CN112651007B

CN112651007B - Threshold predicate encryption biological characteristic authentication method based on digital watermark

Info

Publication number: CN112651007B
Application number: CN202011634886.7A
Authority: CN
Inventors: 胡红爽; 吴永东; 翁健; 魏凯敏; 罗伟其; 张继连
Original assignee: Jinan University
Current assignee: Jinan University
Priority date: 2020-12-31
Filing date: 2020-12-31
Publication date: 2023-05-23
Anticipated expiration: 2040-12-31
Also published as: CN112651007A

Abstract

A digital watermark-based threshold predicate encryption biological feature authentication method disclosed by the present invention includes the following steps: acquiring the user's biological feature, generating a reference template for each user's biological feature and storing it in the server; the user initiates an authentication request; After receiving the authentication request, the terminal will send a challenge to the user; after receiving the challenge, the client will collect a new biometric sample of the client, and obtain a biometric vector, and after embedding the watermark information, obtain a challenge template and send it to the server; The server receives the challenge template, calculates the signal of the detection vector in each segment, judges whether the watermark information is correct, and obtains the authentication result of the first step according to the judgment result of the watermark information; calculates the total correlation value, according to the total correlation value and the first The final authentication result can be obtained through the step authentication result; this application can prevent the system from being cheated and attacked, and the calculation is simple and efficient, which can make the biometric authentication work safe and efficient.

Description

Threshold predicate encryption biological characteristic authentication method based on digital watermark

Technical Field

The invention relates to the field of research of biological feature authentication, in particular to a threshold predicate encryption biological feature authentication method based on digital watermarking.

Background

The biological characteristic template has the advantages of irreversibility and cancelability. Where irreversibility refers to irreversible conversion of a biometric template to a corresponding biometric, and cancelability refers to the ability to update, undo, and reconstruct a single template. Once these advantages are compromised, however, an attacker can reconstruct the biometric vector from the compromised template, sometimes even obtaining the original biometric sample. The attacker can then use the resulting biometric template to launch replay attacks or provide a spoofed sample/template to spoof the authentication server, with a consequent reduction in the security of the biometric authentication system. Although european authorities have promulgated a series of legal regulations to standardize the application of biometric identification techniques in other fields such as finance in order to ensure the privacy and data security of all citizens, the security of biometric templates still faces serious challenges.

Disclosure of Invention

The invention aims to overcome the defects and shortcomings of the prior art and provide a threshold predicate encryption biological characteristic authentication method based on digital watermarking. However, when an attacker sends a random template or a query template obtained by eavesdropping to the server, the server can be deceived, and random attack, replay attack and collusion attack can be launched on the server, and the success rate is high. Therefore, in order to secure the biometric authentication system, its resistance to the impersonation attack must be improved.

The aim of the invention is achieved by the following technical scheme:

a threshold predicate encryption biometric authentication method based on digital watermarking, as shown in figure 1, comprises the following steps:

acquiring biological characteristics of users through a client, generating a reference template for the biological characteristics of each user, and storing the reference template in a server;

a user initiates an authentication request to a server through a client;

the server receives the authentication request of the client and sends a challenge to the user;

after the client receives the challenge, a new biological characteristic sample of the client is collected, a biological characteristic vector is obtained, and the biological characteristic vector of the challenge is obtained through watermark information embedding operation, so that a challenge template is obtained

And sending the data to a server;

the server receives the inquiry template, carries out signal calculation of detection vectors in each segment, judges whether watermark information is correct, and obtains a first-step authentication result according to the judgment result of the watermark information; and calculating the total correlation value, and obtaining a final authentication result according to the total correlation value and the authentication result of the first step.

Further, the method includes the steps of obtaining the biological characteristics of the users through the client, generating a reference template for the biological characteristics of each user, and storing the reference template in the server, and specifically includes the following steps:

s101, acquiring system parameters;

wherein the system parameters param are as follows:

param＝{n,θ}，

wherein n represents the number of elements in the feature vector, and θ is a threshold;

s102, the client generates a private key sk for the user,

generating a private random arrangement function pi for each biometric fragment of the user, and if q elements are contained in the biometric fragment, generating two (q+3) x (q+3) random matrices M ₁ and M₂ And then generates a private key sk:

sk＝{M ₁ ,M ₂ ,n,π}，

s103, the user registers the biometric template vector x and the private key sk at the client to generate a reference template C _x ；

S104, generating a reference template C _x Stored in the server.

Further, the reference template C _x The code is needed to be obtained by the code, and the code is specifically as follows:

the client registers its biometric as a reference template C on the server using the private key sk _x ，

If q elements are contained in the first biometric fragment, then a q+3-dimensional vector is created:

where beta is a random positive number,

also random numbers;

construction of a diagonal matrix diag (X) ₁ )＝π ₁ (x′ ₁), wherein π₁ (x′ ₁ ) Representing the displacement vector x' ₁ The position of the medium element;

constructing a (q+3) × (q+3) lower triangular matrix

The diagonal elements of the matrix are all 1;

obtaining a reference template of a first fragment in a biometric template of a user:

wherein ,M₁ and M₂ In the form of a random matrix,

is a triangular matrix;

finally, connecting the reference templates of all fragments to obtain a finished reference template C _x 。

Further, the user initiates an authentication request to the server through the client, specifically: and the user initiates an authentication request to the server through the client by using the identity ID.

Further, the server receives the authentication request of the client and sends a challenge to the user, which specifically includes the following steps:

s301, after receiving an authentication request of a user, a server reads a reference template of the user

S302, the server randomly selects one and a reference template

Nonsingular matrix R with same dimension _i The operation is carried out with the above-mentioned formula to obtain the challenge->

S303, let u= { U ₁ ,U ₂ ,…,U _p And (3) sending the information to the client.

Further, the watermark information embedding operation, namely watermark encryption is performed on the biometric vector, specifically as follows:

if the biological feature vector y is divided into p segments, two vectors m= { m are randomly selected ₁ ,m ₂ ,…,m _p} and {θ₁ ,θ ₂ ,…,θ _p And the two vectors satisfy the following relationship:

wherein q represents the number of elements in the ith fragment, θ ₁ ,θ ₂ ,…θ _p Is a value interval of [0,1 ]]And satisfy θ ₁ +θ ₂ +…+θ _p Relation of =θ, m ₁ ,m ₂ ,…,m _p Is a random number and satisfies m ₁ +m ₂ +…+m _p A relation of =0;

constructing a bipolar vector w= { w ₁ ,w ₂ ,…,w _q The following are noted:

wherein Sign (·) represents a Sign function with a value of 1 or-1, m _i Random number, θ, representing the ith fragment _i A threshold value representing the ith fragment;

then calculating h=hash (w) using a one-way Hash function;

selecting p random numbers ry ₁ ,ry ₂ ,…,ry _p And a random positive number alpha, while w is given to _i And y is _i The combination produces a new vector:

y′ _i ＝α(y _i ,m _i +θ _i ,0,r _yi ),i＝1,2,…,p，

wherein ,y_i The expression of the i-th fragment of the biological feature,

a random number representing the ith biometric fragment, α being a randomly generated positive number.

Further, the challenged biometric vector is specifically as follows:

for any one y 'of y' _i Constructing a diagonal matrix Y _i Wherein diag (Y) _i )＝π _i (y′ _i )；

Selecting a lower triangular matrix S of (q+3) x (q+3) _yi And the diagonal element of the matrix is 1;

constructing sub-challenge biometric templates as:

wherein

and

Is extracted from the key sk;

the final challenge biometric template is obtained as follows:

wherein ,

the challenge biological characteristic template of the ith segment is represented, and after the challenge biological characteristic templates of p segments are spliced, the complete challenge biological characteristic template T is obtained _y 。

Further, the method also comprises the step of feature decoding, wherein the feature decoding is specifically as follows:

by calculating a matrix C _x and T_y Constructing a detection matrix v, then:

wherein ,C_xi Representing the ith fragment in the reference template.

Further, the signal calculation of the detection vector in each segment is carried out, whether watermark information is correct or not is judged, and a first authentication result is obtained according to the judgment result of the watermark information; calculating a total correlation value, and obtaining a final authentication result according to the total correlation value and the authentication result of the first step, wherein the final authentication result is specifically as follows:

the client receives the challenge template V and performs the following calculations:

wherein ,R_i The server randomly selects a nonsingular square matrix, U _i The challenge is sent to the user for the service end;

calculating a watermark signal of the detection vector v; if w is empty, authentication fails; otherwise, h=hash (w); the calculation process is as follows:

whether watermark information is correct or not is judged by calculating signals of detection vectors in each segment, and the calculation process is as follows:

for any one element v in the detection vector v _i Calculating the signals of the elements:

wherein ,v_i Is the correlation value of the ith biological feature fragment.

If h is equal to Hash (w), the output watermark is the signal w, otherwise, the output watermark is null;

finally, the server calculates v' =v ₁ +v ₂ +…+c _p As a total correlation value; if v' < 0, the user fails to authenticate the same; otherwise, the watermark is considered to be correctly extracted, and the user authentication is successful.

Compared with the prior art, the invention has the following advantages and beneficial effects:

1. the authentication watermark is randomly generated, the watermark is embedded into each inquiry biological characteristic section according to the bit, the randomness of the watermark ensures that the watermark cannot be copied intentionally, and the safety of the system is improved;

2. compared with the common watermarking technology, the watermarking encryption method based on the one-way hash function is high in calculation efficiency, the result is unique, once an attacker falsifies or counterfeits to inquire the biological characteristic information, the biological characteristic information can be identified at the first time, and the success rate of simulating the attack is greatly reduced;

3. in the method, the watermark is used as a shared key for generating the key between the user and the server, so that the key cannot be easily cracked.

Drawings

Fig. 1 is a flowchart of a threshold predicate encryption biometric authentication method based on digital watermarking.

Detailed Description

The present invention will be described in further detail with reference to examples and drawings, but embodiments of the present invention are not limited thereto.

Examples:

a user initiates an authentication request to a server through a client;

And sending the data to a server;

The method comprises the following steps:

the predicate encryption algorithm based on the digital watermark comprises the following specific steps:

step 1: parameter setting

Generating a system parameter param = { n, θ }, where n represents the number of elements in the feature vector and θ is a threshold, which is dependent on the application.

Step 2: key generation

The client generates a private key sk for Alice. The private key is a randomly generated multidimensional parameter matrix, and the number of elements of the fragment to be encrypted determines the dimension of the matrix. The system will generate its private random permutation function pi for each biometric fragment of Alice. If the biometric fragment contains q elements, the system will generate two (q+3) x (q+3) random matrices M ₁ and M₂ The final generated key is:

sk＝{M ₁ ,M ₂ ,n,π}

step 3: code encoding

In this step, the client uses asThe private key sk generated by Alice registers its biological characteristics as a reference template C on the server _x 。

where beta is a random positive number,

also random numbers.

Build a diagonal matrix diag (X) ₁ )＝π ₁ (x′ ₁), wherein π₁ (x′ ₁ ) Representing the displacement vector x' ₁ The position of the element in (c).

Constructing a lower triangular matrix of (q+3) × (q+3)

The diagonal elements of the matrix are all 1.

Obtaining a reference template for the first fragment in Alice's biometric template:

finally, the reference templates of all fragments are connected to obtain the completed reference template C _x 。

Step 4: embedding watermark information

In this step, after Alice obtains her biometric vector y and private key sk, in order to ensure the security of y, watermark encryption is performed on it, and the process is as follows:

if the biometric vector y can be divided into p segments, then two vectors m= { m are randomly chosen ₁ ,m ₂ ,…,m _p} and {θ₁ ,θ ₂ ,…,θ _p And the two vectors satisfy the following relationship:

where q represents the number of elements in the ith fragment.

Build a bipolar vector w= { w ₁ ,w ₂ ,…,w _q The following are noted:

h=hash (w) is then calculated using a one-way Hash function.

Select p random numbers ry ₁ ,ry ₂ ,…,ry _p And a random positive number alpha, while w is given to _i And y is _i Combining to generate a new vector

Step 5: generating biometric vectors of challenges

In this step, a biometric vector T of the challenge will be generated _y The process is as follows:

any one y 'of the pair y' _i Constructing a diagonal matrix Y _i Wherein diag (Y) _i )＝π _i (y′ _i )。

Selecting a lower triangular matrix of (q+3) × (q+3)

And the diagonal element of the matrix is 1.

Constructing the sub-templates as

wherein

and

Is derived from the extraction of the key sk,

the final template is

Step 6: feature decoding

In this step, the matrix C is calculated _x and T_y To construct a detection matrix v

Step 7: watermark extraction

The step judges whether the watermark information is correct by calculating the signal of the detection vector in each segment, and the calculation process is as follows:

for any one element v in the detection vector v _i Calculate its signal

If h is equal to Hash (w), the output watermark is the signal w, otherwise the output watermark is null.

On the basis of the algorithm, the authentication method capable of realizing the biological characteristics comprises the following steps:

step 1: preparation link

The step generates a reference template for the biological characteristics of each user and stores the reference template in a service end of the system, and the process is as follows:

as shown in algorithm steps 1,2, first the parameters param= { n, θ } and the key sk corresponding to each user of the system are obtained

To obtain the response of the server, alice will register its biometric template vector x and key sk at the client to generate a reference template C _x 。

Generated reference template C _x Will be stored in the server.

Step 2: initializing links

In this step. Alice sends her identity ID to the server, initiating an authentication request.

Step 3: challenge link

After receiving the request of the user, the server sends a challenge U to the user, and the process is as follows:

after receiving the ID of the user, the server reads Alice's reference template C _x 。

The server randomly selects one and

nonsingular matrix R with same dimension _i Performing operation to obtain new matrix ∈>

Let u= { U ₁ ,U ₂ ,…,U _p And (3) sending the information to the client.

Step 4: response link

In this step, after receiving the challenge U, the client acquires a new feature sample of Alice, and obtains a feature vector y. Then obtaining the biological characteristic vector T of the inquiry after a series of operations such as embedding watermark information _y . The client calculates all

And sends it to the server together with the hash value h.

Step 5: authentication link

referring to algorithm 7, a watermark signal of the detection vector v is calculated. If w is empty, authentication fails. Otherwise, h=hash (w).

Finally, the server calculates v' =v ₁ +v ₂ +…+c _p As a total correlation value. If v' < 0, the user fails to authenticate as well. Otherwise, consider the watermark to beCorrectly extracted, and the user authentication is successful.

The above examples are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above examples, and any other changes, modifications, substitutions, combinations, and simplifications that do not depart from the spirit and principle of the present invention should be made in the equivalent manner, and the embodiments are included in the protection scope of the present invention.

Claims

1. A threshold predicate encryption biometric authentication method based on digital watermark, characterized by comprising the following steps:

The user's biometric features are obtained through the client, a reference template is generated for each user's biometric features, and stored on the server;

The user initiates an authentication request to the server through the client;

The server receives the authentication request from the client and sends a challenge to the user;

After receiving the challenge, the client will collect a new biometric sample of the client and obtain a biometric vector. After embedding the watermark information, the biometric vector of the challenge is obtained, and then the challenge template is obtained and sent to the server.

The operation of embedding watermark information, i.e. encrypting the biometric feature vector with a watermark, is as follows:

If the biometric vector y is divided into p segments, two vectors m = {m ₁ ,m ₂ ,…,m _p } and {θ ₁ ,θ ₂ ,…,θ _p } are randomly selected, and the two vectors satisfy the following relationship:

Wherein, q represents the number of elements in the i-th segment, θ ₁ ,θ ₂ ,…θ _p are random numbers with a value interval of [0,1] and satisfy the relationship θ ₁ +θ ₂ +…+θ _p ＝θ, m ₁ ,m ₂ ,…, _mp are random numbers and satisfy the relationship m ₁ +m ₂ +…+ _mp ＝0;

Construct a bipolar vector w = {w ₁ ,w ₂ ,…,w _q } as follows:

Wherein, Sign(·) represents a sign function with a value of 1 or -1, _mi represents the random number of the i-th segment, and _θi represents the threshold of the i-th segment;

Then use the one-way hash function to calculate h = Hash (w);

Select p random numbers ry ₁ ,ry ₂ ,…,ry _p and a random positive number α, and combine _wi with _yi to generate a new vector:

Where _yi represents the i-th biometric feature fragment,

represents the random number of the i-th biometric feature segment, α is a randomly generated positive number;

The server receives the challenge template, calculates the signal of the detection vector in each fragment, determines whether the watermark information is correct, and obtains the first step authentication result based on the judgment result of the watermark information; calculates the total correlation value, and obtains the final authentication result based on the total correlation value and the first step authentication result.

2. According to claim 1, a threshold predicate encryption biometric authentication method based on digital watermark is characterized in that the biometrics of the user are obtained through the client, a reference template is generated for each user's biometrics, and stored in the server, specifically comprising the following steps:

S101, obtaining system parameters;

The system parameters param are as follows:

param＝{n,θ}，

Where n represents the number of elements in the feature vector, and θ is the threshold;

S102, the client generates a private key sk for the user,

Generate a private random permutation function π for each biometric segment of the user. If the biometric segment contains q elements, generate two (q+3)×(q+3) random matrices _M1 and _M2 , and then generate the private key sk:

sk＝{M ₁ ,M ₂ ,n,π}，

S103, the user registers his/her biometric template vector x and private key sk on the client to generate a reference template C _x ;

S104: Store the generated reference template C _x in the server.

3. According to the digital watermark-based threshold predicate encryption biometric authentication method of claim 2, it is characterized in that the reference template _Cx needs to be obtained by password encoding, specifically as follows:

The client uses the private key sk to register its biometrics as a reference template _Cx on the server.

If the first biometric segment contains q elements, create a q+3-dimensional vector:

Among them, β is a random positive number,

It is also a random number;

Construct a diagonal matrix diag(X ₁ )=π ₁ (x ₁ ′), where π ₁ (x ₁ ′) represents the position of the elements in the permutation vector x ₁ ′;

Construct a (q+3)×(q+3) lower triangular matrix S _x1 whose diagonal elements are all 1;

Get the reference template of the first segment in the user's biometric template:

Among them, _M1 and _M2 are random matrices,

is a lower triangular matrix;

Finally, the reference templates of all segments are connected to obtain the completed reference template C _x .

4. According to the threshold predicate encryption biometric authentication method based on digital watermarking in claim 1, it is characterized in that the user initiates an authentication request to the server through the client, specifically: the user uses the identity ID to initiate an authentication request to the server through the client.

5. According to claim 1, a threshold predicate encryption biometric authentication method based on digital watermark is characterized in that the server receives the authentication request from the client and sends a challenge to the user, specifically comprising the following steps:

S301: After receiving the user's authentication request, the server reads the user's reference template

S302: The server randomly selects a template that matches the reference template.

The non-singular square matrix R _i of the same dimension is operated with it to obtain a new matrix

S303: Send U={U ₁ ,U ₂ ,…,U _p } to the client.

6. The method of biometric authentication based on threshold predicate encryption using digital watermark according to claim 1, wherein the biometric vector of the challenge is as follows:

For any y _i ′ of y ′, construct a diagonal matrix _Yi , where diag(Y _i )＝π _i (y _i ′);

Select a (q+3)×(q+3) lower triangular matrix

And the diagonal elements of the matrix are 1;

The constructor challenge biometric template is:

in,

and

is extracted from the key sk;

The final challenge biometric template is:

in,

It represents the challenge biometric template of the ith segment. After the challenge biometric templates of p segments are concatenated, a complete challenge biometric template _Ty is obtained.

7. According to claim 6, a threshold predicate encrypted biometric authentication method based on digital watermark, characterized in that it also includes a feature decoding step, and the feature decoding is specifically as follows:

By calculating the traces of matrices C _x and _Ty , we construct a detection matrix v, and we have:

Where C _xi represents the i-th segment in the reference template.

8. According to claim 7, a threshold predicate encrypted biometric authentication method based on digital watermark is characterized in that the signal calculation of the detection vector in each segment is performed to determine whether the watermark information is correct, and the first authentication result is obtained according to the judgment result of the watermark information; the total correlation value is calculated, and the final authentication result is obtained according to the total correlation value and the first authentication result, which is specifically:

The server receives the challenge template V and performs the following calculations:

Among them, R _i is a non-singular matrix randomly selected by the server, and U _i is the challenge sent by the server to the user;

Calculate the watermark signal of the detection vector v; if w is empty, the authentication fails; otherwise, h = Hash (w); the calculation process is as follows:

The watermark information is judged to be correct by calculating the signal of the detection vector in each segment. The calculation process is as follows:

For any element _vi in the detection vector v, calculate the signal of its element:

Where, _vi is the correlation value of the i-th biometric feature segment;

If h is equal to Hash(w), the output watermark is the signal w, otherwise the output watermark is empty;

Finally, the server will calculate v′=v ₁ +v ₂ +…+ _cp as the total correlation value; if v′<0, the user authentication also fails; otherwise, it is considered that the watermark is correctly extracted and the user authentication succeeds.