CN115100715A - Biological information identification method and device - Google Patents

Abstract

The embodiment of the application provides a biological information identification method and a device, which relate to the technical field of computers, and the method comprises the following steps: the method comprises the steps of dividing a reference feature vector of reference biological information into a plurality of feature vector fragments and storing the plurality of feature vector fragments in a plurality of identification backgrounds respectively, so that any one identification background cannot restore the whole reference feature vector based on one stored feature vector fragment to identify the biological information, and the safety of feature vector information storage is guaranteed. Secondly, each recognition background independently calculates the characteristic distance between the local characteristic vector fragment and the target characteristic vector of the biological information to be recognized based on a homomorphic encryption operation mode, and then the characteristic distances are gathered to one recognition background to be calculated to realize biological information recognition, so that calculation in a ciphertext state is realized, the calculation safety is ensured, the communication round and the communication traffic are reduced, the calculation performance is improved, and the communication resource consumption is reduced.

Description

Biometric information identification method and device

technical field

The embodiments of the present application relate to the field of computer technologies, and in particular, to a method and device for identifying biological information.

Background technique

In a biometric recognition scene (such as a face recognition scene), the Euclidean distance and the cosine distance are used to measure the characteristic distance of biological information, and then to determine whether it is the same biological object. In the related art, when performing biometric identification, the biological information is stored in the form of plaintext data or original image data, and then it is determined whether it is the same biological object by calculating the characteristic distance between the biological information in the form of plaintext data or original image data. .

However, when biometric information is stored and compared in the above manner, there is a risk of biometric information leakage, thereby affecting data security.

SUMMARY OF THE INVENTION

Embodiments of the present application provide a method and device for identifying biological information, which are used to improve the security of biological information data.

On the one hand, an embodiment of the present application provides a biometric information identification method, which is applied to each identification platform in a secure computing system, including:

Obtain the target feature vector of the biological information to be identified, and obtain the local feature vector fragment corresponding to at least one reference biological identifier from the vector fragment library;

For each reference biological identifier, determine the feature distance between the corresponding local feature vector fragment and the target feature vector, and send the target feature vector to at least one other identification platform that stores the corresponding other feature vector fragments , and receive the feature distance between the target feature vector sent by the at least one other identification platform and the other feature vector fragments saved;

Based on the obtained multiple characteristic distances, a recognition result of the biological information to be recognized is determined.

On the one hand, an embodiment of the present application provides a biometric information identification device, which is applied to each identification platform in a secure computing system, including:

an acquisition module, including acquiring a target feature vector of the biological information to be identified, and acquiring a local feature vector fragment corresponding to at least one reference biological identifier from the vector fragment library;

The processing module is used to determine the feature distance between the corresponding local feature vector fragment and the target feature vector for each reference biological identifier, and send to at least one other identification platform that stores the corresponding other feature vector fragments the target feature vector, and receive the feature distance between the target feature vector sent by the at least one other identification platform and the other feature vector fragments saved;

The identification module is configured to determine the identification result of the biological information to be identified based on the obtained multiple characteristic distances.

Optionally, the processing module is also used for:

Before obtaining the target feature vector of the biological information to be identified, for each reference biological marker, obtain the reference biological information corresponding to the reference biological marker, and perform feature extraction on the reference biological information to obtain the reference feature vector;

dividing the reference feature vector into a plurality of feature vector slices;

One feature vector fragment in the plurality of feature vector fragments is stored as a local feature vector fragment, and at least one other feature vector fragment in the plurality of feature vector fragments is sent to the corresponding other identification. platform to save.

Optionally, the processing module is also used for:

Acquiring device information of multiple identification platforms for saving the multiple feature vector fragments;

saving the reference biomarker and device information of the plurality of identification platforms;

For each other identification platform, the reference biological identifier and the device information of the multiple identification platforms are sent to the other identification platforms for storage.

Optionally, the plurality of feature vector fragments are in plaintext or after homomorphic encryption, and the target feature vector is in plaintext or after homomorphic encryption.

Optionally, the biological information to be identified corresponds to the target biological identifier;

The acquisition module is specifically used for:

A local feature vector fragment corresponding to a reference biological identifier matching the target biological identifier is obtained from the vector fragment library.

Optionally, the identification module is specifically used for:

Determine the target feature distance between the target feature vector and the reference feature vector corresponding to the one reference biomarker based on the obtained multiple feature distances;

If the target feature distance is less than the distance threshold, it is determined that the identification result of the biological information to be identified is verified as passed;

If the target feature distance is greater than or equal to the distance threshold, it is determined that the identification result of the biological information to be identified is that the verification fails.

Optionally, the identification module is specifically used for:

Homomorphic addition is performed on the obtained multiple feature distances to obtain candidate feature distances between the target feature vector and the reference feature vector corresponding to the one reference biological identifier;

The candidate feature distance is decrypted using a homomorphic encryption private key to obtain the target feature distance.

Optionally, the vector fragment library includes local feature vector fragments corresponding to multiple reference biological identifiers;

Optionally, the obtaining module is specifically used for:

The respective corresponding local feature vector fragments of the multiple reference biological identifiers are acquired from the vector fragment library.

Optionally, the identification module is specifically used for:

For each reference biomarker in the multiple reference biomarkers, determine a target between the target feature vector and the reference feature vector corresponding to the reference biomarker based on multiple feature distances associated with the reference biomarker feature distance;

From the obtained multiple target feature distances, determine the minimum feature distance;

If the minimum characteristic distance is less than the distance threshold, then determine that the identification result of the biological information to be identified is verified as passed;

If the minimum characteristic distance is greater than or equal to the distance threshold, it is determined that the identification result of the biological information to be identified is that the verification fails.

On the one hand, an embodiment of the present application provides a computer device, including a memory, a processor, and a computer program stored in the memory and running on the processor, the processor implementing the above image processing method when the program is executed. step.

On the one hand, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program that can be executed by a computer device, and when the program runs on the computer device, causes the computer device to execute the above-mentioned biometric information identification method A step of.

In one aspect, an embodiment of the present application provides a computer program product, the computer program product includes a computer program stored on a computer-readable storage medium, the computer program includes program instructions, and when the program instructions are executed by a computer device At the time, the computer device is made to execute the steps of the above-mentioned biometric information identification method.

In the embodiment of the present application, a reference feature vector of reference biological information is divided into multiple feature vector slices, and the multiple feature vector slices are respectively stored in multiple identification backgrounds, so that any identification background needs to use other identification The biometric identification can only be completed by the feature vector shards saved in the platform. Each recognition background cannot restore the entire reference feature vector based on a feature vector shard saved locally, thus ensuring the security of feature vector information storage. Secondly, each identification background calculates the feature distance between the local feature vector fragment and the target feature vector of the biological information to be identified based on the operation method of homomorphic encryption, which realizes the calculation in the ciphertext state and ensures the security of the calculation. In addition, each recognition background independently calculates the feature distance between the local feature vector fragment and the target feature vector, and then aggregates the calculation results into one recognition background, which greatly reduces the number of communication rounds and Therefore, the performance of computing is improved and the consumption of communication resources is reduced.

Description of drawings

In order to illustrate the technical solutions in the embodiments of the present invention more clearly, the following briefly introduces the accompanying drawings used in the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained from these drawings without any creative effort.

FIG. 1 is a schematic structural diagram of a system architecture provided by an embodiment of the present application;

2 is a schematic flowchart of a biological information identification method provided by an embodiment of the present application;

3 is a schematic flowchart of a feature vector fragmentation method provided by an embodiment of the present application;

4 is a schematic flowchart of a biological information identification method provided by an embodiment of the present application;

5 is a schematic flowchart of a biological information identification method provided by an embodiment of the present application;

FIG. 6 is a schematic structural diagram of a biometric information identification device provided by an embodiment of the present application;

FIG. 7 is a schematic structural diagram of a computer device according to an embodiment of the present application.

Detailed ways

In order to make the objectives, technical solutions and beneficial effects of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention, but not to limit the present invention.

Referring to FIG. 1 , which is a system architecture diagram of a multi-party secure computing applicable to an embodiment of the application, the system architecture includes multiple terminals and multiple identification platforms, and the multiple terminals include terminals 101-1 and terminals 101-2 , . Corresponding to the identification platforms 102-2, ..., the terminals 101-N correspond to the identification platforms 102-N, wherein N is an integer greater than 0. Each recognition platform includes a business system, a feature extraction module, a feature comparison module, and a vector fragmentation library.

The terminal is pre-installed with target applications that require biometric identification, such as payment applications, instant messaging applications, video applications, shopping applications, and the like. Each terminal device has the function of collecting biological information, wherein the biological information includes but is not limited to face information, fingerprint information, and iris information. The terminal may be a smart phone, a tablet computer, a notebook computer, a desktop computer, a smart home appliance, a smart voice interaction device, a smart vehicle-mounted device, etc., but is not limited thereto.

The identification platform is the background server of the target application. Different identification platforms correspond to different target applications. The identification platform can be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, or it can provide cloud services, Cloud database, cloud computing, cloud function, cloud storage, network service, cloud communication, middleware service, domain name service, security service, content delivery network (CDN), and basic cloud computing such as big data and artificial intelligence platform service cloud server. The terminal and the identification platform may be directly or indirectly connected through wired or wireless communication, and any two identification platforms may be directly or indirectly connected through wired or wireless communication, which is not limited in this application.

In practical applications, the biometric information identification method in the embodiments of the present application can be applied to payment scenarios, login scenarios, identity verification scenarios, and the like.

It can be understood that, in the specific implementation of this application, related biological information data such as face information, fingerprint information, iris information, etc. are involved. When the embodiments in this application are applied to specific products or technologies, it is necessary to obtain User permission or consent, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

Based on the system architecture diagram shown in FIG. 1 , an embodiment of the present application provides a flow of a method for identifying biological information. As shown in FIG. 2 , the flow of the method is executed by a computer device, and the computer device may be the one shown in FIG. 1 . Any identification platform, including the following steps:

Step S201 , acquiring a target feature vector of the biological information to be identified, and acquiring a local feature vector fragment corresponding to at least one reference biological identifier from a vector fragment library.

Specifically, the biological information includes but is not limited to face information, fingerprint information and iris information; the biological identifier may be an identifier that uniquely identifies the biological information, specifically a name, a unique number, etc., such as a user ID. A vector sharding library is included in each recognition platform. Taking a recognition platform as an example, the local feature vector fragments in the vector fragment library can be obtained by the recognition platform after fragmenting the reference feature vector, or it can be sent by any other recognition platform after fragmenting the reference feature vector. of.

In some embodiments, for each reference biological identifier, the reference biological information corresponding to the reference biological identifier is obtained, and feature extraction is performed on the reference biological information to obtain a reference feature vector. The reference feature vector is then divided into multiple feature vector slices. Save one feature vector fragment among the multiple feature vector fragments as a local feature vector fragment, and send at least one other feature vector fragment among the multiple feature vector fragments to the corresponding other recognition platforms for saving. .

Specifically, the terminal collects the reference biological information corresponding to the reference biological identifier, and then sends the reference biological information to the corresponding identification platform. After the identification platform performs denoising, grayscale, face detection, normalization and other preprocessing on the reference biological information, the feature extraction module uses a neural network model to extract features from the reference biological information to obtain a reference feature vector. The reference feature vector may be equally divided into multiple feature vector segments, or the reference feature vector may be equally divided into multiple feature vector segments in an uneven manner, and the multiple feature vector segments are different feature vectors. The number of feature vector slices can be determined based on the number of cooperatively stored identification platforms. For example, if the number of cooperatively stored identification platforms is three, the reference feature vector is divided into three feature vector slices.

In addition, a feature vector fragment can be randomly selected from multiple feature vector fragments to be saved as a local feature vector fragment, or the feature vector fragment ranked first can be saved as a local feature vector fragment. Other methods may be used as selecting a feature vector fragment to save as a local feature vector fragment, etc. Each other feature vector fragment can be sent to another recognition platform for storage, and after receiving a feature vector fragment, the other recognition platform saves the feature vector fragment as a local feature vector fragment. The feature vector slices saved by different recognition platforms are different. After each recognition platform obtains the feature vector slice, it can extend the dimension of the feature vector slice to the dimension of the reference feature vector by means of zero-padding.

In some embodiments, in addition to storing the local feature vector slices, the identification platform also acquires device information of multiple identification platforms for storing multiple feature vector slices, and then stores the reference biological identifier and the information of the multiple identification platforms. Device Information. For each other identification platform, the reference biometric identifier and the device information of multiple identification platforms are sent to other identification platforms for storage.

Specifically, the device information includes, but is not limited to, the device name, device ID, organization information corresponding to the identification platform, and the like. For each identification platform, the identification platform associates and saves the local feature vector shards, the reference biometric identifiers and the device information of multiple identification platforms, so that in the subsequent biometric information identification process, the feature vector shards can be quickly queried for calculation, thereby Improve the efficiency of biometric identification.

In some embodiments, the plurality of feature vector slices are feature vector slices in plaintext. In order to ensure the security of feature vector shards, the identification platform encrypts one feature vector shard among multiple eigenvector shards and saves it as a local feature vector shard. When each other identification platform receives another feature vector fragment in plaintext, it can also encrypt the other feature vector fragment and save it as a local feature vector fragment.

In some embodiments, the plurality of feature vector slices are feature vector slices in encrypted form. Specifically, the reference eigenvector is divided into multiple original vector shards, and then each eigenvector shard is homomorphically encrypted using public-private homomorphic encryption to obtain multiple eigenvector shards. In this way, the recognition platform saves one feature vector fragment among the multiple feature vector fragments as a local feature vector fragment, and each other recognition platform, when receiving one other feature vector fragment, divides the other feature vector fragment into When the slice is stored as a local feature vector slice, the security of the feature vector slice can also be guaranteed.

For example, as shown in FIG. 3 , it is assumed that the multi-party secure computing system includes a first terminal, a second terminal, a first identification platform and a second identification platform, wherein the first terminal corresponds to the first identification platform, and the second identification platform corresponds to the first identification platform. The terminal corresponds to the second identification platform, and the first terminal is installed with a payment application. When the user registers in the payment application, the first terminal collects the face image and the user account with the user's permission, and sends the face image and the user account to the business system of the first recognition platform. The feature extraction module in the first recognition platform obtains the face image from the business system, and performs preprocessing on the face image such as denoising, grayscale, face detection, and normalization, and then uses the neural network model to analyze the face image. Perform feature extraction to obtain reference feature vectors [v1, v2, v3, ..., v1024]. Divide the reference feature vector into two feature vector slices, namely, feature vector slice A[v1, v2, v3,...,v512] and feature vector slice B[v513, v514,...,v1024]. The feature vector fragment A is encrypted and stored in the vector fragment library of the first identification platform, and the user account, the device information of the first identification platform and the device information of the second identification platform are stored in association at the same time.

The feature extraction module in the first recognition platform sends the feature vector fragment B to the second recognition platform, and the second recognition platform encrypts the feature vector fragment B and saves it in the vector fragment library of the second recognition platform, and saves it in association at the same time. User account, device information of the first identification platform, and device information of the second identification platform.

In the embodiment of the present application, a reference feature vector of reference biological information is divided into multiple feature vector slices, and the multiple feature vector slices are respectively stored in multiple identification backgrounds, so any identification background cannot be saved locally based on One of the feature vector slices restores the entire reference feature vector, thus ensuring the security of feature vector information storage.

In the biometric information identification stage, the terminal collects the biometric information to be identified, and then sends the biometric information to be identified to the identification platform. The recognition platform performs feature extraction on the biological information to be recognized through the feature extraction module, and obtains the target feature vector. Of course, the terminal can also perform feature extraction on the biological information to be recognized after collecting the biological information to be recognized, obtain a target feature vector, and then send the target feature vector to the recognition platform, which is not specifically limited in this application. In addition, the recognition platform can directly output the target feature vector in plaintext after feature extraction of the biological information to be recognized, or can perform feature extraction on the biological information to be recognized to obtain the original feature vector, and then perform homomorphic encryption on the original feature vector to obtain the target feature vector. .

In some embodiments, if the target biological identifier of the biological information to be recognized is obtained when the target feature vector of the biological information to be recognized is obtained, a reference biological identifier matching the target biological identifier will be obtained from the vector fragment library Corresponding local feature vector shards (one-to-one comparison for biometric identification scenarios).

In some embodiments, if the target biometric identifier of the biometric information to be recognized is not obtained when the target feature vector of the biometric information to be recognized is obtained, and the vector fragment library includes local feature vector fragments corresponding to each of the multiple reference biometric identifiers . Then, the identification device obtains local feature vector fragments corresponding to multiple reference biological identifiers from the vector fragmentation library, that is, obtains the local feature vector fragments corresponding to all reference biological identifiers in the vector fragmentation library (one-to-many comparison for biological identification). information recognition scene), and then sort the multiple local feature vector slices according to the reference biological identifier and compare and process them in sequence.

Step S202, for each reference biological identifier, determine the feature distance between the corresponding local feature vector slice and the target feature vector.

Specifically, the feature distance may be Euclidean distance, cosine distance, Mahalanobis distance, or the like.

When the local feature vector fragment is a plaintext feature vector fragment, and the target feature vector is a homomorphically encrypted feature vector, the identification platform performs homomorphism on the local feature vector fragment and the target feature vector in the semi-homomorphic mode. Multiplication operation to obtain feature distances.

When the local feature vector fragment is a homomorphically encrypted feature vector fragment and the target feature vector is a plaintext feature vector, the recognition platform performs homomorphism on the local feature vector fragment and the target feature vector in the semi-homomorphic mode. Multiplication operation to obtain feature distances. In the embodiment of the present application, the feature distance calculation is performed based on the semi-homogenous mode, which not only ensures the security of the calculation, but also improves the calculation efficiency.

When the local feature vector fragment is the feature vector fragment after homomorphic encryption, and the target feature vector is the feature vector after homomorphism encryption, the recognition platform will perform the matching between the local feature vector fragment and the target feature vector in the fully homomorphic mode. Homomorphic multiplication operation to obtain the characteristic distance.

Step S203, sending the target feature vector to at least one other identification platform that stores the corresponding other feature vector fragments.

Since the reference feature vector corresponding to each reference biomarker is divided into multiple feature vector segments, the reference biomarker corresponds to at least one other feature vector segment in addition to one local feature vector segment. Vector shards are stored in one of the other recognition platforms. Therefore, the identification platform sends the target feature vector to each other identification platform that stores other feature vector slices corresponding to the reference biomarker.

Step S204: Receive the feature distance between the target feature vector sent by at least one other identification platform and the other stored feature vector fragments.

Specifically, after each other recognition platform receives the target feature vector, it calculates the feature distance between the target feature vector and other saved feature vector slices.

Step S205, based on the obtained multiple characteristic distances, determine the identification result of the biological information to be identified.

In some embodiments, in the scenario of performing biometric identification by one-to-one comparison, the target feature distance between the target feature vector and the reference feature vector corresponding to the matched reference biometric identifier is determined based on the obtained multiple feature distances. If the target feature distance is less than the distance threshold, the identification result of the biometric information to be recognized is determined to be verified; if the target feature distance is greater than or equal to the distance threshold, the identification result of the biometric information to be recognized is determined to be a failed verification.

Specifically, the identification platform performs a homomorphic addition operation on the obtained plurality of feature distances through the feature comparison module to obtain candidate feature distances between the target feature vector and the reference feature vector corresponding to the reference biomarker. Then, the candidate feature distance is decrypted using the homomorphic encryption private key to obtain the target feature distance.

When the target feature distance is less than the distance threshold, it indicates that the similarity between the biological information to be identified and the reference biological information corresponding to the reference biological identifier is greater than the similarity threshold, and further indicates that the biological information to be identified and the reference biological information correspond to the same creature, then it is determined that the biological information to be identified and the reference biological information correspond to the same creature. The identification result of identifying the biometric information is the verification passed.

When the target feature distance is greater than or equal to the distance threshold, it indicates that the similarity between the biological information to be identified and the reference biological information corresponding to the reference biological identifier is less than or equal to the similarity threshold, and further indicates that the biological information to be identified and the reference biological information correspond to different creatures, then It is determined that the identification result of the biological information to be identified is that the verification fails.

The following takes user authentication as an example of a specific implementation scenario. As shown in FIG. 4 , it is assumed that the multi-party secure computing system includes a first terminal, a second terminal, a first identification platform and a second identification platform, wherein the first terminal and the The first identification platform corresponds to the second identification platform, the second terminal corresponds to the second identification platform, and the first terminal is installed with a shopping application. When the user registers in the shopping application, the first terminal collects the reference face image and the user account with the user's permission, and sends the reference face image and the user account to the business system of the first recognition platform. The feature extraction module in the first recognition platform obtains the reference face image from the business system, and performs preprocessing such as denoising, grayscale, face detection, and normalization on the reference face image, and uses the neural network model to compare the reference face image. Feature extraction is performed on the face image to obtain reference feature vectors [v1, v2, v3, ..., v1024]. Divide the reference feature vector into two feature vector slices, namely feature vector slice A[v1, v2, v3,...,v512] and feature vector slice B[v513, v514,...,v1024]. The feature vector fragment A is encrypted and stored in the vector fragment library of the first identification platform, and the user account, the device information of the first identification platform and the device information of the second identification platform are stored in association at the same time.

The feature extraction module in the first recognition platform sends the feature vector fragment B to the second recognition platform, and the second recognition platform encrypts the feature vector fragment B and saves it in the vector fragment library of the second recognition platform, and saves it in association at the same time. User account, device information of the first identification platform, and device information of the second identification platform.

During user verification, the first terminal collects the face image to be recognized and the user account with the permission of the user, and sends the face image to be recognized and the user account to the business system of the first recognition platform. The feature extraction module of the first recognition platform obtains the face image to be recognized from the business system, and performs preprocessing such as denoising, grayscale, face detection, normalization, etc. Feature extraction is performed on the face image to obtain the original feature vector C[c1, c2, c3, ..., c1024]. The feature comparison module of the first identification platform generates an asymmetric homomorphic encryption public-private key pair (he_pub_key, he_pri_key), uses the asymmetric homomorphic encryption public key (he_pub_key) to perform homomorphic encryption on the original feature vector C, and obtains the target feature vector D .

The feature comparison module of the first identification platform obtains the encrypted feature vector fragment A based on the user account, and then decrypts the encrypted feature vector fragment A to obtain the feature vector fragment A in plaintext. Then, use the homomorphic encryption Lib library to calculate the Euclidean distance of the target feature vector D and the feature vector slice A, obtain the first feature distance, and send the first feature distance to the business system of the first recognition platform.

Based on the user account, the first identification platform can also learn that the second identification platform has saved another feature vector fragment, therefore, the target feature vector D is sent to the business system of the second identification platform, and the feature comparison module of the second identification platform is from The target feature vector D is obtained in the business system, and the encrypted feature vector fragment B is obtained based on the user account, and the encrypted feature vector fragment B is decrypted to obtain the feature vector fragment B in plaintext. Then use the homomorphic encryption Lib library to calculate the Euclidean distance of the target feature vector D and the feature vector fragment B to obtain the second feature distance, and send the second feature distance to the business system of the second recognition platform. The business system of the second identification platform sends the second characteristic distance to the business system of the first identification platform.

The business system of the first identification platform performs an addition operation on the first feature distance and the second feature distance based on the homomorphic encryption Lib library to obtain the candidate feature distance. Then, the candidate feature distance is decrypted using the asymmetric homomorphic encryption private key (he_pri_key) to obtain the target feature distance. Since the target feature distance is less than the distance threshold, it is determined that the verification of the face image to be recognized has passed.

It should be noted that the second recognition platform can also collect the face image to be recognized, and use the same method as above to verify the face image to be recognized. When the data encrypted by the first identification platform is involved, the API service interface provided by the first identification platform can be called to perform decryption operation.

In some embodiments, in the scenario of performing biometric information identification by one-to-many comparison, for each reference biomarker in multiple reference biomarkers, based on multiple feature distances associated with the reference biomarker, determine the target feature vector and The target feature distance between the reference feature vectors corresponding to the reference biomarker. Then, from the obtained multiple target feature distances, the minimum feature distance is determined. If the minimum feature distance is less than the distance threshold, it is determined that the identification result of the biological information to be identified is verified as passed. If the minimum feature distance is greater than or equal to the distance threshold, it is determined that the identification result of the biological information to be identified is that the verification fails.

Specifically, for each reference biomarker, multiple feature distances can be obtained. Taking the expansion of a reference biomarker as an example, the obtained feature distances are subjected to a homomorphic addition operation to obtain a candidate feature distance between the target feature vector and the reference feature vector corresponding to the reference biomarker. Then, the candidate feature distance is decrypted using the homomorphic encryption private key to obtain the target feature distance.

After normalizing and sorting multiple target feature distances, the minimum feature distance and the reference biomarker corresponding to the minimum feature distance are obtained. When the minimum feature distance is less than the distance threshold, it indicates that the similarity between the biological information to be identified and the reference biological information corresponding to the reference biological identifier is greater than the similarity threshold, and further indicates that the biological information to be identified and the reference biological information correspond to the same creature, then determine The identification result of the biological information to be identified is the verification passed.

When the minimum feature distance is greater than or equal to the distance threshold, it indicates that the similarity between the biological information to be identified and the reference biological information corresponding to the reference biological identifier is less than or equal to the similarity threshold, and further indicates that the biological information to be identified and the reference biological information correspond to different creatures, Then, it is determined that the identification result of the biological information to be identified is that the verification fails.

The following takes the payment scenario as an example of a specific implementation scenario. As shown in FIG. 5 , it is assumed that the multi-party secure computing system includes a first terminal, a second terminal, a third terminal, a first identification platform, a second identification platform and a third An identification platform, wherein the first terminal corresponds to the first identification platform, the second terminal corresponds to the second identification platform, the third terminal corresponds to the third identification platform, and the first terminal is installed with a payment application.

When the first user registers in the payment application, the first terminal collects the first reference face image and the first user account with the user's permission, and sends the first reference face image and the first user account to the first user. 1. Identify the business system of the platform. The feature extraction module in the first recognition platform obtains the first reference face image from the business system, and performs preprocessing such as denoising, grayscale, face detection, and normalization on the first reference face image, and uses neural The network model performs feature extraction on the first reference face image to obtain a reference feature vector. The first reference feature vector is divided into two feature vector fragments, which are feature vector fragment A and feature vector fragment B respectively. The feature vector fragment A is encrypted and stored in the vector fragment library of the first identification platform, and the first user account, the device information of the first identification platform and the device information of the second identification platform are stored in association at the same time. The first recognition platform sends the feature vector fragment B to the second recognition platform, and the second recognition platform encrypts the feature vector fragment B and saves it in the vector fragment library of the second recognition platform, and stores the first user account, The first identifies the device information of the platform and the second identifies the device information of the platform.

When the second user registers in the payment application, with the permission of the user, the first terminal collects the second reference face image and the second user account, and sends the second reference face image and the second user account to the first terminal 1. Identify the business system of the platform. The feature extraction module in the first recognition platform obtains the second reference face image from the business system, and performs preprocessing such as denoising, grayscale, face detection, and normalization on the second reference face image, and uses neural The network model performs feature extraction on the second reference face image to obtain a second reference feature vector. The second reference feature vector is divided into two feature vector segments, which are the feature vector segment M and the feature vector segment N respectively. The feature vector fragment M is encrypted and stored in the vector fragment library of the first identification platform, and the second user account, the device information of the first identification platform and the device information of the third identification platform are stored in association at the same time. The first recognition platform sends the feature vector fragment N to the third recognition platform, and the third recognition platform encrypts the feature vector fragment N and saves it in the vector fragment library of the third recognition platform, and stores the first user account, The device information of the first identification platform and the device information of the third identification platform are identified.

When the first user makes payment, the first terminal collects the face image to be recognized under the condition of obtaining the user's permission, and sends the face image to be recognized to the business system of the first recognition platform. The feature extraction module of the first recognition platform obtains the face image to be recognized from the business system, and performs preprocessing such as denoising, grayscale, face detection, normalization, etc. Perform feature extraction on the face image to obtain the original feature vector C. The feature comparison module of the first identification platform generates an asymmetric homomorphic encryption public-private key pair (he_pub_key, he_pri_key), uses the asymmetric homomorphic encryption public key (he_pub_key) to perform homomorphic encryption on the original feature vector C, and obtains the target feature vector D .

The first identification platform obtains the feature vector fragment A corresponding to the first user account and the feature vector fragment M corresponding to the second user account from the vector fragment library.

For the feature vector fragment A corresponding to the first user account, the feature comparison module of the first identification platform decrypts the encrypted feature vector fragment A to obtain the feature vector fragment A in plaintext. Then use the homomorphic encryption Lib library to calculate the Euclidean distance of the target feature vector D and the feature vector slice A to obtain the first feature distance.

Based on the first user account, the feature comparison module of the first identification platform can also learn that the second identification platform has saved another feature vector fragment corresponding to the first user account, therefore, the target feature vector D is sent to the second identification platform. business system. The feature comparison module of the second identification platform obtains the target feature vector D from the business system, and at the same time obtains the encrypted feature vector fragment B based on the user account, and then decrypts the encrypted feature vector fragment B to obtain the plaintext. Feature vector slice B. Then use the homomorphic encryption Lib library to calculate the Euclidean distance of the target feature vector D and the feature vector fragment B to obtain the second feature distance, and send the second feature distance to the business system of the second recognition platform. The business system of the second identification platform sends the second characteristic distance to the business system of the first identification platform.

The business system of the first identification platform performs an addition operation on the first feature distance and the second feature distance based on the homomorphic encryption Lib library to obtain the candidate feature distance. Then, the candidate feature distance is decrypted using the asymmetric homomorphic encryption private key (he_pri_key) to obtain the target feature distance X.

For the feature vector fragment M corresponding to the second user account, the feature comparison module of the first identification platform decrypts the encrypted feature vector fragment M to obtain the feature vector fragment M in plaintext. Then use the homomorphic encryption Lib library to calculate the Euclidean distance of the target feature vector D and the feature vector slice M to obtain the third feature distance.

Based on the second user account, the feature comparison module of the first identification platform can also learn that the third identification platform has saved another feature vector fragment corresponding to the second user account, therefore, the target feature vector D is sent to the third identification platform. business system. The feature comparison module of the third identification platform obtains the target feature vector D from the business system, and at the same time obtains the encrypted feature vector slice N based on the second user account, and then decrypts the encrypted feature vector slice N to obtain plaintext Feature vector slices of the form N. Then use the homomorphic encryption Lib library to calculate the Euclidean distance of the target feature vector D and the feature vector slice N, obtain the fourth feature distance, and send the fourth feature distance to the business system of the third recognition platform. The business system of the third identification platform sends the fourth characteristic distance to the business system of the first identification platform.

The business system of the first identification platform performs an addition operation on the third feature distance and the fourth feature distance based on the homomorphic encryption Lib library to obtain the candidate feature distance. Then use the asymmetric homomorphic encryption private key (he_pri_key) to decrypt the candidate feature distance to obtain the target feature distance Y.

Since the target feature distance X is smaller than the target feature distance Y, it is determined whether the target feature distance X is smaller than the distance threshold. If the target feature distance is less than the distance threshold, it is determined that the verification of the face image to be recognized has passed. At this time, the first identification platform performs payment message assembly and payment transaction based on the first user account, bank card and other information. The payment result is then returned to the first terminal, and the first terminal displays the payment result in the payment application.

In the embodiment of the present application, a reference feature vector of reference biological information is divided into multiple feature vector slices, and the multiple feature vector slices are respectively stored in multiple identification backgrounds, so that any identification background needs to use other identification The biometric identification can only be completed by the feature vector shards saved in the platform. Each recognition background cannot restore the entire reference feature vector based on a feature vector shard saved locally, thus ensuring the security of feature vector information storage. Secondly, each identification background calculates the feature distance between the local feature vector fragment and the target feature vector of the biological information to be identified based on the operation method of homomorphic encryption, which realizes the calculation in the ciphertext state and ensures the security of the calculation. In addition, each recognition background independently calculates the feature distance between the local feature vector fragment and the target feature vector, and then aggregates the calculation results into one recognition background, which greatly reduces the number of communication rounds and Therefore, the performance of computing is improved and the consumption of communication resources is reduced.

Based on the same technical concept, an embodiment of the present application provides a schematic structural diagram of a biometric information identification device, which is applied to each identification platform in a secure computing system. As shown in FIG. 6 , the device 600 includes:

The obtaining module 601 includes obtaining the target feature vector of the biological information to be identified, and obtaining the local feature vector fragment corresponding to at least one reference biological identifier from the vector fragment library;

The processing module 602 is used to, for each reference biological identifier, determine the feature distance between the corresponding local feature vector fragment and the target feature vector, and store at least one other identification platform with corresponding other feature vector fragments Send the target feature vector, and receive the feature distance between the target feature vector sent by the at least one other identification platform and the other stored feature vector fragments;

The identification module 603 is configured to determine the identification result of the biological information to be identified based on the obtained multiple characteristic distances.

Optionally, the processing module 602 is further configured to:

Before obtaining the target feature vector of the biological information to be identified, for each reference biological marker, obtain the reference biological information corresponding to the reference biological marker, and perform feature extraction on the reference biological information to obtain the reference feature vector;

dividing the reference feature vector into a plurality of feature vector slices;

One feature vector fragment in the plurality of feature vector fragments is stored as a local feature vector fragment, and at least one other feature vector fragment in the plurality of feature vector fragments is sent to the corresponding other identification. platform to save.

Optionally, the processing module 602 is further configured to:

Acquiring device information of multiple identification platforms for saving the multiple feature vector fragments;

saving the reference biomarker and device information of the plurality of identification platforms;

For each other identification platform, the reference biological identifier and the device information of the multiple identification platforms are sent to the other identification platforms for storage.

Optionally, the plurality of feature vector fragments are in plaintext or after homomorphic encryption, and the target feature vector is in plaintext or after homomorphic encryption.

Optionally, the biological information to be identified corresponds to the target biological identifier;

The obtaining module 601 is specifically used for:

A local feature vector fragment corresponding to a reference biological identifier matching the target biological identifier is obtained from the vector fragment library.

Optionally, the identification module 603 is specifically used for:

Determine the target feature distance between the target feature vector and the reference feature vector corresponding to the one reference biomarker based on the obtained multiple feature distances;

If the target feature distance is less than the distance threshold, it is determined that the identification result of the biological information to be identified is verified as passed;

If the target feature distance is greater than or equal to the distance threshold, it is determined that the identification result of the biological information to be identified is that the verification fails.

Optionally, the identification module 603 is specifically used for:

Homomorphic addition is performed on the obtained multiple feature distances to obtain candidate feature distances between the target feature vector and the reference feature vector corresponding to the one reference biological identifier;

The candidate feature distance is decrypted using a homomorphic encryption private key to obtain the target feature distance.

Optionally, the vector fragment library includes local feature vector fragments corresponding to multiple reference biological identifiers;

Optionally, the obtaining module 601 is specifically used for:

The respective corresponding local feature vector fragments of the multiple reference biological identifiers are acquired from the vector fragment library.

Optionally, the identification module 603 is specifically used for:

For each reference biomarker in the multiple reference biomarkers, determine a target between the target feature vector and the reference feature vector corresponding to the reference biomarker based on multiple feature distances associated with the reference biomarker feature distance;

From the obtained multiple target feature distances, determine the minimum feature distance;

If the minimum characteristic distance is less than the distance threshold, then determine that the identification result of the biological information to be identified is verified as passed;

If the minimum characteristic distance is greater than or equal to the distance threshold, it is determined that the identification result of the biological information to be identified is that the verification fails.

In the embodiment of the present application, a reference feature vector of reference biological information is divided into multiple feature vector slices, and the multiple feature vector slices are respectively stored in multiple identification backgrounds, so that any identification background needs to use other identification The biometric identification can only be completed by the feature vector shards saved in the platform. Each recognition background cannot restore the entire reference feature vector based on a feature vector shard saved locally, thus ensuring the security of feature vector information storage. Secondly, each identification background calculates the feature distance between the local feature vector fragment and the target feature vector of the biological information to be identified based on the operation method of homomorphic encryption, which realizes the calculation in the ciphertext state and ensures the security of the calculation. In addition, each recognition background independently calculates the feature distance between the local feature vector fragment and the target feature vector, and then aggregates the calculation results into a single recognition background, which greatly reduces the number of communication rounds and Therefore, the performance of computing is improved and the consumption of communication resources is reduced.

Based on the same technical concept, an embodiment of the present application provides a computer device. The computer device may be the identification platform shown in FIG. 1 , as shown in FIG. 7 , and includes at least one processor 701 and is connected to at least one processor. The specific connection medium between the processor 701 and the memory 702 is not limited in this embodiment of the present application. In FIG. 7 , the connection between the processor 701 and the memory 702 is taken as an example through a bus. The bus can be divided into address bus, data bus, control bus and so on.

In this embodiment of the present application, the memory 702 stores instructions that can be executed by at least one processor 701 , and the at least one processor 701 can execute the steps of the above-mentioned biometric information identification method by executing the instructions stored in the memory 702 .

Among them, the processor 701 is the control center of the computer equipment, and can use various interfaces and lines to connect various parts of the computer equipment, by running or executing the instructions stored in the memory 702 and calling the data stored in the memory 702, so as to realize biological Information identification. Optionally, the processor 701 may include one or more processing units, and the processor 701 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, application programs, etc., and the modem The modulation processor mainly handles wireless communication. It can be understood that, the above-mentioned modulation and demodulation processor may also not be integrated into the processor 701 . In some embodiments, the processor 701 and the memory 702 may be implemented on the same chip, and in some embodiments, they may be implemented separately on separate chips.

The processor 701 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application specific integrated circuit (ASIC), a field programmable gate array or other programmable logic devices, discrete gates or transistors Logic devices and discrete hardware components can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. A general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the methods disclosed in conjunction with the embodiments of the present application may be directly embodied as executed by a hardware processor, or executed by a combination of hardware and software modules in the processor.

As a non-volatile computer-readable storage medium, the memory 702 can be used to store non-volatile software programs, non-volatile computer-executable programs and modules. The memory 702 may include at least one type of storage medium, for example, may include a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a Programmable Read Only Memory (PROM), Read Only Memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Magnetic Memory, Disk, CD and so on. Memory 702 is, but is not limited to, any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer device. The memory 702 in this embodiment of the present application may also be a circuit or any other device capable of implementing a storage function, for storing program instructions and/or data.

Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program that can be executed by a computer device, and when the program runs on the computer device, causes the computer device to execute the steps of the above-mentioned biometric information identification method .

As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, or as a computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block in the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer device or other programmable data processing device produce Means for implementing the functions specified in a flow or flow of a flowchart and/or a block or blocks of a block diagram.

The computer program instructions may also be stored in a computer readable memory capable of directing a computer apparatus or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory result in an article of manufacture comprising instruction means, the The instruction means implement the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

These computer program instructions may also be loaded on a computer device or other programmable data processing device, such that a series of operational steps are performed on the computer device or other programmable device to produce a computer device implemented process, thereby executing the computer device or other programmable device. The instructions executing on the device provide steps for implementing the functions specified in the flow or blocks of the flowcharts and/or the blocks or blocks of the block diagrams.

Although preferred embodiments of the present invention have been described, additional changes and modifications to these embodiments may occur to those skilled in the art once the basic inventive concepts are known. Therefore, the appended claims are intended to be construed to include the preferred embodiment and all changes and modifications that fall within the scope of the present invention.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit and scope of the invention. Thus, provided that these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims (12)

1. A biological information identification method applied to each identification platform in a secure computing system is characterized by comprising the following steps:

acquiring a target characteristic vector of biological information to be identified, and acquiring a local characteristic vector fragment corresponding to at least one reference biological identifier from a vector fragment library;

for each reference biological identifier, determining a characteristic distance between a corresponding local characteristic vector fragment and the target characteristic vector, sending the target characteristic vector to at least one other recognition platform storing corresponding other characteristic vector fragments, and receiving the characteristic distance between the target characteristic vector sent by the at least one other recognition platform and the stored other characteristic vector fragments;

and determining the identification result of the biological information to be identified based on the obtained plurality of characteristic distances.

2. The method of claim 1, wherein before obtaining the target feature vector of the biometric information to be identified, the method further comprises:

acquiring reference biological information corresponding to each reference biological identifier, and performing feature extraction on the reference biological information to acquire a reference feature vector;

dividing the reference feature vector into a plurality of feature vector slices;

and taking one of the feature vector fragments as a local feature vector fragment for storage, and respectively sending at least one other feature vector fragment of the feature vector fragments to other corresponding identification platforms for storage.

3. The method of claim 2, further comprising:

acquiring equipment information of a plurality of identification platforms for storing the plurality of feature vector fragments;

saving the reference biometric identifier and device information for the plurality of recognition platforms;

and for each other recognition platform, sending the reference biological identification and the device information of the plurality of recognition platforms to the other recognition platforms for storage.

4. The method of claim 2, wherein the plurality of feature vector tiles are in plaintext form or homomorphically encrypted feature vector tiles, and the target feature vector is in plaintext form or homomorphically encrypted feature vector.

5. The method of claim 2, wherein the biometric information to be recognized corresponds to a target biometric identifier;

the obtaining of local feature vector patches corresponding to at least one reference biometric identifier from a vector patch library includes:

and acquiring a local feature vector fragment corresponding to a reference biological identifier matched with the target biological identifier from the vector fragment library.

6. The method of claim 5, wherein the determining the recognition result of the biometric information to be recognized based on the obtained plurality of feature distances comprises:

determining a target feature distance between the target feature vector and a reference feature vector corresponding to the one reference biometric identifier based on the obtained plurality of feature distances;

if the target characteristic distance is smaller than a distance threshold, determining that the identification result of the biological information to be identified is passed through verification;

and if the target characteristic distance is greater than or equal to the distance threshold, determining that the identification result of the biological information to be identified is not verified.

7. The method of claim 6, wherein the determining the target feature distance between the target feature vector and the reference feature vector corresponding to the one reference biometric identifier based on the obtained plurality of feature distances comprises:

performing homomorphic addition operation on the obtained multiple characteristic distances to obtain candidate characteristic distances between the target characteristic vector and a reference characteristic vector corresponding to the reference biological identifier;

and decrypting the candidate characteristic distance by adopting a homomorphic encryption private key to obtain the target characteristic distance.

8. The method of claim 1, wherein the vector shard library includes local feature vector shards corresponding to respective ones of a plurality of reference biometric identifiers;

the obtaining of local feature vector patches corresponding to at least one reference biometric identifier from a vector patch library includes:

and obtaining local feature vector fragments corresponding to the plurality of reference biological identifiers from the vector fragment library.

9. The method of claim 8, wherein the determining the recognition result of the biometric information to be recognized based on the obtained plurality of feature distances comprises:

for each of the plurality of reference biometrics, determining a target feature distance between the target feature vector and a reference feature vector corresponding to the reference biometrics, based on a plurality of feature distances associated with the reference biometrics;

determining a minimum feature distance from the obtained plurality of target feature distances;

if the minimum characteristic distance is smaller than a distance threshold, determining that the identification result of the biological information to be identified is passed through verification;

and if the minimum characteristic distance is larger than or equal to the distance threshold, determining that the identification result of the biological information to be identified is not verified.

10. A biometric information recognition apparatus for use in each recognition platform of a secure computing system, comprising:

the acquisition module comprises a target characteristic vector for acquiring biological information to be identified and a local characteristic vector fragment corresponding to at least one reference biological identifier from a vector fragment library;

the processing module is used for determining a characteristic distance between the corresponding local characteristic vector fragment and the target characteristic vector for each reference biological identifier, sending the target characteristic vector to at least one other recognition platform storing corresponding other characteristic vector fragments, and receiving the characteristic distance between the target characteristic vector sent by the at least one other recognition platform and the stored other characteristic vector fragments;

and the identification module is used for determining the identification result of the biological information to be identified based on the obtained characteristic distances.

11. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the steps of the method of any one of claims 1 to 9 are performed when the program is executed by the processor.

12. A computer-readable storage medium, having stored thereon a computer program executable by a computer device, for causing the computer device to perform the steps of the method of any one of claims 1 to 9, when the program is run on the computer device.

Images