is dynamically generated based on the user's real-time biometric features when signing is needed.

[0079] The user or system uses this real-time generated private key to sign the data. This process usually involves generating a fixed length hash value from the data through a hash function, and then encrypting the hash value using the private key. After signing, anyone can use the corresponding public key to verify the signature. The verification process includes using the public key to decrypt the signature and comparing the decrypted result with the hash value of the original data. If they match, the signature is considered valid.

[0080] Since the private key is dynamically generated, a different private key is used for each signature, which greatly increases the difficulty for attackers to crack the signature, because even if the attacker obtains the private key of a signature, it cannot be used for signature verification of other data.

[0081] In the above biometric-based data signing method, by combining biometric features and SM2 encryption algorithm, the private key is generated in real time, avoiding long-term storage of the private key, simplifying private key management, and reducing the risk of private key leakage, enhancing the security of the data. In the data signing process, the real-time private key is generated by collecting the user's real-time biometric features, which has high real-time and dynamic characteristics, so that each signature is based on the user's current biometric features, increasing the security of the signature. User login authentication is performed using biometric features, which improves the strength of identity verification, as biometric features are unique and difficult to copy and fake. This method reflects the latest developments in data security technology, such as the combination of biometric recognition technology and asymmetric cryptography, as well as the use of the high security and efficiency of the SM2 algorithm, promoting the development of data security technology.

[0082] In an exemplary embodiment, as shown in Figure 3 According to at least one user's biometric features, an SM2 public key is generated, including:

[0083] At step S302, data cleaning and data correction are performed on at least one user's biometric features to obtain public biometric features.

[0084] Step S304, feature encoding is performed on the public biological feature to obtain an SM2 private key;

[0085] Step S306, according to the SM2 private key, an SM2 public key corresponding to the SM2 private key in the SM2 key pair is generated by using an SM2 encryption algorithm.

[0086] Specifically, data cleaning refers to removing noise and irrelevant information in the biological feature data to ensure that the data used to generate the key is accurate and reliable. Then the cleaned data is corrected to correct any possible bias or error, ensuring the consistency and accuracy of the biological feature data.

[0087] After cleaning and correction, the obtained data is called a public biological feature, which is the original data used to generate the key. The public biological feature is converted into a format suitable for key generation; for example, the biological feature data is mapped to a numerical value or a string, which will serve as the basis for the SM2 private key. Using the feature-encoded data, an SM2 private key is generated by a specific key generation algorithm. This private key is randomly generated, but is associated with the user's biological feature, ensuring the uniqueness and security of the key.

[0088] According to the SM2 private key, the corresponding SM2 public key is generated using the SM2 encryption algorithm. The SM2 encryption algorithm is based on elliptic curve cryptography (ECC), which uses a specific elliptic curve and mathematical operations to generate a key pair, the SM2 key pair includes a private key and a public key. The private key is used for signing, and the public key is used for verifying the signature or encrypting data. By combining the biological feature with the SM2 encryption algorithm, a secure and convenient key management method can be provided. The generated SM2 public key needs to be registered to the cloud platform or identity management platform for use in the data signature and verification process.

[0089] In this embodiment, through the above public key generation process, not only the security of key management is improved, but also the problem of traditional key storage and management is solved, because the private key does not need to be stored for a long time, but is dynamically generated, and each generated private key is associated with the real-time biological feature of the user. This method reduces the risk of private key misuse and improves the overall security of the system.

[0090] In an exemplary embodiment, after obtaining the public biological feature by data cleaning and data correction on at least one user's biological feature, the method further comprises:

[0091] According to the public biological feature and the at least one user's biological feature, a graph correction parameter of the biological feature is obtained, and the graph correction parameter is uploaded to the cloud platform.

[0092] In particular, based on the public biometric feature and at least one user's biometric feature, the system analyzes the differences between the two to obtain graphical correction parameters. These parameters are used to adjust and correct the biometric feature data to ensure consistency and comparability of biometric feature data collected at different time points. Uploading the obtained graphical correction parameters to the cloud platform ensures that the graphical correction parameters can be retrieved and used when needed, especially during the data signing process, to ensure the accuracy and consistency of biometric feature data.

[0093] Graphical correction parameters play a key role in the data signing process, helping the system adjust and correct the collected data when the user performs real-time biometric feature collection to match the previously registered biometric feature data. Uploading the graphical correction parameters to the cloud platform ensures that the user's biometric feature data can be accurately identified and processed in different devices and environments, thereby improving the security and consistency of the system. During the data signing process, the system uses these graphical correction parameters and the user's real-time biometric feature data to generate or recover the corresponding private key, and then signs the data using this private key. The cloud platform is responsible for storing and managing the user's graphical correction parameters to ensure their security and privacy, while providing fast access when needed.

[0094] In this embodiment, through this process, the system can ensure that the private key generated each time is based on the user's current biometric feature data and consistent with the previously registered biometric feature data, thereby improving the security and reliability of the entire signing process.

[0095] In an exemplary embodiment, before generating the user's real-time private key based on the real-time biometric feature and the SM2 public key, it includes:

[0096] Data cleaning is performed on the real-time biometric feature, and data correction is performed on the data cleaned real-time biometric feature based on the graphical correction parameters.

[0097] In particular, the purpose of data cleaning is to remove noise and irrelevant information in real-time biometric feature data, such as background noise, illumination changes, blurring, etc. in images, to ensure that the data used to generate the private key is accurate and reliable. Data cleaning includes image enhancement, filtering, normalization, etc. to improve the quality of biometric feature data.

[0098] Adjusting the real-time collected biometric feature data based on the graphical correction parameters, the purpose of data correction is to adjust the cleaned biometric feature data to maintain consistency with the previously registered biometric feature data. Data correction includes scaling, rotation correction, alignment, etc. These operations are performed based on the graphical correction parameters previously uploaded to the cloud platform.

[0099] The graph correction parameters are obtained when the user registers the biometric feature, describing how to adjust the real-time collected biometric feature data to the same standard as when registering. Before data signing, the system retrieves these parameters from the cloud platform and applies them to the correction process of real-time biometric feature data.

[0100] In this embodiment, through data cleaning and correction, it is ensured that each collected biometric feature data is consistent and comparable, which can improve the efficiency of private key generation and make the entire signing process more rapid and smooth. After data cleaning and correction, the real-time private key is generated according to the biometric feature data adjusted according to the graph correction parameters and the SM2 public key. This real-time private key will be used in the subsequent data signing process, which enhances the security of the system because only the biometric feature data that has been correctly corrected can be used to generate the private key, reducing the security risks caused by data quality problems.

[0101] In an exemplary embodiment, generating a real-time private key of a user according to real-time biometric feature and SM2 public key comprises:

[0102] Mapping the biometric feature data and the SM2 public key into a feature space; converting the biometric feature data into key data using a key derivation function; finding a corresponding SM2 public key colliding with the key data in the feature space using a key collision algorithm to obtain the real-time private key of the user.

[0103] Specifically, first, the real-time collected biometric feature data (such as fingerprint, iris, face recognition, etc.) needs to be digitized and mapped into a feature space. This feature space is a mathematical model used to represent and process biometric feature data. At the same time, the SM2 public key also needs to be mapped into the same feature space. This step ensures that the public key and the biometric feature data can be operated in the same mathematical framework.

[0104] The biometric feature data is converted into key data using a key derivation function. KDF is a cryptographic algorithm that accepts various inputs (such as passwords, biometric feature data, etc.) and produces a fixed-length key. The use of KDF increases the security of the key generation process, as it converts the biometric feature data into a key format suitable for encryption.

[0105] In the feature space, a key collision algorithm is used to find an SM2 public key that matches the key data. The key collision algorithm attempts to find a public key in the feature space that matches the given key data. Once a matching public key is found, the algorithm will use this public key and the key data to generate the real-time private key of the user. This process may involve some mathematical operations, such as point multiplication on an elliptic curve.

[0106] Through the above steps, the final generated real-time private key is associated with the user's real-time biometric features and SM2 public key. This private key is only valid in the current session and is used to sign data. This method ensures that a dynamically generated private key based on real-time biometric features is used for each signature, increasing the difficulty of cracking and improving security. Since the private key is not stored permanently, but is dynamically generated each time based on real-time biometric features, this reduces the risk of private key misuse.

[0107] In this embodiment, using biometric data and SM2 public key, through key derivation function and key collision algorithm, the real-time private key of the user is dynamically generated in the feature space for data signature. This method improves the security and reliability of the signature, and solves the problem of traditional key management.

[0108] In an exemplary embodiment, the SM2 public key is represented by 64 bytes of feature data, and the SM2 private key is represented by 32 bytes of feature data.

[0109] Specifically, the SM2 public key is usually represented as a point on an elliptic curve, which consists of a pair of coordinates (x, y). In the SM2 algorithm, these two coordinate values are usually defined on a specific finite field, such as a prime field or a binary field. The length of 64 bytes (i.e. 512 bits) means that each coordinate value (x and y) can use 256 bits to represent, because in binary representation, each byte contains 8 bits. This representation method ensures that the public key has enough space to store the point coordinates on the elliptic curve, so that it can be used for encryption and signature verification.

[0110] The SM2 private key is a randomly selected integer, usually represented as a 256-bit number. This number must be kept secret because it is used to generate signatures and decrypt data. The length of 32 bytes (i.e. 256 bits) provides sufficient randomness and security for the private key, ensuring the security of the private key and the anti-cracking ability of the algorithm.

[0111] In this embodiment, using 64-byte public keys and 32-byte private keys, the SM2 algorithm can provide smaller key sizes compared to other encryption algorithms (such as RSA) while maintaining high security, which helps to improve the efficiency of encryption and signature operations.

[0112] As Figure 4 shown, the most detailed embodiment of the present application includes:

[0113] a) The user logs in to the identity management platform or cloud platform to obtain personal data for identity authentication.

[0114] b) In the case of passing the authentication, the biometric data (including fingerprint, iris, etc.) is collected multiple times.

[0115] c) generating an SM2 key pair using the multiple times collected biometric data, the SM2 public-private key pair including an SM2 public key and an SM2 private key.

[0116] d) uploading the SM2 public key to an identity management platform or a cloud platform for binding.

[0117] e) before the user signs, the user logs in to the identity management platform or the cloud platform, and in the case of authentication passing, collects real-time biometric features.

[0118] f) according to the real-time biometric features, the SM2 public key is called to generate real-time private keys through key collision.

[0119] g) using the generated real-time private key to sign the data.

[0120] Among them, the image data corresponding to the multiple times collected biometric data is data cleaned and data corrected to generate public biometric features; and each public biometric feature is feature encoded; 32 byte feature values are taken as SM2 private keys, and then SM2 calculation is performed to generate corresponding SM2 public keys, and 64 byte feature values are taken as SM2 public keys; wherein the graphic correction parameters are output in the process of data correction. The graphic correction parameters and the SM2 public key are sent to the cloud platform for registration and binding at the same time.

[0121] Among them, as shown in Figure 5 , after the user logs in to the identity management platform or the cloud platform, the biometric features are collected, the corresponding image data is data cleaned, and the SM2 public key and the graphic correction parameters are obtained; the graphic correction parameters are used for data correction; the corrected biometric feature data is used for feature extraction, and then the real-time SM2 private key is collided out by using the key calculation module and the SM2 public key, and the data is signed by using the real-time SM2 private key.

[0122] It should be understood that although each step in the flowchart involved in each embodiment as described above is displayed in sequence according to the direction of the arrow, these steps are not necessarily executed in sequence according to the direction of the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other orders. Moreover, at least part of the steps in the flowchart involved in each embodiment as described above can include multiple steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of these steps or stages is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or steps or stages in other steps.

[0123] Based on the same inventive concept, the embodiments of the present application also provide a biometric feature-based data signature device for implementing the above-mentioned biometric feature-based data signature method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme described in the above-mentioned method, so the specific limitations in one or more biometric feature-based data signature device embodiments provided below can refer to the limitations of the biometric feature-based data signature method in the above, which will not be repeated here.

[0124] In one exemplary embodiment, as shown in Figure 6 a biometric feature-based data signature device is provided, comprising:

[0125] The biometric feature acquisition module 602 is configured to acquire at least one biometric feature of a user if the user login authentication is passed.

[0126] The key calculation module 604 is configured to generate an SM2 public key according to the at least one biometric feature of the user, and the uploading module 606 is configured to register the SM2 public key in a cloud platform.

[0127] The biometric feature acquisition module 602 is further configured to acquire a real-time biometric feature of the user before data signature.

[0128] The key calculation module 604 is further configured to generate a real-time private key of the user according to the real-time biometric feature and the SM2 public key.

[0129] The signature module 608 is configured to perform data signature by using the real-time private key.

[0130] In one exemplary embodiment, the key calculation module 604 is further configured to perform feature coding on the public biometric feature to obtain an SM2 private key, and generate an SM2 public key corresponding to the SM2 private key in the SM2 key pair by using an SM2 encryption algorithm according to the SM2 private key.

[0131] In one exemplary embodiment, the processing module is configured to obtain a graph correction parameter of the biometric feature according to the public biometric feature and the at least one biometric feature of the user, and the uploading module 606 is further configured to upload the graph correction parameter to the cloud platform.

[0132] In one exemplary embodiment, the processing module is further configured to perform data cleaning on the real-time biometric feature, and perform data correction on the data cleaned real-time biometric feature according to the graph correction parameter.

[0133] In an example embodiment, the key calculation module 604 is further configured to map the biometric data and the SM2 public key into a feature space; convert the biometric data into key data by using a key derivation function; and find a corresponding SM2 public key colliding with the key data in the feature space by using a key collision algorithm, to obtain a real-time private key of the user.

[0134] In an example embodiment, the SM2 public key is represented by 64 bytes of feature data, and the SM2 private key is represented by 32 bytes of feature data.

[0135] The above modules in the biometric-based data signature apparatus can be implemented wholly or partially by software, hardware, and combinations thereof. The above modules can be embedded in or independent of a processor in a computer device in hardware form, or stored in a memory in the computer device in software form, so as to be called and executed by a processor to perform operations corresponding to the above modules.

[0136] In an example embodiment, a computer device is provided, which can be a server, and an internal structure diagram of the computer device can be as shown in Figure 7 The computer device includes a processor, a memory, an input / output interface (I / O), and a communication interface. The processor, the memory, and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The database of the computer device is configured to store biometric features, SM2 public keys, and graphical correction parameters of users. The input / output interface of the computer device is configured to exchange information between the processor and external devices. The communication interface of the computer device is configured to communicate with terminals outside through a network connection. The computer program is executed by the processor to implement a biometric-based data signature method.

[0137] Those skilled in the art can understand that Figure 7 the structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. A specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0138] In an example embodiment, a computer device is provided, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the following steps:

[0139] collecting at least one biological feature of the user in the case of passing of the user login authentication;

[0140] generating an SM2 public key according to the at least one biological feature of the user and registering the SM2 public key into a cloud platform;

[0141] collecting a real-time biological feature of the user before data signing;

[0142] generating a real-time private key of the user according to the real-time biological feature and the SM2 public key;

[0143] performing data signing by using the real-time private key.

[0144] In an embodiment, the processor, when executing the computer program, further implements the following steps:

[0145] performing data cleaning and data correction on the at least one biological feature of the user to obtain a public biological feature;

[0146] performing feature coding on the public biological feature to obtain an SM2 private key;

[0147] generating an SM2 public key corresponding to the SM2 private key in the SM2 key pair by using an SM2 encryption algorithm according to the SM2 private key.

[0148] In an embodiment, the processor, when executing the computer program, further implements the following steps:

[0149] obtaining a graph correction parameter of the biological feature according to the public biological feature and the at least one biological feature of the user, and uploading the graph correction parameter into the cloud platform.

[0150] In an embodiment, the processor, when executing the computer program, further implements the following steps:

[0151] performing data cleaning on the real-time biological feature, and performing data correction on the data cleaned real-time biological feature according to the graph correction parameter.

[0152] In an embodiment, the processor, when executing the computer program, further implements the following steps:

[0153] mapping the biological feature data and the SM2 public key into a feature space;

[0154] converting the biological feature data into key data by using a key derivation function;

[0155] finding a corresponding SM2 public key colliding with the key data in the feature space by using a key collision algorithm to obtain a real-time private key of the user.

[0156] In one embodiment, the SM2 public key is represented by 64 bytes of feature data, and the SM2 private key is represented by 32 bytes of feature data.

[0157] In one embodiment, a computer readable storage medium is provided, and the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the following steps:

[0158] In the case that the user login authentication is passed, at least one user's biometric feature is collected;

[0159] According to the at least one user's biometric feature, an SM2 public key is generated, and the SM2 public key is registered in the cloud platform;

[0160] Before data signing, a real-time biometric feature of the user is collected;

[0161] According to the real-time biometric feature and the SM2 public key, a real-time private key of the user is generated;

[0162] The real-time private key is used for data signing.

[0163] In one embodiment, the computer program is executed by the processor to further implement the following steps:

[0164] The at least one user's biometric feature is data cleaned and data corrected to obtain a public biometric feature;

[0165] The public biometric feature is feature encoded to obtain an SM2 private key;

[0166] According to the SM2 private key, an SM2 public key corresponding to the SM2 private key in the SM2 key pair is generated by using an SM2 encryption algorithm.

[0167] In one embodiment, the computer program is executed by the processor to further implement the following steps:

[0168] According to the public biometric feature and the at least one user's biometric feature, a graph correction parameter of the biometric feature is obtained, and the graph correction parameter is uploaded to the cloud platform.

[0169] In one embodiment, the computer program is executed by the processor to further implement the following steps:

[0170] The real-time biometric feature is data cleaned, and the data cleaned real-time biometric feature is data corrected according to the graph correction parameter.

[0171] In one embodiment, the computer program is executed by the processor to further implement the following steps:

[0172] The biometric feature data and the SM2 public key are mapped to a feature space;

[0173] The biometric data is converted into key data by using a key derivation function;

[0174] A corresponding SM2 public key and the key data are collided in a feature space by using a key collision algorithm to obtain a real-time private key of the user.

[0175] In one embodiment, the SM2 public key is represented by 64 bytes of feature data, and the SM2 private key is represented by 32 bytes of feature data.

[0176] In one embodiment, a computer program product is provided, comprising a computer program which, when executed by a processor, implements the following steps:

[0177] In the case where the user login authentication is passed, at least one biometric feature of the user is collected;

[0178] According to the at least one biometric feature of the user, an SM2 public key is generated, and the SM2 public key is registered in a cloud platform;

[0179] Before data signing, a real-time biometric feature of the user is collected;

[0180] According to the real-time biometric feature and the SM2 public key, a real-time private key of the user is generated;

[0181] The real-time private key is used for data signing.

[0182] In one embodiment, the computer program, when executed by the processor, further implements the following steps:

[0183] The at least one biometric feature of the user is subjected to data cleaning and data correction to obtain a public biometric feature;

[0184] The public biometric feature is subjected to feature encoding to obtain an SM2 private key;

[0185] According to the SM2 private key, an SM2 public key corresponding to the SM2 private key in the SM2 key pair is generated by using an SM2 encryption algorithm.

[0186] In one embodiment, the computer program, when executed by the processor, further implements the following steps:

[0187] According to the public biometric feature and the at least one biometric feature of the user, a graph correction parameter of the biometric feature is obtained, and the graph correction parameter is uploaded to a cloud platform.

[0188] In one embodiment, the computer program, when executed by the processor, further implements the following steps:

[0189] The real-time biometric feature is subjected to data cleaning, and the data cleaned real-time biometric feature is subjected to data correction according to the graph correction parameter.

[0190] In one embodiment, the computer program, when executed by the processor, further implements the following steps:

[0191] Mapping the biometric data and the SM2 public key into a feature space;

[0192] Converting the biometric data into key data using a key derivation function;

[0193] Finding a corresponding SM2 public key colliding with the key data in the feature space using a key collision algorithm, to obtain a real-time private key of the user.

[0194] In one embodiment, the SM2 public key is represented by 64 bytes of feature data, and the SM2 private key is represented by 32 bytes of feature data.

[0195] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when executed, can include the processes of the above-mentioned embodiment methods. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. The non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. The volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, the RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., without being limited thereto.

[0196] The technical features of the above embodiments can be combined arbitrarily. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, but as long as the combinations of the technical features do not exist, they should be considered as the scope of the present application.

[0197] The above-described embodiments are merely illustrative of several embodiments of the present application, and the description is relatively specific and detailed, but should not be understood as a limitation on the scope of the patent. It should be noted that for those skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are all within the scope of the present application. Therefore, the scope of protection of the present application should be subject to the appended claims.

Claims

1. A biometric-based data signing method, characterized by, The method is applied to a user terminal and comprises the following steps: In the case that the user login authentication is passed, at least one user's biometric feature is collected; According to the at least one user's biometric feature, an SM2 public key is generated, and the SM2 public key is registered in a cloud platform; Before data signature is performed, a real-time biometric feature of the user is collected; According to the real-time biometric feature and the SM2 public key, a real-time private key of the user is generated; The real-time biometric feature after data correction and the SM2 public key are mapped into a feature space; a biometric feature data is converted into key data by using a key derivation function; an SM2 public key matching the key data is searched in the feature space by using a key collision algorithm; and according to the SM2 public key and the key data, the real-time private key of the user is generated; Data signature is performed by using the real-time private key.

2. The method of claim 1, wherein, The generation of the SM2 public key according to the at least one user's biometric feature comprises the following steps: The at least one user's biometric feature is subjected to data cleaning and data correction to obtain a public biometric feature; The public biometric feature is subjected to feature coding to obtain an SM2 private key; According to the SM2 private key, an SM2 public key corresponding to the SM2 private key in the SM2 key pair is generated by using an SM2 encryption algorithm.

3. The method of claim 2, wherein, After the at least one user's biometric feature is subjected to data cleaning and data correction to obtain the public biometric feature, the following step is further included: According to the public biometric feature and the at least one user's biometric feature, a graph correction parameter of the biometric feature is obtained, and the graph correction parameter is uploaded to the cloud platform.

4. The method of claim 3, wherein, Before the real-time private key of the user is generated according to the real-time biometric feature and the SM2 public key, the following steps are included: The real-time biometric feature is subjected to data cleaning, and the real-time biometric feature after data cleaning is subjected to data correction according to the graph correction parameter.

5. The method of claim 2, wherein, The SM2 public key is represented by 64 bytes of feature data, and the SM2 private key is represented by 32 bytes of feature data.

6. A biometric-based data signing apparatus, characterized by The device applies the method according to any one of claims 1-5 and comprises the following modules: A biometric feature collection module is configured to collect at least one user's biometric feature in the case that the user login authentication is passed; A key calculation module is configured to generate an SM2 public key according to the at least one user's biometric feature, and an uploading module is configured to register the SM2 public key in a cloud platform; The biometric feature collection module is further configured to collect a real-time biometric feature of the user before data signature is performed; The key calculation module is further configured to generate a real-time private key of the user according to the real-time biometric feature and the SM2 public key; A signature module is configured to perform data signature by using the real-time private key. 7.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-6 when the computer program is executed by the processor. The processor executes the computer program to implement the steps of the method according to any one of claims 1-5.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method according to any one of claims 1-5.

9. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method according to any one of claims 1-5.

Images