High-safety characteristic value transmission method
By encrypting the personnel information and writing it to the PSAM card and performing offline comparison, the problems of data leakage and user experience in biometric technology are solved, and high security and feature value transmission is achieved shared by multiple terminals.
Patent Information
- Application Number
- CN202411809260.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-10
- Publication Date
- 2025-04-29
AI Technical Summary
Existing biometric technologies have shortcomings in the risk of data breach and user experience, especially in the case of multi-terminal sharing and network instability.
By encrypting the personnel information and writing it to the PSAM card and performing offline comparisons in the terminal device, high-security feature value transmission is achieved, avoiding the risk of networking leakage, and supporting multi-terminal authorization and expansion.
It improves facial recognition efficiency, effectively avoids the risk of network leakage, ensures data security, and supports multi-terminal sharing and expansion.
Smart Images
Figure CN119904920A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of biometric identification technology, and in particular to a high-security feature value transmission method. Background Art
[0002] With the development of computer vision and deep learning technology, face recognition terminals and fingerprint recognition terminals have been widely used in many fields due to their high efficiency, convenience and increasing accuracy. Compared with traditional passwords or card codes, biometric technology provides an additional layer of security and reduces the risk of forgetting passwords or losing cards. Although these technologies bring many conveniences, there are also some security and privacy risks. Especially in terms of data leakage risks, once facial feature data or fingerprint feature data is stolen or leaked, attackers may use this information to carry out illegal activities. Since these feature data are fixed biometric features, once they are stolen, users cannot simply change their facial features or fingerprint features like changing passwords.
[0003] In order to protect these feature value data from leakage, many companies on the market adopt online identification methods. For example, when a large group purchases face recognition terminals from three companies at the same time, if it is directly identified and compared on the face recognition terminal, it is necessary to authorize the photos and face feature values to the three companies at the same time. This approach is unsafe and can easily leak user information. In order to ensure that this information is not leaked, an online face recognition solution can be adopted. After the local device recognizes the face, the face photo is passed to the back-end software platform for feature value and personnel information comparison, and then the result is returned to the local device. This method ensures that user data is only retained in the background software and will not be leaked to the terminal devices of the three companies, but it also brings a bad experience. Online identification requires the device and software background to be online in real time. Once a network failure causes all devices to fail to work normally, and the devices of these three companies need to be connected and developed with the background software, the online recognition rate will be slower than direct local recognition, and the user experience will be poor. If you want to introduce new equipment manufacturers in the future, it will be very limited and inconvenient to expand. Summary of the invention
[0004] In order to solve the above problems, the present invention provides a high-security feature value transmission method, in which personnel information is encrypted and written into a PSAM card, and a terminal device reads the information in the PSAM card for offline comparison, thereby improving the efficiency of face recognition and effectively avoiding the risk of network leakage. The PSAM card is provided with write and access permissions, which is convenient for distribution and expansion, and can be safely opened for authorization to a third party. In addition, the method is not only applicable to face recognition, but also to fingerprint recognition, and has a wide range of applications.
[0005] The technical solution adopted by the present invention is to provide a high-security feature value transmission method, including entering registered personnel information and establishing a personnel information database, wherein the personnel information includes basic personnel information and biometric information;
[0006] Biometric value data is extracted based on biometric information, encrypted with SM4, and written into the PSAM card together with the basic information of the person. After the terminal device collects the biometrics, it reads the biometric value data in the PSAM card offline for comparison and identification.
[0007] The specific comparison process of the terminal device is to insert the PSAM card into the terminal device. When the terminal device collects the biometric features, it encrypts the biometric features with SM4, reads the biometric feature value data written in the PSAM card for comparison, and provides feedback after the comparison succeeds or fails.
[0008] The directory structure of the PSAM card includes the MF root directory and multiple subdirectories established under the MF root directory. The subdirectories include basic information files, feature information files, KEY security files, terminal information files, reserved information files and ADFX files. The basic information file is used to write basic personnel information, and the feature information file is used to write biometric feature value data and has write permission and read permission.
[0009] The characteristic information file is written using ciphertext and MAC, and is read using the SM1 algorithm for external authentication.
[0010] When the personnel information in the PSAM card needs to be updated or re-entered, the updated personnel information is written into the CPU user setting card, the CPU user setting card is read through the terminal device, and the data in the CPU user setting card is replaced or overwritten into the PSAM card.
[0011] The directory structure of the CPU user setting card includes the MF root directory and multiple subdirectories established under the MF root directory. The subdirectories include KEY security files, basic information files, setting card information files, and feature information files, wherein the feature information files are provided with the same write and read permissions as the feature information files in the PSAM card.
[0012] When the personnel information in the PSAM card needs to be updated or re-entered, the updated personnel information is written into another PSAM card to replace the current PSAM card of the terminal device.
[0013] The biometric information includes one of facial information, fingerprint information and palm vein information, the biometric feature value data includes one of facial feature value data, fingerprint feature value data and palm vein feature value data, the biometric feature includes one of facial image, fingerprint and palm vein, and the terminal device includes one of facial recognition device, fingerprint recognition device and palm vein device.
[0014] The beneficial effect of the present invention is that a high-security feature value transmission method uses the national secret algorithm SM4 to encrypt the biometric feature value data and write it into the PSAM card, and access to the PSAM card data increases the access permission control. The biometric feature value data is not disclosed to the terminal device manufacturer and user, and the terminal device can directly insert the PSAM card for offline identification. BRIEF DESCRIPTION OF THE DRAWINGS
[0015] Figure 1 It is a flow chart of the present invention. DETAILED DESCRIPTION
[0016] like Figure 1 As shown, the present invention provides a high-security feature value transmission method, including inputting registered personnel information and establishing a personnel information database, wherein the personnel information includes basic personnel information and biometric information;
[0017] Biometric value data is extracted based on biometric information, encrypted with SM4, and written into the PSAM card together with the basic information of the person. After the terminal device collects the biometrics, it reads the biometric value data in the PSAM card offline for comparison and identification.
[0018] like Figure 1 As shown, the terminal device performs the comparison process specifically as follows: insert the PSAM card into the terminal device. After the terminal device collects the biometric features, it performs SM4 encryption on the biometric features, reads the biometric feature value data written in the PSAM card for comparison, and provides feedback after the comparison succeeds or fails.
[0019] like Figure 1 As shown, the directory structure of the PSAM card includes a MF root directory and multiple subdirectories established under the MF root directory, and the subdirectories include basic information files, feature information files, KEY security files, terminal information files, reserved information files and ADFX files. The basic information file is used to write basic personnel information, and the feature information file is used to write biometric feature value data and is set with write permission and read permission.
[0020] like Figure 1 As shown, the characteristic information file is written using ciphertext and MAC, and is read using the SM1 algorithm for external authentication.
[0021] like Figure 1As shown, when the personnel information in the PSAM card needs to be updated or re-entered, the updated personnel information is written into the CPU user setting card, the CPU user setting card is read through the terminal device, and the data in the CPU user setting card is replaced or overwritten into the PSAM card.
[0022] like Figure 1 As shown, the directory structure of the CPU user setting card includes an MF root directory and multiple subdirectories established under the MF root directory, wherein the subdirectories include a KEY security file, a basic information file, a setting card information file, and a feature information file, wherein the feature information file is provided with the same write permission and read permission as the feature information file in the PSAM card.
[0023] like Figure 1 As shown, when the personnel information in the PSAM card needs to be updated or re-entered, the updated personnel information is written into another PSAM card to replace the current PSAM card of the terminal device.
[0024] like Figure 1 As shown, the biometric information includes one of face information, fingerprint information and palm vein information, the biometric feature value data includes one of face feature value data, fingerprint feature value data and palm vein feature value data, the biometric feature includes one of face image, fingerprint and palm vein, and the terminal device includes one of face recognition device, fingerprint recognition device and palm vein device.
[0025] The present invention uses the national secret algorithm SM4 to encrypt and write the biometric feature value data into the PSAM card, access the PSAM card data to increase the access right control, and the PSAM card can be distributed and authorized to the third party manufacturer. For example, A company, in order to ensure that the facial feature information data of our company is not disclosed to the terminal equipment manufacturer, the user of A company can encrypt and write the extracted feature value, personnel data, etc. into the PSAM card, and the terminal equipment manufacturer only needs to insert the PSAM card under the premise of realizing local device face recognition, read the relevant data content according to the PSAM card structure document, and directly verify the local face feature value right to compare the feedback recognition result. If it is necessary to temporarily modify the user's facial feature data, the PSAM card can be taken out and the encryption coverage is rewritten, or a CPU with the information data function of modifying and increasing personnel features can be set up. The terminal equipment manufacturer extracts the latest feature value data of the card according to the structure document of the CPU card, and covers and writes into the PSAM card. The whole process has both ensured that the data is not leaked, and the end-to-end physical contact transmission is also supported to be authorized to multiple terminal equipment manufacturers for use.
[0026] The national secret PSAM card creates a key file, basic information file 1, basic information file 2, feature information file, reserved information file, terminal information file, and ADFX application file in the MF directory. Basic information file 1, basic information file 2, and feature information file are all equipped with access control. The feature information file is used to store facial feature information data. The write permission adopts the ciphertext + MAC method to write. The read permission needs to use the SM1 algorithm to pass the external authentication before the relevant information can be read.
[0027] Select a CPU card, create basic information files and key files in the MF directory, and set the card information file, feature information file, and DF directory.
[0028] The basic information file, the setting card information file and the characteristic information file are all equipped with access control permissions. The characteristic information file is used to store the data content that needs to be modified, and the information data content of the PSAM card is modified by reading the secondary card information content.
[0029] The implementation process of the present invention is specifically:
[0030] 1. Write characteristic data into PSAM card
[0031] 1. After the implementer enters the collected personnel information into the software platform, he / she takes a photo or enters the fingerprint on the software platform, or directly extracts the facial or fingerprint feature data based on the photo or fingerprint, encrypts the facial or fingerprint feature data with SM4, and writes the encrypted data directly into the PSAM card feature information file.
[0032] 2. The implementer only needs to assign different terminal information according to different terminal devices, grant different usage permissions, and write the permissions, characteristic value data, and terminal information data into the PSAM card, and then issue the PSAM card and directly insert it into the corresponding terminal device for use.
[0033] 2. User and terminal device usage process
[0034] 1. When a user performs face recognition or fingerprint recognition on a third-party terminal device, the device collects the recognized feature information A and encrypts it using the SM4 algorithm to obtain B.
[0035] 2. When a third-party terminal device reads the characteristic information file in the PSAM card, it needs to first perform external card authentication to obtain reading permission, and then perform a 1:N comparison of all characteristic data of B and PSAM card. After the comparison and authentication, the result is directly fed back to the user.
[0036] 3. User information change and device permission change process
[0037] When the user's face information or fingerprint information needs to be updated or re-entered, there are two ways: one is to use the CPU user setting card to transfer, and the other is to directly rewrite the PSAM card.
[0038] Method 1: Transfer via CPU user setting card
[0039] The new personnel information data and feature value information are written into the CPU setting card. The implementer takes the setting card and swipes it on the corresponding terminal device. After the terminal device obtains the read permission through the external authentication of the card, it reads out all the encrypted feature data in the card and replaces or overwrites it into the PSAM card.
[0040] Method 2: directly input new personnel information or information that needs to be changed.
[0041] Write data directly to the new PSAM card. The implementer only needs to replace the old PSAM card with the old one and reinsert it for use.
Claims
1. A high-security characteristic value transmission method, characterized in that: Including entering the registered personnel information and establishing a personnel information database, wherein the personnel information includes basic personnel information and biometric information; Biometric value data is extracted based on biometric information, encrypted with SM4, and written into the PSAM card together with the basic information of the person. After the terminal device collects the biometrics, it reads the biometric value data in the PSAM card offline for comparison and identification.
2. A highly secure feature value transmission method according to claim 1, characterized in that: The specific comparison process of the terminal device is to insert the PSAM card into the terminal device. When the terminal device collects the biometric features, it encrypts the biometric features with SM4, reads the biometric feature value data written in the PSAM card for comparison, and provides feedback after the comparison succeeds or fails.
3. A highly secure feature value transmission method according to claim 1, characterized in that: The directory structure of the PSAM card includes the MF root directory and multiple subdirectories established under the MF root directory. The subdirectories include basic information files, feature information files, KEY security files, terminal information files, reserved information files and ADFX files. The basic information file is used to write basic personnel information, and the feature information file is used to write biometric feature value data and has write permission and read permission.
4. A highly secure feature value transmission method according to claim 3, characterized in that: The characteristic information file is written using ciphertext and MAC, and is read using the SM1 algorithm for external authentication.
5. A highly secure feature value transmission method according to claim 1, characterized in that: When the personnel information in the PSAM card needs to be updated or re-entered, the updated personnel information is written into the CPU user setting card, the CPU user setting card is read through the terminal device, and the data in the CPU user setting card is replaced or overwritten into the PSAM card.
6. A highly secure feature value transmission method according to claim 5, characterized in that: The directory structure of the CPU user setting card includes the MF root directory and multiple subdirectories established under the MF root directory. The subdirectories include KEY security files, basic information files, setting card information files, and feature information files, wherein the feature information files are provided with the same write and read permissions as the feature information files in the PSAM card.
7. A highly secure feature value transmission method according to claim 1, characterized in that: When the personnel information in the PSAM card needs to be updated or re-entered, the updated personnel information is written into another PSAM card to replace the current PSAM card of the terminal device.
8. A highly secure feature value transmission method according to claim 1, characterized in that: The biometric information includes one of facial information, fingerprint information and palm vein information, the biometric feature value data includes one of facial feature value data, fingerprint feature value data and palm vein feature value data, the biometric feature includes one of facial image, fingerprint and palm vein, and the terminal device includes one of facial recognition device, fingerprint recognition device and palm vein device.