A biometric authentication method and system based on distributed quantum state computation

Abstract

This application discloses a biometric authentication method and system based on distributed encrypted computation, comprising: extracting user biometric features into a first high-dimensional feature vector, splitting it into N feature segments according to a preset splitting strategy, homomorphically encrypting the segments, and uploading them to multiple servers for storage; real-time acquisition of biometric features, extracting them into a second high-dimensional feature vector, splitting it according to the same strategy, homomorphically encrypting it, and sending it to different servers; each server performing a ciphertext similarity calculation on the received second ciphertext segment and the multiple stored first ciphertext segments to generate a local ciphertext comparison result, and signing it with the server's private key; receiving the signature results returned by each server, verifying the signature with the public key of each server; if all local ciphertext comparison results indicate similarity after decryption, authentication is successful; otherwise, it fails. This application achieves control over user privacy and improves the security of biometric authentication through vector splitting, distributed storage, and a multi-server signature verification mechanism.

Description

Technical Field

[0001] This application relates to the field of image processing technology, and in particular to a biometric authentication method and system. Background Technology

[0002] Biometric authentication technologies (such as facial recognition and fingerprint recognition) have been widely applied in access control systems, financial payments, identity verification, and public security due to their uniqueness, non-replicability, and convenience. The traditional biometric authentication process typically involves: the terminal collecting plaintext biometric data (such as facial image pixel information and fingerprint texture features) and transmitting it directly to the server; the server then compares the collected data with pre-stored feature templates in its database in plaintext, ultimately returning the authentication result. However, this model suffers from core privacy and security flaws: the data transmission link is vulnerable to interception attacks; the plaintext feature templates centrally stored on the server become high-value targets for hackers; and once biometric data is leaked, it cannot be reset like a password, causing permanent privacy damage to users. Therefore, ensuring the security of users' biometric data throughout the entire process of transmission, storage, and computation while maintaining recognition accuracy has become a pressing technical challenge for those skilled in the art.

[0003] To address the aforementioned technical challenges, existing published literature CN118799945A proposes "A Face Recognition Method and System Based on Homomorphic Encryption." This method involves a client acquiring a face image and extracting feature vectors. The feature vectors are then encrypted using an encryption algorithm before being uploaded to a server. The server pre-stores encrypted face templates and, based on homomorphic encryption, directly calculates the Euclidean distance between the uploaded ciphertext features and the pre-stored ciphertext template. The encrypted calculation result is then returned to the client. The client uses a locally held decryption key to decrypt the distance value, compares it with a preset threshold, and obtains the recognition result. This scheme, through homomorphic encryption, enables the server to complete face comparison calculations by only accessing the ciphertext, thus achieving privacy protection for biometric data during transmission and storage.

[0004] However, while existing facial recognition technologies have achieved effective privacy protection in real-world scenarios, they still have the following shortcomings when applied to identity authentication scenarios:

[0005] (1) Privacy control is not fully vested in the user. The scheme uses a single server to store the complete encrypted template. Once the server is compromised, all users’ encrypted data are at risk of being leaked in batches. The user’s biometric information does not achieve the privacy protection goal of “always being in the hands of the individual”.

[0006] (2) The comparison results lack authenticity verification. The scheme does not provide any cryptographic verification means for the authenticity and integrity of the calculation results. If the server is maliciously controlled or the transmission link is attacked, the returned results may be tampered with without the user's notice, which seriously threatens the security of the authentication system. Summary of the Invention

[0007] Based on this, and to address the aforementioned technical problems, a biometric authentication method and system based on distributed dense-state computing is provided to solve the problem of low security in existing authentication processes.

[0008] Firstly, a biometric authentication method based on distributed dense-state computation, the method comprising:

[0009] Collect the user's original biometric data and extract it as the first high-dimensional feature vector;

[0010] According to the preset splitting strategy, the first high-dimensional feature vector is split into N first feature segments; each first feature segment is homomorphically encrypted using the user's private key to generate N first ciphertext segments; the N first ciphertext segments are uploaded to multiple different servers according to the preset allocation method, so that each server stores the received first ciphertext segments.

[0011] The system collects users' raw biometric data in real time and extracts it as a second high-dimensional feature vector.

[0012] According to the same preset splitting strategy, the second high-dimensional feature vector is split into N second feature segments; each second feature segment is homomorphically encrypted using the user's private key to generate N second ciphertext segments; the N second ciphertext segments are sent to multiple servers according to the same preset distribution method, so that each server performs ciphertext similarity calculation on the received second ciphertext segments and multiple stored first ciphertext segments to obtain a local ciphertext comparison result, and signs the local ciphertext comparison result using its own private key to obtain a signed local ciphertext comparison result;

[0013] Receive the partial ciphertext comparison results after N signatures returned by multiple servers;

[0014] The public key of each server is used to verify the signed partial ciphertext comparison result returned by the corresponding server. The signed partial ciphertext comparison result is verified. If all the received partial ciphertext comparison results indicate the existence of similar segments, the authentication pass result is output. If any partial ciphertext comparison result indicates that no similar segments exist, the authentication failure result is output.

[0015] Optionally, in the above scheme, the biometric data includes: facial image data or fingerprint texture data.

[0016] Optionally, in the above scheme, the preset allocation method includes:

[0017] Before uploading the N first encrypted fragments along with the user IDs to multiple different servers according to a preset allocation method, obtain the capability assessment values ​​Ci of the N servers and calculate the total capability. ;

[0018] interval Divide the system into N consecutive sub-intervals, where the sub-interval of the i-th server is:

[0019]

[0020] and ;

[0021] A random seed is selected, and a corresponding random number is generated for each feature dimension. The server assigned to the feature dimension is determined based on the sub-interval in which the random number falls. A dimension assignment mapping table is generated and stored, and the mapping table records the correspondence between each feature dimension and its assigned server.

[0022] When uploading the N first encrypted fragments along with the user ID to multiple different servers according to a preset allocation method, and when sending the N second encrypted fragments along with the user ID to multiple servers according to the same preset allocation method, the dimension allocation mapping table is directly read, and the feature value corresponding to each feature dimension is sent to the corresponding server according to the mapping table.

[0023] Optionally, in the above scheme, the ciphertext similarity calculation includes: Euclidean distance calculation or cosine similarity calculation.

[0024] Optionally, in the above scheme, the server's own private key signs the local ciphertext comparison result using homomorphic signature calculation.

[0025] Optionally, in the above scheme, ,in, .

[0026] Optionally, in the above scheme, the extraction of the first high-dimensional feature vector or the extraction of the second high-dimensional feature vector is achieved through a pre-trained deep learning network.

[0027] Secondly, a biometric authentication system based on distributed dense-state computing, the system comprising:

[0028] First high-dimensional feature vector generation module: used to collect the user's original biometric data and extract it into a first high-dimensional feature vector;

[0029] The first high-dimensional feature vector splitting module is used to split the first high-dimensional feature vector into N first feature segments according to a preset splitting strategy; to perform homomorphic encryption on each first feature segment using a user's private key to generate N first ciphertext segments; and to upload the N first ciphertext segments to multiple different servers according to a preset allocation method, so that each server stores the received first ciphertext segments.

[0030] The second high-dimensional feature vector generation module is used to collect the user's original biometric data in real time and extract it as a second high-dimensional feature vector.

[0031] The second high-dimensional feature vector splitting module is used to split the second high-dimensional feature vector into N second feature segments according to the same preset splitting strategy; to homomorphically encrypt each second feature segment using the user's private key to generate N second ciphertext segments; and to send the N second ciphertext segments to multiple servers according to the same preset distribution method, so that each server performs ciphertext similarity calculation on the received second ciphertext segments and multiple stored first ciphertext segments to obtain a local ciphertext comparison result, and signs the local ciphertext comparison result using its own private key to obtain a signed local ciphertext comparison result.

[0032] Ciphertext Comparison Result Receiving Module: Used to receive the partial ciphertext comparison results after N signatures returned by multiple servers;

[0033] Authentication module: Used to verify the signed partial ciphertext comparison results returned by the corresponding server using the public key of each server. After verification, if all received partial ciphertext comparison results indicate the existence of similar segments, the authentication pass result is output. If any partial ciphertext comparison result indicates that no similar segments exist, the authentication failure result is output.

[0034] Thirdly, a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the aforementioned biometric authentication method based on distributed dense-state computing.

[0035] Fourthly, a computer program product includes a computer program / instructions that, when executed by a processor, follow the steps of the aforementioned biometric authentication method based on distributed dense computing.

[0036] This application has at least the following beneficial effects:

[0037] (1) To achieve true privacy control for users, by splitting biometric vectors and storing them on multiple servers, and using the user's private key for encryption throughout the process, no single server or even multiple servers can recover the complete biometric information, ensuring that the user's biometric data is always in their own hands.

[0038] (2) Construct a verifiable authentication result trust mechanism. Each server independently signs the local ciphertext comparison result. The user terminal can decrypt and use the result after verifying the signature. This effectively prevents the result from being tampered with or forged, and ensures the authenticity and integrity of the authentication result from a cryptographic perspective.

[0039] (3) Eliminate the risk of single-point storage. Adopt a multi-server distributed storage architecture to physically isolate encrypted data in different storage nodes. Even if some servers are compromised, it will not lead to global data leakage, which significantly improves the system's anti-attack capability. Attached Figure Description

[0040] Figure 1 A flowchart illustrating a biometric authentication method based on distributed dense-state computation is provided for one embodiment of this application;

[0041] Figure 2 This is a schematic diagram illustrating the specific process of a biometric authentication method based on distributed dense-state computation, provided as an embodiment of this application. Detailed Implementation

[0042] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0043] In the description of this application: unless otherwise stated, "a plurality of" means two or more. The terms "first," "second," "third," etc., in this application are intended to distinguish the objects referred to and do not have any special meaning in terms of technical connotation (e.g., they should not be construed as an emphasis on importance or order). Expressions such as "including," "comprising," and "having" also mean "not limited to" (certain units, components, materials, steps, etc.).

[0044] In one embodiment, such as Figure 1 As shown, a biometric authentication method based on distributed dense-state computation is provided, including:

[0045] Step S1: Collect the user's original biometric data and extract it as the first high-dimensional feature vector;

[0046] Step S2: According to the preset splitting strategy, the first high-dimensional feature vector is split into N first feature segments; each first feature segment is homomorphically encrypted using the user's private key to generate N first ciphertext segments; the N first ciphertext segments are uploaded to multiple different servers according to the preset distribution method, so that each server stores the received first ciphertext segments.

[0047] Step S3: Collect the user's original biometric data in real time and extract it as a second high-dimensional feature vector;

[0048] Step S4: According to the same preset splitting strategy, the second high-dimensional feature vector is split into N second feature segments; each second feature segment is homomorphically encrypted using the user's private key to generate N second ciphertext segments; the N second ciphertext segments are sent to multiple servers according to the same preset distribution method, so that each server performs ciphertext similarity calculation on the received second ciphertext segments and the stored multiple first ciphertext segments to obtain a local ciphertext comparison result, and signs the local ciphertext comparison result using its own private key to obtain a signed local ciphertext comparison result;

[0049] Step S5: Receive the partial ciphertext comparison results after N signatures returned by multiple servers;

[0050] Step S6: Use the public key of each server to verify the signed partial ciphertext comparison result returned by the corresponding server. Verify the signed partial ciphertext comparison result. If all received partial ciphertext comparison results indicate the existence of similar segments, output the authentication pass result. If any partial ciphertext comparison result indicates that no similar segments exist, output the authentication failure result.

[0051] In this embodiment, when performing traditional biometric identification such as facial or fingerprint recognition, the collected data is no longer directly uploaded. Instead, it passes through a data processing network to obtain a high-dimensional information vector (e.g., a 256-dimensional or 128-dimensional vector). This vector is then split (the splitting method is determined by the user), and the split data is uploaded to different cloud servers. When an application system (e.g., access control) needs to perform biometric identification on a user, the real-time acquired ciphertext data is also split in the same way. Simultaneously, each server reads pre-stored ciphertext data and compares it row-wise with the subsequently acquired ciphertext data in a homomorphic manner to obtain a homomorphic ciphertext result. A joint homomorphic signature is then performed on this ciphertext result. After receiving the homomorphic ciphertext result and the server's joint homomorphic signature, the user terminal decrypts it and provides the decryption result. The application system decrypts the result based on the joint homomorphic signature and verifies the validity of the biometric identification result based on the homomorphic signature. This closed-state biometric authentication method ensures that personal privacy information is always in the hands of the individual, preventing the leakage of personal plaintext information by servers or intermediate links, and achieving maximum protection of personal privacy; it is suitable for biometric identification systems that require high security.

[0052] Specifically, the authentication process is divided into two parts: the registration stage and the authentication stage. The registration stage provides encrypted feature templates for the authentication stage, and the authentication stage realizes full-process encrypted comparison and verification.

[0053] (I) Registration Phase: Encryption Feature Template Input:

[0054] This stage involves extracting the user's biometric vectors, encrypting them, and storing the ciphertext template. The specific steps are as follows:

[0055] Raw Feature Acquisition and Vector Transformation: The user terminal acquires raw biometric data such as face / fingerprint through the biometric acquisition module and transmits it to the feature vector extraction module. The extraction module then uses a pre-trained deep learning network to convert the raw data into d-dimensional high-dimensional feature vectors. The obtained high-dimensional feature vectors are then split into multiple parts.

[0056] The multiple high-dimensional feature vectors after splitting are encrypted using private keys to generate ciphertext features. The encryption module of the user terminal calls the user's private key SK in the key management module to perform asymmetric encryption on the high-dimensional feature vector V to generate the ciphertext feature vector. ;

[0057] Uploading encrypted feature templates to the library: The user terminal uploads multiple encrypted feature vectors (CVs) to different servers through the transport layer; the encrypted feature library module of the server receives the CVs and completes the registration and storage of encrypted feature templates.

[0058] Note: No plaintext feature vectors are uploaded during the registration process. The server only stores encrypted data, making it impossible to deduce the user's original biometric features.

[0059] (II) Authentication Stage: Full-process confidentiality comparison and signature verification;

[0060] This stage represents the core business process. After the application system (such as access control) initiates an authentication request, it implements end-to-end encrypted processing, including "ciphertext transmission - ciphertext comparison - signature verification - decryption confirmation." The specific steps are as follows:

[0061] Real-time feature acquisition and ciphertext generation: When user authentication is required, the user terminal repeats the first two steps of the registration phase, acquiring biometric features in real time and generating real-time ciphertext feature vectors. ,in This involves extracting high-dimensional feature vectors in real time and then splitting the generated ciphertext feature vectors.

[0062] Ciphertext Feature Transmission and Comparison Request: Initiates the user terminal to transmit multiple real-time ciphertext feature vectors The requests are sent to different servers through the transport layer to initiate authentication and comparison requests.

[0063] Server-side ciphertext homomorphic comparison: After receiving a request, the server retrieves the registered ciphertext feature vector (CV) from the ciphertext feature library and performs similarity calculation; the homomorphic operation module, based on the homomorphic encryption algorithm, compares multiple CVs with... Perform ciphertext similarity calculation.

[0064] Computational logic: Based on the homomorphic addition / multiplication properties, the distance between the ciphertext vectors is directly calculated (e.g., Euclidean distance). The result obtained is the encrypted comparison result CD, which is in encrypted state throughout and cannot be directly interpreted to determine whether the authentication has passed.

[0065] Server-side homomorphic signature generation: The server's homomorphic signature module calls the server's private key. Sign the dense-state alignment result CD to generate a homomorphic signature. The purpose of a signature is to prevent CDs from being tampered with during transmission or terminal processing.

[0066] Secret state result and signature return: The server returns the secret state comparison result CD and the homomorphic signature Sig to the user terminal through the transport layer.

[0067] User terminal signature verification: After the user terminal receives the CD and Sig, it performs the verification operation:

[0068] Step 1: Signature Validity Verification: Use the server public key PK_S stored in the key management module to verify the validity of the signature Sig. The formula is as follows: If the verification fails, the authentication process is deemed abnormal and terminated directly; if the verification passes, proceed to the next step.

[0069] Step 2: Decryption of the encrypted result: The user terminal uses its private key SK to decrypt the encrypted comparison result CD to obtain the plaintext comparison result. .

[0070] Step 3: The user terminal determines whether the plaintext comparison result D meets the authentication pass conditions based on the preset authentication threshold (such as the Euclidean distance threshold T): If there exists a... If all are true, then the authentication is considered successful; if all are false, then the authentication is considered successful. If so, the plaintext comparison and authentication for this part is deemed to have failed.

[0071] Step 4: The user combines the authentication results of all the encrypted comparison results sent by the server. If all comparisons are successful, the user is finally deemed to have passed authentication. If the authentication result of one of the encrypted comparison results fails, the user is ultimately deemed to have failed.

[0072] Step 5: The application system (such as access control) reads the final authentication result of the user terminal and executes the corresponding action (opens the door if authentication is successful, and refuses if authentication fails).

[0073] The aforementioned biometric authentication method based on distributed dense-state computation has the following advantages:

[0074] (1) To achieve true privacy control for users, by splitting biometric vectors and storing them on multiple servers, and using the user's private key for encryption throughout the process, no single server or even multiple servers can recover the complete biometric information, ensuring that the user's biometric data is always in their own hands.

[0075] (2) Construct a verifiable authentication result trust mechanism. Each server independently signs the local ciphertext comparison result. The user terminal can decrypt and use the result after verifying the signature. This effectively prevents the result from being tampered with or forged, and ensures the authenticity and integrity of the authentication result from a cryptographic perspective.

[0076] (3) Eliminate the risk of single-point storage. Adopt a multi-server distributed storage architecture to physically isolate encrypted data in different storage nodes. Even if some servers are compromised, it will not lead to global data leakage, which significantly improves the system's anti-attack capability.

[0077] In one embodiment, biometric data includes: facial image data or fingerprint texture data.

[0078] In one embodiment, the preset allocation method includes:

[0079] Before uploading the N first encrypted fragments along with the user IDs to multiple different servers according to a preset allocation method, obtain the capability assessment values ​​Ci of the N servers and calculate the total capability. ;

[0080] interval Divide the system into N consecutive sub-intervals, where the sub-interval of the i-th server is:

[0081] and ;

[0082] A random seed is selected, and a corresponding random number is generated for each feature dimension. The server assigned to the feature dimension is determined based on the sub-interval in which the random number falls. A dimension assignment mapping table is generated and stored, and the mapping table records the correspondence between each feature dimension and its assigned server.

[0083] When uploading the N first encrypted fragments along with the user ID to multiple different servers according to a preset allocation method, and when sending the N second encrypted fragments along with the user ID to multiple servers according to the same preset allocation method, the dimension allocation mapping table is directly read, and the feature value corresponding to each feature dimension is sent to the corresponding server according to the mapping table.

[0084] Specifically, the data from N servers is segmented and numbered, and the service capacity of each server is evaluated to obtain a numerical value. Add up all the abilities and record them as Then, in turn, map the probability distributions of all servers to... In the middle, that is, the service range of the i-th server is The lower bound of the first server Therefore, there is ,and Arranged in an orderly manner.

[0085] The feature data consists of M segments, therefore a function is needed to map these M segments to N servers. Therefore, this invention employs a function generator based on a random seed to implement the mapping rules.

[0086] The recommended mapping rule of this invention is as follows: select a random number seed, and generate M based on the seed. A sequence of random numbers that do not repeat within an interval The j-th segment information The server number being processed satisfies Then the j-th server performs data processing services.

[0087] Since the segmentation function determined by the server is the default configuration, the server can know how to read and process data simply by transmitting the seed.

[0088] In one embodiment, the ciphertext similarity calculation includes: Euclidean distance calculation or cosine similarity calculation.

[0089] In one embodiment, the server's own private key signs the local ciphertext comparison result using homomorphic signature computation.

[0090] In one embodiment, ,in, .

[0091] In one embodiment, the extraction of the first high-dimensional feature vector or the extraction of the second high-dimensional feature vector is achieved through a pre-trained deep learning network.

[0092] In one embodiment, a biometric authentication system based on distributed dense-state computation is provided, comprising:

[0093] First high-dimensional feature vector generation module: used to collect the user's original biometric data and extract it into a first high-dimensional feature vector;

[0094] The first high-dimensional feature vector splitting module is used to split the first high-dimensional feature vector into N first feature segments according to a preset splitting strategy; to perform homomorphic encryption on each first feature segment using a user's private key to generate N first ciphertext segments; and to upload the N first ciphertext segments to multiple different servers according to a preset allocation method, so that each server stores the received first ciphertext segments.

[0095] The second high-dimensional feature vector generation module is used to collect the user's original biometric data in real time and extract it as a second high-dimensional feature vector.

[0096] The second high-dimensional feature vector splitting module is used to split the second high-dimensional feature vector into N second feature segments according to the same preset splitting strategy; to homomorphically encrypt each second feature segment using the user's private key to generate N second ciphertext segments; and to send the N second ciphertext segments to multiple servers according to the same preset distribution method, so that each server performs ciphertext similarity calculation on the received second ciphertext segments and multiple stored first ciphertext segments to obtain a local ciphertext comparison result, and signs the local ciphertext comparison result using its own private key to obtain a signed local ciphertext comparison result.

[0097] Ciphertext Comparison Result Receiving Module: Used to receive the partial ciphertext comparison results after N signatures returned by multiple servers;

[0098] Authentication module: Used to verify the signed partial ciphertext comparison results returned by the corresponding server using the public key of each server. After verification, if all received partial ciphertext comparison results indicate the existence of similar segments, the authentication pass result is output. If any partial ciphertext comparison result indicates that no similar segments exist, the authentication failure result is output.

[0099] In one embodiment, the system architecture of this application consists of three core layers: the user terminal layer, the transmission layer, and the server layer. The functional modules of each layer work together to achieve end-to-end encrypted authentication.

[0100] The user terminal layer is the core carrier for biometric data collection, preprocessing, encryption, and decryption, and includes the following functional modules:

[0101] Biometric data acquisition module: responsible for collecting raw biometric data such as facial images and fingerprint textures;

[0102] Feature vector extraction module: Built-in pre-trained deep learning feature extraction network (such as CNN-based face recognition model, fingerprint vector generation model based on feature point extraction) to convert the original biometric data into a fixed-dimensional high-dimensional information vector (128-dimensional / 256-dimensional optional). This vector retains only the core features required for authentication and removes redundant privacy information from the original image.

[0103] Feature vector splitting module: splits high-dimensional information vectors according to a preset method;

[0104] Key management module: Users independently hold and manage asymmetric encryption private keys, which are used to encrypt the split high-dimensional feature vectors; at the same time, the server's public key is stored, which is used to verify the server's homomorphic signature;

[0105] Encryption / Decryption Module: Encrypts high-dimensional feature vectors using the user's private key to generate ciphertext feature vectors; after receiving the encrypted comparison result and homomorphic signature returned by the server, it completes the decryption operation.

[0106] Authentication Result Confirmation Module: Displays the decrypted authentication result for application systems (such as access control systems) to read.

[0107] The transport layer is responsible for transmitting encrypted data between the user terminal and the server. The transmitted content only includes encrypted feature vectors, encrypted comparison results, and homomorphic signatures. There is no plaintext biometric data flow throughout the process, and the security of the transmission link can be further guaranteed based on the TLS / SSL protocol.

[0108] The server layer is responsible for storing encrypted feature vectors, performing ciphertext comparison operations, and homomorphic signatures. It does not access any plaintext biometric information and includes the following functional modules:

[0109] Ciphertext Feature Library Module: Stores ciphertext feature vectors pre-registered by users, but does not store original biometric features or plaintext feature vectors;

[0110] Homomorphic operation module: Built-in encryption algorithms that support addition / multiplication homomorphism (such as BFV and CKKS homomorphic encryption algorithms), which can directly perform similarity comparison operations on ciphertext feature vectors (such as Euclidean distance calculation and cosine similarity calculation) and output the ciphertext comparison results;

[0111] Homomorphic signature module: Holding the server's private key, it performs homomorphic signature on the cryptographic comparison result to generate tamper-proof signature information;

[0112] Signature verification auxiliary module: works with the user terminal to complete the signature verification logic and ensure a closed loop in the authentication process.

[0113] In addition, the system also includes an application system layer (such as access control and identity verification system) to read the decryption results of the user terminal and perform the final authentication actions (such as opening the door and granting permissions).

[0114] For specific limitations regarding a biometric authentication system based on distributed dense computation, please refer to the limitations of a biometric authentication method based on distributed dense computation mentioned above, which will not be repeated here. Each module in the aforementioned biometric authentication system based on distributed dense computation can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0115] In one embodiment, a computer-readable storage medium is also provided, having stored thereon a computer program relating to all or part of the processes in the methods of the above embodiments.

[0116] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0117] In one embodiment, a computer program product is also provided, including a computer program / instructions that, when executed by a processor, involve all or part of the processes in the methods of the above embodiments.

[0118] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0119] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A biometric authentication method based on distributed secure computation, characterized by, The method includes: Collect the user's original biometric data and extract it as the first high-dimensional feature vector; According to the preset splitting strategy, the first high-dimensional feature vector is split into N first feature segments; each first feature segment is homomorphically encrypted using the user's private key to generate N first ciphertext segments; the N first ciphertext segments are uploaded to multiple different servers according to the preset allocation method, so that each server stores the received first ciphertext segments. The system collects users' raw biometric data in real time and extracts it as a second high-dimensional feature vector. According to the same preset splitting strategy, the second high-dimensional feature vector is split into N second feature segments; each second feature segment is homomorphically encrypted using the user's private key to generate N second ciphertext segments; the N second ciphertext segments are sent to multiple servers according to the same preset distribution method, so that each server performs ciphertext similarity calculation on the received second ciphertext segments and multiple stored first ciphertext segments to obtain a local ciphertext comparison result, and signs the local ciphertext comparison result using its own private key to obtain a signed local ciphertext comparison result; Receive the partial ciphertext comparison results after N signatures returned by multiple servers; The public key of each server is used to verify the signed partial ciphertext comparison result returned by the corresponding server. The signed partial ciphertext comparison result is verified. If all the received partial ciphertext comparison results indicate the existence of similar segments, the authentication pass result is output. If any partial ciphertext comparison result indicates that no similar segments exist, the authentication failure result is output.

2. The biometric authentication method based on distributed dense-state computation according to claim 1, characterized in that, The biometric data includes: facial image data or fingerprint texture data.

3. The biometric authentication method based on distributed dense-state computation according to claim 1, characterized in that, The preset allocation method includes: Before uploading the N first encrypted fragments along with the user IDs to multiple different servers according to a preset allocation method, obtain the capability assessment values ​​Ci of the N servers and calculate the total capability. ; interval Divide the system into N consecutive sub-intervals, where the sub-interval of the i-th server is: ； and ; A random seed is selected, and a corresponding random number is generated for each feature dimension. The server assigned to the feature dimension is determined based on the sub-interval in which the random number falls. A dimension assignment mapping table is generated and stored, and the mapping table records the correspondence between each feature dimension and its assigned server. When uploading the N first encrypted fragments along with the user ID to multiple different servers according to a preset allocation method, and when sending the N second encrypted fragments along with the user ID to multiple servers according to the same preset allocation method, the dimension allocation mapping table is directly read, and the feature value corresponding to each feature dimension is sent to the corresponding server according to the mapping table.

4. The biometric authentication method based on distributed dense-state computation according to claim 1, characterized in that, The ciphertext similarity calculation includes: Euclidean distance calculation or cosine similarity calculation.

5. The biometric authentication method based on distributed dense-state computation according to claim 1, characterized in that, The server uses its own private key to sign the local ciphertext comparison result, and uses homomorphic signature calculation.

6. The biometric authentication method based on distributed dense-state computation according to claim 1, characterized in that, ,in, .

7. The biometric authentication method based on distributed dense-state computation according to claim 1, characterized in that, The extraction of the first high-dimensional feature vector or the extraction of the second high-dimensional feature vector is achieved through a pre-trained deep learning network.

8. A biometric authentication system based on distributed dense-state computing, characterized in that, The system includes: First high-dimensional feature vector generation module: used to collect the user's original biometric data and extract it into a first high-dimensional feature vector; The first high-dimensional feature vector splitting module is used to split the first high-dimensional feature vector into N first feature segments according to a preset splitting strategy; to perform homomorphic encryption on each first feature segment using a user's private key to generate N first ciphertext segments; and to upload the N first ciphertext segments to multiple different servers according to a preset allocation method, so that each server stores the received first ciphertext segments. The second high-dimensional feature vector generation module is used to collect the user's original biometric data in real time and extract it as a second high-dimensional feature vector. The second high-dimensional feature vector splitting module is used to split the second high-dimensional feature vector into N second feature segments according to the same preset splitting strategy; to homomorphically encrypt each second feature segment using the user's private key to generate N second ciphertext segments; and to send the N second ciphertext segments to multiple servers according to the same preset distribution method, so that each server performs ciphertext similarity calculation on the received second ciphertext segments and multiple stored first ciphertext segments to obtain a local ciphertext comparison result, and signs the local ciphertext comparison result using its own private key to obtain a signed local ciphertext comparison result. Ciphertext Comparison Result Receiving Module: Used to receive the partial ciphertext comparison results after N signatures returned by multiple servers; Authentication module: Used to verify the signed partial ciphertext comparison results returned by the corresponding server using the public key of each server. After verification, if all received partial ciphertext comparison results indicate the existence of similar segments, the authentication pass result is output. If any partial ciphertext comparison result indicates that no similar segments exist, the authentication failure result is output.

9. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements the method as described in any one of claims 1 to 7.

10. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instruction is executed by the processor, it implements the method described in any one of claims 1 to 7.

Images