Biometric feature matching method, terminal device, server, system, and medium

Abstract

This application discloses a biometric feature matching method, a terminal device, a server, a system, and a medium, which belong to the data processing field. The method includes: obtaining second encrypted data by interacting with a server multiple times based on a first secret key, an acquired biometric feature vector to be matched, a preset generator, a second secret key, and first encrypted data, where the first encrypted data is obtained by the terminal device previously encrypting a sample biometric feature vector using the generator and the first secret key and is sent to the server, where a calculation operator including the second secret key and a target Euclidean distance is formed in the second encrypted data; and sending the second encrypted data to the server, so that the server obtains a matching result between the biometric feature vector to be matched and the sample biometric feature vector using the second encrypted data, the generator, the second secret key, and the preset Euclidean distance matching threshold.

Description

[Technical Field]

[0001] This application claims priority to Chinese Patent Application No. 202310095121.8, entitled "Biometric Feature Matching Method, Terminal Device, Server, System and Medium," filed on January 20, 2023, the entire contents of which are incorporated herein by reference.

[0002] The present application relates to the field of data processing, and in particular to a biometric feature matching method, a terminal device, a server, a system and a medium. [Background technology]

[0003] With the development of information technology, biometric feature recognition technologies such as face recognition have been widely applied in situations such as identity authentication, authentication, and verification. When using biometric feature identification technology to perform matching, it is necessary to collect the user's biometric feature data in advance and upload it to a server as a matching sample. When the user performs biometric feature matching, the currently collected biometric feature data is compared with the biometric feature data of the matching sample to achieve biometric feature matching.

[0004] However, a user's biometric characteristics are the user's privacy data, and if the matching samples stored on the server or the biometric characteristics data being uploaded are leaked, it may pose a significant risk to the user's data security. Summary of the Invention [Problem to be solved by the invention]

[0005] The embodiments of the present application provide a biometric feature matching method, a terminal device, a server, a system, and a medium that can reduce the security risk of user privacy data.

[0006] In a first aspect, an embodiment of the present application provides a biometric feature matching method applied to a terminal device, the method including: obtaining second encrypted data by interacting and processing with a server multiple times based on a first private key, an acquired biometric feature vector to be matched, a preset generator, a second private key, and first encrypted data, where the first private key is the private key of the terminal device and the second private key is the private key of the server; the first encrypted data is obtained by the terminal device previously encrypting a sample biometric feature vector using the generator and the first private key, and sent to the server; a calculation operator including the second private key and a target Euclidean distance is formed in the second encrypted data, where the target Euclidean distance includes the Euclidean distance between the biometric feature vector to be matched and the sample biometric feature vector; and sending the second encrypted data to the server, so that the server obtains a matching result between the biometric feature vector to be matched and the sample biometric feature vector using the second encrypted data, the generator, the second private key, and the preset Euclidean distance matching threshold.

[0007] In a second aspect, an embodiment of the present application provides a biometric feature matching method applied to a server, in which the terminal device interacts with and processes with the terminal device multiple times based on a second secret key, first encrypted data, the first secret key, a preset generator, and a matching target biometric feature vector acquired by the terminal device to obtain second encrypted data, where the first secret key is the secret key of the terminal device, the second secret key is the secret key of the server, and the first encrypted data is obtained by the terminal device encrypting a sample biometric feature vector using the generator and the first secret key in advance. the second encrypted data is obtained and sent to a server, a calculation operator including a second secret key and a target Euclidean distance is formed in the second encrypted data, the target Euclidean distance includes the Euclidean distance between the matching target biometric feature vector and the sample biometric feature vector; receiving the second encrypted data sent from the terminal device; and obtaining a matching result between the matching target biometric feature vector and the sample biometric feature vector by using the second encrypted data, the second secret key, a generator, and a preset Euclidean distance matching threshold.

[0008] In a third aspect, an embodiment of the present application provides a terminal device including a first communication module and a first encryption module, wherein the first communication module and the first encryption module are configured to obtain second encrypted data by interacting with a server and performing processing multiple times according to a first secret key, an acquired matching target biometric feature vector, a preset generator, a second secret key, and first encrypted data, wherein the first secret key is a secret key of the terminal device, the second secret key is a secret key of the server, and the first encrypted data is obtained by the terminal device previously using the generator and the first secret key to generate the sample biometric feature vector. the second encrypted data is obtained by encrypting the target biometric feature vector and sent to a server, the second encrypted data forming a calculation operator including a second secret key and a target Euclidean distance, the target Euclidean distance including the Euclidean distance between the target biometric feature vector and the sample biometric feature vector, the first communication module being further configured to send the second encrypted data to the server, so that the server obtains a matching result between the target biometric feature vector and the sample biometric feature vector using the second encrypted data, the generator, the second secret key and a preset Euclidean distance matching threshold.

[0009] In a fourth aspect, an embodiment of the present application provides a server including a second communication module, a second encryption module, and a matching module, wherein the second communication module and the second encryption module are configured to interact with and process with a terminal device multiple times according to a second secret key, first encryption data, the first secret key, a preset generator, and a matching target biometric feature vector acquired by the terminal device, so that the terminal device obtains second encrypted data, wherein the first secret key is a secret key of the terminal device, and the second secret key is a secret key of the server, and the first encrypted data is generated by the terminal device using the generator and the first secret key in advance to generate a sample biometric feature vector. the second encrypted data is obtained by encrypting the vector and sent to a server, the second encrypted data forming a calculation operator including a second secret key and a target Euclidean distance, the target Euclidean distance including the Euclidean distance between the biometric feature vector to be matched and the sample biometric feature vector, the second communication module is further configured to receive the second encrypted data sent from the terminal device, and the matching module is configured to obtain a matching result between the biometric feature vector to be matched and the sample biometric feature vector using the second encrypted data, the second secret key, the generator and a preset Euclidean distance matching threshold.

[0010] In a fifth aspect, an embodiment of the present application provides a terminal device including a processor and a memory having computer program instructions stored therein, the processor executing the computer program instructions realizing the biometric feature matching method of the first aspect.

[0011] In a sixth aspect, an embodiment of the present application provides a server including a processor and a memory having computer program instructions stored therein, the server realizing the biometric feature matching method of the second aspect when the processor executes the computer program instructions.

[0012] In a seventh aspect, an embodiment of the present application provides a biometric feature matching system, including the terminal device of the fifth aspect and the server of the sixth aspect.

[0013] In an eighth aspect, an embodiment of the present application provides a computer-readable storage medium having stored thereon computer program instructions, the computer-readable storage medium being configured to, when executed by a processor, implement the biometric feature matching method of the first aspect or the biometric feature matching method of the second aspect.

[0014] The embodiments of the present application provide a biometric feature matching method, a terminal device, a server, a system and a medium, in which the terminal device and the server can perform interactions and processing multiple times based on a first secret key, a biometric feature vector to be matched, a generator, a second secret key and first encrypted data, wherein the terminal device has the first secret key, the biometric feature to be matched and the generator, and the server has the second secret key and the first encrypted data. The terminal device can obtain second encrypted data, including a calculation operator including the second private key and a target Euclidean distance that can represent the Euclidean distance between the target biometric feature vector and the sample biometric feature vector, through encryption processing by the terminal device using the first private key, encryption processing by the server using the second private key, and data interaction between the terminal device and the server, the second encrypted data including the second private key, the second private key being inaccessible to the terminal device and difficult to decrypt to obtain the plaintext of the target biometric feature vector and the sample biometric feature vector, and similarly, the server cannot know the first private key and difficult to decrypt the first encrypted private key. The server also determines a matching result between the target biometric feature vector and the sample biometric feature vector based on the second encrypted data, the generator, the second private key, and a preset Euclidean distance matching threshold, thereby completing the matching regardless of the plaintext of the target biometric feature vector and the plaintext of the sample biometric feature vector, further reducing the security risk of user privacy data and improving the security of biometric feature matching. [Brief explanation of the drawings]

[0015] In order to more clearly explain the technical solutions of the embodiments of the present application, the following briefly introduces drawings necessary for the embodiments of the present application, and those skilled in the art can also obtain other drawings based on these drawings without any creative work.

[0016] [Figure 1] 1 is an architecture diagram of a biometric feature matching system according to an embodiment of the present application; [Figure 2] 1 is a flowchart of a biometric feature matching method according to an embodiment of the first aspect of the present application; [Figure 3] 4 is a flowchart of a biometric feature matching method according to another embodiment of the first aspect of the present application. [Figure 4] 4 is a flowchart of a biometric feature matching method according to an embodiment of the second aspect of the present application. [Figure 5] 4 is a flowchart of a biometric feature matching method according to another embodiment of the second aspect of the present application. [Figure 6] FIG. 10 is a schematic structural diagram of a terminal device according to an embodiment of the third aspect of the present application; [Figure 7] FIG. 10 is a schematic structural diagram of a server according to an embodiment of the fourth aspect of the present application; [Figure 8] FIG. 10 is a schematic structural diagram of a terminal device according to an embodiment of the fifth aspect of the present application; [Figure 9] FIG. 10 is a schematic structural diagram of a server according to an embodiment of the sixth aspect of the present application; DETAILED DESCRIPTION OF THE INVENTION

[0017] The features and exemplary embodiments of each aspect of the present application will be described in detail below. In order to make the objectives, technical solutions, and advantages of the present application more clearly understood, the present application will be described in more detail below with reference to the drawings and specific examples. It should be understood that the specific examples described herein are for the purpose of illustrating the present application and do not limit the present application. A person skilled in the art can implement the present application without requiring some of these specific details. The following description of the examples is provided merely to illustrate the present application and to provide a better understanding of the present application.

[0018] With the development of information technology, biometric feature recognition technologies such as facial recognition have been widely applied in situations such as identity authentication, authentication, and verification. When using biometric feature recognition technology to perform matching, a user's biometric feature data must be collected in advance and uploaded to a server as a matching sample. When a user performs biometric feature matching, the currently collected biometric feature data is compared with the matching sample biometric feature data to achieve biometric feature matching. However, since a user's biometric features are their private data, leaking the matching sample stored on the server or the biometric feature data being uploaded could pose a significant risk to the user's data security.

[0019] This application provides a biometric feature matching method, terminal device, server, system, and medium in which a terminal device encrypts a biometric feature vector using its own private key, interacts with a server, and the server encrypts the received data using its own private key. The terminal device and the server perform encryption processes using their own private keys to construct encrypted data including a Euclidean distance calculation operator capable of expressing the similarity between a matching target biometric feature vector and a sample biometric feature vector, and the encrypted data is used to obtain a matching result. This enables biometric feature matching even when the plaintext data of the biometric feature is not stored in either the terminal device or the server, thereby reducing the security risk of user privacy data and improving the security of biometric feature matching.

[0020] In addition, in this application, the acquisition, storage, use, processing, etc. of information and data are all carried out with the permission of the user or relevant institutions and comply with the relevant provisions of national laws and regulations.

[0021] The biometric feature matching method, terminal device, server, system, and medium according to the embodiments of the present application can be applied to situations requiring identity verification, such as payment, time stamping, and passport control, and are not limited thereto. The biometric feature matching method, terminal device, server, system, and medium according to the present application will be described below.

[0022] For ease of understanding, this specification will first briefly describe the system architecture to which the biometric feature matching method according to the embodiment of the present application is applied. Figure 1 is an architecture diagram of the biometric feature matching system according to the embodiment of the present application. As shown in Figure 1, the biometric feature matching system may include a terminal device 11 and a server 12.

[0023] The terminal device 11 may be a device used by a user, and an application program requiring a biometric feature identification function may be installed on the terminal device 11, or the operating system of the terminal device 11 itself may have a biometric feature identification function, and is not limited thereto. The terminal device 11 can collect and process biometric feature data of a user. For example, the terminal device 11 may include devices such as a mobile phone, a tablet computer, a smart wearable device, a time clock, and a vending machine, and the type and number of the terminal device 11 are not limited thereto. The terminal device 11 can communicate with the server 12. In the embodiment of the present application, the terminal device 11 has its own private key, i.e., a first private key, and can encrypt and process data.

[0024] The server 12 can communicate with the terminal device 11 and receive data sent from the terminal device 11. The server 12 stores encrypted sample biometric feature data, including biometric feature data as a matching sample or an identification sample. In the embodiment of the present application, the server 12 has its own private key, i.e., a second private key, and can encrypt and process data. The server 12 can obtain a matching result and feed the matching result back to the terminal device 11. The type and number of the server 12 are not limited here.

[0025] A first aspect of the present application provides a biometric feature matching method, which can be applied to a terminal device, i.e., can be executed by a terminal device. Figure 2 is a flowchart of the biometric feature matching method according to an embodiment of the first aspect of the present application. As shown in Figure 2, the biometric feature matching method can include steps S201 and S202.

[0026] In step S201, multiple interactions and processes are performed with the server based on the first private key, the acquired matching target biometric feature vector, a preset generator, a second private key, and the first encrypted data to obtain second encrypted data.

[0027] The terminal device has a first private key, a matching target biometric feature vector, and a generator. The first private key is the private key of the terminal device, and the server cannot know the first private key. The matching target biometric feature vector is a vector converted from the matching target biometric data. The terminal device can collect the matching target biometric data, which is the original biometric data to be matched. The terminal device can convert the matching target biometric data into the matching target biometric feature vector using a vector conversion model. The matching target biometric data may include one or more types of data, such as face data, fingerprint data, palm vein data, and iris data, but is not limited thereto. The vector conversion model can be selected to match the type of the original biometric data. The type of vector conversion model is not limited here. For example, the matching target biometric data may include face data, and the face data may specifically be face image data. A model such as OpenFace or Eigenface may be selected to extract features from the face data and form a face feature vector.

[0028] The server has a second private key and first encrypted data. The second private key is the server's private key, and the terminal device cannot know the second private key. The terminal device encrypts a sample biometric feature vector using a generator and the first private key in advance to obtain the first encrypted data, which is then transmitted to the server. The terminal device can convert the acquired sample biometric data into a sample biometric feature vector. The sample biometric data may include, but is not limited to, one or more types of data, such as face data, fingerprint data, palm vein data, and iris data. The vector conversion model for converting the sample biometric data into the sample biometric feature vector can be the same as the vector conversion model for converting the matching target biometric data into the matching target biometric feature vector. The generator can be predetermined between the terminal device and the server and can be one type of basic data involved in the encryption processes of the terminal device and the server.

[0029] The terminal device can use the generator and the first secret key to encrypt the matching target biometric feature vector, and can also encrypt data transmitted from the server. The data encrypted by the terminal device is transmitted to the server, and the server can encrypt the data transmitted from the terminal device, and the server can perform encryption using the second secret key. Second encrypted data can be configured on the terminal device side through the encryption process and data interaction between the terminal device and the server. The second encrypted data is substantially obtained based on the data encryption process by the terminal device, the data encryption process by the server, and the interaction between the terminal device and the server. A calculation operator including the second secret key and the target Euclidean distance is formed in the second encrypted data. The target Euclidean distance includes the Euclidean distance between the matching target biometric feature vector and the sample biometric feature vector, and the target Euclidean distance can represent the similarity between the matching target biometric feature vector and the sample biometric feature vector. The smaller the target Euclidean distance, the higher the similarity between the matching target biometric feature vector and the sample biometric feature vector, indicating that there is a high possibility that the user corresponding to the matching target biometric feature vector and the user corresponding to the sample biometric feature vector are the same user.

[0030] A computational operator can be considered as a component of data obtained by computational processing, and computational processing here is a computational processing in a broad sense and can include various computational processing methods, for example, encryption processing, conversion processing, mapping processing, determination processing, etc. can all be considered as computational processing. For example, when parameters A, B, and C are involved in computational processing to obtain data AC×(A+B), AC and (A+B) can both be computational operators formed within the data, and the computational operator AC may be a computational operator including A or a computational operator including C. Also, for example, when parameters A, B, and C are involved in computational processing to obtain data AC×(A+B), AC and (A+B) can both be computational operators formed within the data, and the computational operator AC may be a computational operator including A or a computational operator including C. BCWhen obtaining data A, B can be a calculation operator formed within the data, and the calculation operator BC may be a calculation operator including B or a calculation operator including C. In some examples, the calculation operator may include a modular exponentiation operator or a dot product operator. A modular exponentiation operator is a calculation operator in exponential form, for example, when data A is BC It can be said that a modular exponentiation operator BC including B is formed within, or that a modular exponentiation operator BC including C is formed within. The dot product operator is a multiplier type operator, for example, in data AC×(A+B), AC and (A+B) can be regarded as dot product operators, and the calculation operator AC can be regarded as a dot product operator including A, and the calculation operator AC can also be regarded as a dot product operator including C. In the second encrypted data, a calculation operator including a second secret key and a target Euclidean distance is formed, and the second secret key is defined as b, and the matching target biometric feature vector is defined as an n-dimensional vector X(x1, x2, x3, , x i ,·····,x n ), and the sample biometric feature vector is expressed as an n-dimensional vector Y(y1,y2,y3,...,y i ,·····,y n ) and the Euclidean distance between the matching target biometric feature vector and the sample biometric feature vector is

number

number

number

number

number

[0031] In some examples, the first private key may be a random number generated by the terminal device, and the second private key may be a random number generated by the server. To further improve data security, the first private key may be a large integer with a bit occupancy of at least 128 bits, for example, the first private key may be a large integer with a bit occupancy of 256 bits. Similarly, the second private key may be a large integer with a bit occupancy of at least 128 bits, for example, the second private key may be a large integer with a bit occupancy of 256 bits. Setting the first private key and the second private key with a bit occupancy of 128 bits or more can meet the requirements for encryption security strength, further improve the security of the user's personal privacy data, and further improve the security of biometric feature matching.

[0032] In step S202, the second encrypted data is sent to the server, so that the server uses the second encrypted data, the second secret key, the generator and the preset Euclidean distance matching threshold to obtain a matching result between the matching target biometric feature vector and the sample biometric feature vector.

[0033] The server uses the second private key, the generator, and a preset Euclidean distance matching threshold to construct data that matches the format of the second encrypted data, and compares the second encrypted data with the data constructed using the second private key, the generator, and the preset Euclidean distance matching threshold to obtain a matching result between the matching target biometric feature vector and the sample biometric feature vector. The preset Euclidean distance matching threshold is a Euclidean distance judgment threshold for determining whether two vectors are the same vector, and can be set according to the scene, needs, experience, etc., and is not limited thereto. If the target Euclidean distance is less than or equal to the preset Euclidean distance matching threshold, it indicates that the matching between the matching target biometric feature vector and the sample biometric feature vector is successful, i.e., the matching result is a matching success. On the other hand, if the target Euclidean distance is greater than the preset Euclidean distance matching threshold, it indicates that the matching between the matching target biometric feature vector and the sample biometric feature vector is unsuccessful, i.e., the matching result is a matching failure. The second encrypted data includes a calculation operator including a second private key and a target Euclidean distance, and the data constructed by the server using the second private key, the generator, and the preset Euclidean distance matching threshold includes a calculation operator including the second private key and the preset Euclidean distance matching threshold. Therefore, the matching result between the second encrypted data and the data constructed by the server using the second private key, the generator, and the preset Euclidean distance matching threshold corresponds to the matching result between the target Euclidean distance and the preset Euclidean distance matching threshold. Therefore, the matching result between the target Euclidean distance and the preset Euclidean distance matching threshold can be determined from the matching result between the second encrypted data and the data constructed by the server using the second private key, the generator, and the preset Euclidean distance matching threshold, and the matching result can represent the matching result.

[0034] In an embodiment of the present application, a terminal device and a server can perform multiple interactions and processes based on a first secret key, a matching target biometric feature vector, a generator, a second secret key, and first encrypted data, where the terminal device has the first secret key, the matching target biometric feature, and the generator, and the server has the second secret key and the first encrypted data. Through the encryption process by the terminal device using the first secret key, the encryption process by the server using the second secret key, and the data interaction between the terminal device and the server, the terminal device can obtain second encrypted data including a calculation operator including the second secret key and a target Euclidean distance that can represent the Euclidean distance between the matching target biometric feature vector and the sample biometric feature vector, where the second encrypted data includes the second secret key, the terminal device cannot know the second secret key, and it is difficult to decrypt the second secret key to obtain the plaintext of the matching target biometric feature vector and the sample biometric feature vector. For the same reason, the server cannot know the first secret key, and it is also difficult to decrypt the first encrypted secret key. Furthermore, the server determines the matching result between the target biometric feature vector and the sample biometric feature vector based on the second encrypted data, the generator, the second secret key, and the preset Euclidean distance matching threshold, thereby completing the matching regardless of the plaintext of the target biometric feature vector and the plaintext of the sample biometric feature vector, further reducing the security risk of the user's privacy data and improving the security of biometric feature matching.The terminal device and the server do not store the plaintext of the target biometric feature vector and the plaintext of the sample biometric feature vector, thereby ensuring the user's control over their personal privacy data, thereby limiting the use scenarios of their personal privacy data, fulfilling the principle of minimal use of personal privacy data, and preventing the misuse of personal privacy data.

[0035] In addition, in the embodiments of the present application, the target biometric feature vector and the sample biometric feature vector are encrypted, and the matching result is determined by comparing the encrypted data. If the target biometric data and the sample biometric data are of different types, the available vector transformation models may also be different. In the embodiments of the present application, the similarity of the biometric data is described by the similarity of the feature vectors. In the biometric feature matching process in the embodiments of the present application, the process of protecting personal privacy data and the transformation process of converting the target biometric data into the target biometric feature vector and the sample biometric data into the sample biometric feature vector may be independent of each other, thereby realizing a technical solution that can be assembled and plugged into the vector transformation model and the biometric feature matching model, that is, realizing decoupling between the vector transformation model and the biometric feature matching model.

[0036] In some embodiments, during the interaction and processing process between the terminal device and the server, a plurality of intermediate encrypted data may be generated, and the plurality of intermediate encrypted data may be further processed to obtain second encrypted data. Figure 3 is a flowchart of a biometric feature matching method according to another embodiment of the first aspect of the present application, and Figure 3 differs from Figure 2 in that step S201 in Figure 2 can be specifically subdivided into steps S2011 to S2013 in Figure 3.

[0037] In step S2011, the first intermediate encrypted data sent from the server is received.

[0038] The first intermediate encrypted data is obtained by the server encrypting the first encrypted data using the second secret key. A calculation operator including the first secret key and an element in the sample biometric feature vector may be formed in the first encrypted data. Furthermore, a calculation operator including a product of the first secret key and an element in the sample biometric feature vector may be formed in the first encrypted data. For example, if the first secret key is a and the sample biometric feature vector is an n-dimensional vector Y(y1, y2, y3, . . . , y i ,·····,y n ), the first encrypted data has the arithmetic operator ay i and the first encrypted data may include a computation operator ay i 2 where i=1, 2, ..., n, and the calculation operator a i 2 The calculation operator ay i 2 may be included.

[0039] The server can obtain first intermediate encrypted data by encrypting the first encrypted data using the second secret key. The first intermediate encrypted data can have a calculation operator formed therein, including a product of the first secret key, the second secret key, and an element in the sample biometric feature vector. The first encrypted data can have a calculation operator of the product of the first secret key and the element in the sample biometric feature vector, and the second secret key can be involved in the encryption operation, such that the calculation operator of the product of the first secret key and the element in the sample biometric feature vector is further multiplied by the second secret key, thereby obtaining first intermediate encrypted data having a calculation operator formed therein, including a product of the first secret key and the second secret key and an element in the sample biometric feature vector. For example, if the first secret key is a, the second secret key is b, and the sample biometric feature vector is an n-dimensional vector Y(y1, y2, y3, . . . , y i ,·····,y n ), the first intermediate encrypted data includes the calculation operator aby i may be included.

[0040] In step S2012, second intermediate encrypted data is obtained based on the first intermediate encrypted data, the matching target biometric feature vector, the generator, and the first secret key.

[0041] At least some data in the second intermediate encrypted data is obtained based on the first intermediate encrypted data, and the second intermediate encrypted data includes a calculation operator including a product of a first secret key and an element in the matching target biometric feature vector. For example, if the first secret key is a and the matching target biometric feature vector is an n-dimensional vector X(x1, x2, x3, . . . , x i ,·····,x n ), the second intermediate encrypted data contains ax i The second intermediate encrypted data can be calculated as ax so that the second encrypted data can be constructed in a subsequent step. i The second intermediate encrypted data may be used in a subsequent step to participate in the construction of the target Euclidean distance.

[0042] In some examples, the second intermediate encrypted data includes first intermediate encrypted sub-data and second intermediate encrypted sub-data. Step S2012 may be specifically subdivided into obtaining first intermediate encrypted sub-data based on the first intermediate encrypted data and the matching biometric feature vector, and obtaining second intermediate encrypted sub-data based on the first secret key, the generator, and the matching biometric feature vector.

[0043] The first intermediate encrypted sub-data includes a calculation operator including a product of the first secret key, the second secret key, an element in the sample biometric feature vector, and an element in the matching target biometric feature vector. For example, the first secret key is a, the second secret key is b, and the sample biometric feature vector is an n-dimensional vector Y(y1, y2, y3, . . . , y i ,·····,y n ), and the matching target biometric feature vector is an n-dimensional vector X(x1, x2, x3, , x i ,·····,xn ), the first intermediate encrypted sub-data is abx i y i In the first intermediate encrypted sub-data, a calculation operator including the calculation operator -2abx can be formed, and the target Euclidean distance can be constructed in the subsequent process. i y i may be included.

[0044] In the second intermediate encrypted sub-data, a calculation operator is formed including a product of the first secret key, the second secret key, and an element in the matching target biometric feature vector. For example, if the first secret key is a and the matching target biometric feature vector is an n-dimensional vector X(x1, x2, x3, . . . , x i ,·····,x n ), the second intermediate encrypted data contains ax i The second intermediate encrypted data includes a calculation operator ax i 2 may be included.

[0045] In step S2013, interaction and processing is performed with the server based on the second intermediate encrypted data, the first encrypted data, the first private key, and the second private key, and the first private key is deleted from the processed data to obtain the second encrypted data.

[0046] After obtaining the second intermediate encrypted data, the second intermediate encrypted data is sent to the server, so that the server performs encryption processing based on the second intermediate encrypted data, and then the encrypted data is fed back to the terminal device, and the terminal device processes the received data to obtain the second encrypted data. In the embodiment of the present application, the second encrypted data can be obtained based on the second intermediate encrypted data through the processing performed by the terminal device, the processing performed by the server, and the data interaction between the terminal device and the server.

[0047] In some examples, the method includes: transmitting the second intermediate encrypted data to a server, such that the server obtains third intermediate encrypted data based on the second intermediate encrypted data, the first encrypted data, and the second secret key; receiving the third intermediate encrypted data transmitted from the server; and using the first secret key to erase the first secret key from the third intermediate encrypted data to obtain the second encrypted data.

[0048] The server can obtain third intermediate encrypted data by performing calculations on the second intermediate encrypted data and the first encrypted data. The second intermediate encrypted data includes first intermediate encrypted sub-data and second intermediate encrypted sub-data. For specific contents of the first intermediate encrypted sub-data and the second intermediate encrypted sub-data, reference can be made to the relevant descriptions in the above embodiments, and they will not be repeated here. The server can obtain third intermediate encrypted data by performing calculations on the first intermediate encrypted sub-data, the second intermediate encrypted sub-data, and the first encrypted data. A calculation operator including the product of the first secret key, the second secret key, and the target Euclidean distance is formed in the third intermediate encrypted data. For example, suppose the first secret key is a, the second secret key is b, and the matching target biometric feature vector is an n-dimensional vector X(x1, x2, x3, . . . , x i ,·····,x n ), the sample biometric feature vector is an n-dimensional vector Y(y1,y2,y3,...,y i ,·····,y n ), the third intermediate encrypted data is

number

number

number

number

[0049] Through the interaction between the terminal device and the server, the terminal device and the server can perform further processing based on the data received respectively, and through the interaction and re-processing of the intermediate encrypted data, second encrypted data can be constructed, and the entire processing process ensures security and reliability regardless of the plaintext of the matching target biometric feature vector and the plaintext of the sample biometric feature vector.

[0050] In some embodiments, the server can determine whether the matching between the target biometric feature vector and the sample biometric feature vector is successful by determining whether the second encrypted data belongs to a matching data set. The matching data set may be generated by the server, and the maximum value of the elements in the matching data set is obtained based on the second secret key and a predetermined Euclidean distance matching threshold. In some examples, the maximum value of the elements in the matching data set is formed by a calculation operator including the product of the second secret key and the predetermined Euclidean distance matching threshold, where the predetermined Euclidean distance matching threshold may be the predetermined Euclidean distance matching threshold itself or the predetermined Euclidean distance matching threshold after integer processing, and is not limited thereto.

[0051] If the second encrypted data belongs to the matching data set, the matching result includes a successful match, and if the second encrypted data does not belong to the matching data set, the matching result includes a failed match. The second encrypted data belonging to the matching data set means that the target Euclidean distance is equal to or less than a preset Euclidean distance matching threshold. The second encrypted data not belonging to the matching data set means that the target Euclidean distance is greater than a preset Euclidean distance matching threshold.

[0052] In some embodiments, the elements in the matching-target biometric feature vector, the elements in the sample biometric feature vector, and the preset Euclidean distance matching threshold are integerized by a single factor. That is, the elements in the matching-target biometric feature vector, the elements in the sample biometric feature vector, and the preset Euclidean distance matching threshold, which are integerized by a single factor, are all integers, and are the same in multiples as the elements in the original matching-target biometric feature vector, the elements in the sample biometric feature vector, and the preset Euclidean distance matching threshold. Correspondingly, since the preset Euclidean distance matching threshold, which is integerized by a single factor, is an integer and the number of elements in the matching data set is finite, a calculation operator is formed in the matching data set, including a product of the second secret key and each square of the preset Euclidean distance matching threshold, which is an integer from 0. For example, if the second secret key is b and the preset Euclidean distance matching threshold is θ, the calculation operator associated with the matching data set is b×0, b×1, b×2, ..., b×θ. 2 may include:

[0053] In some embodiments, to improve the efficiency of biometric feature matching, a Bloom filter can be used to determine the belonging relationship between the second encrypted data and the matching data set. If the values ​​at the positions corresponding to the K target hash values ​​in the pre-constructed Bloom filter lookup table are all 1, it can be determined that the second encrypted data belongs to the matching data set, and if at least one of the values ​​at the positions corresponding to the K target hash values ​​in the Bloom filter lookup table is 0, it can be determined that the second encrypted data does not belong to the matching data set.

[0054] K target hash values ​​are calculated using K hash functions based on the second encrypted data. One target hash value can be calculated for each piece of second encrypted data using one hash function. Each piece of second encrypted data corresponds to one of the K target hash values. K is a positive integer and can be set according to the scenario, needs, experience, etc., and is not limited thereto. Values ​​in the Bloom filter lookup table are calculated using K hash functions based on elements in the matching data set. The Bloom filter lookup table may be generated by a server. Specifically, the server may calculate each of the elements in the matching data set using the K hash functions to obtain K hash values ​​corresponding to each element, map the K hash values ​​corresponding to each element to K positions in a binary array where all values ​​are 0, update the values ​​at the K positions corresponding to each element to 1, and determine the updated binary array as the Bloom filter lookup table. The K hash functions used to generate the Bloom filter lookup table are the same as the K hash functions used to calculate the K target hash values. In some examples, the binary array is a binary array in which the values ​​at each position are all 0 before the update, and each position in the binary array may be represented by an index of an element in the binary array, and a hash value corresponding to an element may be mapped to a position in the binary array, specifically, a hash value corresponding to an element may be mapped to an index of an element in the binary data.

[0055] By using a Bloom filter to determine whether the second encrypted data belongs to a matching data set, the speed of determining whether the second encrypted data belongs to a matching data set can be increased, and the efficiency of biometric feature matching can be significantly improved, especially when the number of matching target biometric feature vectors and sample biometric feature vectors is extremely large.

[0056] In some embodiments, before matching the target biometric feature vector with the sample biometric feature vector, the terminal device may generate first encrypted data and send the first encrypted data to the server, so that the server may store the first encrypted data. Specifically, the terminal device may obtain the sample biometric feature vector, encrypt the sample biometric feature vector using a generator and a first secret key to obtain the first encrypted data, and send the first encrypted data to the server. The first encrypted data includes a calculation operator including the product of the first secret key and an element in the sample biometric feature vector. Specifically, the relevant description in the above embodiments may be referred to, and will not be repeated here.

[0057] The first encrypted data contains the first private key, and the server cannot know the first private key. Therefore, it is difficult for the first encrypted data to be decrypted on the server side, and security can be ensured when personal privacy data is stored on the server.

[0058] A second aspect of the present application provides a biometric feature matching method, which can be applied to a server, i.e., can be executed by the server. Figure 4 is a flowchart of the biometric feature matching method according to an embodiment of the second aspect of the present application. As shown in Figure 4, the biometric feature matching method can include steps S301 to S303.

[0059] In step S301, the terminal device interacts and processes with the terminal device multiple times based on the second private key, the first encrypted data, the first private key, the preset generator and the matching target biometric feature vector acquired by the terminal device, so that the terminal device obtains second encrypted data.

[0060] The first private key is the private key of the terminal device. The second private key is the private key of the server. The first encrypted data is obtained by the terminal device encrypting the sample biometric feature vector in advance using the generator and the first private key, and is sent to the server. The second encrypted data forms a calculation operator including the second private key and the target Euclidean distance. The target Euclidean distance includes the Euclidean distance between the matching target biometric feature vector and the sample biometric feature vector.

[0061] In some examples, the arithmetic operator may include a modular exponentiation operator or a dot product operator.

[0062] In step S302, the second encrypted data transmitted from the terminal device is received.

[0063] In step S303, the second encrypted data, the second secret key, the generator, and the preset Euclidean distance matching threshold are used to obtain a matching result between the matching target biometric feature vector and the sample biometric feature vector.

[0064] For the specific contents of the above steps S301 to S303, the relevant explanations in the above embodiments can be referred to, and will not be repeated here.

[0065] In an embodiment of the present application, the server and the terminal device can interact and process multiple times based on a first secret key, a target biometric feature vector, a generator, a second secret key, and first encrypted data, where the terminal device has the first secret key, the target biometric feature, and the generator, and the server has the second secret key and the first encrypted data. Through the encryption process by the terminal device using the first secret key, the encryption process by the server using the second secret key, and the data interaction between the terminal device and the server, the terminal device can obtain second encrypted data, which includes a calculation operator between the second secret key and a target Euclidean distance that can represent the Euclidean distance between the target biometric feature vector and the sample biometric feature vector, where the second encrypted data includes the second secret key, the terminal device cannot know the second secret key, and it is difficult to decrypt it to obtain the plaintext of the target biometric feature vector and the sample biometric feature vector. For the same reason, the server cannot know the first secret key, and it is also difficult to decrypt the first encrypted secret key. Furthermore, the server determines the matching result between the target biometric feature vector and the sample biometric feature vector based on the second encrypted data, the generator, the second secret key, and the preset Euclidean distance matching threshold, thereby completing the matching regardless of the plaintext of the target biometric feature vector and the plaintext of the sample biometric feature vector, further reducing the security risk of the user's privacy data and improving the security of biometric feature matching.The terminal device and the server do not store the plaintext of the target biometric feature vector and the plaintext of the sample biometric feature vector, thereby ensuring the user's control over their personal privacy data, thereby limiting the use scenarios of their personal privacy data, fulfilling the principle of minimal use of personal privacy data, and preventing the misuse of personal privacy data.

[0066] In addition, in the embodiment of the present application, the target biometric feature vector and the sample biometric feature vector are encrypted, and the matching result is determined by comparing the encrypted data. If the target biometric data and the sample biometric data are different in type, the available vector transformation models may also be different. In the embodiment of the present application, the similarity of the biometric data is described by the similarity of the feature vectors. In the biometric feature matching process in the embodiment of the present application, the process of protecting personal privacy data and the transformation process of converting the target biometric data into the target biometric feature vector and the sample biometric data into the sample biometric feature vector may be independent of each other, thereby realizing a technical solution that can be assembled and plugged into the vector transformation model and the biometric feature matching model, i.e., realizing decoupling between the vector transformation model and the biometric feature matching model.

[0067] In some embodiments, during the interaction and processing between the server and the terminal device, multiple intermediate encrypted data may be generated, and the multiple intermediate encrypted data may be further processed to obtain second encrypted data. Figure 5 is a flowchart of a biometric feature matching method according to another embodiment of the second aspect of the present application, and Figure 5 differs from Figure 4 in that step S301 in Figure 4 may be specifically subdivided into steps S3011 to S3013 in Figure 5, and step S303 in Figure 4 may be specifically subdivided into steps S3031 to S3033 in Figure 5.

[0068] In step S3011, the first encrypted data is encrypted using the second secret key to obtain first intermediate encrypted data.

[0069] A calculation operator is formed in the first intermediate encrypted data, the calculation operator including a product of the first private key, the second private key and an element in the sample biometric feature vector.

[0070] In step S3012, the first intermediate encrypted data is sent to the terminal device, so that the terminal device obtains second intermediate encrypted data based on the first intermediate encrypted data, the matching target biometric feature vector, the generator, and the first secret key.

[0071] The second intermediate encrypted data includes a calculation operator that includes a product of the first private key and an element in the matching target biometric feature vector.

[0072] In some examples, the second intermediate encrypted data includes first intermediate encrypted subdata and second intermediate encrypted subdata. The first intermediate encrypted subdata is obtained by the terminal device based on the first intermediate encrypted data and the biometric feature vector to be matched. A calculation operator is formed in the first intermediate encrypted subdata, the calculation operator including a product of the first secret key, the second secret key, an element in the sample biometric feature vector, and an element in the biometric feature vector to be matched. The second intermediate encrypted subdata is obtained by the terminal device based on the first secret key, a generator, and the biometric feature vector to be matched. A calculation operator is formed in the second intermediate encrypted subdata, the calculation operator including a product of the first secret key and an element in the biometric feature vector to be matched.

[0073] In step S3013, interaction and processing is performed with the terminal device based on the second intermediate encrypted data, the first encrypted data, the first private key and the second private key, so that the terminal device erases the first private key from the processed data and obtains the second encrypted data.

[0074] In some examples, step S3013 may be specifically subdivided into: receiving second intermediate encrypted data sent from the terminal device; obtaining third intermediate encrypted data based on the second intermediate encrypted data, the first encrypted data, and the second secret key, wherein the third intermediate encrypted data forms a calculation operator including the product of the first secret key, the second secret key, and the target Euclidean distance; and sending the third intermediate encrypted data to the terminal device, so that the terminal device uses the first secret key to erase the first secret key from the third intermediate encrypted data to obtain the second encrypted data.

[0075] In step S3031, a matching data set is obtained based on the second secret key, the generator and a preset Euclidean distance matching threshold.

[0076] The maximum value of elements in the matching data set is obtained based on a second secret key and a preset Euclidean distance matching threshold.

[0077] In some examples, the elements in the matching target biometric feature vector, the elements in the sample biometric feature vector, and the preset Euclidean distance matching threshold are converted to integers at the same rate. Step S3031 may be specifically subdivided into calculating the product of the second secret key and the square of the preset Euclidean distance matching threshold converted from 0 to an integer, and obtaining a matching data set based on the product of the second secret key and the square of the preset Euclidean distance matching threshold converted from 0 to an integer, and the generator.

[0078] In step S3032, if the second encrypted data belongs to the matching data set, it is determined that the matching result includes successful matching.

[0079] In step S3033, if the second encrypted data does not belong to the matching data set, it is determined that the matching result includes a matching failure.

[0080] In some embodiments, the server may use a Bloom filter to determine whether the second encrypted data belongs to the matching data set. Specifically, the server may calculate K target hash values ​​based on the second encrypted data using K hash functions, and determine that the second encrypted data belongs to the matching data set if the values ​​at corresponding positions of the K target hash values ​​in a pre-constructed Bloom filter lookup table are all 1, and determine that the second encrypted data does not belong to the matching data set if at least one of the values ​​at corresponding positions of the K target hash values ​​in the Bloom filter lookup table is 0. The K target hash values ​​are calculated based on the second encrypted data using the K hash functions, and the values ​​in the Bloom filter lookup table are calculated based on elements in the matching data set using the K hash functions.

[0081] In some embodiments, the server may pre-generate a Bloom filter lookup table to determine whether the second encrypted data belongs to a matching data set using a Bloom filter method. Specifically, the server may use K hash functions to calculate each of the elements in the matching data set to obtain K hash values ​​corresponding to each element, map the K hash values ​​corresponding to each element to K positions in a binary array where all values ​​are 0, update the values ​​at the K positions corresponding to each element to 1, and determine the updated binary array as the Bloom filter lookup table.

[0082] For specific details of the above steps S3011 to S3013 and steps S3031 to S3033, please refer to the relevant explanations in the above embodiments, and they will not be repeated here.

[0083] In the above embodiment, the calculation operator may include a modular exponentiation operator or a dot product operator. For ease of understanding, the biometric feature enrollment process and the matching process will be described below using the case where the calculation operator includes the modular exponentiation operator and the case where the calculation operator includes the dot product operator as examples. The biometric feature enrollment process is a process in which a terminal device processes data to obtain first encrypted data, and sends the first encrypted data to a server for storage in the server. The biometric feature matching process is a process in which a terminal device interacts with the server multiple times to obtain a matching result between a matching target biometric feature vector and a sample biometric feature vector.

[0084] In a first example, the calculation operator includes a modular exponential operator, and the registration process and matching process of the biometric feature can include the following steps c1 to c12.

[0085] In step c1, the terminal device collects sample biometric data and converts the sample biometric data into a sample biometric feature vector Y(y1, y2, y3, . . . , y i ,·····,y n )

[0086] In step c2, the terminal device generates a random number a and sets the random number a as a first secret key.

[0087] In step c3, the terminal device generates a sample biometric feature vector Y(y1, y2, y3, . . . , y i ,·····,y n ) to obtain first encrypted data.

[0088] The first encrypted data is data of the following formula (1):

number

number

number

number

[0089] In step c4, the first encrypted data is transmitted to the server, and the server stores the first encrypted data.

[0090] The format of the modular exponentiation operator is g p The security of the first encrypted data can be ensured by utilizing the difficulty of the discrete logarithm problem in the field of cryptography. That is, when an integer g is given in a finite field whose generator is g, g p Although it is easy to calculate p from g and q, it is difficult to calculate p from g and q. The server cannot know the first secret key a, and furthermore, due to the difficulty of the discrete logarithm problem, the server

number

[0091] The above steps c1 to c4 belong to the biometric feature registration process.

[0092] In step c5, the terminal device collects matching target biometric data, and converts the matching target biometric data into a matching target biometric feature vector X(x1, x2, x3, . . . , x i ,·····,x n )

[0093] In step c6, the server generates a random number b and sets the random number b as a second secret key.

[0094] In step c7, the server encrypts the first encrypted data using the second secret key to obtain first intermediate encrypted data, and transmits the first intermediate encrypted data to the terminal device.

[0095] The first intermediate encrypted data is expressed by the following formula 2:

number

number

[0096] In step c8, the terminal device calculates the matching target biometric feature vector X(x1, x2, x3, . . . , x i ,·····,x n ), obtain second intermediate encrypted data based on the first intermediate encrypted data and the first secret key, and send the second intermediate encrypted data to the server.

[0097] The second intermediate encrypted data is

number

number

number

[0098] In step c9, the server obtains third intermediate encrypted data using the second intermediate encrypted data, the first encrypted data, and the second secret key b, and transmits the third intermediate encrypted data to the terminal device.

[0099] The third intermediate encrypted data is

number

number

[0100] In addition, in the biometric feature matching scenario, the terminal device is considered as the untrusted party, so the target Euclidean distance of the encrypted state must be constructed by the server.

[0101] In step c10, the terminal device uses the first private key to obtain second encrypted data by deleting the first private key from the third intermediate encrypted data, and transmits the second encrypted data to the server.

[0102] The second encrypted data is expressed by the following formula (5):

number

number

[0103] Because the terminal device cannot know the second secret key, the terminal device cannot construct a calculation operator including a Euclidean distance smaller than a preset Euclidean distance matching threshold, thereby further improving the security of the data.

[0104] In step c11, the server generates a matching data set based on the second secret key b and a preset Euclidean distance matching threshold θ.

number

[0105] Here, the preset Euclidean distance matching threshold θ, the sample biometric feature vector, and the matching target biometric feature vector may be integer-scaled data, so the number of elements in the matching data set is limited.

[0106] In step c12, the server

number

number

[0107] The target Euclidean distance is

number

number

number

number

number

number

number

[0108] The above steps c5 to c12 belong to the biometric feature matching process.

[0109] In a second example, the calculation operator may include a dot product operator, and the biometric feature registration and matching process may include the following steps d1 to d12.

[0110] In step d1, the terminal device collects sample biometric data and converts the sample biometric data into a sample biometric feature vector Y(y1, y2, y3, . . . , y i ,·····,y n )

[0111] In step d2, the terminal device generates a random number a and uses the random number a as a first secret key.

[0112] In step d3, the terminal device generates a sample biometric feature vector Y(y1, y2, y3, . . . , y i ,·····,y n ) to obtain first encrypted data.

[0113] The first encrypted data is the data ay in the following Equation 6: i g and SY2, or the data ay in the following Equation 6 i g and ay i 2 g, where i=1, 2, ..., n.

number

[0114] In step d4, the first encrypted data is transmitted to the server, and the server stores the first encrypted data.

[0115] The format of the dot product operator is g×p, and the security of the first encrypted data can be ensured by utilizing the problem of elliptic curve cryptography algorithm in the field of encryption. That is, in an elliptic curve group with a generator g, the generator g is a point on the curve, and when an integer p is given, it is easy to calculate g×p=q, but it is difficult to calculate p from g and q. The server cannot know the first secret key a, and the elliptic curve cryptography algorithm allows the server to know ay i Even if you get g, y i cannot be decrypted, so the first encrypted data is stored as ciphertext on the server.

[0116] The above steps d1 to d4 belong to the process of registering biometric features.

[0117] In step d5, the terminal device collects matching target biometric data, and converts the matching target biometric data into a matching target biometric feature vector X(x1, x2, x3, . . . , x i ,·····,x n )

[0118] In step d6, the server generates a random number b and sets the random number b as a second secret key.

[0119] In step d7, the server encrypts the first encrypted data using the second secret key b to obtain first intermediate encrypted data, and transmits the first intermediate encrypted data to the terminal device.

[0120] The first intermediate encrypted data is aby in the following Equation 7. i It may contain g.

number

[0121] In step d8, the terminal device generates a matching target biometric feature vector X(x1, x2, x3, . . . , x i ,·····,x n ), obtain second intermediate encrypted data based on the first intermediate encrypted data and the first secret key, and send the second intermediate encrypted data to the server.

[0122] The second intermediate encrypted data is −2abx in the following Equation 8. i y i g and ax i 2 It may contain g.

number

[0123] In step d9, the server obtains third intermediate encrypted data using the second intermediate encrypted data, the first encrypted data, and the second secret key b, and transmits the third intermediate encrypted data to the terminal device.

[0124] The third intermediate encrypted data is expressed as:

number

number

[0125] In addition, in the biometric feature matching scene, the terminal device is considered as the untrusted party, so the encrypted target Euclidean distance must be constructed by the server.

[0126] In step d10, the terminal device uses the first private key to erase the first private key from the third intermediate encrypted data, thereby obtaining second encrypted data, and transmits the second encrypted data to the server.

[0127] The second encrypted data is

number

number

[0128] Because the terminal device cannot know the second secret key, the terminal device cannot construct a calculation operator including a Euclidean distance smaller than a preset Euclidean distance matching threshold, thereby further improving the security of the data.

[0129] In step d11, the server obtains a matching data set based on the second secret key b and a preset Euclidean distance matching threshold θ.

[0130] Here, the preset Euclidean distance matching threshold, the sample biometric feature vector, and the matching target biometric feature vector may be integerized by a single multiple, so the number of elements in the matching data set is limited.

[0131] In step d12, the server generates the second encrypted data

number

number

[0132] The target Euclidean distance is

number

number

number

number

number

[0133] The above steps d5 to d12 belong to the biological feature matching process.

[0134] A third aspect of the present application provides a terminal device. Figure 6 is a schematic structural diagram of a terminal device according to an embodiment of the third aspect of the present application. As shown in Figure 6, a terminal device 400 may include a first communication module 401 and a first encryption module 402.

[0135] The first communication module 401 and the first encryption module 402 are configured to interact and process with the server multiple times based on the first private key, the acquired matching target biometric feature vector, the preset generator, the second private key, and the first encrypted data to obtain second encrypted data.

[0136] The first private key is the private key of the terminal device. The second private key is the private key of the server. The first encrypted data is obtained by the terminal device encrypting the sample biometric feature vector using the generator and the first private key in advance, and is sent to the server. The second encrypted data includes a calculation operator including the second private key and the target Euclidean distance. The target Euclidean distance includes the Euclidean distance between the matching target biometric feature vector and the sample biometric feature vector.

[0137] In some examples, the arithmetic operator includes a modular exponentiation operator or a dot product operator.

[0138] The first communication module 401 may be further configured to send the second encrypted data to the server, so that the server uses the second encrypted data, the generator, the second secret key, and the preset Euclidean distance matching threshold to obtain a matching result between the matching target biometric feature vector and the sample biometric feature vector.

[0139] In an embodiment of the present application, a terminal device and a server can perform multiple interactions and processes based on a first secret key, a biometric feature vector to be matched, a generator, a second secret key, and first encrypted data, where the terminal device has the first secret key, the biometric feature to be matched, and the generator, and the server has the second secret key and the first encrypted data. Through the encryption process by the terminal device using the first secret key, the encryption process by the server using the second secret key, and the data interaction between the terminal device and the server, the terminal device can obtain second encrypted data including a calculation operator between the second secret key and a target Euclidean distance that can represent the Euclidean distance between the biometric feature vector to be matched and the sample biometric feature vector, where the second encrypted data includes the second secret key, the terminal device cannot know the second secret key, and it is difficult to decrypt the second secret key to obtain the plaintext of the biometric feature vector to be matched and the sample biometric feature vector. Similarly, the server cannot know the first secret key, and it is difficult to decrypt the first encrypted secret key. Furthermore, the server determines the matching result between the target biometric feature vector and the sample biometric feature vector based on the second encrypted data, the generator, the second secret key, and the preset Euclidean distance matching threshold, thereby completing the matching regardless of the plaintext of the target biometric feature vector and the plaintext of the sample biometric feature vector, further reducing the security risk of the user's privacy data and improving the security of biometric feature matching.The terminal device and the server do not store the plaintext of the target biometric feature vector and the plaintext of the sample biometric feature vector, thereby ensuring the user's control over their personal privacy data, thereby limiting the use scenarios of their personal privacy data, fulfilling the principle of minimal use of personal privacy data, and preventing the misuse of personal privacy data.

[0140] In addition, in the embodiments of the present application, the target biometric feature vector and the sample biometric feature vector are encrypted, and the matching result is determined by comparing the encrypted data. If the target biometric data and the sample biometric data are of different types, the available vector transformation models may also be different. In the embodiments of the present application, the similarity of the biometric data is described by the similarity of the feature vectors. In the biometric feature matching process in the embodiments of the present application, the process of protecting personal privacy data and the transformation process of converting the target biometric data into the target biometric feature vector and the sample biometric data into the sample biometric feature vector may be independent of each other, thereby realizing a technical solution that can be assembled and plugged into the vector transformation model and the biometric feature matching model, that is, realizing decoupling between the vector transformation model and the biometric feature matching model.

[0141] In some embodiments, the first communication module 401 may be configured to receive the first intermediate encrypted data sent from the server.

[0142] The first intermediate encrypted data is obtained by the server encrypting the first encrypted data using the second private key, and a calculation operator is formed in the first intermediate encrypted data, the calculation operator including a product of the first private key, the second private key, and an element in the sample biometric feature vector.

[0143] The first encryption module 402 may be configured to derive second intermediate encrypted data based on the first intermediate encrypted data, the matching biometric feature vector, the generator, and the first secret key.

[0144] A calculation operator including a product of the first private key, the second private key, and an element in the matching target biometric feature vector is formed in the second intermediate encrypted data.

[0145] The first communication module 401 and the first encryption module 402 may be configured to interact with and process with a server based on the second intermediate encrypted data, the first encrypted data, the first private key, and the second private key, and to erase the first private key from the processed data to obtain the second encrypted data.

[0146] In some examples, the second intermediate encrypted data includes first intermediate encrypted sub-data and second intermediate encrypted sub-data.

[0147] The first encryption module 402 may be configured to obtain first intermediate encrypted word data based on the first intermediate encrypted data and the matching biometric feature vector, and to obtain second intermediate encrypted sub-data based on the first secret key, the generator and the matching biometric feature vector.

[0148] The first intermediate encrypted sub-data includes a calculation operator including a product of the first secret key, the second secret key, an element in the sample biometric feature vector, and an element in the matching target biometric feature vector, and the second intermediate encrypted sub-data includes a calculation operator including a product of the first secret key and an element in the matching target biometric feature vector.

[0149] In some examples, the first communication module 401 may be configured to send the second intermediate encrypted data to the server, and receive the third intermediate encrypted data sent from the server, such that the server obtains the third intermediate encrypted data based on the second intermediate encrypted data, the first encrypted data, and the second secret key.

[0150] A calculation operator including a product of the first private key, the second private key, and the target Euclidean distance is formed in the third intermediate encrypted data.

[0151] The first encryption module 402 may be configured to utilize the first private key to erase the first private key from the third intermediate encrypted data to obtain the second encrypted data.

[0152] In some embodiments, if the second encrypted data belongs to the matching data set, the matching result includes a successful match. If the second encrypted data does not belong to the matching data set, the matching result includes a failed match. The maximum value of the elements in the matching data set is obtained based on the second secret key and a preset Euclidean distance matching threshold.

[0153] In some examples, the elements in the matching target biometric feature vector, the elements in the sample biometric feature vector, and the preset Euclidean distance matching threshold are multiplied by an integer, and a calculation operator is formed on the matching data set, the calculation operator including a product of the second secret key and the square of the preset Euclidean distance matching threshold, which is multiplied from 0 to an integer.

[0154] In some examples, if the values ​​at corresponding positions of the K target hash values ​​in the pre-constructed Bloom filter lookup table are all 1, the second encrypted data belongs to the matching data set. If at least one of the values ​​at corresponding positions of the K target hash values ​​in the Bloom filter lookup table is 0, the second encrypted data does not belong to the matching data set. The K target hash values ​​are calculated by K hash functions based on the second encrypted data, and the values ​​in the Bloom filter lookup table are calculated by K hash functions based on elements in the matching data set, where K is a positive integer.

[0155] In some embodiments, the terminal device 400 may further include a first acquisition module.

[0156] The first acquisition module is configured to acquire a sample biometric feature vector.

[0157] The first encryption module 402 may further be configured to encrypt the sample biometric feature vector using the generator and a first private key to obtain first encrypted data.

[0158] A computational operator is formed on the first encrypted data, the computational operator including the product of the first private key and an element in the sample biometric feature vector.

[0159] The first communication module 401 may be further configured to transmit the first encrypted data to a server.

[0160] A fourth aspect of the present application provides a server. Figure 7 is a schematic structural diagram of a server according to one embodiment of the fourth aspect of the present application. As shown in Figure 7, the server 500 may include a second communication module 501, a second encryption module 502, and a matching module 503.

[0161] The second communication module 501 and the second encryption module 502 may be configured to interact and process with the terminal device multiple times based on the second private key, the first encrypted data, the first private key, the preset generator, and the matching target biometric feature vector obtained by the terminal device, so that the terminal device obtains second encrypted data.

[0162] The first private key is the private key of the terminal device. The second private key is the private key of the server. The first encrypted data is obtained by the terminal device encrypting the sample biometric feature vector using the generator and the first private key in advance, and is sent to the server. The second encrypted data forms a calculation operator including the second private key and the target Euclidean distance. The target Euclidean distance includes the Euclidean distance between the matching target biometric feature vector and the sample biometric feature vector.

[0163] In some examples, the arithmetic operator includes a modular exponentiation operator or a dot product operator.

[0164] The second communication module 501 is further configured to receive second encrypted data sent from the terminal device.

[0165] The matching module 503 is configured to obtain a matching result between the matching target biometric feature vector and the sample biometric feature vector using the second encrypted data, the second secret key, the generator and a preset Euclidean distance matching threshold.

[0166] In an embodiment of the present application, the server and the terminal device can interact and process multiple times based on a first secret key, a biometric feature vector to be matched, a generator, a second secret key, and first encrypted data, where the terminal device has the first secret key, the biometric feature to be matched, and the generator, and the server has the second secret key and the first encrypted data. Through the encryption process by the terminal device using the first secret key, the encryption process by the server using the second secret key, and the data interaction between the terminal device and the server, the terminal device can obtain second encrypted data including a calculation operator including the second secret key and a target Euclidean distance that can represent the Euclidean distance between the biometric feature vector to be matched and the sample biometric feature vector, where the second encrypted data includes the second secret key, the terminal device cannot know the second secret key, and it is difficult to decrypt the second secret key to obtain the plaintext of the biometric feature vector to be matched and the sample biometric feature vector. For the same reason, the server cannot know the first secret key, and it is also difficult to decrypt the first encrypted secret key. Furthermore, the server determines the matching result between the target biometric feature vector and the sample biometric feature vector based on the second encrypted data, the generator, the second secret key, and the preset Euclidean distance matching threshold, thereby completing the matching regardless of the plaintext of the target biometric feature vector and the plaintext of the sample biometric feature vector, further reducing the security risk of the user's privacy data and improving the security of biometric feature matching.The terminal device and the server do not store the plaintext of the target biometric feature vector and the plaintext of the sample biometric feature vector, thereby ensuring the user's control over their personal privacy data, thereby limiting the use scenarios of their personal privacy data, fulfilling the principle of minimal use of personal privacy data, and preventing the misuse of personal privacy data.

[0167] In addition, in the embodiments of the present application, the target biometric feature vector and the sample biometric feature vector are encrypted, and the matching result is determined by comparing the encrypted data. If the target biometric data and the sample biometric data are of different types, the available vector transformation models may also be different. In the embodiments of the present application, the similarity of the biometric data is described by the similarity of the feature vectors. In the biometric feature matching process in the embodiments of the present application, the process of protecting personal privacy data and the transformation process of converting the target biometric data into the target biometric feature vector and the sample biometric data into the sample biometric feature vector may be independent of each other, thereby realizing a technical solution that can be assembled and plugged into the vector transformation model and the biometric feature matching model, that is, realizing decoupling between the vector transformation model and the biometric feature matching model.

[0168] In some embodiments, the second encryption module 502 may be configured to encrypt the first encrypted data using a second private key to obtain first intermediate encrypted data.

[0169] A calculation operator is formed in the first intermediate encrypted data, the calculation operator including a product of the first private key, the second private key, and an element in the sample biometric feature vector.

[0170] The second communication module 501 may be configured to send the first intermediate encrypted data to the terminal device, so that the terminal device obtains second intermediate encrypted data based on the first intermediate encrypted data, the matching biometric feature vector, the generator, and the first secret key.

[0171] The second intermediate encrypted data includes a calculation operator that includes a product of the first private key and an element in the matching target biometric feature vector.

[0172] The second communication module 501 and the second encryption module 502 may be configured to interact and process with the terminal device based on the second intermediate encrypted data, the first encrypted data, the first private key, and the second private key, so that the terminal device erases the first private key from the processed data to obtain the second encrypted data.

[0173] In some examples, the second intermediate encrypted data includes first intermediate encrypted sub-data and second intermediate encrypted sub-data.

[0174] The first intermediate encrypted subdata is obtained by the terminal device based on the first intermediate encrypted data and the matching target biometric feature vector, and a calculation operator is formed in the first intermediate encrypted subdata, the calculation operator including a product of the first secret key, the second secret key, an element in the sample biometric feature vector, and an element in the matching target biometric feature vector.

[0175] The second intermediate encrypted sub-data is obtained by the terminal device based on the first secret key, the generator, and the matching target biometric feature vector, and a calculation operator is formed in the second intermediate encrypted sub-data, the calculation operator including a product of the first secret key and an element in the matching target biometric feature vector.

[0176] In some examples, the second communication module 501 may be configured to receive second intermediate encrypted data sent from the terminal device.

[0177] The second encryption module 502 may be configured to derive third intermediate encrypted data based on the second intermediate encrypted data, the first encrypted data, and the second private key.

[0178] A calculation operator including a product of the first private key, the second private key, and the target Euclidean distance is formed in the third intermediate encrypted data.

[0179] The second communication module 501 may be configured to transmit the third intermediate encrypted data to the terminal device so that the terminal device uses the first private key to erase the first private key from the third intermediate encrypted data to obtain the second encrypted data.

[0180] In some embodiments, the matching module 503 is configured to obtain a matching data set based on the second private key, a generator, and a preset Euclidean distance matching threshold; obtain a maximum value of elements in the matching data set based on the second private key and the preset Euclidean distance matching threshold; determine that if the second encrypted data belongs to the matching data set, the matching result includes successful matching; and determine that if the second encrypted data does not belong to the matching data set, the matching result includes failed matching.

[0181] In some examples, the elements in the matching target biometric feature vector, the elements in the sample biometric feature vector, and the preset Euclidean distance matching threshold are multiplied by an integer.

[0182] The matching module 503 may be configured to calculate the products of the second private key and the squares of the predetermined Euclidean distance matching thresholds, which are integers from 0, respectively, and obtain a matching data set based on the products of the second private key and the squares of the predetermined Euclidean distance matching thresholds, which are integers from 0, and the generator.

[0183] In some examples, the matching module 503 may be configured to calculate K target hash values ​​by K hash functions based on the second encrypted data, and determine that the second encrypted data belongs to the matching data set if the values ​​at corresponding positions of the K target hash values ​​in the pre-constructed Bloom filter lookup table are all 1, and determine that the second encrypted data does not belong to the matching data set if at least one of the values ​​at corresponding positions of the K target hash values ​​in the Bloom filter lookup table is 0.

[0184] K target hash values ​​are calculated by K hash functions based on the second encrypted data, and values ​​in the Bloom filter lookup table are calculated by K hash functions based on elements in the matching data set, where K is a positive integer.

[0185] In some embodiments, the server 500 may further include a lookup table generation module, which may be configured to use K hash functions to calculate each of the elements in the matching data set, obtain K hash values ​​corresponding to the elements, map the K hash values ​​corresponding to the elements to K positions in a binary array where all values ​​are 0, update the values ​​at the K positions corresponding to the elements to 1, and determine the updated binary array as the Bloom filter lookup table.

[0186] A fifth aspect of the present application further provides a terminal device. Figure 8 is a schematic structural diagram of a terminal device according to an embodiment of the fifth aspect of the present application. As shown in Figure 8, the terminal device 600 includes a memory 601, a processor 602, and a computer program stored in the memory 601 and executable on the processor 602.

[0187] In some examples, the processor 602 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured as one or more integrated circuits that implement embodiments of the present application.

[0188] The memory 601 may include read-only memory (ROM), random access memory (RAM), a magnetic disk storage medium device, an optical storage medium device, a flash memory device, an electrical, optical, or other physical / tangible memory storage device. Thus, the memory typically includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, which when executed (e.g., by one or more processors) can operate to perform the operations described with reference to the biometric feature matching method in the embodiment of the first aspect of the present application.

[0189] The processor 602 is configured to read the executable program code stored in the memory 601 and execute a computer program corresponding to the executable program code, thereby realizing the biometric feature matching method in the embodiment of the first aspect.

[0190] In some examples, the terminal device 600 may further include a communication interface 603 and a bus 604. As shown in Figure 8, the memory 601, the processor 602, and the communication interface 603 are connected by the bus 604 to complete communication between them.

[0191] The communication interface 603 is mainly configured to realize communication between modules, apparatuses, units, and / or devices in the embodiments of the present application. Input devices and / or output devices can also be accessed through the communication interface 603.

[0192] The bus 604 includes hardware, software, or both, and couples the components of the terminal device 600 together. By way of example only and not limitation, bus 604 may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-E) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable bus, or a combination of two or more thereof. Where appropriate, bus 604 may include one or more buses. Although the embodiments of this application describe and illustrate a particular bus, this application contemplates any suitable bus or interconnect.

[0193] A sixth aspect of the present application further provides a server. Fig. 9 is a schematic structural diagram of a server according to an embodiment of the sixth aspect of the present application. As shown in Fig. 9, the server 700 includes a memory 701, a processor 702, and a computer program stored in the memory 701 and executable on the processor 702.

[0194] In some examples, the processor 702 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured as one or more integrated circuits that implement embodiments of the present application.

[0195] The memory 701 may include read-only memory (ROM), random access memory (RAM), a magnetic disk storage medium device, an optical storage medium device, a flash memory device, an electrical, optical, or other physical / tangible memory storage device. Thus, the memory typically includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, which when executed (e.g., by one or more processors) can operate to perform the operations described with reference to the biometric feature matching method in the embodiment of the second aspect of the present application.

[0196] The processor 702 is configured to read the executable program code stored in the memory 701 and execute a computer program corresponding to the executable program code, thereby realizing the biometric feature matching method in the embodiment of the second aspect.

[0197] In some examples, the terminal device 700 may further include a communication interface 703 and a bus 704. As shown in Figure 9, the memory 701, the processor 702, and the communication interface 703 are connected by the bus 704 to complete intercommunication.

[0198] The communication interface 703 is mainly configured to realize communication between modules, apparatuses, units, and / or devices in the embodiments of the present application. Input devices and / or output devices can also be accessed through the communication interface 703.

[0199] Bus 704, which may include hardware, software, or both, couples the components of server 700 together. By way of example only and not limitation, bus 704 may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-E) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable bus, or a combination of two or more thereof. Where appropriate, bus 704 may include one or more buses. Where appropriate, bus 704 may include one or more buses. Although embodiments of the present application are described and illustrated with reference to a particular bus, the present application contemplates any suitable bus or interconnect.

[0200] A seventh aspect of the present application provides a biometric feature matching system, which may include a terminal device and a server in the above embodiments, wherein the terminal device can execute the biometric feature matching method in the above embodiment of the first aspect, and the server can execute the biometric feature matching method in the above embodiment of the second aspect. For specific contents, please refer to the relevant descriptions in the above embodiments, and they will not be repeated here.

[0201] An eighth aspect of the present application further provides a computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, can realize the biometric feature matching method in the embodiment of the first aspect or the biometric feature matching method in the embodiment of the second aspect, and can achieve the same technical effects, which will not be repeated here to avoid redundancy. The computer-readable storage medium may include, but is not limited to, a non-transitory computer-readable storage medium such as a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0202] The embodiments of the present application may further provide a computer program product, and when the instructions in the computer program product are executed by a processor of an electronic device, the electronic device can perform the biometric feature matching method in the embodiments of the first aspect or the biometric feature matching method in the embodiments of the second aspect. For specific contents, reference may be made to the relevant descriptions in the above embodiments, and the same technical effects can be achieved, which will not be repeated here to avoid redundancy.

[0203] Note that each embodiment in this specification is described progressively, and identical or similar parts between embodiments may be referred to, and the description of each embodiment will focus on the differences from other embodiments. For relevant parts of the terminal device embodiment, server embodiment, system embodiment, computer-readable storage medium embodiment, and computer program product embodiment, please refer to the description of the method embodiment. This application is not limited to the specific steps and structures described and illustrated above. Those skilled in the art may make various changes, modifications, and additions, or change the order of steps, while understanding the spirit of this application. For the sake of brevity, detailed descriptions of known method technologies will be omitted.

[0204] The above describes various aspects of the present application with reference to flowcharts and / or block diagrams of methods, apparatuses (systems), and computer program products according to embodiments of the present application. It should be understood that each block in the flowcharts and / or block diagrams, and combinations of blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions, when provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus, generate a machine that enables the instructions, executed by the processor of the computer or other programmable data processing apparatus, to implement the functions / operations specified in one or more blocks in the flowcharts and / or block diagrams. Such processors include, but are not limited to, general-purpose processors, special-purpose processors, special-purpose processors, or field-programmable logic circuits. It should also be understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented by dedicated hardware that performs the specified functions or operations, or by a combination of dedicated hardware and computer instructions.

[0205] As those skilled in the art will understand, the above embodiments are illustrative and not restrictive. Different technical features described in different embodiments can be combined to achieve beneficial effects. Those skilled in the art will be able to understand and implement other variations of the disclosed embodiments after studying the drawings, the description, and the claims. In the claims, the term "comprises" does not exclude other devices or steps, the quantifier "a" does not exclude a plurality, and the terms "first" and "second" are used to indicate names but not any particular order. Any reference numerals in the claims should not be construed as limiting the scope of protection. The functions of multiple parts described in the claims may be realized by a single hardware or software module. The fact that several technical features are described in different dependent claims does not mean that these technical features cannot be combined to achieve beneficial effects.

Claims

1. A biometric feature matching method applied to a terminal device, comprising: and obtaining second encrypted data by interacting with and processing a server multiple times based on a first private key, the acquired matching target biometric feature vector, a preset generator, a second private key, and first encrypted data, wherein the first private key is a private key of the terminal device, the second private key is a private key of the server, the first encrypted data is obtained by the terminal device encrypting a sample biometric feature vector using the generator and the first private key in advance, and the first encrypted data is sent to the server, a calculation operator including the second private key and a target Euclidean distance is formed in the second encrypted data, and the target Euclidean distance includes the Euclidean distance between the matching target biometric feature vector and the sample biometric feature vector; sending the second encrypted data to the server, so that the server obtains a matching result between the matching target biometric feature vector and the sample biometric feature vector using the second encrypted data, the generator, the second secret key, and a preset Euclidean distance matching threshold; Biometric feature matching method.

2. Obtaining second encrypted data by performing interactions and processing with a server multiple times based on the first private key, the acquired matching target biometric feature vector, a preset generator, a second private key, and the first encrypted data includes: receiving first intermediate encrypted data sent from the server, the first intermediate encrypted data being obtained by the server encrypting the first encrypted data using the second private key, and a calculation operator including a product of the first private key, the second private key, and an element in the sample biometric feature vector is formed in the first intermediate encrypted data; obtaining second intermediate encrypted data based on the first intermediate encrypted data, the matching target biometric feature vector, the generator, and the first secret key, wherein a calculation operator including a product of the first secret key, the second secret key, and an element in the matching target biometric feature vector is formed in the second intermediate encrypted data; interacting with and processing the server based on the second intermediate encrypted data, the first encrypted data, the first private key, and the second private key, and erasing the first private key from the processed data to obtain the second encrypted data; The method of claim 1.

3. the second intermediate encrypted data includes first intermediate encrypted sub-data and second intermediate encrypted sub-data; Obtaining second intermediate encrypted data based on the first intermediate encrypted data, the matching target biometric feature vector, the generator, and the first secret key includes: obtaining the first intermediate encrypted sub-data based on the first intermediate encrypted data and the matching target biometric feature vector, wherein the first intermediate encrypted sub-data is formed with a calculation operator including a product of the first secret key, the second secret key, an element in the sample biometric feature vector, and an element in the matching target biometric feature vector; obtaining the second intermediate encrypted sub-data based on the first private key, the generator, and the matching biometric feature vector, wherein a calculation operator including a product of the first private key and an element in the matching biometric feature vector is formed in the second intermediate encrypted sub-data. The method of claim 2.

4. performing an interaction and processing with the server based on the second intermediate encrypted data, the first encrypted data, the first private key, and the second private key, and deleting the first private key from the processed data to obtain the second encrypted data; sending the second intermediate encrypted data to the server, so that the server obtains third intermediate encrypted data based on the second intermediate encrypted data, the first encrypted data, and the second secret key, wherein a calculation operator including a product of the first secret key, the second secret key, and the target Euclidean distance is formed in the third intermediate encrypted data; receiving the third intermediate encrypted data sent from the server; and using the first private key to erase the first private key from the third intermediate encrypted data to obtain the second encrypted data. The method of claim 3.

5. If the second encrypted data belongs to a matching data set, the matching result includes a successful match; If the second encrypted data does not belong to the matching data set, the matching result includes a matching failure; the maximum value of elements in the matching data set is obtained based on the second secret key and the preset Euclidean distance matching threshold; The method of claim 1.

6. The elements in the matching target biometric feature vector, the elements in the sample biometric feature vector, and the preset Euclidean distance matching threshold are converted into integers at the same magnification; A calculation operator is formed on the matching data set, the calculation operator including the product of each of the squares of the second secret key and the predetermined Euclidean distance matching threshold, which is an integer from 0. The method of claim 5.

7. If the values ​​at the corresponding positions of the K target hash values ​​in the pre-constructed Bloom filter lookup table are all 1, the second encrypted data belongs to the matching data set; If at least one of the values ​​at the corresponding positions of the K target hash values ​​in the Bloom filter lookup table is 0, the second encrypted data does not belong to the matching data set; K target hash values ​​are calculated by K hash functions based on the second encrypted data, and values ​​in the Bloom filter lookup table are calculated by the K hash functions based on elements in the matching data set, where K is a positive integer. The method of claim 5.

8. before performing a plurality of interactions and processes with the server based on the first secret key, the acquired matching target biometric feature vector, the second secret key, and the first encrypted data to obtain the second encrypted data, obtaining the sample biometric feature vector; encrypting the sample biometric feature vector using the generator and the first private key to obtain the first encrypted data, wherein a calculation operator including a product of the first private key and an element in the sample biometric feature vector is formed in the first encrypted data; transmitting the first encrypted data to the server; The method of claim 1.

9. The arithmetic operators include the modular exponentiation operator or the dot product operator. The method according to any one of claims 1 to 8.

10. A biometric feature matching method applied to a server, comprising: a terminal device interacts with and processes the terminal device multiple times based on a second private key, first encrypted data, a first private key, a preset generator, and a matching target biometric feature vector acquired by the terminal device, so as to obtain second encrypted data, wherein the first private key is a private key of the terminal device, and the second private key is a private key of the server; the first encrypted data is obtained by the terminal device encrypting a sample biometric feature vector using the generator and the first private key in advance, and is sent to the server; a calculation operator including the second private key and a target Euclidean distance is formed in the second encrypted data, and the target Euclidean distance includes the Euclidean distance between the matching target biometric feature vector and the sample biometric feature vector; receiving the second encrypted data transmitted from the terminal device; obtaining a matching result between the matching target biometric feature vector and the sample biometric feature vector using the second encrypted data, the second secret key, the generator, and a preset Euclidean distance matching threshold. Biometric feature matching method.

11. Interacting and processing with the terminal device multiple times based on the second secret key, the first encrypted data, the first secret key, a preset generator, and a matching target biometric feature vector acquired by the terminal device, so that the terminal device obtains second encrypted data, encrypting the first encrypted data using the second private key to obtain the first intermediate encrypted data, wherein the first intermediate encrypted data is formed with a calculation operator including a product of the first private key, the second private key, and an element in the sample biometric feature vector; transmitting the first intermediate encrypted data to the terminal device so that the terminal device obtains second intermediate encrypted data based on the first intermediate encrypted data, the matching target biometric feature vector, the generator, and the first secret key, wherein a calculation operator including a product of elements of the first secret key and the matching target biometric feature vector is formed in the second intermediate encrypted data; interacting and processing with the terminal device based on the second intermediate encrypted data, the first encrypted data, the first private key, and the second private key, so that the terminal device erases the first private key from the processed data to obtain the second encrypted data; The method of claim 10.

12. the second intermediate encrypted data includes first intermediate encrypted sub-data and second intermediate encrypted sub-data; the first intermediate encrypted sub-data is obtained by the terminal device based on the first intermediate encrypted data and the matching target biometric feature vector, and a calculation operator is formed in the first intermediate encrypted sub-data, the calculation operator including a product of the first secret key, the second secret key, an element in the sample biometric feature vector, and an element in the matching target biometric feature vector; the second intermediate encrypted sub-data is obtained by the terminal device based on the first secret key, the generator, and the matching target biometric feature vector, and a calculation operator is formed in the second intermediate encrypted sub-data, the calculation operator including a product of the first secret key and an element in the matching target biometric feature vector; The method of claim 11.

13. performing an interaction and processing with the terminal device based on the second intermediate encrypted data, the first encrypted data, the first private key, and the second private key, such that the terminal device erases the first private key from the processed data and obtains the second encrypted data; receiving the second intermediate encrypted data transmitted from the terminal device; Obtaining third intermediate encrypted data based on the second intermediate encrypted data, the first encrypted data, and the second secret key, wherein a calculation operator including a product of the first secret key, the second secret key, and the target Euclidean distance is formed in the third intermediate encrypted data; transmitting the third intermediate encrypted data to the terminal device so that the terminal device uses the first private key to erase the third intermediate encrypted data and obtain the second encrypted data; The method of claim 12.

14. Obtaining a matching result between the target biometric feature vector and the sample biometric feature vector by using the second encrypted data, the second secret key, the generator, and a preset Euclidean distance matching threshold, Obtaining a matching data set based on the second private key, the generator, and the preset Euclidean distance matching threshold, wherein a maximum value of elements in the matching data set is obtained based on the second private key and the preset Euclidean distance matching threshold; determining that the matching result includes a successful match if the second encrypted data belongs to a matching data set; determining that the matching result includes a failed match if the second encrypted data does not belong to the matching data set; The method of claim 10.

15. The elements in the matching target biometric feature vector, the elements in the sample biometric feature vector, and the preset Euclidean distance matching threshold are converted into integers at the same magnification; Obtaining a matching data set based on the second private key, the generating element, and the preset Euclidean distance matching threshold includes: Calculating the product of the square of the second secret key and the square of the predetermined Euclidean distance matching threshold after being rounded from 0 to an integer; obtaining the matching data set based on the product of the second secret key and the square of the preset Euclidean distance matching threshold after being converted from 0 to an integer, and the generator; 15. The method of claim 14.

16. calculating K target hash values ​​by K hash functions based on the second encrypted data; determining that the second encrypted data belongs to the matching data set if the values ​​at corresponding positions of the K target hash values ​​in a pre-constructed Bloom filter lookup table are all 1; determining that the second encrypted data does not belong to the matching data set if at least one of the values ​​in the Bloom filter lookup table at a corresponding position of the K target hash values ​​is 0; K target hash values ​​are calculated by K hash functions based on the second encrypted data, and values ​​in the Bloom filter lookup table are calculated by the K hash functions based on elements in the matching data set, where K is a positive integer.

15. The method of claim 14.

17. using the K hash functions to compute each of the elements in the matching data set to obtain K hash values ​​corresponding to each element; mapping the K hash values ​​corresponding to each element to K positions in a binary array where all values ​​are 0, updating the values ​​at the K positions corresponding to each element to 1, and determining the updated binary array as the Bloom filter lookup table.

17. The method of claim 16.

18. The arithmetic operators include the modular exponentiation operator or the dot product operator.

18. The method of any one of claims 10 to 17.

19. A terminal device including a first communication module and a first encryption module, the first communication module and the first encryption module are configured to obtain second encrypted data by interacting and processing with a server multiple times based on a first private key, the acquired matching target biometric feature vector, a preset generator, a second private key, and first encrypted data, wherein the first private key is a private key of a terminal device, and the second private key is a private key of a server, the first encrypted data is obtained by the terminal device previously encrypting a sample biometric feature vector using the generator and the first private key, and is sent to the server, a calculation operator including the second private key and a target Euclidean distance is formed in the second encrypted data, and the target Euclidean distance includes the Euclidean distance between the matching target biometric feature vector and the sample biometric feature vector; the first communication module is further configured to transmit the second encrypted data to the server, so that the server obtains a matching result between the matching target biometric feature vector and the sample biometric feature vector using the second encrypted data, the generator, the second secret key, and a predetermined Euclidean distance matching threshold. Terminal equipment.

20. a server including a second communication module, a second encryption module, and a matching module, the second communication module and the second encryption module are configured to interact and process with the terminal device multiple times based on a second private key, first encrypted data, a first private key, a preset generator, and a matching target biometric feature vector acquired by the terminal device, so that the terminal device obtains second encrypted data, the first private key being a private key of the terminal device, the second private key being a private key of the server, the first encrypted data being obtained by the terminal device encrypting a sample biometric feature vector using the generator and the first private key in advance, and being sent to the server, the second encrypted data forming a calculation operator including the second private key and a target Euclidean distance, the target Euclidean distance including the Euclidean distance between the matching target biometric feature vector and the sample biometric feature vector, the second communication module is further configured to receive the second encrypted data transmitted from the terminal device; the matching module is configured to obtain a matching result between the matching target biometric feature vector and the sample biometric feature vector by using the second encrypted data, the second secret key, the generator, and a preset Euclidean distance matching threshold; server.

21. 1. A terminal device including a processor and a memory storing computer program instructions, When the processor executes the computer program instructions, it implements the biometric feature matching method according to any one of claims 1 to 9. Terminal equipment.

22. A server including a processor and a memory storing computer program instructions, When the processor executes the computer program instructions, it implements the biometric feature matching method according to any one of claims 10 to 18. server.

23. A system including the terminal device according to claim 21 and the server according to claim 22, Biometric feature matching system.

24. A computer-readable storage medium having computer program instructions stored thereon, comprising: When the computer program instructions are executed by a processor, the biometric feature matching method according to any one of claims 1 to 18 is implemented. A computer-readable storage medium.

Images