An information processing method, apparatus and electronic device

Abstract

The application provides an information processing method, relates to the field of information security, in particular to the fields of identity authentication and terminal device login, and can be applied to scenarios such as terminal device identity authentication. The specific implementation scheme is as follows: a hardware encryption unit is used to process target incentive information to obtain initial encryption information for the target incentive information, wherein the target incentive information is one of a plurality of candidate incentive information generated by a hardware incentive generation unit; the initial encryption information for the target incentive information is used to obtain target encryption information for the target incentive information; a plurality of biological local feature information of a user to be authenticated is fused with the target encryption information respectively to obtain to-be-authenticated information of the user to be authenticated; and an authentication result is determined according to the to-be-authenticated information and preset authentication information for the target incentive information. The application further provides an information processing device, an electronic device and a storage medium.

Description

Technical Field

[0001] This application relates to the field of information security, and more specifically to an information processing method, apparatus, and electronic device. Background Technology

[0002] In scenarios where users use terminal devices for identity verification, the relevant technologies typically store biometric templates directly on the terminal device, which poses a risk of being illegally read or leaked. Once the biometric template is stolen, attackers can use it to forge identities on other devices, creating a security vulnerability of cross-device reuse. Summary of the Invention

[0003] In view of the above problems, embodiments of this application provide an information processing method, apparatus, and electronic device.

[0004] According to a first aspect of this application, an information processing method is provided, comprising:

[0005] In response to obtaining the global biometric feature information of the user to be authenticated, initial encryption information for the target incentive information is determined, wherein the target incentive information is one of a plurality of pre-generated candidate incentive information; based on the initial encryption information for the target incentive information, target encryption information for the target incentive information is obtained; multiple local biometric feature information corresponding to the global biometric feature information are respectively fused with the target encryption information to obtain the authentication information for the user to be authenticated; based on the authentication information for the user to be authenticated and the preset authentication information for the target incentive information, an authentication result is determined, wherein the authentication result is used to indicate whether the user to be authenticated has passed authentication;

[0006] In the above scheme, obtaining the initial encrypted information for the target stimulus information includes: using a hardware encryption unit to process the target stimulus information based on a physically non-cloning function to obtain the initial encrypted information for the target stimulus information.

[0007] In the above scheme, obtaining the target encrypted information based on the initial encrypted information for the target stimulus information includes: determining the initial transformation matrix for the target stimulus information based on the initial encrypted information; and performing orthogonalization on the initial transformation matrix to obtain the target transformation matrix, which serves as the target encrypted information.

[0008] In the above scheme, the multiple local biometric features of the user to be authenticated are fused with the target encrypted information to obtain the authentication information of the user to be authenticated, including: segmenting the global biometric features of the user to be authenticated according to a preset segmentation method to obtain multiple local biometric features of the user to be authenticated; fusing the multiple local biometric features of the user to be authenticated with the target encrypted information to obtain multiple local authentication information for each of the multiple local biometric features; and obtaining the authentication information based on the multiple local authentication information.

[0009] In the above scheme, the local authentication information is local authentication sequence information, which includes at least one authentication value, which is either a first authentication value or a second authentication value. The process of fusing multiple biometric local feature information of the user to be authenticated with target encrypted information to obtain multiple local authentication information for each of the multiple biometric local feature information includes: fusing multiple biometric local feature information of the user to be authenticated with target encrypted information to obtain multiple fusion results, each fusion result including at least one fusion value; and, based on the multiple fusion results and a preset mapping threshold, performing at least one of the following operations to obtain multiple local authentication sequence information: in response to determining that the fusion value is greater than or equal to the preset mapping threshold, mapping the fusion value to a first authentication value; and in response to determining that the fusion value is less than the preset mapping threshold, mapping the fusion value to a second authentication value.

[0010] In the above scheme, the candidate stimulus information is the initial stimulus information that meets the first preset condition. The first preset condition includes: the proportion of identical results is greater than or equal to the first preset proportion threshold. The proportion of identical results is: the maximum proportion of identical function processing results among the multiple function processing results of the initial stimulus information in the hardware encryption unit. The multiple function processing results of the initial stimulus information are obtained by processing the initial stimulus information multiple times by the hardware encryption unit.

[0011] In the above scheme, the preset authentication information for candidate incentive information is stored in a hardware storage unit. The preset authentication information for candidate incentive information is obtained based on multiple preset local authentication information for candidate incentive information. The multiple preset local authentication information for candidate incentive information is obtained by fusing multiple selected biological local feature information of the certified user with candidate encryption information. The multiple selected biological local feature information is obtained by segmenting the selected biological global feature information of the certified user according to a preset segmentation method. The selected biological global feature information is candidate biological global feature information that meets the second preset condition. The second preset condition includes: the proportion of identical authentication information is greater than or equal to the second preset proportion threshold. The proportion of identical authentication information is: the maximum proportion of identical initial authentication information among multiple initial authentication information for the candidate biological local feature information set. The candidate biological local feature information set includes multiple candidate biological local feature information obtained by segmenting the candidate biological global feature information according to the preset segmentation method. The initial authentication information for the candidate biological local feature information set is obtained based on multiple initial local authentication information for candidate incentive information. The multiple initial local authentication information for candidate incentive information is obtained by fusing multiple candidate biological local feature information with candidate encryption information for candidate incentive information.

[0012] In the above scheme, the authentication result is determined based on the information to be authenticated and the preset authentication information for the target incentive information. This includes: in response to determining that the difference between the information to be authenticated and the preset authentication information is less than or equal to a preset difference threshold, the authentication result is determined as a first authentication result, which is used to indicate that the user to be authenticated has passed the authentication; in response to determining that the difference between the information to be authenticated and the preset authentication information is greater than the preset difference threshold, the authentication sub-result is determined as a second authentication result, which is used to indicate that the user to be authenticated has failed the authentication.

[0013] According to a second aspect of this application, an information processing apparatus is provided, comprising a processing module for processing target incentive information using a hardware encryption unit to obtain initial encrypted information for the target incentive information, wherein the target incentive information is one of multiple candidate incentive information generated by a hardware incentive generation unit; an obtaining module for obtaining target encrypted information for the target incentive information based on the initial encrypted information for the target incentive information; a fusion module for fusing multiple biometric local feature information of the user to be authenticated with the target encrypted information to obtain authentication information for the user to be authenticated; and a determining module for determining an authentication result based on the authentication information for the user to be authenticated and preset authentication information for the target incentive information.

[0014] According to a third aspect of this application, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the steps of the above-described method.

[0015] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description.

[0016] The information processing method provided in this application has at least the following advantages compared with related technologies:

[0017] In the identity registration process, a number of incentive seeds are generated using a true random number generator. A unique random space is generated for each incentive seed using a physically non-cloning function. Each random space is then projected onto the segmented biometric features to obtain encrypted biometric features. The terminal device retains only the encrypted biometric features. In the identity authentication process, an incentive seed is randomly selected again to regenerate the random space and encrypted biometric features. Authentication is completed by comparing these encrypted biometric features stored in the terminal device. Since the generation of the random space is physically bound to the terminal device, the risk of random space leakage is avoided. Furthermore, this application only stores the encrypted biometric features, thus avoiding the risk of biometric feature leakage while ensuring the random space remains undisclosed. Attached Figure Description

[0018] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0019] Figure 1 This is a schematic diagram of the hardware architecture of an information processing method that can be applied according to an embodiment of this application;

[0020] Figure 2 This is an example flowchart of an information processing method according to an embodiment of this application;

[0021] Figure 3 This is an example flowchart of the process for generating authentication information according to an embodiment of this application;

[0022] Figure 4 This is a block diagram of an information processing apparatus according to an embodiment of the present application; and,

[0023] Figure 5 This is a block diagram of an electronic device to which image processing methods can be applied, according to an embodiment of the present disclosure. Detailed Implementation

[0024] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0025] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0026] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0027] In the technical solution of this application, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0028] In scenarios where personal information is used for automated decision-making, the methods, devices, and systems provided in this application all provide users with corresponding operation entry points for users to choose to agree to or reject the automated decision results; if the user chooses to reject, the process enters the expert decision-making process.

[0029] Figure 1 This is a schematic diagram of the hardware architecture of an information processing method that can be applied according to an embodiment of this application.

[0030] like Figure 1 As shown, the system architecture 100 according to this embodiment may include a camera 101, an embedded controller 102, a storage chip 103, and a terminal device 104.

[0031] More specifically, when a user needs to register their identity, their biometric features are first collected via a camera and used as input to an embedded controller 102 electrically connected to the camera. The embedded controller 102 contains a first circuit for a true random number generator 1021 and a second circuit corresponding to a physically unclonable function 1022. The true random number generator 1021 generates true random numbers through physical fluctuations in the first circuit, while the physically unclonable function 1022 is used as an stimulus to take the true random numbers as input and outputs an unpredictable sequence of random binary numbers as a stimulus response based on the physical characteristics of the second circuit. Subsequently, the processor 1023 maps the input biometric features to the random space corresponding to the stimulus response, obtaining an encrypted biometric code. This biometric code is then saved to the storage chip 103 for subsequent identity authentication.

[0032] During the user authentication phase, the user sends an authentication command to the embedded controller 102 through the terminal device 104, and collects new biometric features, which are then used by the embedded controller 102 to generate a new biometric code. The embedded controller 102 extracts the stored biometric code from the storage chip 103, compares the difference between the stored biometric code and the newly generated biometric code to obtain the authentication result, and returns the authentication result to the terminal device 104.

[0033] It is important to note that Figure 1 The examples shown are merely hardware architectures applicable to embodiments of this application, intended to help those skilled in the art understand the technical content of this disclosure. However, they do not imply that embodiments of this application cannot be used in other devices, systems, or biometric extraction methods. For instance, in addition to a camera, a fingerprint recording device can be used to collect biometric features. Furthermore, the true random number generator 1021 and the physically unclonable function 1022 may be externally connected to the embedded controller 102, rather than being embedded within it. In other words, this application does not restrict the location of the true random number generator 1021 and the physically unclonable function 1022.

[0034] Furthermore, the true random number generator 1021 achieves true physical randomness through physical phenomena such as thermal noise, photon noise, and oscillation jitter in the first circuit, rather than pseudo-randomness calculated by a program algorithm. Therefore, it has the characteristics of being unpredictable and unreproducible, thereby ensuring the unreplicability of the user registration and authentication process. For example, it uses the random thermal noise of semiconductor gate delay and process deviation to generate unpredictable clock jitter as random numbers.

[0035] Furthermore, the physically unclonable function 1022 utilizes random physical deviations during the manufacturing of the second circuit, such as transistor threshold voltage, linewidth, and doping, to generate a unique, unclonable, and unpredictable hardware fingerprint for the second circuit. In specific implementations, physically unclonable functions with stable outputs, such as SRAM-PUF, eFuse PUF, and Ring Oscillator (RO) PUF, can be used. Taking SRAM-PUF as an example, it utilizes the uniqueness of the initial power-on state of the SRAM to achieve physical unclonability. Specifically, the SRAM is composed of cross-coupled inverters. Manufacturing deviations cause each cell to stably bias towards 0 or 1 upon power-on, and the same chip is consistent each time it is powered on, while different chips are completely different. Then, using the aforementioned true random number as the selected address, by reading the initial power-on state of the SRAM cell at the address selected by the true random number, a binary response sequence unique to the chip and whose process cannot be replicated is output.

[0036] Understandably, through the hardware architecture, the first circuit generates truly random numbers each time, and then reads the unique and uncopyable binary response sequence in the second circuit based on the truly random numbers, thereby achieving true randomness and uncopyability of the response sequence, ensuring that each authentication process is unpredictable, and avoiding replay or modeling attacks on fixed credentials or historical authentication data.

[0037] As can be understood, the hardware architecture of this application has been described above, and the method of this application will be described below.

[0038] Figure 2 This is a flowchart of an information processing method according to an embodiment of this application.

[0039] like Figure 2 As shown, the method 200 may include operations S210-S240;

[0040] In operation S210, in response to obtaining the global biometric feature information of the user to be authenticated, initial encryption information for the target incentive information is determined, wherein the target incentive information is one of a plurality of pre-generated candidate incentive information.

[0041] This embodiment provides a hardware stimulus generation unit and a hardware encryption unit, which correspond to the first circuit of the true randomness generator and the second circuit of the physically unclonable function, respectively.

[0042] In this embodiment, the multiple candidate incentive information can be generated by a set of truly random numbers generated multiple times by the hardware incentive generation unit. The target incentive information is randomly selected from the set of truly random numbers generated again by the hardware incentive generation unit. It can be understood that there is more than one candidate incentive information. The purpose is to save the registration encryption information corresponding to multiple candidate incentive information during user identity information registration. By setting multiple candidate incentive information and randomly selecting the target incentive information, the risk of a single incentive information being cracked or predicted is reduced, ensuring the randomness of each authentication process and avoiding replay attacks.

[0043] Therefore, the process of generating the initial encrypted information is to randomly select the target stimulus information from the set of true random numbers, use the target stimulus information as the input of the hardware encryption unit, and obtain it after processing by the hardware encryption unit.

[0044] In operation S220, target encrypted information is obtained based on the initial encrypted information for the target incentive information.

[0045] It is understood that in this embodiment, the initial encryption information output by the second circuit corresponding to the hardware encryption unit is a binary response sequence. However, the binary response sequence cannot effectively map biometric features spatially, making it difficult to embed the user's local biometric feature information into a highly secure encryption space. Therefore, obtaining the target encryption information for the target incentive information can be achieved by upgrading the one-dimensional initial encryption information to a two-dimensional space through a dimensionality-upgrading method.

[0046] In step S230, multiple biometric local feature information of the user to be authenticated is fused with the target encryption information to obtain the authentication information of the user to be authenticated.

[0047] In this embodiment, the biological local feature information is obtained by segmenting the biological global feature information input by the user. It can be understood that the biological global feature information is generally a long feature vector. For example, in some applications, the feature vector corresponding to a face may be 4160-dimensional. Mapping this feature vector to a two-dimensional space requires a two-dimensional matrix with 4160 rows. The resulting mapping requires a large amount of computation. Therefore, this step segments the global feature information. For example, the 4160-dimensional global feature vector is segmented into 13 local feature vectors with a length of 320 as biological local feature information. Thus, the length of the segmented biological local feature information will be greatly reduced, and the size of the two-dimensional space required for mapping will also be greatly reduced, thereby greatly reducing the amount of computation.

[0048] Therefore, as described above, the method of fusing biological local feature information and target encrypted information is to map the one-dimensional feature vector of the biological local feature information onto the two-dimensional space corresponding to the target encrypted information, thereby obtaining the authentication information corresponding to the biological local feature information. It can be understood that the calculation process of the authentication information is essentially an encryption operation on the biological local feature information. Since the target encrypted information originates from the initial encrypted information, and the generation of each initial encrypted information is random and cannot be cloned, the generated authentication information is also random and cannot be cloned. It is completely bound to the circuit properties of the hardware structure, so even if the authentication information is copied, it cannot be used for identity authentication on any other device.

[0049] In step 240, the authentication result is determined based on the information to be authenticated and the preset authentication information for the target incentive information.

[0050] In this embodiment, the preset authentication information is the registration encryption information corresponding to the target incentive information stored in the hardware storage unit when the user registers their identity information. Specifically, when the user registers their identity information, the hardware incentive generation unit randomly generates different true random numbers multiple times to form a set of true random numbers. Each of these true random numbers is used as the target incentive information in step S210 to obtain the initial encryption information corresponding to each true random number. Then, step S220 is executed to obtain the target encryption information for each true random number. Multiple biometric local feature information input by the user during identity registration is collected for each true random number. For each true random number, the fusion of multiple biometric local feature information and target encryption information corresponding to step S230 is performed to obtain the registration encryption information corresponding to each true random number. It can be understood that this registration encryption information is the identity template saved by the hardware storage unit when the user registers their identity information. During authentication, the difference between the newly input information to be authenticated and the registration encryption information is compared, i.e., the difference between the authenticated identity information and the identity template is compared. When the difference is less than a threshold, authentication is considered successful; otherwise, it is considered unsuccessful.

[0051] In this embodiment, the hardware storage unit only stores the set of true random numbers and the registration encryption information corresponding to each true random number. The generation process of the registration encryption information is random and cannot be cloned. It is also completely bound to the circuit properties of the hardware structure. Therefore, even if the registration encryption information is leaked, it cannot be used for identity authentication of other devices, thus realizing the unique binding of identity information and terminal device.

[0052] In this embodiment, candidate incentive information is randomly generated by hardware and randomly selected for each authentication, thus ensuring the uncopyability of the candidate incentive information. Secondly, the initial encrypted information is generated by a physically unclonable function, and the characteristics of the physically unclonable function determine that its processing result is strongly bound to the properties of the hardware circuit and cannot be cloned, thereby making the upgraded target encrypted information also have hardware-bound attributes. Thirdly, the information to be authenticated is obtained by fusing biometric local features with the target encrypted information. The fusion process is essentially an encryption of biometric features. Since the target incentive information and the initial encrypted information are random for each authentication, the information to be authenticated generated each time has random unclonability. Therefore, the information to be authenticated is completely bound to the current device hardware, and even if it is illegally copied, it cannot complete authentication on other devices, realizing a strong binding between identity information and device. At the same time, the information to be authenticated is different for each authentication, and the authentication process is random throughout, effectively avoiding replay attacks and improving the security, uniqueness, and anti-cracking capability of identity authentication.

[0053] In some embodiments, taking the physically unclonable function of SRAM-PUF as an example, the hardware encryption unit processes the target stimulus information and obtains the initial encryption information for the target stimulus information. Specifically, it can be done by using the target stimulus information generated by the first circuit as the address selected by the second circuit, and then using the address selected by the second circuit as the selected address. By reading the power-on initial state of the SRAM cell with the selected address as the initial address, it outputs a binary response sequence of a predetermined length after the initial address as the initial encryption information. The predetermined length can be determined by the length of the user's biometrics.

[0054] When the physical non-cloning function of the eFuse PUF is used as the hardware encryption unit, the target excitation information is input into the row and column decoding circuit of the second circuit corresponding to the eFuse PUF. The row and column decoding circuit selects a group of non-continuous and scattered eFuse fuse cells in the eFuse fuse cell array. After sampling the resistance of the selected cells one by one and performing differential comparison, the bits are output sequentially, and the output bits are concatenated into a fixed-length binary sequence as the initial encryption information.

[0055] In this embodiment, the initial encrypted information obtained through the physically unclonable function has the attribute of being bound to the device, thereby achieving the effect of being uncopyable.

[0056] In some embodiments, target encrypted information for the target incentive information is obtained based on the initial encrypted information for the target incentive information, which is used to increase the dimensionality of the initial encrypted information. Specifically, an initial transformation matrix for the target incentive information is determined based on the initial encrypted information; the initial transformation matrix is ​​orthogonalized to obtain the target transformation matrix, which is used as the target encrypted information.

[0057] Among them, the initial transformation matrix determined for the target incentive information is used to convert the one-dimensional initial encryption information into a two-dimensional initial transformation matrix;

[0058] In some embodiments, the initial encrypted information can be cut into several initial encrypted information slices of a fixed length, with the fixed length used as the number of columns in the initial transformation matrix and the number of initial encrypted information slices obtained as the number of rows in the initial transformation matrix. Then, each initial encrypted information slice is sequentially filled into each row of the initial transformation matrix to obtain the initial transformation matrix. For example, an initial encrypted information of length 32000 can be transformed into an initial transformation matrix of size 320*100. It can be understood that the number of columns in the initial transformation matrix corresponds to the length of the biological local feature information, so as to facilitate the spatial mapping of the biological local feature information.

[0059] In another embodiment, when the length of the initial encrypted information is insufficient to construct an initial change matrix that matches the local biological feature information, the length of the initial encrypted information can be supplemented by randomly padding the initial encrypted information; for example, when the length of the initial encrypted information is 8000, 3 bits can be randomly padded after each bit to make the length of the initial encrypted information reach 32000, thereby constructing an initial change matrix of size 320*100.

[0060] Furthermore, in this embodiment, since the acquisition of the initial encrypted information has a certain degree of randomness, the initial transformation matrix constructed from the initial encrypted information suffers from projection coupling problems caused by a combination of randomness and feature correlation. Therefore, it is necessary to orthogonalize the initial transformation matrix. Orthogonalization refers to the process of transforming a linearly independent vector system into an orthogonal system, thereby eliminating the correlation and energy bias in the initial transformation matrix and constructing a stable, independent, and controllable latent space representation for the random projection of biological local feature information, thus achieving decoupling of the initial transformation matrix.

[0061] In this embodiment, the target encrypted information can be obtained by applying any one of the following methods to the initial transformation matrix: Schmitt orthogonalization, QR decomposition, or singular value decomposition. This application does not impose any restrictions on this method.

[0062] It is understandable that by orthogonalizing the initial transformation matrix, a set of latent space bases that are orthogonal to each other and have consistent energy can be constructed, thereby ensuring that the projection results of biological local feature information in the latent space are statistically approximately independent, significantly improving stability, entropy value and security.

[0063] In some embodiments, fusing multiple local biometric features of the user to be authenticated with target encrypted information to obtain the user's authentication information includes: segmenting the global biometric features of the user to be authenticated according to a preset segmentation method to obtain multiple local biometric features of the user to be authenticated; fusing the multiple local biometric features of the user to be authenticated with target encrypted information to obtain multiple local authentication information for the multiple local biometric features; and obtaining the authentication information based on the multiple local authentication information.

[0064] Specifically, global biometric information refers to biometric features that characterize a user's identity. In some embodiments, global biometric information can be obtained by collecting a user's facial image through a camera and then extracting features from that image. In other embodiments, global biometric information can also be obtained by collecting a user's fingerprint data through a fingerprint recognition device and then extracting features from that data.

[0065] In some embodiments, the method for feature extraction of user face images is as follows: First, the acquired face image is preprocessed to complete grayscale normalization, noise filtering, and pose correction. Then, the face image is convolved using multi-scale, multi-directional Gabor filtering to extract local facial texture, edge details, and facial muscle features. At the same time, DCT-II discrete cosine transform is used to perform block transformation processing on the face image to remove redundant information and extract global facial contour, facial feature distribution, and low-frequency structural features. The local texture features extracted by Gabor filtering and the global structural features extracted by DCT-II transform are spliced ​​and fused to form a fixed-dimensional global biological feature information of the face as the global biological feature information.

[0066] In other embodiments, feature extraction is performed on user fingerprint data. First, the collected fingerprint is matched with the fingerprint ridge direction and texture density characteristics through multi-directional and multi-scale Gabor filtering to extract local ridge texture and detailed structural features. Then, the fingerprint image is divided into blocks using DCT-II discrete cosine transform to extract the global ridge distribution and overall morphological contour features. Furthermore, fingerprint orientation field features are fused to characterize the main direction distribution of ridges. Multiple features are fused and spliced ​​into fixed-dimensional fingerprint biological global feature information as biological global feature information.

[0067] In some embodiments, fusing multiple local biometric features of the user to be authenticated with target encrypted information to obtain multiple local authentication information for the multiple local biometric features is used to map the local biometric features to the two-dimensional latent space corresponding to the target encrypted information.

[0068] Specifically, the local authentication information is local authentication sequence information, which includes at least one authentication value, either a first authentication value or a second authentication value. Multiple biometric local feature information of the user to be authenticated is fused with the target encrypted information to obtain multiple local authentication information items, each targeting a different biometric local feature information item.

[0069] Multiple local biometric features of the user to be authenticated are fused with the target encrypted information to obtain multiple fusion results, each of which includes at least one fusion value.

[0070] In some embodiments, multiple biometric local feature information of the user to be authenticated can be fused with target encrypted information to obtain multiple fusion results. This can be achieved using a two-dimensional matrix linear mapping method. That is, each dimension of the structured biometric local feature information is treated as a row vector or column vector, and matrix multiplication is performed with a two-dimensional latent space matrix to complete the coordinate mapping of the biometric local feature information to the target two-dimensional latent space, obtaining the corresponding fusion result. Each dimension of the coordinate mapping corresponds to a fusion value. For example, matrix multiplication is performed between a biometric local feature information of length 320 and the matrix corresponding to the target encrypted information of size 320*100 to obtain a feature vector of length 100 as the fusion result.

[0071] In other embodiments, multiple biometric local feature information of the user to be authenticated can be fused with the target encrypted information to obtain multiple fusion results. This can also be achieved using orthogonal projection mapping. Specifically, a two-dimensional mapping matrix is ​​constructed using the orthogonal latent space basis corresponding to the target encrypted information. The biometric local feature vectors are then projected onto the inner product directions of each orthogonal basis to obtain the projected coordinate representation of the features in the latent space, which serves as the corresponding fusion result. Each dimension of the projected coordinates corresponds to a fusion value.

[0072] It is understood that the above mapping method is only an example. Other methods that can map a one-dimensional feature vector to the latent space corresponding to a two-dimensional matrix can be used as methods to fuse multiple local biometric features of the user to be authenticated with the target encrypted information. This application does not limit these methods.

[0073] It is understood that the fusion result obtained by the above method is essentially a mapping of a one-dimensional feature vector in a two-dimensional space. The fusion result is represented as two-dimensional coordinates. Each two-dimensional coordinate is not a binary number. Since the hardware storage unit needs to store the preset authentication information as a binary number, in order to improve the storage efficiency of the preset authentication information, each fusion value is binarized.

[0074] In some embodiments, fusing multiple local biometric features of the user to be authenticated with target encryption information to obtain multiple local authentication information targeting the multiple local biometric features further includes:

[0075] Based on multiple fusion results and a preset mapping threshold, perform at least one of the following operations to obtain multiple local authentication sequence information: in response to determining that the fusion value is greater than or equal to the preset mapping threshold, map the fusion value to a first authentication value; in response to determining that the fusion value is less than the preset mapping threshold, map the fusion value to a second authentication value. The first authentication value and the second authentication value are either 0 or 1.

[0076] In some embodiments, obtaining the information to be authenticated based on multiple local authentication information can be achieved by sequentially concatenating the multiple local authentication information. For example, concatenating the local authentication information corresponding to 13 biological local feature information with a length of 100 can yield the information to be authenticated with a length of 1300.

[0077] This embodiment performs binarization processing on local authentication information, which improves the storage efficiency of the hardware storage unit and greatly reduces storage costs.

[0078] In summary, the user's authentication information can be... Figure 3 The flowchart illustrating the method for obtaining authentication information is provided for overview.

[0079] like Figure 3 As shown, the processing steps of method 300 include:

[0080] The hardware excitation unit randomly selects target excitation information, uses the target excitation information as the excitation of the hardware encryption unit, obtains the response of the output binary sequence as the initial encryption information, and then performs dimensionality increase and orthogonalization processing on the initial encryption information to obtain the target encryption information of the target excitation information.

[0081] When a user is to be authenticated, the system first collects the user's global biological feature information through feature extraction. Then, the global biological feature information is segmented to obtain multiple local biological feature information. These multiple local biological feature information are then fused with the target encrypted information to obtain multiple local authentication information. Finally, these multiple local authentication information are concatenated in sequence to obtain the user's authentication information.

[0082] Furthermore, since the output of the hardware encryption unit after receiving the response has an unstable probability, it is necessary to pre-screen the candidate stimulus information in the set of true random numbers randomly generated multiple times by the hardware stimulus generation unit.

[0083] In some embodiments, the candidate stimulus information is initial stimulus information that meets a first preset condition. The first preset condition includes: the proportion of identical results is greater than or equal to a first preset proportion threshold. The proportion of identical results is: the maximum proportion of identical function processing results among the multiple function processing results of the initial stimulus information by the hardware encryption unit. The multiple function processing results of the initial stimulus information are obtained by processing the initial stimulus information multiple times by the hardware encryption unit.

[0084] For example, for any candidate stimulus information HJX, the candidate stimulus information HJX is used multiple times as the stimulus input value by the hardware encryption unit, resulting in a response set XJ from the multiple outputs of the hardware encryption unit. The response set XJ is then deduplicated to obtain a deduplicated response set QXJ. The proportion of each response in the deduplicated response set QXJ within the response set XJ is calculated, and the largest proportion is obtained. By comparing this largest proportion with a first preset proportion threshold, it is determined whether to retain the candidate stimulus information HJX. It can be understood that this candidate stimulus information filtering method retains candidate stimulus information that has a stable response output to the hardware encryption unit, thereby ensuring the stability of the target encrypted information generated in each authentication process, further ensuring the stability of the information to be authenticated, thus guaranteeing the stability of the authentication process and improving the user experience during authentication.

[0085] Furthermore, due to the instability caused by the randomness of the target encrypted information generation, during the user identity registration process, there is a probability that different registration encrypted information will be obtained when the target encrypted information remains fixed and different user biometric global feature information is used to fuse with the target encrypted information. For example, different registration encrypted information may be generated by using the user's face from different angles. Therefore, it is necessary to filter the preset authentication information to further ensure stability.

[0086] In some embodiments, the preset authentication information for candidate incentive information may also be obtained based on multiple preset local authentication information for candidate incentive information. The multiple preset local authentication information for candidate incentive information is obtained by fusing multiple screened local biometric features of the authenticated user with candidate encryption information.

[0087] Multiple selected local biological feature information are obtained by segmenting the selected global biological feature information of the authenticated user according to a preset segmentation method. The selected global biological feature information is the candidate global biological feature information that meets the second preset condition.

[0088] The second preset condition includes: the proportion of identical authentication information is greater than or equal to the second preset proportion threshold. The proportion of identical authentication information is: the maximum proportion of identical initial authentication information among multiple initial authentication information for the candidate biological local feature information set. The candidate biological local feature information set includes multiple candidate biological local feature information obtained by segmenting the candidate biological global feature information according to a preset segmentation method. The initial authentication information for the candidate biological local feature information set is obtained based on multiple initial local authentication information for candidate incentive information. The multiple initial local authentication information for candidate incentive information is obtained by fusing multiple candidate biological local feature information with candidate encryption information for candidate incentive information.

[0089] For example, when a user registers their identity, any one of the reserved candidate incentive information HJX is input into the hardware encryption unit to obtain a candidate response. The candidate response is then subjected to dimensionality upscaling and orthogonalization to obtain the corresponding candidate encryption information.

[0090] Collect users' global biological feature information multiple times. For any candidate global biological feature information HSQTX, divide it into several candidate local biological feature information HSJT.

[0091] After fusing the local feature information (HSJT) of each candidate organism with the candidate encryption information, and then concatenating them, the initial authentication information (CRX) corresponding to the global feature information of the candidate organism is obtained.

[0092] The initial authentication information set CRXJ is composed of the initial authentication information CRX corresponding to all the candidate biological global feature information of the user.

[0093] The initial authentication information set CRXJ is deduplicated to obtain the deduplicated authentication information set QRXJ. The proportion of each initial authentication information in the deduplicated response set QRXJ to the initial authentication information set CRXJ is calculated, and the initial authentication information with the largest proportion is identified as the candidate biological global feature information.

[0094] This embodiment can obtain stable encrypted registration information for users, further improving the user authentication experience.

[0095] In some embodiments, determining the authentication result based on the information to be authenticated and preset authentication information for the target incentive information may include:

[0096] In response to determining that the difference between the information to be authenticated and the preset authentication information is less than or equal to a preset difference threshold, the authentication result is determined as the first authentication result, which is used to indicate that the user to be authenticated has passed the authentication.

[0097] In response to determining that the difference between the information to be authenticated and the preset authentication information is greater than a preset difference threshold, the authentication sub-result is determined as the second authentication result, which is used to indicate that the user to be authenticated has failed authentication.

[0098] The difference between the information to be authenticated and the preset authentication information is a kind of distance between two feature vectors, which can be Hamming distance, cosine distance, or other distances. This application does not limit this.

[0099] In this embodiment, the authentication result is obtained by comparing the newly generated authentication information of the user to be authenticated with the preset authentication information of the user to be authenticated stored in the hardware storage unit during registration.

[0100] As you can understand, the registration and authentication processes have been explained separately above. Now, we will provide a complete overview of the registration and authentication processes.

[0101] During the user registration phase, multiple function stimuli are generated by the hardware stimulus generation unit, and candidate stimulus information that meets the first preset condition is selected from the multiple function stimuli. Each candidate stimulus information is used as the stimulus input of the hardware encryption unit to obtain the response output of the initial encryption information. Then, each initial encryption information is upgraded and orthogonalized to obtain the target encryption information of each candidate stimulus information.

[0102] Several sets of user biometric data are collected. For each candidate incentive information, global biometric features that meet the second preset condition are selected from the user biometric data. These global biometric features are then segmented into multiple local biometric features. These local biometric features are then fused with the target encryption information and concatenated to obtain the registration encryption information for each candidate incentive. The correspondence between each candidate incentive and the registration encryption information is saved.

[0103] During the user authentication phase, a candidate stimulus information is randomly selected as the target stimulus information by the hardware stimulus generation unit. The target stimulus information is used as the stimulus input of the hardware encryption unit to obtain the initial encrypted information for the target stimulus information. Then, the initial encrypted information for the target stimulus information is upgraded and orthogonalized to obtain the target encrypted information for the target stimulus information.

[0104] Collect global biometric feature information of the user to be authenticated at the time of authentication, segment the global biometric feature information at the time of authentication to obtain multiple local biometric feature information at the time of authentication, and fuse the local biometric feature information at the time of authentication with the target encryption information of the target incentive information to obtain the authentication information of the user to be authenticated.

[0105] The corresponding registration encryption information of the target incentive information is read from the hardware storage unit, and the authentication result is obtained by comparing the registration encryption information and the information to be authenticated.

[0106] It is understood that the method of this application has been described above, and the apparatus of this application will be described below.

[0107] Figure 4 This is a block diagram of an image processing apparatus according to an embodiment of the present disclosure;

[0108] like Figure 4 As shown, the device 400 may include a processing module 410, an acquisition module 420, a fusion module 430, and a determination module 440.

[0109] The processing module 410, in response to obtaining the global biometric feature information of the user to be authenticated, determines the initial encryption information for the target incentive information, wherein the target incentive information is one of a plurality of pre-generated candidate incentive information; and obtains the target encryption information for the target incentive information based on the initial encryption information for the target incentive information.

[0110] The module 420 is used to obtain target encrypted information based on the initial encrypted information for the target incentive information.

[0111] The fusion module 430 is used to fuse multiple local biometric features of the user to be authenticated with the target encrypted information to obtain the authentication information of the user to be authenticated.

[0112] The determination module 440 is used to determine the authentication result based on the authentication information to be authenticated and the preset authentication information for the target incentive information. The authentication result is used to indicate whether the user to be authenticated has passed the authentication.

[0113] The processing module 410 is also used to process the target stimulus information based on a physically unclonable function using a hardware encryption unit to obtain initial encrypted information for the target stimulus information.

[0114] The obtaining module 420 is also used to determine the initial transformation matrix for the target excitation information based on the initial encryption information; and to perform orthogonalization processing on the initial transformation matrix to obtain the target transformation matrix, which is used as the target encryption information.

[0115] The fusion module 430 is further configured to segment the global biometric feature information of the user to be authenticated according to a preset segmentation method to obtain multiple local biometric feature information of the user to be authenticated; fuse the multiple local biometric feature information of the user to be authenticated with the target encrypted information respectively to obtain multiple local authentication information for the multiple local biometric feature information; and obtain the information to be authenticated based on the multiple local authentication information. The local authentication information is local authentication sequence information, which includes at least one authentication value, which is either a first authentication value or a second authentication value. Fusing the multiple local biometric feature information of the user to be authenticated with the target encrypted information to obtain multiple local authentication information for the multiple local biometric feature information includes: fusing the multiple local biometric feature information of the user to be authenticated with the target encrypted information respectively to obtain multiple fusion results, each fusion result including at least one fusion value; and, based on the multiple fusion results and a preset mapping threshold, performing at least one of the following operations to obtain multiple local authentication sequence information: in response to determining that the fusion value is greater than or equal to the preset mapping threshold, mapping the fusion value to a first authentication value; and in response to determining that the fusion value is less than the preset mapping threshold, mapping the fusion value to a second authentication value.

[0116] The determining module 440 is further configured to, in response to determining that the difference between the information to be authenticated and the preset authentication information is less than or equal to a preset difference threshold, determine the authentication result as a first authentication result, which is used to indicate that the user to be authenticated has passed authentication; and in response to determining that the difference between the information to be authenticated and the preset authentication information is greater than a preset difference threshold, determine the authentication sub-result as a second authentication result, which is used to indicate that the user to be authenticated has failed authentication. The preset authentication information for candidate incentive information is obtained based on multiple preset local authentication information for candidate incentive information. These multiple preset local authentication information are obtained by fusing multiple filtered biometric local feature information of the authenticated user with candidate encrypted information. The multiple filtered biometric local feature information are obtained by segmenting the filtered global biometric feature information of the authenticated user according to a preset segmentation method. The filtered global biometric feature information is candidate global biometric feature information that satisfies a second preset condition. The second preset condition includes: the proportion of identical authentication information is greater than or equal to a second preset proportion threshold. The proportion of identical authentication information is the maximum proportion of identical initial authentication information among multiple initial authentication information sets for candidate biometric local feature information. The candidate biometric local feature information set includes multiple candidate biometric local feature information obtained by segmenting the global biometric feature information according to a preset segmentation method. The initial authentication information for the candidate biometric local feature information set is obtained based on multiple initial local authentication information for candidate incentive information. These multiple initial local authentication information for candidate incentive information are obtained by fusing multiple candidate biometric local feature information with candidate encrypted information for candidate incentive information.

[0117] According to embodiments of this disclosure, this disclosure also provides an electronic device.

[0118] Figure 5 A schematic block diagram of an example electronic device 500 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0119] like Figure 5 As shown, device 500 includes a computing unit 501, which can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) 502 or a computer program loaded from storage unit 508 into random access memory (RAM) 503. RAM 503 may also store various programs and data required for the operation of device 500. The computing unit 501, ROM 502, and RAM 503 are interconnected via bus 504. Input / output (I / O) interface 505 is also connected to bus 504.

[0120] Multiple components in device 500 are connected to I / O interface 505, including: input unit 506, such as keyboard, mouse, etc.; output unit 507, such as various types of monitors, speakers, etc.; storage unit 508, such as disk, optical disk, etc.; and communication unit 509, such as network card, modem, wireless transceiver, etc. Communication unit 509 allows device 500 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0121] The computing unit 501 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 501 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 501 performs the various methods and processes described above, such as image processing methods. For example, in some embodiments, the image processing method may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 508. In some embodiments, part or all of the computer program may be loaded and / or installed on device 500 via ROM 502 and / or communication unit 509. When the computer program is loaded into RAM 503 and executed by the computing unit 501, one or more steps of the image processing method described above may be performed. Alternatively, in other embodiments, the computing unit 501 may be configured to perform image processing methods by any other suitable means (e.g., by means of firmware).

[0122] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard parts (ASSPs), systems-on-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0123] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0124] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

Claims

1. An information processing method, characterized in that, The method includes: In response to obtaining the global biometric feature information of the user to be authenticated, initial encryption information for the target incentive information is determined, wherein the target incentive information is one of a plurality of pre-generated candidate incentive information; Based on the initial encryption information for the target incentive information, target encryption information for the target incentive information is obtained; The biological global feature information is fused with the target encryption information to obtain the authentication information of the user to be authenticated. Based on the information to be authenticated and the preset authentication information for the target incentive information, an authentication result is determined, and the authentication result is used to indicate whether the user to be authenticated has passed the authentication.

2. The information processing method according to claim 1, characterized in that, The determination of the initial encrypted information for the target incentive information includes: The target stimulus information is processed using a hardware encryption unit based on a physically unclonable function to obtain initial encrypted information for the target stimulus information.

3. The information processing method according to claim 1, characterized in that, The step of obtaining target encrypted information for the target incentive information based on initial encrypted information for the target incentive information includes: Based on the initial encryption information, determine the initial transformation matrix for the target excitation information; The initial transformation matrix is ​​orthogonalized to obtain the target transformation matrix, which serves as the target encrypted information.

4. The information processing method according to claim 1, characterized in that, The step of fusing multiple local biometric features of the user to be authenticated with the target encrypted information to obtain the authentication information of the user to be authenticated includes: According to a preset segmentation method, the global biological feature information of the user to be authenticated is segmented to obtain multiple local biological feature information of the user to be authenticated. The multiple local biometric features of the user to be authenticated are fused with the target encrypted information to obtain multiple local authentication information for the multiple local biometric features; The information to be authenticated is obtained based on multiple sets of local authentication information.

5. The method according to claim 4, characterized in that, The local authentication information is local authentication sequence information, which includes at least one authentication value, wherein the authentication value is a first authentication value or a second authentication value. The step of fusing multiple local biometric features of the user to be authenticated with the target encryption information to obtain multiple local authentication information for each of the multiple local biometric features includes: Multiple biometric local feature information of the user to be authenticated is fused with the target encrypted information to obtain multiple fusion results, each of which includes at least one fusion value; Based on the multiple fusion results and a preset mapping threshold, at least one of the following operations is performed to obtain multiple local authentication sequence information: In response to determining that the fusion value is greater than or equal to the preset mapping threshold, the fusion value is mapped to the first authentication value; In response to determining that the fusion value is less than the preset mapping threshold, the fusion value is mapped to the second authentication value.

6. The information processing method according to claim 1, characterized in that, The candidate incentive information is initial incentive information that meets a first preset condition. The first preset condition includes: the proportion of identical results is greater than or equal to a first preset proportion threshold. The proportion of identical results is the maximum proportion of identical function processing results among the multiple function processing results of the hardware encryption unit for the initial incentive information. The results of multiple function processing of the initial stimulus information are obtained by processing the initial stimulus information multiple times using the hardware encryption unit.

7. The information processing method according to claim 1, characterized in that, Preset authentication information for the candidate incentive information is stored in a hardware storage unit. The preset authentication information for the candidate incentive information is obtained based on multiple preset local authentication information for the candidate incentive information. These multiple preset local authentication information are obtained by fusing multiple filtered local biometric features of the authenticated user with candidate encryption information. The multiple filtered local biometric features are obtained by segmenting the authenticated user's filtered global biometric features according to a preset segmentation method. The filtered global biometric features are candidate global biometric features that satisfy a second preset condition. The second preset condition includes: the proportion of identical authentication information is greater than or equal to a second preset proportion threshold, wherein the proportion of identical authentication information is: the maximum proportion of identical initial authentication information among multiple initial authentication information for the candidate biological local feature information set. The candidate organism local feature information set includes multiple candidate organism local feature information obtained by segmenting the candidate organism global feature information according to a preset segmentation method. The initial authentication information for the candidate biological local feature information set is obtained based on multiple initial local authentication information for the candidate incentive information. The multiple initial local authentication information for the candidate incentive information is obtained by fusing multiple candidate biological local feature information with candidate encryption information for the candidate incentive information.

8. The information processing method according to claim 1, characterized in that, The step of determining the authentication result based on the information to be authenticated and the preset authentication information for the target incentive information includes: In response to determining that the difference between the information to be authenticated and the preset authentication information is less than or equal to a preset difference threshold, the authentication result is determined to be a first authentication result, which is used to indicate that the user to be authenticated has passed the authentication. In response to determining that the difference between the information to be authenticated and the preset authentication information is greater than a preset difference threshold, the authentication sub-result is determined as a second authentication result, which is used to indicate that the user to be authenticated has failed authentication.

9. An information processing apparatus, comprising: The processing module, in response to obtaining the global biometric feature information of the user to be authenticated, determines the initial encryption information for the target incentive information, wherein the target incentive information is one of a plurality of pre-generated candidate incentive information; The obtaining module obtains target encrypted information for the target incentive information based on the initial encrypted information for the target incentive information; The fusion module fuses multiple local biological features corresponding to the global biological feature information with the target encrypted information to obtain the authentication information of the user to be authenticated. The determination module determines the authentication result based on the authentication information to be authenticated and the preset authentication information for the target incentive information. The authentication result is used to indicate whether the user to be authenticated has passed the authentication.

10. An electronic device, characterized in that, include: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the information processing method according to any one of claims 1 to 8.

Images