Biological information encryption method and system based on Internet of Things security chip

Abstract

The invention belongs to the technical field of Internet of Things security and biological feature encryption, and discloses a biological information encryption method based on an Internet of Things security chip, and the method comprises the steps: obtaining biological feature data of a user through a biological information collection module, and carrying out the preprocessing of normalization, denoising, enhancement and the like in an edge processor; then, depth features are extracted by using a convolutional neural network, a fixed-length ordered binary string is generated through a hash function and a replacement operation, and the fixed-length ordered binary string is stored in an edge processor database and copied to a security chip of the Internet of Things. And the Internet of Things security chip generates a random key, and generates a commitment for file encryption by XOR with the registered binary feature. In the authentication stage, preprocessing and feature extraction are repeated, an authentication binary string is generated and compared with the database, if matching succeeds, the secret key decryption file is released, and if matching fails, the process is terminated. According to the invention, an Internet of Things security chip and a biological characteristic encryption technology are combined, an efficient and safe file encryption solution is provided, and unauthorized access and data leakage are effectively prevented.

Description

Technical Field

[0001] The present invention relates to the fields of Internet of Things security technology and biometric encryption, and in particular to a file encryption and decryption method and system based on an Internet of Things security chip, an edge processor and biometrics. Background Art

[0002] With the rapid development of IoT technology and the acceleration of digital transformation, file encryption and data protection have become core concerns across industries. In today's era of information explosion, the leakage of sensitive files and data not only causes losses to individuals but also has a serious impact on the reputation and financial interests of enterprises. According to IBM's "2024 Cost of a Data Breach Report," the average cost of a global data breach has reached $4.88 million, a 10% increase from the previous year, the largest increase since 2020.

[0003] Biometric encryption technology, as an emerging encryption method, has attracted considerable attention due to its uniqueness and irreproducibility. Biometrics (such as fingerprints, irises, and faces) offer significant convenience as a means of identifying individuals. Biometrics are unique to an individual and easy to use, unlike passwords that require memorization. However, this is also a double-edged sword. Loss of a biometric can lead to irreversible damage, unlike passwords that can be changed at any time. For example, in 2019, DeepNet Vision, a domestic artificial intelligence company specializing in security, suffered a massive data breach. 6.8 million records belonging to over 2.5 million individuals were exposed, including user addresses, ID numbers, facial images, and location information, posing a serious threat to privacy and property security.

[0004] The emergence of IoT security chips has brought new hope to the file encryption field. IoT security chips are hardware devices that integrate multiple security features, providing powerful cryptographic computing capabilities and a secure storage environment. According to a report by market research firm Mordor Intelligence, the IoT security market is projected to reach $6.6 billion by 2024 and $28.01 billion by 2029, with a compound annual growth rate of 33.53% over the forecast period (2024-2029). Emerging applications and business models, coupled with decreasing device costs, are driving this rapid growth.

[0005] Biometric encryption technology utilizes an individual's unique physiological or behavioral characteristics for identity authentication and data encryption. By collecting, extracting, and analyzing an individual's biometric information, such as fingerprints, irises, facial features, and voiceprints, a unique key is generated for data encryption and decryption. Biometric encryption technology primarily involves the following steps: feature collection, feature extraction, feature comparison, key generation, and data encryption.

[0006] Currently, traditional file encryption methods primarily rely on complex key management and symmetric / asymmetric encryption algorithms. However, these methods have numerous limitations. First, the key generation, distribution, and storage processes are complex and costly, making them susceptible to key leakage due to human error or system vulnerabilities. Second, with the advancement of computing power, traditional encryption algorithms face the risk of being cracked, leading to a gradual decline in the security and cost-effectiveness of traditional file encryption.

[0007] Despite its numerous advantages, biometric encryption technology still faces numerous challenges. The security of biometric data storage and transmission cannot be ignored. Once stolen, it irreversibly damages user privacy. Furthermore, ensuring the security of biometric data during collection and transmission remains a pressing issue. Efficiently binding IoT security chips to biometrics and dynamically generating keys to enhance the security and flexibility of encryption systems remains a major technical challenge.

[0008] In summary, existing technologies in the field of file encryption have the following major problems and defects:

[0009] (1) The key management of traditional encryption methods is complex and easy to leak, which makes it difficult to meet the needs of modern information security.

[0010] (2) Using biometric encryption alone has problems such as unstable feature extraction and insecure data storage and transmission.

[0011] (3) The integration of IoT security chips and biometric encryption is not close enough to fully utilize the advantages of both.

[0012] (4) There is a lack of effective mechanisms to ensure the security of biometric data during collection, transmission and storage.

[0013] (5) Existing encryption systems have deficiencies in dynamic key generation and management, making them difficult to adapt to complex network environments and diverse needs. Summary of the Invention

[0014] To address the challenges of existing technologies, this paper proposes a biometric information encryption method based on an IoT security chip. This method, based on a biometric data acquisition system, an edge processor, and an IoT security chip, aims to address the current demands of information encryption.

[0015] The present invention is implemented as follows: a biometric information encryption method based on an Internet of Things security chip includes:

[0016] Step 1: Use the biometric information collection module based on the Internet of Things security chip installed on the device to collect relevant data; the biometric information collection module based on the Internet of Things security chip consists of a camera and a data transmission unit, which plays the role of data collection and uploading.

[0017] Step 2: Build a data processing mechanism based on edge processing. After the edge processor receives the biometric data uploaded by the biometric information acquisition module, it performs information cropping and deep feature extraction, and performs fixed-length ordered binary feature conversion. It is then stored in the feature database of the edge processor to form a registered personnel database, and a copy is copied to the IoT security chip for subsequent commitment generation.

[0018] Step 3: The biometric information involved in authentication is extracted, processed, and transformed as described above, ultimately obtaining a fixed-length, ordered binary feature conversion corresponding to the biometric information involved in authentication. A threshold comparison is then performed in the feature database stored in the edge processor. If a match is found, the feature data is sent to the IoT security chip. If no match is found, the authentication process is terminated at this step.

[0019] Step 4: The IoT security chip first uses the original key to encrypt the file through the encryption and decryption module, and then performs an XOR operation based on the original key and the binary features during registration to generate a commitment;

[0020] Step 5: The IoT security chip compares the original key with the committed generated key. If the comparison result is passed, the encryption and decryption module decrypts the encrypted file. Otherwise, if the comparison result fails, the decryption of the encrypted file is terminated.

[0021] Furthermore, the specific process of collecting biometric data in step 1 includes:

[0022] S11, a bio-information collection module installed on the device, collects bio-information data BIO in real time through built-in sensors;

[0023] S12, the data transmission unit installed on the device uploads the collected bioinformation data BIO to the edge processor module;

[0024] Furthermore, the data processing process of the biological information collection module received in step 2 includes:

[0025] S21, the edge processor module performs deep feature extraction on the received bioinformation data BIO to obtain feature data x and preprocesses the data, wherein the preprocessing methods include

[0026] 1. Normalization processing: The purpose of normalization processing is to scale the feature data to a specific interval (such as [0,1]) to eliminate the dimensional differences between different features and improve the efficiency and accuracy of subsequent processing.

[0027] Let the original feature data be x, and the normalized feature data be x norm , the normalization formula is as follows:

[0028]

[0029] where x max with x min are the maximum and minimum values ​​in the feature dataset, respectively.

[0030] 2. Denoising: The purpose of denoising is to remove noise from feature data and improve the purity of the data. Common methods include Gaussian filtering, median filtering, and moving average filtering. Here, we take moving average filtering as an example. Suppose the original feature data sequence is x1, x2, ..., x n The window size is K, then the denoised feature data x denoise The calculation is as follows:

[0031]

[0032] Where K is the size of the filter window, usually an odd number; i is the index of the current data point.

[0033] 3. Enhancement processing: The purpose of enhancement processing is to improve the contrast of feature data or highlight certain features for subsequent processing. For example, for image data, methods such as histogram equalization or gamma correction can be used.

[0034] Taking gamma correction as an example, let the original feature data be x and the enhanced feature data be x enhanced , the gamma correction formula is as follows:

[0035] x enhanced =x γ

[0036] Where γ is the gamma value, which is used to adjust the contrast of the image. Usually, γ < 1 is used to improve dark details, and γ > 1 is used to improve bright details.

[0037] In general, the comprehensive preprocessing of feature data can be expressed as:

[0038]

[0039] x enhanced =x denoise γ

[0040] Finally, the preprocessed feature data x enhanced This will be used in subsequent hash replacement operations. These steps ensure the quality and stability of feature data and provide a reliable foundation for biometric encryption.

[0041] S22, first apply the hash function H to the preprocessed feature data x (usually a one-dimensional vector) to generate a fixed-length hash value h∈{0,1}L, where L is the length of the hash value. Commonly used hash functions include SHA-256, SHA-512, etc. Here we use the SHA-256 hash function, denoted as

[0042] h=H(x)

[0043] To increase the randomness and security of the hash value, a permutation operation is then performed on the hash value h. The permutation operation can be implemented using a random permutation matrix P, which is a permutation matrix used to rearrange the bits in the hash value, denoted as

[0044] h perm =P·h

[0045] Where P is a random permutation matrix whose elements are either 0 or 1, and there is only one 1 in each row and column; h perm is the hash value after permutation.

[0046] Finally, the replaced hash value h perm Convert to binary form and generate a fixed-length ordered binary string b∈{0,1} L , recorded as

[0047] b=bin(h perm )

[0048] Among them, bin means converting the hash value into binary form to obtain an ordered binary string of a certain length.

[0049] S23, define each user's number as i, and its fixed-length ordered binary string can be further expressed as b i , store all users' binary strings in database D, there are

[0050] D={b1,b2,…,b N}

[0051] Where N is the total number of users, and D is the database that stores all user binary strings.

[0052] S24, copy D to form D' and send it to the IoT security chip.

[0053] Furthermore, the comparison process of the biometric information of the authentication user in step 3 includes:

[0054] S31, biometric information x involved in authentication auth Perform preprocessing, including normalization, denoising and enhancement, to generate preprocessed feature data x auth,norm , recorded as

[0055] x auth,norm =Preprocess(x auth )

[0056] Among them, Proprocess processing means preprocessing the data to obtain feature data that is easy to use.

[0057] S32, the preprocessed feature data x auth,norm Apply hash function H to generate a fixed-length hash value h auth , the process is recorded as

[0058] h auth =H(x auth,norm )

[0059] S33, for the hash value h auth Perform a permutation operation to generate the permuted hash value h auth,perm , recorded as

[0060] h auth,perm =P·h auth

[0061] Where P is a random permutation matrix used to rearrange the bits in the hash value.

[0062] S34, the replaced hash value h auth,perm Convert to binary form and generate a fixed-length ordered binary string b auth , recorded as

[0063] b auth =bin(h auth,perm )

[0064] S35, in the feature database D stored in the edge processor, the generated binary string b auth Perform threshold comparison. Database D contains binary strings of all registered users, namely D={b1,b2,…,b N}, then calculate b auth With each binary string b in the database i Hamming Distance (HD) of

[0065]

[0066] Among them, L is the length of the binary string, b auth,j and b i,j bauth and b i The jth position of .

[0067] S36, if there is a b i Make HD(b auth ,b i )≤T (where T is the preset threshold), the match is successful, and this b i Send it to the IoT security chip. If it does not exist, terminate the process.

[0068] Furthermore, the encryption and commitment generation process described in step 4 is as follows:

[0069] S41, original key generation, the IoT security chip generates a random key and sends it to the encryption and decryption module. The key is used for subsequent file encryption and commitment generation, recorded as

[0070] key = GenerateKey()

[0071] Among them, GenerateKey() is a function that generates a random key.

[0072] S42, encrypt the file file using the generated original key key to generate an encrypted file, recorded as

[0073] file enc =Encrypt(file,key)

[0074] Among them, Encrypy is an encryption function, which means that the file is encrypted through the key.

[0075] S43, use the SHA-256 function to perform hash transformation on the original key to generate the hash value key hash , recorded as

[0076] key hash =SHA256(key)

[0077] S44, the original key key and the binary feature b during registration reg Perform XOR operation to generate commitment, recorded as

[0078]

[0079] in, Indicates exclusive OR operation, b reg Represents the binary features generated during the corresponding registration.

[0080] Furthermore, the key comparison and encryption / decryption process described in step 5 includes:

[0081] S51, the binary feature b of the authenticated person auth Perform XOR operation with the stored commitment to generate the release key key′. This process is recorded as

[0082]

[0083] in, Represents the exclusive OR operation.

[0084] S52, perform hash transformation on the release key key′ to generate its hash value key′ hash Perform key hash value comparison, and the comparison result can be expressed as

[0085]

[0086] S53, make a decision based on the comparison result Match, if the result is True, then decrypt, recorded as

[0087] file=Decrypt(file enc ,key′)

[0088] Decrypt means using the release key key' to encrypt the file file enc Perform decryption operations;

[0089] If the result is False, the process is terminated.

[0090] Another object of the present invention is to provide a biometric information encryption system based on an Internet of Things security chip, comprising:

[0091] A biometric information collection module, which is used to collect biometric information data using a biometric information collection module based on an IoT security chip installed on the device; the biometric information collection module based on an IoT security chip is composed of relevant sensors and a data transmission unit, and plays the role of data collection and upload;

[0092] A construction module is used to build a data processing mechanism based on edge processing. After the edge processor receives the biometric data uploaded by the biometric information acquisition module, it performs information cropping and deep feature extraction, and performs fixed-length ordered binary feature conversion. The data is stored in the feature database of the edge processor to form a registered personnel database, and a copy is copied to the IoT security chip for subsequent generation of commitments.

[0093] The information extraction module is used to perform the above-mentioned information extraction processing and transformation on the biometric information involved in the authentication, and finally obtain the fixed-length ordered binary feature conversion corresponding to the biometric information involved in the authentication. The module then performs a threshold comparison in the feature database stored in the edge processor. If a match is found, the feature data is sent to the IoT security chip. If no match is found, the authentication process is terminated at this step.

[0094] The encryption and decryption module, used in IoT security chips, first uses the original key to encrypt the file through the encryption and decryption module, and then performs an XOR operation based on the original key and the binary features at the time of registration to generate a commitment;

[0095] The comparison module is used by the IoT security chip to compare the original key with the committed generated key. If the comparison result is passed, the encryption and decryption module decrypts the encrypted file. Otherwise, if the comparison result fails, the decryption of the encrypted file is terminated.

[0096] Another object of the present invention is to provide a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the biometric information encryption method based on the Internet of Things security chip.

[0097] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to perform the steps of the biometric information encryption method based on the Internet of Things security chip.

[0098] Another object of the present invention is to provide an information data processing terminal, which is used to implement the biometric information encryption system based on the Internet of Things security chip.

[0099] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0100] In response to the technical problems of the existing technology, the present invention proposes a biometric encrypted file system and method based on an IoT security chip and an edge processor, aiming to comprehensively improve the security, stability and ease of use of file encryption through innovative technical solutions.

[0101] (1) A new biometric information key generation and verification mechanism based on edge processor module and IoT security chip is proposed: biometric information is collected and preprocessed by edge processor module, combined with the key generation capability of IoT security chip, which ensures the lightweight and convenient application of biometric information in file encryption processing.

[0102] (2) An efficient key binding and file encryption process is achieved: Random keys are generated using IoT security chips, and biometrics are bound to the keys to achieve secure storage and dynamic release of the keys. During the file encryption and decryption process, the hash value of the released key is compared with the original key to ensure that only successfully authenticated users can decrypt the files, improving the security and reliability of the file encryption system.

[0103] Traditional biometric systems rely on central servers for data storage and processing, making them vulnerable to network latency, man-in-the-middle attacks, and centralized failures. This paper proposes an architecture with edge nodes as the processing core, integrating heterogeneous sensor networks (embedded sensors) with local transmission modules (such as SPI and I2C buses) to ensure local trusted upload of biometric information (BIO) through low-latency, high-bandwidth channels. Signal acquisition, data clipping, and feature vector extraction are completed on the edge, avoiding the risk of plaintext biometric features being exposed in the transmission link. This implements a front-end distributed trustworthy sensing processing architecture (Distributed Trustworthy Sensing), structurally curbing the security vulnerabilities brought about by central dependencies.

[0104] Existing systems often lack robust feature processing mechanisms for noise and illumination changes, resulting in unstable matching accuracy. This paper constructs a "three-step preprocessing chain": normalization standard transformation, moving average filter denoising, and nonlinear gamma correction enhancement, significantly improving the consistency of data within the modality and stability under low signal-to-noise ratio conditions; further introducing the SHA-256 hash function and permutation matrix P to construct a binary mapping space, so that the feature hash value has both high information entropy and locally uniform distribution properties, greatly improving the hash collision resistance (Hash Collision Resistance) capability, thereby ensuring the uniqueness and collision resistance of subsequent identity matching and key generation.

[0105] Faced with noise interference and time domain changes during the biometric information collection process, traditional hard matching mechanisms are prone to increased false rejection rates. This method introduces a quantitative tolerance matching model based on Hamming distance in the authentication process. By setting a dynamic threshold T to construct an error tolerance recognition interval, users can achieve accurate authentication within a reasonable range of biometric disturbances. The matching strategy is driven by the distance measurement in the binary vector space. Its logical implementation is simple and efficient, compatible with various edge computing platforms, and runs stably under low power conditions. It reflects the dynamic balance optimization between device resource sensitivity and identity authentication accuracy.

[0106] Unlike traditional symmetric encryption mechanisms that rely on plaintext key transmission or unstructured random seeds, this invention innovatively constructs a "biometric-key binding chain." This chain generates a commitment value by XORing the registered signature with the original key. During the authentication phase, it reversely calculates the release key, key′, and then verifies identity-key consistency by comparing its hash value with the original key hash. This mechanism not only implements biometric-driven key release but also eliminates the need for plaintext key storage, establishing a full-link, end-to-end, self-consistent data encryption / decryption closed loop. This improves data storage security and closed-loop autonomy of decryption control from a system architecture perspective.

[0107] This invention achieves an efficient key binding and file encryption process: it uses an IoT security chip to generate a random key and binds it to a biometric feature, enabling secure storage and dynamic release of the key. During file encryption and decryption, the hash value of the released key is compared with the original key, ensuring that only successfully authenticated users can decrypt the file, improving the security and reliability of the file encryption system. BRIEF DESCRIPTION OF THE DRAWINGS

[0108] Figure 1 This is a flow chart of a biometric information encryption method based on an Internet of Things security chip provided by an embodiment of the present invention.

[0109] Figure 2 This is a structural block diagram of a biometric information encryption system based on an Internet of Things security chip provided by an embodiment of the present invention.

[0110] Figure 3 This is a flow chart of an embodiment of the present invention, which provides a flow chart of encryption and decryption of biometric information based on an IoT security chip, an edge processor, and biometric information.

[0111] Figure 4 It is a flowchart of the method provided by an embodiment of the present invention in the context of facial information encrypted video files. DETAILED DESCRIPTION

[0112] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0113] like Figure 1 As shown, the embodiment of the present invention provides a biometric information encryption method based on an Internet of Things security chip, comprising the following steps:

[0114] S101, collecting relevant data using a biometric information collection module based on an IoT security chip installed on a device; the biometric information collection module based on an IoT security chip comprises a camera and a data transmission unit, and performs data collection and uploading.

[0115] S102: Build a data processing mechanism based on edge processing. After the edge processor receives the biometric data uploaded by the biometric information collection module, it performs information cropping and deep feature extraction, and performs fixed-length ordered binary feature conversion. The data is stored in the feature database of the edge processor to form a registered personnel database, and a copy is sent to the IoT security chip for subsequent generation of commitments.

[0116] S103: The biometric information involved in authentication is subjected to the aforementioned information extraction, processing, and transformation, ultimately obtaining a fixed-length, ordered binary feature conversion corresponding to the biometric information involved in authentication. A threshold comparison is then performed against the feature database stored in the edge processor. If a match is found, the feature data is sent to the IoT security chip. If no match is found, the authentication process is terminated at this step.

[0117] At step S104, the IoT security chip first uses the original key to encrypt the file through the encryption and decryption module, and then performs an XOR operation based on the original key and the binary features during registration to generate a commitment.

[0118] S105, the IoT security chip performs a comparison process between the original key and the committed generated key. If the comparison result is passed, the encryption and decryption module decrypts the encrypted file. Otherwise, if the comparison result fails, the decryption of the encrypted file is terminated.

[0119] During the biometric signal acquisition phase, a high-definition image sensor (CMOS sensor) integrated into the terminal device scans and digitizes the facial area, generating raw facial image data. This image data is encrypted and transmitted to the edge computing node via a local embedded transmission unit (UART / SPI communication protocol). During image acquisition, a multi-frame fusion algorithm and adaptive exposure compensation mechanism are combined to enhance facial clarity under uneven lighting conditions, ensuring high robustness in the subsequent feature extraction process.

[0120] After receiving the signal, the edge processing unit first calls the image preprocessing engine (including face positioning and affine normalization modules) to perform geometric normalization on the face area to avoid the interference of posture deviation on feature expression. Subsequently, a lightweight deep convolutional network (such as MobileFaceNet) is used to extract the feature embedding vector. The extracted floating-point 128-dimensional feature vector will be normalized and binarized and converted into a fixed-length hash vector with sequence. The hash vector is based on high entropy and is stored in the edge-end registration feature database in the form of a Boolean value sequence to ensure the consistency of the similarity measurement and computational efficiency.

[0121] During the authentication phase, the system captures the face image to be verified in real time and, through the same preprocessing process, generates a feature hash vector for the current user. This vector is then quickly matched against registered features in the database using a Hamming distance method. A threshold is set to determine the similarity interval, and a successful match is considered the same identity. The user ID and feature vector corresponding to the matching result are then encapsulated into a data packet and sent via a secure channel to the local IoT security chip to initiate subsequent encryption logic processing.

[0122] The chip first synchronizes the current user's binary feature vector with the original feature vector copied to the chip during pre-registration. This is then combined with the original key using Boolean XOR logic to generate a user-specific commitment structure. The key recovery module compares the current result with the original key derivation path. If consistency is verified, the decryption process is triggered, scheduling the chip's built-in AES engine to decrypt the target file in real time. If the comparison fails, the key release process is immediately terminated and the authentication status is reverted to prevent unauthorized decryption.

[0123] The specific process of collecting biometric data in S101 provided in the embodiment of the present invention includes:

[0124] S11, a bio-information collection module installed on the device, collects bio-information data BIO in real time through built-in sensors;

[0125] S12, the data transmission unit installed on the device uploads the collected bioinformation data BIO to the edge processor module.

[0126] The data processing process of the biological information collection module in S102 provided in the embodiment of the present invention includes:

[0127] S21, the edge processor module performs deep feature extraction on the received bioinformation data BIO to obtain feature data x and preprocesses the data, wherein the preprocessing methods include:

[0128] 1) Normalization processing;

[0129] Let the original feature data be x, and the normalized feature data be x norm , the normalization formula is as follows:

[0130]

[0131] where x max with x min are the maximum and minimum values ​​in the feature data set respectively;

[0132] 2) Denoising;

[0133] Assume that the original feature data sequence is x1, x2, ..., x n The window size is K, then the denoised feature data x denoise The calculation is as follows:

[0134]

[0135] Where K is the size of the filter window, usually an odd number; i is the index of the current data point;

[0136] 3) Enhanced processing;

[0137] Use methods such as histogram equalization or gamma correction;

[0138] Let the original feature data be x, and the enhanced feature data be x enhanced , the gamma correction formula is as follows:

[0139] x enhanced =x γ

[0140] Where γ is the gamma value, which is used to adjust the contrast of the image. Usually, γ<1 is used to improve dark details, and γ>1 is used to improve bright details.

[0141] The comprehensive preprocessing of feature data can be expressed as:

[0142]

[0143] x enhanced =x denoise γ

[0144] Finally, the preprocessed feature data x enhanced Will be used for subsequent hash replacement operations;

[0145] S22, first apply the hash function H to the preprocessed feature data x (usually a one-dimensional vector) to generate a fixed-length hash value h∈{0,1}L, where L is the length of the hash value; commonly used hash functions include SHA-256, SHA-512, etc.; here we use the SHA-256 hash function, denoted as

[0146] h=H(x)

[0147] After that, in order to increase the randomness and security of the hash value, the hash value h is permuted. The permutation operation can be implemented by a random permutation matrix P, which is a permutation matrix used to rearrange the bits in the hash value, denoted as

[0148] h perm =P·h

[0149] Where P is a random permutation matrix whose elements are either 0 or 1, and there is only one 1 in each row and column; h perm is the hash value after permutation;

[0150] Finally, the replaced hash value h perm Convert to binary form and generate a fixed-length ordered binary string b∈{0,1} L , recorded as

[0151] b=bin(h perm )

[0152] Among them, bin means converting the hash value into binary form to obtain an ordered binary string of a certain length;

[0153] S23, define each user's number as i, and its fixed-length ordered binary string can be further expressed as b i , store all users' binary strings in database D, there are

[0154] D={b1,b2,…,b N}

[0155] Where N is the total number of users, and D is the database that stores all user binary strings;

[0156] S24, copy D to form D' and send it to the IoT security chip.

[0157] The comparison process of the biometric information of the person being authenticated in S103 provided in the embodiment of the present invention includes:

[0158] S31, biometric information x involved in authentication auth Perform preprocessing, including normalization, denoising and enhancement, to generate preprocessed feature data x auth,norm , recorded as

[0159] x auth,norm =Preprocess(x auth )

[0160] Among them, Proprocess processing means preprocessing the data to obtain feature data that is convenient for application;

[0161] S32, the preprocessed feature data x auth,norm Apply hash function H to generate a fixed-length hash value h auth , the process is recorded as

[0162] h auth =H(x auth,norm )

[0163] S33, for the hash value h auth Perform a permutation operation to generate the permuted hash value h auth,perm , recorded as

[0164] h auth,perm =P·h auth

[0165] Where P is a random permutation matrix used to rearrange the bits in the hash value;

[0166] S34, the replaced hash value h auth,perm Convert to binary form and generate a fixed-length ordered binary string b auth , recorded as

[0167] b auth =bin(h auth,perm )

[0168] S35, in the feature database D stored in the edge processor, the generated binary string b auth Perform threshold comparison; the database D contains the binary strings of all registered users, that is, D = {b1, b2, ..., b N}, then calculate b auth With each binary string b in the database i Hamming Distance (HD) of

[0169]

[0170] Among them, L is the length of the binary string, b auth,j and b i,j b auth and b i The jth position of

[0171] S36, if there is a b i Make HD(bauth ,b i )≤T (where T is the preset threshold), the match is successful, and this b i Send it to the IoT security chip. If it does not exist, terminate the process.

[0172] The encryption and commitment generation process described in S104 provided in the embodiment of the present invention includes:

[0173] S41, original key generation, the IoT security chip generates a random key and sends it to the encryption and decryption module. The key is used for subsequent file encryption and commitment generation, recorded as

[0174] key = GenerateKey()

[0175] Among them, GenerateKey() is a function that generates a random key;

[0176] S42, encrypt the file file using the generated original key key to generate an encrypted file, recorded as

[0177] file enc =Encrypt(file,key)

[0178] Among them, Encrypy is an encryption function, which means encrypting the file through the key;

[0179] S43, use the SHA-256 function to perform hash transformation on the original key to generate the hash value key hash , recorded as

[0180] key hash =SHA256(key)

[0181] S44, the original key key and the binary feature b during registration reg Perform XOR operation to generate commitment, recorded as

[0182]

[0183] in, Indicates exclusive OR operation, b reg Represents the binary features generated during the corresponding registration.

[0184] The key comparison and encryption / decryption process described in S105 provided in the embodiment of the present invention includes:

[0185] S51, the binary feature b of the authenticated person auth Perform XOR operation with the stored commitment to generate the release key key′. This process is recorded as

[0186]

[0187] in, Represents the exclusive OR operation;

[0188] S52, perform hash transformation on the release key key′ to generate its hash value key′ hash Perform key hash value comparison, and the comparison result can be expressed as

[0189]

[0190] S53, make a decision based on the comparison result Match, if the result is True, then decrypt, recorded as

[0191] file=Decrypt(file enc ,key′)

[0192] Decrypt means using the release key key' to encrypt the file file enc Perform decryption operations;

[0193] If the result is False, the process is terminated.

[0194] like Figure 2 , an embodiment of the present invention provides a biometric information encryption system based on an Internet of Things security chip, including:

[0195] A face acquisition module, which is used to collect face data using a face acquisition module based on an IoT security chip installed on the device; the biometric information acquisition module based on the IoT security chip is composed of a camera and a data transmission unit, and plays the role of data acquisition and uploading;

[0196] A construction module is used to build a data processing mechanism based on edge processing. After the edge processor receives the biometric data uploaded by the biometric information acquisition module, it performs information cropping and deep feature extraction, and performs fixed-length ordered binary feature conversion. The data is stored in the feature database of the edge processor to form a registered personnel database, and a copy is copied to the IoT security chip for subsequent generation of commitments.

[0197] The information extraction module is used to perform the above-mentioned information extraction processing and transformation on the biometric information involved in the authentication, and finally obtain the fixed-length ordered binary feature conversion corresponding to the biometric information involved in the authentication. The module then performs a threshold comparison in the feature database stored in the edge processor. If a match is found, the feature data is sent to the IoT security chip. If no match is found, the authentication process is terminated at this step.

[0198] The encryption and decryption module, used in IoT security chips, first uses the original key to encrypt the file through the encryption and decryption module, and then performs an XOR operation based on the original key and the binary features at the time of registration to generate a commitment;

[0199] The comparison module is used by the IoT security chip to compare the original key with the committed generated key. If the comparison result is passed, the encryption and decryption module decrypts the encrypted file. Otherwise, if the comparison result fails, the decryption of the encrypted file is terminated.

[0200] Another object of the present invention is to provide a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the biometric information encryption method based on the Internet of Things security chip.

[0201] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to perform the steps of the biometric information encryption method based on the Internet of Things security chip.

[0202] Another object of the present invention is to provide an information data processing terminal, which is used to implement the biometric information encryption system based on the Internet of Things security chip.

[0203] The present invention is specifically implemented:

[0204] Figure 3 The figure shows a process for encryption and decryption of biometric information based on IoT security chips, edge processors, and biometric information.

[0205] Figure 4 The figure shows the process of this method in the context of facial information encrypted video files.

[0206] Application scenario examples:

[0207] 1. Application example of this method in the scenario of encrypting video files based on facial information

[0208] With the widespread adoption of IoT technology and the acceleration of digital transformation, biometric encryption technology has become crucial for protecting sensitive data and files. Traditional encryption methods rely on complex key management and symmetric / asymmetric encryption algorithms, which pose challenges such as complex key management, vulnerability to key leakage, and high computational resource consumption. Biometric encryption technology utilizes an individual's unique physiological characteristics (such as facial images, voiceprints, and irises) for identity authentication and data encryption, providing greater security and convenience. However, existing technologies still face challenges in terms of feature extraction stability, data storage and transmission security, and key management complexity.

[0209] When it comes to video file encryption, traditional methods struggle to meet the demands of high security, real-time performance, and user privacy protection. For example, scenarios like remote monitoring, video conferencing, and online education require efficient and secure encryption solutions, but existing technologies suffer from high latency and resource consumption when processing large amounts of video data.

[0210] To address these issues, this embodiment proposes a facial encryption file system based on an IoT security chip. Through facial information verification and key binding, the system achieves secure encryption and decryption of video files. The system uses the IoT security chip to generate a random key and binds it to the key through facial features, ensuring that only successfully authenticated users can decrypt the file, effectively preventing unauthorized access and data leakage. At the same time, by optimizing the edge processing module, the amount of data transmitted and computing resource consumption is reduced, thereby improving the system's response speed and efficiency. In summary, this embodiment aims to address the shortcomings of existing file encryption and biometric authentication technologies, providing users with an efficient, secure, and reliable solution.

[0211] The specific implementation method is as follows

[0212] The system architecture consists of the following modules: face acquisition module, edge processor, IoT security chip module, and video encryption and decryption module.

[0213] In the first step, the face acquisition module uses the camera to collect face information, and this process is recorded as

[0214] x raw =CaptureFaceImage()

[0215] Among them, x raw is the original image captured by the camera. After that, the edge processor performs data preprocessing on the collected face image, including normalization, denoising and enhancement, which can be expressed as

[0216] x norm =Preprocess(x raw )

[0217] Preprocessing refers to a series of preprocessing tasks on the data, including normalization. After that, the face acquisition module sends the collected data information to the edge processor.

[0218] In the second step, the edge processor uses a neural convolutional network (CNN) to extract the deep features of the face image and convert them into fixed-length ordered binary features. The process is recorded as

[0219] f=ExtractFeatures(x norm )

[0220] h=SHA256(f)

[0221] h perm =P·h

[0222] b=bin(h perm )

[0223] Among them, ExtractFeatures means using neural convolutional networks to perform deep extraction of data features, SHA256 means using the SHA256 function to perform hash transformation on the extracted feature f to obtain its hash value h, and then permuting h through the random permutation matrix P to obtain the permuted hash value h perm , and finally by replacing the hash value h perm Perform binary conversion bin to generate a fixed-length ordered binary string b.

[0224] In the third step, the edge processor constructs and processes the generated binary string b database. A database D containing N user face information features (including the binary strings of all registered users) is formed.

[0225] D={b1,b2,…,b N}

[0226] In the fourth step, the IoT security chip generates a random key, which is recorded as

[0227] key = GenerateKey()

[0228] And perform SHA-256 hash transformation on the generated key to generate the hash value of the key, recorded as

[0229] key hash =SHA256(key)

[0230] Then, the generated key is XORed with the binary feature at the time of registration to generate the commitment, which is recorded as

[0231]

[0232] The fifth step is to encrypt the video file video according to the key key, which is recorded as

[0233] video enc =Encrypt(video,key)

[0234] The generated commitment is stored in the IoT security chip, and the encrypted video file is stored in the secure storage system.

[0235] Step 6: When decryption is required, the face collection module first collects the authentication face information and records the collected face information as x auth,raw , and perform the image preprocessing described above to obtain x auth,norm , and then perform deep feature extraction of neural convolutional network to obtain f auth , and then generate the authentication binary string b through hash replacement and binarization process auth , and perform threshold screening on the authentication binary string and the binary string in the database D, recorded as

[0236]

[0237] Among them, L is the length of the binary string, b auth,j and b i,j b auth and b i The jth position of .

[0238] If there is a b i Make HD(b auth ,b i )≤T (where T is the preset threshold), the match is successful, and this b i Send it to the IoT security chip. If it does not exist, terminate the process.

[0239] In the seventh step, the IoT security chip performs an XOR operation on the received legal authentication binary string and the stored commitment to generate a release key, which is recorded as

[0240]

[0241] The release key is then hashed and recorded as

[0242] key′ hash =SHA256(key')

[0243] Step 8: Compare the hash value of the released key with the hash value of the original key. The output is as follows:

[0244]

[0245] If the result is True, decryption is performed, recorded as

[0246] video=Decrypt(video enc ,key')

[0247] Decrypt means using the release key 'key' to encrypt the file video enc Perform decryption operations;

[0248] If the result is False, the process is terminated.

[0249] The face encryption file system based on the IoT security chip proposed in this embodiment has significant advantages. First, the IoT security chip generates a random key and binds it to facial features, ensuring that only successfully authenticated users can decrypt files, effectively preventing unauthorized access and data leakage, and greatly improving the security of file encryption. Second, the optimized edge processing module reduces data transmission volume and computing resource consumption, improving the system's response speed and efficiency, and meeting real-time requirements. In addition, the system enhances the security of biometric data and keys through hash and XOR operations, and utilizes the hardware-level security protection of the IoT security chip to further enhance the system's anti-attack capabilities and ensure user privacy and data security. At the same time, the system is suitable for a variety of application scenarios requiring high security, such as remote monitoring, video conferencing, and online education, and can effectively meet the security needs of different scenarios. Finally, combining the IoT security chip and biometric encryption technology provides a complete solution from feature acquisition to file encryption, which is highly innovative and practical.

[0250] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware portion can be implemented using dedicated logic; the software portion can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. Those skilled in the art will appreciate that the above-mentioned devices and methods can be implemented using computer-executable instructions and / or contained in processor control code, for example, such as a carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The devices and modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, or can be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0251] The above description is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with this technical field within the technical scope disclosed by the present invention and within the spirit and principles of the present invention should be covered by the scope of protection of the present invention.

Claims

1. A biometric information encryption method based on an Internet of Things security chip, characterized in that: The following steps are involved: Step 1: Collect relevant data using a biometric information collection module based on an IoT security chip installed on the device; The biometric information collection module based on the IoT security chip consists of a camera and a data transmission unit, which plays the role of data collection and uploading; Step 2: Build a data processing mechanism based on edge processing. After the edge processor receives the biometric data uploaded by the biometric information collection module, it performs information cropping and deep feature extraction, and performs fixed-length ordered binary feature conversion. The data is stored in the edge processor's feature database to form a registered personnel database, and a copy is sent to the IoT security chip for subsequent commitment generation. Step 3: The biometric information involved in authentication is extracted, processed, and transformed as described above, ultimately obtaining a fixed-length, ordered binary feature conversion corresponding to the biometric information involved in authentication. A threshold comparison is then performed in the feature database stored in the edge processor. If a match is found, the feature data is sent to the IoT security chip. If no match is found, the authentication process is terminated at this step. Step 4: The IoT security chip first uses the original key to encrypt the file through the encryption and decryption module, and then performs an XOR operation based on the original key and the binary features during registration to generate a commitment; Step 5: The IoT security chip compares the original key with the committed generated key. If the comparison result is passed, the encryption and decryption module decrypts the encrypted file. Otherwise, if the comparison result fails, the decryption of the encrypted file is terminated.

2. The biometric information encryption method based on the Internet of Things security chip as claimed in claim 1, characterized in that: The specific process of collecting bioinformation data in step 1 includes: S11, a bio-information collection module installed on the device, collects bio-information data BIO in real time through built-in sensors; S12, the data transmission unit installed on the device uploads the collected bioinformation data BIO to the edge processor module.

3. The biometric information encryption method based on the Internet of Things security chip as claimed in claim 1, characterized in that: The data processing process of the biological information acquisition module in step 2 includes: S21, the edge processor module performs deep feature extraction on the received bioinformation data BIO to obtain feature data x and preprocesses the data, wherein the preprocessing methods include: 1) Normalization processing; Let the original feature data be x, and the normalized feature data be x norm , the normalization formula is as follows: where x max with x min are the maximum and minimum values ​​in the feature data set respectively; 2) Denoising; Assume that the original feature data sequence is x1, x2, ..., x n The window size is K, then the denoised feature data x denoise The calculation is as follows: Where K is the size of the filter window, usually an odd number; i is the index of the current data point; 3) Enhanced processing; Use methods such as histogram equalization or gamma correction; Let the original feature data be x, and the enhanced feature data be x enhanced , the gamma correction formula is as follows: x enhanced =x γ Where γ is the gamma value, which is used to adjust the contrast of the image. Usually, γ<1 is used to improve dark details, and γ>1 is used to improve bright details. The comprehensive preprocessing of feature data can be expressed as: x enhanced =x denoise γ Finally, the preprocessed feature data x enhanced Will be used for subsequent hash replacement operations; S22, first apply the hash function H to the preprocessed feature data x (usually a one-dimensional vector) to generate a fixed-length hash value h∈{0,1}L, where L is the length of the hash value; commonly used hash functions include SHA-256, SHA-512, etc.; here we use the SHA-256 hash function, denoted as h=H(x) After that, in order to increase the randomness and security of the hash value, the hash value h is permuted. The permutation operation can be implemented by a random permutation matrix P, which is a permutation matrix used to rearrange the bits in the hash value, denoted as h perm =P·h Where P is a random permutation matrix whose elements are either 0 or 1, and there is only one 1 in each row and column; h perm is the hash value after permutation; Finally, the replaced hash value h perm Convert to binary form and generate a fixed-length ordered binary string b∈{0,1} L , recorded as b=bin(h perm ) Among them, bin means converting the hash value into binary form to obtain an ordered binary string of a certain length; S23, define each user's number as i, and its fixed-length ordered binary string can be further expressed as b i , store all users' binary strings in database D, there are D={b1,b2,…,b N } Where N is the total number of users, and D is the database that stores all user binary strings; S24, copy D to form D' and send it to the IoT security chip.

4. The biometric information encryption method based on the Internet of Things security chip as claimed in claim 1, characterized in that: The comparison process of the biometric information of the authentication user in step 3 includes: S31, biometric information x involved in authentication auth Perform preprocessing, including normalization, denoising and enhancement, to generate preprocessed feature data x auth,norm , recorded as x auth,norm =Preprocess(x auth ) Among them, Proprocess processing means preprocessing the data to obtain feature data that is convenient for application; S32, the preprocessed feature data x auth,norm Apply hash function H to generate a fixed-length hash value h auth , the process is recorded as h auth =H(x auth,norm ) S33, for the hash value h auth Perform a permutation operation to generate the permuted hash value h auth,perm , recorded as h auth,perm =P·h auth Where P is a random permutation matrix used to rearrange the bits in the hash value; S34, the replaced hash value h auth,perm Convert to binary form and generate a fixed-length ordered binary string b auth , recorded as b auth =bin(h auth,perm ) S35, in the feature database D stored in the edge processor, the generated binary string b auth Perform threshold comparison; the database D contains the binary strings of all registered users, that is, D = {b1, b2, ..., b N }, then calculate b auth With each binary string b in the database i Hamming Distance (HD) of Among them, L is the length of the binary string, b auth,j and b i,j b auth and b i The jth position of S36, if there is a b i Make HD(b auth ,b i )≤T (where T is the preset threshold), the match is successful, and this b i Send it to the IoT security chip. If it does not exist, terminate the process.

5. The biometric information encryption method based on the Internet of Things security chip as claimed in claim 1, characterized in that: The encryption and commitment generation process described in step 4 is as follows: S41, original key generation, the IoT security chip generates a random key and sends it to the encryption and decryption module. The key is used for subsequent file encryption and commitment generation, recorded as key = GenerateKey() Among them, GenerateKey() is a function that generates a random key; S42, encrypt the file file using the generated original key key to generate an encrypted file, recorded as file enc =Encrypt(file,key) Among them, Encrypy is an encryption function, which means encrypting the file through the key; S43, use the SHA-256 function to perform hash transformation on the original key to generate the hash value key hash , recorded as key hash =SHA256(key) S44, the original key key and the binary feature b during registration reg Perform XOR operation to generate commitment, recorded as in, Indicates exclusive OR operation, b reg Represents the binary features generated during the corresponding registration.

6. The biometric information encryption method based on the Internet of Things security chip as claimed in claim 1, characterized in that: The key comparison and encryption / decryption process described in step 5 includes: S51, the binary feature b of the authenticated person auth Perform XOR operation with the stored commitment to generate the release key key′. This process is recorded as in, Represents the exclusive OR operation; S52, perform hash transformation on the release key key′ to generate its hash value key′ hash Perform key hash value comparison, and the comparison result can be expressed as S53, make a decision based on the comparison result Match, if the result is True, then decrypt, recorded as file=Decrypt(file enc ,key′) Decrypt means using the release key key' to encrypt the file file enc Perform decryption operations; If the result is False, the process is terminated.

7. A biometric information encryption system based on an Internet of Things security chip that implements the biometric information encryption method based on an Internet of Things security chip as described in any one of claims 1 to 6, characterized in that: The biometric information encryption system based on the Internet of Things security chip includes: A biometric information collection module, configured to collect relevant data using an IoT security chip-based biometric information collection module installed on the device; the IoT security chip-based biometric information collection module comprises a camera and a data transmission unit, and performs data collection and upload functions; A construction module is used to build a data processing mechanism based on edge processing. After the edge processor receives the biometric data uploaded by the biometric information acquisition module, it performs information cropping and deep feature extraction, and performs fixed-length ordered binary feature conversion. The data is stored in the feature database of the edge processor to form a registered personnel database, and a copy is copied to the IoT security chip for subsequent generation of commitments. The information extraction module is used to perform the above-mentioned information extraction processing and transformation on the biometric information involved in the authentication, and finally obtain the fixed-length ordered binary feature conversion corresponding to the biometric information involved in the authentication. The module then performs a threshold comparison in the feature database stored in the edge processor. If a match is found, the feature data is sent to the IoT security chip. If no match is found, the authentication process is terminated at this step. The encryption and decryption module, used in IoT security chips, first uses the original key to encrypt the file through the encryption and decryption module, and then performs an XOR operation based on the original key and the binary features at the time of registration to generate a commitment; The comparison module is used by the IoT security chip to compare the original key with the committed generated key. If the comparison result is passed, the encryption and decryption module decrypts the encrypted file. Otherwise, if the comparison result fails, the decryption of the encrypted file is terminated.

8. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the biometric information encryption method based on the Internet of Things security chip as described in any one of claims 1 to 6.

9. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the biometric information encryption method based on the Internet of Things security chip as described in any one of claims 1 to 6.

10. An information data processing terminal, characterized in that: The information data processing terminal is used to implement the biometric information encryption system based on the Internet of Things security chip as described in claim 7.

Images