CN1822013A - Fingerprint biometric identification engine system and identification method based on trusted platform module - Google Patents

Abstract

The invention relates to a fingerprint biological identification engine system and a method based on a trusted platform module, wherein a TPM chip in the system is internally provided with a functional module and a chip operating system, and further comprises a fingerprint sensor, a fingerprint acquisition and fingerprint processing module borne by a computer mainboard, a nonvolatile memory and a fingerprint comparison module arranged in the TPM chip of the trusted platform module, wherein the fingerprint sensor is connected with the nonvolatile memory through the fingerprint acquisition module, the fingerprint processing module and the fingerprint comparison module in sequence. The fingerprint biological identification engine system and the identification method thereof have higher system safety and reliability, and lay a foundation for the development of computer safety biological authentication technology.

Description

Fingerprint biometric identification engine system and identification method based on trusted platform module

technical field

The invention relates to the technical field of computer biometric identification, in particular to the technical field of computer fingerprint biometric identification, in particular to a fingerprint biometric identification engine system based on a trusted platform module and an identification method thereof.

Background technique

In the middle of the 19th century, humans began to study fingerprints in a scientific sense, and came to two important conclusions: no two fingerprints have the same shape of the lines; the shape of the fingerprint lines remains unchanged throughout life. Fingerprint identification technology is currently internationally recognized as the most widely used, cheapest, and most easy-to-use biometric authentication technology. Compared with other identity authentication technologies, automatic fingerprint identification has many unique information security advantages as follows:

(1) The fingerprint of each person is quite fixed and will not change with the growth of the person's age or the change of the health level, but there is a possibility of great changes in the voice and face of the person.

(2) Fingerprint samples are easy to obtain, easy to develop an identification system, and have strong practicability.

(3) The ten fingerprints of a person are all different, so multiple passwords can be easily formed by using multiple fingerprints, and the security of the system can be improved.

(4) The template used in fingerprint identification is the key feature extracted from the fingerprint image, so the storage capacity is small, which can greatly reduce the burden of network transmission and facilitate authentication.

TPM (Trusted Platform Module, Trusted Platform Module), it is currently the best technology in the world that can not only improve the security of PC, but also improve its ease of use. TPM is actually a small system-on-a-chip containing cryptographic computing components and storage components, which fundamentally solves the security problem of the underlying hardware facilities. The leading idea of the TPM chip is based on the concept of trusted computing, based on different underlying authentication of user identity, application environment, network environment, etc., to completely prevent malicious theft of information and virus infringement.

The core function of TPM technology is to encrypt the data flow processed by the CPU and monitor the status of the bottom layer of the system at the same time. On this basis, security applications for unique identification, system login encryption, folder encryption, and network communication encryption can be developed. It can generate encrypted keys, as well as key storage and identity verification. High-speed data encryption and restoration, as an auxiliary processor to protect BIOS and OS from modification, build a trusted computing architecture that crosses platforms and software and hardware systems through the combination of TSS and TPM. Even if the user's hard drive is stolen, it will not cause data leakage.

Please refer to Figure 1 for the security architecture of the trusted computing terminal system platform.

The TPM chip is a SOC (System-on-Chip) chip, which integrates CPU core, RAM, ROM, Flash, encryption algorithm coprocessor, random number generator and other modules. The SOC system and supporting application software are mainly used for Complete computer platform reliability certification, user identity certification, digital signature and other functions. Trusted computing usually includes the following three attributes and functions:

(1) Ensure the uniqueness of the user's identity, the integrity and privacy of the user's workspace;

(2) Ensure the integrity of hardware environment configuration, OS kernel, services and applications;

(3) Ensure the confidentiality/integrity of information stored, processed, and transmitted.

Not only that, in terms of biometric technology to achieve secure access to computers, most fingerprint technologies are currently implemented at the operating system and application levels. Hidden dangers of attacks; when it comes to the computer hardware layer, it only realizes the safe storage of fingerprint data, that is, the fingerprint data is safely stored in the BIOS or TPM hardware chip, and the processing and comparison of fingerprints are done by adding a fingerprint sensor on the computer motherboard. The microprocessor and the auxiliary chip with the microprocessor are completed, and the biometric technology is realized to realize the safe boot access to the computer.

Separate storage and processing of fingerprint collection, processing and comparison from fingerprint data has potential safety hazards. At least the fingerprint identification code for comparison and fingerprint comparison processing need to be stored in the same SOC chip to achieve internal fingerprint recognition. factor security; and just realizing the authentication of computer power-on security is not enough for the security of the entire computer at all levels.

The following is a comparison table of advantages and disadvantages with and without TPM chips: User authentication without TPM User authentication with TPM Only the user number and password are easy to be cracked Complete trusted authentication for user login, excluding the possibility of cracking Multiple login user numbers and passwords can easily lead to carelessness of users, and the storage of user numbers and passwords is not safe Login verification information is stored in the TPM chip, strong security protection The user ID and password are stored in a copyable file; the entire system can be accessed through the user ID and password The storage and protection of user ID and password are done by TPM Platform verification without TPM Platform verification with TPM Unauthorized access and malicious damage can easily change system settings and data Can prevent unauthorized access; various security algorithm modules verify system settings Changes in system settings allow unauthorized and malicious access to networks and sensitive data The system settings verified by TPM ensure the integrity of the system and prevent illegal access Bad habits lead to unreliable systems Reliable system with reduced support and maintenance costs

At the same time, in order to achieve a deeper level of computer security, we must start from the TPM. At present, for the TPM chip, it only stays in the secure encrypted storage of fingerprint data, that is, the fingerprint feature information is stored in the TPM or encrypted in the TPM. Externally, this only manages and stores fingerprint data information as important information, and does not really play the significance of fingerprint identification itself.

Contents of the invention

The purpose of the present invention is to overcome the above-mentioned shortcomings in the prior art, to provide a combination of trusted computing and biometric authentication and identification technology of the computer system security chip, which can improve and enhance the computer system from hardware, operating system and basic platform Comprehensive security down to the application layer. At least the pre-stored fingerprint identification code is stored in the TPM chip, and the fingerprint comparison is completed inside the TPM chip, which has high operating efficiency, strong system stability, and a wide range of applications. The trusted platform module-based fingerprint biometric engine system and its identification method.

In order to achieve the above-mentioned purpose, the fingerprint biometric engine system and its identification method based on the trusted platform module of the present invention are as follows:

The fingerprint biometric engine system based on the trusted platform module includes the computer motherboard and the basic input and output system BIOS carried on the motherboard and connected to each other through the system bus, the trusted platform module TPM chip, the central processing unit, the random access memory and other Computer hardware, described trusted platform module TPM chip has built-in function module and chip operating system, its main feature is that described engine system also includes fingerprint sensor, the fingerprint acquisition module and the fingerprint processing module carried on the computer motherboard , non-volatile memory, trusted platform module TPM chip built-in fingerprint comparison module, the output end of the fingerprint sensor is connected with the input end of the fingerprint collection module, the output end of the fingerprint collection module is connected with the fingerprint processing The input ends of the modules are connected, the output ends of the fingerprint processing module are connected with the input ends of the fingerprint comparison module, and the fingerprint comparison module is connected with the non-volatile memory.

The fingerprint acquisition module and the fingerprint processing module of the fingerprint biometric engine system based on the trusted platform module can be built in the trusted platform module TPM chip, and between the fingerprint acquisition module and the fingerprint processing module, between the fingerprint processing module and the The fingerprint comparison modules are all connected, and the non-volatile memory is a non-volatile memory in the trusted platform module TPM chip, and the fingerprint comparison module and the trusted platform module TPM chip connected to the non-volatile memory in the

The fingerprint acquisition module and the fingerprint processing module of the fingerprint biometric engine system based on the trusted platform module are placed in the basic input and output system BIOS carried by the computer motherboard, and the fingerprint acquisition module is connected with the fingerprint processing module, and the fingerprint processing The module is connected with the fingerprint comparison module through the system bus, and the non-volatile memory is an encrypted storage area in the basic input and output system BIOS, and the fingerprint comparison module is connected with the fingerprint comparison module in the basic input and output system BIOS through the system bus. The encrypted storage area is connected.

The fingerprint collection module and the fingerprint processing module of the fingerprint biometric engine system based on the trusted platform module can also be placed in the embedded SOC chip with the on-chip central processing unit carried by the computer motherboard or without the on-chip central processing unit. The processor has a chip with non-volatile storage space, and the fingerprint collection module is connected with the fingerprint processing module, and the fingerprint processing module is connected with the fingerprint comparison module through the system bus, and the non-volatile memory is embedded The non-volatile memory in the SOC chip or the non-volatile memory in the chip that does not have on-chip central processing unit, described fingerprint comparison module communicates with the non-volatile memory in the embedded SOC chip through the system bus or to non-volatile memory in chips that do not have an on-chip CPU.

The non-volatile memory of the fingerprint biometric engine system based on the trusted platform module is flash memory Flash, electrically erasable programmable read-only memory EEPROM, erasable programmable read-only memory EPROM, programmable read-only memory PROM or Other magnetic and electrical storage media that can continue to retain data in the event of a power failure.

The fingerprint sensor of the fingerprint biometric engine system based on the trusted platform module can be embedded in the motherboard, keyboard, mouse or casing surface of the computer, or be connected with the computer as an independent device through a data line; the fingerprint sensor can be An optical fingerprint sensor, a semiconductor fingerprint sensor or an ultrasonic fingerprint sensor, etc. The semiconductor fingerprint sensor may be a silicon capacitive fingerprint sensor, a semiconductor pressure-sensitive fingerprint sensor, or a semiconductor temperature-sensitive fingerprint sensor.

The method for using the above-mentioned engine system to carry out fingerprint biometric identification is characterized in that the method includes the following steps:

(1) The system performs initialization settings;

(2) The fingerprint collection module collects the original image information of the fingerprint by the fingerprint sensor, and transmits the information to the fingerprint processing module;

(3) The fingerprint processing module extracts fingerprint feature information and generates an identification code according to the original image information;

(4) The fingerprint processing module judges whether the initial fingerprint registration setting operation is performed, and the identification code is sent to the fingerprint comparison module;

(5) If the initial fingerprint registration setting operation is performed, the fingerprint comparison module directly stores the identification code as the fingerprint identification code in the non-volatile memory;

(6) Otherwise, extract the pre-stored fingerprint identification code from the non-volatile memory in the built-in function module of the trusted platform module TPM chip, and compare the identification code with the pre-stored fingerprint identification code , and return the comparison result;

(7) The system performs subsequent processing according to the comparison result.

The original image information of the fingerprint biometric identification method is digital fingerprint image information.

According to the method of fingerprint biometric identification, the operation process of extracting fingerprint feature information and generating identification code according to the original image information includes the following steps:

(1) The fingerprint processing module extracts fingerprint feature information from the original image information according to a specific fingerprint algorithm;

(2) The fingerprint processing module encodes and classifies the above-mentioned fingerprint feature information, and generates identification codes.

The judgment of the method for performing fingerprint biometric identification is to perform the initial fingerprint registration setting operation as follows:

Determine whether the fingerprint identification code is stored in the non-volatile memory in the built-in function module of the trusted platform module TPM chip, if not, then return the result of performing the initial fingerprint registration setting operation; if yes, then return the result of performing the initial fingerprint registration register the result of the set operation;

Or: judging whether the identification value set by the system is an initial fingerprint registration setting operation.

The fingerprint biometric engine system and its identification method based on the trusted platform module of the invention are adopted. Since the fingerprint biometric engine system is formed on the computer motherboard based on the TPM security chip, it is compatible with the pre-existing system under the security environment in the TPM chip. The fingerprints in the TPM chip are compared to achieve fingerprint comparison authentication, and even the collection, processing and comparison of fingerprints can be completed in the TPM chip, so as to obtain higher system security and reliability; at the same time, fingerprint pre-stored data Compared with the TPM, the strong two-factor security authentication is realized; not only that, the fingerprint biometric engine system can receive authentication requests from any other system hardware layer, operating system and basic platform layer, and security application layer, and will The authentication result is returned, thereby realizing secure fingerprint biometric authentication, ensuring the integrity and privacy of users and information, ensuring the integrity of system hardware, OS kernel, services and applications, and can be applied to boot fingerprint security identity authentication, operation System fingerprint security authentication and application layer fingerprint security authentication and other fields not only have high operating efficiency, but also have strong system stability and a wide range of applications, laying a solid foundation for the further development of computer security authentication technology.

Description of drawings

FIG. 1 is a security architecture diagram of a trusted computing terminal system platform in the prior art.

FIG. 2 is a system architecture diagram of the trusted platform module TPM security chip of the present invention.

FIG. 3 is a schematic diagram of the system architecture of the first embodiment of the trusted platform module-based fingerprint biometric engine system of the present invention.

FIG. 4 is a schematic diagram of the system architecture of the second embodiment of the trusted platform module-based fingerprint biometric engine system of the present invention.

FIG. 5 is a schematic diagram of the installation position of the fingerprint sensor applied in the desktop computer according to the present invention.

FIG. 6 is a schematic diagram of the installation position of the fingerprint sensor applied in the notebook computer according to the present invention.

Detailed ways

In order to further illustrate the technology, method and functional effect that the present invention adopts to achieve the predetermined purpose, please refer to the following detailed description and accompanying drawings of the present invention. It is believed that the purpose, characteristics and characteristics of the present invention can be deeply and specifically understood. , however, the accompanying drawings are for reference and illustration only, and are not intended to limit the present invention.

Please refer to FIG. 2 , which is a block diagram of a TPM chip on a computer motherboard. Generally, the TPM chip has a central processing unit (CPU), an asymmetric cryptographic coprocessor (RSA), a true random number generator (RNG), a storage module (RAM), a non-volatile storage (Non-VblatiIe Storage) and a security Protection, management and interface modules, etc., thus constitute a complete TPM chip.

The TPM chip forms a system security certification system through the TPM chip operating system and built-in functional modules. In terms of identity authentication, the TPM chip has a storage area that can store certificates, and usually uses the certificates stored in the chip and various encryption algorithms to complete security authentication.

For further technical details of the security chip, please refer to the patent document "A Security Chip and Information Security Processing Device and Method Based on the Chip" (patent application number: 03138380.7).

Please refer to Fig. 3 again, which is the first embodiment of the engine system of the present invention, wherein the fingerprint acquisition module and the fingerprint processing module of the fingerprint biometric engine system based on the trusted platform module are all built in the trusted platform module. In the platform module TPM chip, the fingerprint collection module, fingerprint processing module and fingerprint comparison module together form the fingerprint biometric engine in the TPM chip, and between the fingerprint collection module and the fingerprint processing module, the fingerprint processing module and the fingerprint comparison module The non-volatile memory is a non-volatile memory in the trusted platform module TPM chip, and the fingerprint comparison module is connected with the non-volatile memory in the trusted platform module TPM chip. The volatile memory is connected.

At this time, the hardware resources of the TPM chip can complete fingerprint collection and processing operations. Its computing power completely depends on the on-chip CPU, and its memory uses the on-chip RAM.

Referring to Fig. 4 again, it is the second embodiment of the engine system of the present invention, wherein the fingerprint biometric engine system based on the trusted platform module includes the computer main board and the main board, which are carried on the main board and connected to each other through the system bus. Basic input and output system BIOS, trusted platform module TPM chip, central processing unit, random access memory, described trusted platform module TPM chip has built-in function module and chip operating system, wherein, described engine system also includes fingerprint The fingerprint acquisition module and fingerprint processing module carried by the sensor, the computer motherboard, the non-volatile memory, the fingerprint comparison module built into the TPM chip of the trusted platform module, and the fingerprint comparison module forms the fingerprint biometric engine in the TPM chip; The fingerprint collection module and the fingerprint processing module are placed in the basic input and output system BIOS carried by the computer motherboard, and the fingerprint collection module is connected with the fingerprint processing module, and the fingerprint processing module is connected with the fingerprint comparison module through the system bus; The output end of the fingerprint sensor is connected with the input end of the fingerprint collection module, the output end of the fingerprint collection module is connected with the input end of the fingerprint processing module, and the output end of the fingerprint processing module is compared with the fingerprint The input end of the module is connected, and the non-volatile memory is an encrypted storage area in the BIOS of the basic input and output system, and the fingerprint comparison module is connected with the encrypted storage area in the BIOS of the basic input and output system through the system bus. connect.

The TPM chip hardware resources at this moment can't finish fingerprint acquisition and processing operation, but must utilize existing chip or increase chip on the motherboard, in this embodiment, utilize existing BIOS and the encrypted storage area in BIOS to realize, its operation The power depends on the central processing unit on the motherboard, and the memory is the random access memory RAM on the motherboard.

Not only that, similar to the above-mentioned second embodiment, the following third type of the engine system of the present invention can also be used:

Example:

Wherein the fingerprint biometric engine system based on the trusted platform module includes the computer motherboard and the basic input and output system BIOS carried on the motherboard and connected to each other through the system bus, the trusted platform module TPM chip, the central processing unit, the random access memory, The trusted platform module TPM chip has a built-in functional module and a chip operating system, wherein the engine system also includes a fingerprint sensor, a fingerprint acquisition module and a fingerprint processing module carried on the computer motherboard, and a non-volatile memory 1. The fingerprint comparison module built in the trusted platform module TPM chip, the fingerprint comparison module forms the fingerprint biometric engine in the TPM chip; In the chip of the central processing unit but with non-volatile storage space, and the fingerprint collection module is connected with the fingerprint processing module, and the fingerprint processing module is connected with the fingerprint comparison module through the system bus; the output terminal of the fingerprint sensor Be connected with the input end of fingerprint acquisition module, the output end of fingerprint acquisition module is connected with the input end of described fingerprint processing module, the output end of fingerprint processing module is connected with the input end of described fingerprint comparison module, so The non-volatile memory described above is an encrypted storage area in a chip that does not have an on-chip central processing unit but has a non-volatile storage space carried by a computer motherboard, and the fingerprint comparison module communicates with the chip through a system bus Connect to encrypted storage in .

Now TPM chip hardware resource can't finish fingerprint collection and processing operation, but must utilize the existing chip on the motherboard or increase chip, is to utilize the embedded SOC chip on the motherboard to realize in this embodiment, and its computing ability depends on The central processing unit on the motherboard, and the memory is the random access memory RAM on the motherboard.

Similar to the second embodiment above, the following fourth embodiment of the engine system of the present invention can also be used:

Among them, the fingerprint biometric engine system based on the trusted platform module includes the computer motherboard and the basic input and output system BIOS carried on the motherboard and connected to each other through the system bus, the trusted platform module TPM chip, the central processing unit, and the random access memory RAM , the trusted platform module TPM chip has a built-in function module and a chip operating system, wherein the engine system also includes a fingerprint sensor, a fingerprint acquisition module and a fingerprint processing module carried on the computer motherboard, a non-volatile The built-in fingerprint comparison module of memory, trusted platform module TPM chip, this fingerprint comparison module has formed the fingerprint biometric engine in the TPM chip; In the embedded SOC chip of the central processing unit in the chip, and the fingerprint collection module is connected with the fingerprint processing module, and the fingerprint processing module is connected with the fingerprint comparison module through the system bus; the output end of the fingerprint sensor is connected with the fingerprint collection module The input end is connected, the output end of the fingerprint collection module is connected with the input end of the fingerprint processing module, the output end of the fingerprint processing module is connected with the input end of the fingerprint comparison module, and the nonvolatile The permanent memory is an encrypted nonvolatile memory in the embedded SOC chip, and the fingerprint comparison module is connected with the encrypted nonvolatile memory in the embedded SOC chip through a system bus.

Now TPM chip hardware resource can't finish fingerprint collection and processing operation, but must utilize the existing chip on the motherboard or increase chip, is to utilize the embedded SOC chip on the motherboard to realize in this embodiment, and its computing ability depends on The central processing unit in the embedded SOC chip, and the memory is the random access memory RAM in the embedded SOC chip.

At the same time, the non-volatile memory of the fingerprint biometric engine system based on the trusted platform module is flash memory Flash, electrically erasable programmable read-only memory EEPROM, erasable programmable read-only memory EPROM, programmable read-only memory PROM or other magnetic and electrical storage media that can continue to retain data in the event of power failure. For detailed technical information of the magnetic memory unit, please refer to the US patent document "Thin Film Magnetic Core Memory And Method Of Making Same", patent number: 5126971, published on June 30, 1992.

In the middle of practical application, the present invention is to increase fingerprint biological authentication engine in TPM security chip, and connect a fingerprint sensor, this fingerprint sensor passes the fingerprint image that gathers to TPM through basic input and output system (I/O) of computer The fingerprint biometric authentication engine fingerprint collection module, the digital fingerprint image collected by the fingerprint collection module is sent to the fingerprint processing module, and the fingerprint feature value is extracted by the fingerprint processing module, and encoded as a fingerprint identification code.

The fingerprint comparison module compares the fingerprint identification code with the pre-stored fingerprint identification code in the TPM chip to complete identity authentication.

The present invention mainly provides the on-chip fingerprint biometric authentication technology and implementation method of the secure computer hardware TPM chip, and its key is to add a biometric engine module in the TPM chip, which is pre-stored in the TPM chip in the safe environment of the TPM chip. Fingerprint identification codes are compared to realize fingerprint comparison authentication.

Due to the complexity of fingerprint collection and processing, the hardware resources in the TPM chip are not enough to complete complex processing operations. In the first embodiment above, the fingerprint collection and processing are placed in other embedded SOC chips on the motherboard to complete , process the fingerprint image imported by the fingerprint sensor into data containing fingerprint feature information, and store it safely in the TPM chip or compare it with the pre-stored fingerprint information in the TPM chip; and in the second embodiment above, when the TPM When the hardware resources in the chip are able to handle the collection and processing of fingerprints, the collection, processing and comparison of fingerprints are all completed in the TPM chip.

The pre-stored data and comparison of fingerprints have not crossed the TPM, realizing strong two-factor security authentication. The fingerprint biometric engine in the TPM receives authentication requests from any other system hardware layer, operating system and basic platform layer, and security application layer, and returns the authentication results to realize secure fingerprint biometric authentication, ensure the integrity and privacy of users and information, and ensure Security and integrity of system hardware, OS kernel, services and applications.

Referring again to Fig. 5 and Fig. 6, the fingerprint sensor 1 of the fingerprint biometric engine system based on the trusted platform module of the present invention can be embedded in the keyboard of the desktop computer, the mouse or the casing surface of the notebook computer according to the situation, or As an independent device, it is connected with a computer through a data communication connection line, and the TPM chip 2 is embedded on the main board of the desktop computer or the main board of the notebook computer.

At the same time, the fingerprint sensor 1 can be an optical fingerprint sensor, a semiconductor fingerprint sensor, an ultrasonic fingerprint sensor or other sensors capable of obtaining fingerprint image data through induction, and the semiconductor fingerprint sensor is a silicon capacitive fingerprint sensor, a semiconductor pressure-sensitive fingerprint sensor Or a semiconductor temperature-sensing fingerprint sensor.

In actual use, the fingerprint sensor 1 can use various types of fingerprint sensors. At present, there are mainly three types of fingerprint sensors, namely: optical, semiconductor, and ultrasonic fingerprint sensors. Among them, the semiconductor fingerprint sensor is divided into: silicon capacitive, semiconductor pressure sensitive, semiconductor temperature sensor and other sensors. With the development of technology, new types of sensors will continue to be introduced. In the present invention, fingerprint collection can use various sensors that obtain fingerprint image data by induction to obtain fingerprint image information; meanwhile, the position where fingerprint sensor 1 is placed on the computer: the keyboard , mouse, casing, and various independent fingerprint sensors connected to the computer through data communication cables.

The method for using the above-mentioned engine system of the present invention to carry out fingerprint biometrics includes the following steps:

(1) The system performs initialization settings;

(2) The fingerprint collection module collects the original image information of the fingerprint by the fingerprint sensor, and transmits the information to the fingerprint processing module, and the original image information is digital fingerprint image information;

(3) The fingerprint processing module extracts fingerprint feature information and generates an identification code according to the original image information. The operation process includes the following steps:

(a) The fingerprint processing module extracts fingerprint feature information from the original image information according to a specific fingerprint algorithm;

(b) The fingerprint processing module encodes and classifies the above-mentioned fingerprint feature information, and generates identification codes;

(4) The fingerprint processing module judges whether it is an initial fingerprint registration setting operation, and sends the identification code to the fingerprint comparison module. The judgment can be:

Determine whether the fingerprint identification code is stored in the non-volatile memory in the built-in function module of the trusted platform module TPM chip, if not, then return the result of performing the initial fingerprint registration setting operation; if yes, then return the result of performing the initial fingerprint registration register the result of the set operation;

It can also be: judging whether the identification value set by the system is an initial fingerprint registration setting operation;

(5) If the initial fingerprint registration setting operation is performed, the fingerprint comparison module directly stores the identification code as the fingerprint identification code in the non-volatile memory in the built-in function module of the trusted platform module TPM chip;

(6) Otherwise, the fingerprint comparison module extracts the pre-stored fingerprint identification code from the non-volatile memory in the built-in function module of the trusted platform module TPM chip, and compares the described pre-stored fingerprint identification code with the fingerprint identification code Perform a comparison and return the comparison result;

(7) The system performs subsequent processing according to the comparison result.

In actual use, the technical problem to be solved by the present invention lies in the method of realizing the fingerprint biometric engine module in the computer TPM chip, that is, completing the fingerprint algorithm, the collection and processing of fingerprints, and the comparison and authentication of fingerprints in the TPM chip, so as to achieve All fingerprint processing will never go out of the TPM chip. As a basic biometric authentication function module of a trusted computer, it is provided from the computer system security hardware layer, security operating system and basic platform layer, and security application layer.

Therefore, the computer needs to be connected to a fingerprint collection device, that is, various types of fingerprint sensors. When the computer needs fingerprint image information, it collects live fingerprint information and transmits the collected live fingerprint information to the fingerprint biometric authentication engine inside the TPM. The fingerprint biometric authentication engine calculates and processes the incoming raw living fingerprint information through the fingerprint algorithm, stores it in the TPM storage area or makes an authentication result, and returns it to the device and program that calls the fingerprint biometric authentication engine.

The above authentication process includes the following steps:

(1) Fingerprint collection

The original image of the fingerprint is collected through various fingerprint collection sensors, and the original image information is non-simulated digital fingerprint image information. Then send it to the fingerprint processing module. Fingerprint collection includes interfaces with various fingerprint sensors, fingerprint image collection and judgment, etc.

(2) Fingerprint processing

The fingerprint processing module extracts the fingerprint characteristic information according to the fingerprint algorithm, encodes and classifies the fingerprint characteristic information, and encodes it into an identification code.

For the technical details of the fingerprint algorithm, please refer to the patent document "Fingerprint Identification Method" (patent application number: 03142267.5).

(3) Fingerprint comparison

Compare the collected fingerprint identification code of the user with the fingerprint identification code pre-stored in the TPM chip.

The fingerprint comparison program is pre-stored in the non-volatile memory of the TPM chip.

The above-mentioned fingerprint biometric engine system based on the trusted platform module and its identification method have been adopted, since the fingerprint biometric engine system is formed on the computer motherboard based on the TPM security chip, and the TPM is pre-existed in the safe environment of the TPM chip. The fingerprints in the chip are compared to achieve fingerprint comparison authentication, and even the collection, processing and comparison of fingerprints can be completed in the TPM chip, so as to obtain higher system security and reliability; at the same time, fingerprint pre-stored identification Code and fingerprint comparison has not crossed the TPM, to achieve a strong two-factor security authentication; not only that, the fingerprint biometric engine system can receive any other system hardware layer, operating system and basic platform layer, security application layer authentication request, And return the authentication result, thus realizing secure fingerprint biometric authentication, ensuring the integrity and privacy of users and information, ensuring the integrity of system hardware, OS kernel, services and applications, and can be applied to boot fingerprint security identity authentication , operating system fingerprint security authentication and application layer fingerprint security authentication and other fields, not only has high operating efficiency, but also has strong system stability and a wide range of applications, laying a solid foundation for the further development of computer security authentication technology.

In this specification, the invention has been described with reference to specific embodiments thereof. However, it is obvious that various modifications and changes can be made without departing from the spirit and scope of the invention. Accordingly, the specification and drawings are to be regarded as illustrative rather than restrictive.

Claims (12)

1, a kind of fingerprint bio-identification automotive engine system based on credible platform module, comprise and carrying on computer motherboard and the mainboard and by the interconnective basic input-output system BIOS of system bus, credible platform module TPM chip, central processing unit, random access storage device and other computer hardware, have build-in function module and chip operating system in the described credible platform module TPM chip, it is characterized in that, described automotive engine system also comprises fingerprint sensor, finger print acquisition module that is carried on the computer motherboard and Fingerprint Processing Module, nonvolatile memory, the fingerprint comparison module of credible platform module TPM built-in chip type, the output terminal of described fingerprint sensor is connected with the input end of finger print acquisition module, the output terminal of finger print acquisition module is connected with the input end of described Fingerprint Processing Module, the output terminal of Fingerprint Processing Module is connected with the input end of described fingerprint comparison module, and described fingerprint comparison module is connected with described nonvolatile memory.

2, the fingerprint bio-identification automotive engine system based on credible platform module according to claim 1, it is characterized in that, described finger print acquisition module, Fingerprint Processing Module all are built in the described credible platform module TPM chip, and between finger print acquisition module and the Fingerprint Processing Module, all be connected between Fingerprint Processing Module and the fingerprint comparison module, described nonvolatile memory is the nonvolatile memory in the credible platform module TPM chip, and described fingerprint comparison module is connected with nonvolatile memory in the described credible platform module TPM chip.

3, fingerprint bio-identification automotive engine system based on credible platform module according to claim 1, it is characterized in that, described finger print acquisition module and Fingerprint Processing Module place in the basic input-output system BIOS that described computer motherboard carries, and finger print acquisition module is connected with Fingerprint Processing Module, Fingerprint Processing Module is connected with the fingerprint comparison module by system bus, described nonvolatile memory is the encryption memory block in the basic input-output system BIOS, and described fingerprint comparison module is connected with encryption memory block in this basic input-output system BIOS by system bus.

4, fingerprint bio-identification automotive engine system based on credible platform module according to claim 1, it is characterized in that, described finger print acquisition module and Fingerprint Processing Module also place in the embedded SOC chip with central processing unit in the sheet that described computer motherboard carries or do not have central processing unit in the sheet and have in the chip of nonvolatile storage space, and finger print acquisition module is connected with Fingerprint Processing Module, Fingerprint Processing Module is connected with the fingerprint comparison module by system bus, described nonvolatile memory is the nonvolatile memory in nonvolatile memory in the embedded SOC chip or the chip that does not have central processing unit in the sheet, and described fingerprint comparison module is connected by the nonvolatile memory in the embedded SOC chip of system bus and this or is connected with nonvolatile memory in the chip that does not have central processing unit in the sheet.

5, according to each described fingerprint bio-identification automotive engine system in the claim 1 to 4, it is characterized in that described fingerprint comparison module all is built in the TPM chip based on credible platform module.

6, according to each described fingerprint bio-identification automotive engine system in the claim 1 to 4 based on credible platform module, it is characterized in that described nonvolatile memory is flash memory Flash, EEPROM (Electrically Erasable Programmable Read Only Memo) EEPROM, Erarable Programmable Read only Memory EPROM, programmable read only memory PROM or other the magnetic that can continue retention data under powering-off state, electric storage medium.

7, according to each described fingerprint bio-identification automotive engine system in the claim 1 to 4 based on credible platform module, it is characterized in that, described fingerprint sensor is flush-mounted in mainboard, keyboard, mouse or the casing surface of computing machine, perhaps is connected with computing machine by the data communication connecting line as autonomous device; Described fingerprint sensor is that optical fingerprint sensor, semiconductor fingerprint sensor, ultrasound wave fingerprint sensor or other can obtain the sensor of fingerprint image data by induction, and described semiconductor fingerprint sensor is silicon capacitance fingerprint sensor, semiconductor pressure-sensitive fingerprint sensor or conductor temperature induction fingerprint sensor.

8, a kind of method of using the described automotive engine system of claim 1 to carry out the fingerprint bio-identification is characterized in that described method may further comprise the steps:

(1) system carries out the initialization setting;

(2) finger print acquisition module is gathered the original image information of fingerprint by fingerprint sensor, and this information is sent to Fingerprint Processing Module;

(3) Fingerprint Processing Module is according to take the fingerprint characteristic information and generate the operational processes of identification code of this original image information;

(4) Fingerprint Processing Module judges whether it is to carry out initial fingerprint registration setting operation, and this identification code is sent to the fingerprint comparison module;

(5) if carry out initial fingerprint registration setting operation, then the fingerprint comparison module directly is stored in described identification code in the nonvolatile memory in the TPM chip as the identification of fingerprint sign indicating number;

(6) otherwise, then extract the identification of fingerprint sign indicating number that prestores in the nonvolatile memory in the credible platform module TPM chip, and described identification code and this identification of fingerprint sign indicating number that prestores compared, and comparison result is returned;

(7) system carries out subsequent treatment according to this comparison result.

9, method of carrying out the fingerprint bio-identification according to claim 8 is characterized in that, described original image information is the digital finger-print image information.

10, according to Claim 8 or 9 described methods of carrying out the fingerprint bio-identification, it is characterized in that the described operational processes that takes the fingerprint characteristic information and generate identification code according to this original image information may further comprise the steps:

(1) Fingerprint Processing Module extracts fingerprint characteristic information according to specific fingerprint algorithm from original image information;

(2) Fingerprint Processing Module is encoded to above-mentioned fingerprint characteristic information and is sorted out, and the knowledge sign indicating number is debated in generation.

11, according to Claim 8 or 9 described methods of carrying out the fingerprint bio-identification, it is characterized in that described judging whether is to carry out initial fingerprint registration setting operation to be:

Judge in the nonvolatile memory of credible platform module TPM chip whether be pre-stored with the identification of fingerprint sign indicating number, if not, then returning is the result who carries out initial fingerprint registration setting operation; If then returning is the result who carries out initial fingerprint registration setting operation;

Perhaps be: whether the ident value of judging system's setting is to carry out initial fingerprint registration setting operation.

12, method of carrying out the fingerprint bio-identification according to claim 8 is characterized in that, the described identification of fingerprint sign indicating number that prestores is all deposited in the nonvolatile memory of TPM chip internal.

Images