CN105550562B - A kind of information management system and method based on iris recognition identification certification - Google Patents

Abstract

The invention discloses an information management system and method based on iris recognition identity authentication. The system includes: an iris information collection and registration module, which is used to collect user iris feature information, register the user's basic identity information, and The iris feature information and basic identity information uploaded to the iris data server; the iris data server is used to summarize and store the iris feature information and basic identity information of each user, and establish a unified and shared user profile database; the iris identity authentication module is used to The iris feature information collected on-site by the user to be authenticated is compared with the iris feature information stored in the iris data server, the identity of the user to be authenticated is verified, and he is authorized to log in to each business subsystem. The invention performs identity authentication based on the iris recognition technology, has high recognition rate, good security, simple and convenient operation, can effectively improve business efficiency, and realize safe and reliable exchange of data.

Description

An information management system and method based on iris recognition identity authentication

technical field

The invention relates to the field of information technology, in particular to an information management system and method based on iris recognition identity authentication.

Background technique

In some units with high requirements for identity authentication, such as confidential military industrial units and key state agencies, their office platform is often a very large and rigorous information system, which requires strong identity authentication technology to support it. At present, most units use traditional one-card, user name and password authentication or digital certificate technology for identity authentication and authority management in different occasions, which is very cumbersome and inconvenient for users; and once these authentication carriers are lost or stolen, it will It poses a serious security threat to users and organizations.

Contents of the invention

The purpose of the present invention is to provide an information management system and method based on iris recognition identity authentication, which solves the technical problems of the existing information management system identity authentication and authority management which are cumbersome and inconvenient, and have high potential safety hazards.

To achieve the above object, the present invention adopts the following technical solutions:

An information management system based on iris recognition authentication, including:

The iris information collection and registration module is used to collect the user's iris feature information, register the user's basic identity information, and upload the user's iris feature information and basic identity information to the iris data server;

The iris data server is used to summarize and store the iris feature information and basic identity information of each user, establish a unified and shared user profile database, and provide the user's iris feature information and basic identity information to the iris identity authentication module;

The iris identity authentication module is used to compare the iris feature information collected on-site by the user to be authenticated with the iris feature information stored in the iris data server, verify the identity of the user to be authenticated, and authorize it to log in to each business sub system.

Preferably, the basic identity information includes the user's name, gender, unit, department, position and registration image, the registration image includes the user's face information, the registration image is encrypted using the Base64 algorithm, and the encryption is not changed periodically. key.

Preferably, the iris feature information stored in the iris data server includes user binocular iris feature information, and the iris feature information is encrypted using a key negotiated between the iris data server and each service subsystem, and the key is not changed periodically. key.

Preferably, the iris authentication module includes:

The system management sub-module is used for system user management, system user role management, system user authority management and system user authentication management;

The user management sub-module is used for user management, user attribute management and user authority management;

Authorization management sub-module for role management, task management, resource management and operation management;

The authentication and authorization sub-module is used for iris recognition authentication, fingerprint recognition authentication and password authentication;

The data management sub-module is used for log storage management, log query management, log export management and log sharing management;

The system management submodule, the user management submodule, the authorization management submodule, the authentication authorization submodule, and the data management submodule are all connected to the iris data server.

Preferably, the business subsystem includes:

The computer and network security login subsystem is used for identity authentication when logging in to the office information system network and confidential computers; the employee access and attendance statistics subsystem is used for personnel identity authentication when access control is in and out, as well as identification logs. Employee attendance statistics;

Secret-related carrier circulation management subsystem, which is responsible for confirming the identity of the operator when lending and returning secret-related carriers;

The safe management subsystem of the safe is used to control the authority of the operator on the safe;

The document borrowing subsystem is used to confirm the identity of the operator for the lending and returning of confidential documents;

The document output management subsystem is used for operator authority authentication when performing document output tasks such as printing and copying.

Preferably, the information management system includes multiple iris information collection and registration modules, and the multiple iris information collection and registration modules simultaneously collect iris characteristic information of multiple users in parallel.

Preferably, the communication channel in the information management system is an encrypted transmission channel using a VPN private network.

An information management method based on iris recognition identity authentication, comprising the following steps:

The iris information collection and registration module collects the user's iris feature information, and registers the user's basic identity information;

The iris information collection and registration module uploads the user's iris feature information and basic identity information to the iris data server;

The iris data server summarizes and stores iris feature information and basic identity information of each user, and establishes a unified shared user data database;

When the user to be authenticated logs into each service subsystem, the iris identity authentication module uses its own iris collection device to collect the iris characteristic information of the user to be authenticated on the spot, and store the iris characteristic information collected on the spot with the iris data server And compare the iris feature information provided, if the two are consistent, the verification is passed, and the iris identity authentication module authorizes the user to log in to each business subsystem.

Preferably, the key used by the iris data server to store the iris feature information and the basic identity information is the same as the key used by the iris data server to transmit the iris feature information and the basic identity information The keys are not the same.

Preferably, when the user to be authenticated logs in to a different service subsystem, the iris data server negotiates with the different service subsystems to encrypt the iris characteristic information using different keys.

The present invention has the following beneficial effects:

Iris recognition technology is currently the most advanced biometric technology, which has the advantages of high recognition rate, good reliability, difficult to forge, high security, and its non-contact is also easy to be accepted by users. The information management system provided by the present invention uses iris characteristic information for identity authentication, which can fundamentally eliminate potential safety hazards caused by the loss of one-card, passwords, and digital certificates, and is simpler and more convenient for users without carrying any carrier. Completing identity authentication can effectively improve business efficiency, realize safe and reliable exchange of data between departments, realize all-round security monitoring, and form an overall joint office system supported by biological intelligence informatization.

Description of drawings

The specific implementation manners of the present invention will be further described in detail below in conjunction with the accompanying drawings.

FIG. 1 is a schematic diagram of an information management system provided by an embodiment of the present invention;

Fig. 2 is the schematic diagram of iris identity authentication module in the embodiment of the present invention;

Fig. 3 is a flowchart of an information management method provided by an embodiment of the present invention.

Detailed ways

In order to illustrate the present invention more clearly, the present invention will be further described below in conjunction with preferred embodiments and accompanying drawings. Similar parts in the figures are denoted by the same reference numerals. Those skilled in the art should understand that the content specifically described below is illustrative rather than restrictive, and should not limit the protection scope of the present invention.

The present invention at first provides a kind of information management system based on iris recognition authentication, as shown in Figure 1, described information management system comprises:

The iris information collection and registration module 1 is used to collect the user's iris feature information, register the user's basic identity information, and upload the user's iris feature information and basic identity information to the iris data server 2;

The iris data server 2 is used to summarize and store the iris characteristic information and basic identity information of each user, establish a unified and shared user profile database, perform database management, and provide the user's iris characteristic information and basic identity information to the iris identity authentication module 3 ;

The iris identity authentication module 3 is used to compare the iris feature information collected on-site by the user to be authenticated with the iris feature information stored in the iris data server 2, verify the identity of the user to be authenticated, and authorize it to log in to each business sub-service after the verification is passed. System 4.

Iris recognition technology is currently the most advanced biometric technology, which has the advantages of high recognition rate, good reliability, difficult to forge, high security, and its non-contact is also easy to be accepted by users.

The information management system provided by the present invention uses iris characteristic information for identity authentication, which can fundamentally eliminate potential safety hazards caused by the loss of one-card, passwords, and digital certificates, and is simpler and more convenient for users without carrying any carrier. Complete identity authentication and truly achieve "knowing who I am at a glance", thereby effectively improving business efficiency, realizing safe and reliable exchange of data between departments, realizing all-round security monitoring, and forming an overall joint office system supported by biological intelligence informatization .

Preferably, the iris information collection and registration module 1 includes a portable iris collection device and corresponding computer equipment, so as to realize the collection and recording of user iris feature information.

In the present invention, the basic identity information includes personal information such as the user's name, gender, unit, department, position, and a registered image, and the registered image includes the user's face information, and the registered image is encrypted using the Base64 algorithm. The key is not changed regularly to improve the security of data storage.

The user information database here can adopt database modes such as SQL Server and Oracle. The iris feature information stored in the iris data server 2 includes the user's binocular iris feature information, and the iris feature information utilizes the key negotiated between the iris data server 2 and each service subsystem 4 to encrypt, and the key is not regularly changed to improve Security of data storage.

Further, as shown in Figure 2, the iris identity verification module 3 includes:

The system management sub-module 31 is used for system user management, system user role management, system user authority management and system user authentication management;

User management sub-module 32, used for user management, user attribute management and user authority management;

Authorization management sub-module 33, used for role management, task management, resource management and operation management;

Authentication and authorization sub-module 34, used for iris recognition authentication, fingerprint recognition authentication and password authentication;

The data management sub-module 35 is used for log storage management, log query management, log export management and log sharing management;

Wherein, the system management submodule 31, the user management submodule 32, the authorization management submodule 33, the authentication authorization submodule 34, and the data management submodule 35 are all connected with the iris data server 2, according to the user data stored in the iris data server 2 Perform corresponding authentication and authorization operations.

Further, referring to Fig. 1, the business subsystem 4 includes:

The computer and network security login subsystem is responsible for the identity authentication of the office information system network and confidential computer login;

The employee access and attendance statistics subsystem is used for personnel identity authentication when access control is in and out, and employee attendance statistics based on identification logs;

Secret-related carrier circulation management subsystem, which is responsible for confirming the identity of the operator when lending and returning secret-related carriers;

The safe management subsystem of the safe is used to control the authority of the operator on the safe;

The document borrowing subsystem is used to confirm the identity of the operator for the lending and returning of confidential documents;

The document output management subsystem is used for operator authority authentication when performing document output tasks such as printing and copying.

Taking the office system as an example, the relevant internal departments of the unit can use the iris feature information in the shared user profile database as an identifier to identify the user's identity, thereby effectively improving the user experience and improving the operational efficiency of the intelligent department.

It can be understood that the business subsystem 4 is not limited to the subsystems listed above, and may also include subsystems with other extended functions. Therefore, the information management system provided by the present invention has strong scalability, and can provide an efficient adaptation interface for the seamless integration of new systems and applications in the future, and is especially suitable for authentication occasions with relatively high requirements for identity authentication. Many units use information management systems for their offices.

Preferably, the information management system includes multiple iris information collection and registration modules 1, and multiple iris information collection and registration modules 1 can simultaneously collect iris feature information for multiple users in parallel to save time and improve registration efficiency .

Correspondingly, the present invention also provides an information management method based on iris recognition identity authentication, as shown in FIG. 3 , the information management method includes the following steps:

The iris information collection and registration module collects the user's iris feature information, and registers the user's basic identity information;

The iris information collection and registration module uploads the user's iris feature information and basic identity information to the iris data server;

The iris data server summarizes and stores iris feature information and basic identity information of each user, and establishes a unified shared user data database;

When the user to be authenticated logs into each business subsystem, the iris identity authentication module uses its own iris collection device to collect the iris feature information of the user to be authenticated on the spot, and

Comparing the iris feature information collected on-site with the iris feature information stored and provided by the iris data server, if the two are consistent, the verification is passed, and the iris identity authentication module authorizes the user to log in to each business subsystem, and logs Record.

In order to prevent the collected iris characteristic information from being intercepted during network transmission and leaking events, and to fully ensure the transmission security of the communication channel, the present invention adopts a dual protection mechanism for data and channels:

First, the key used by the iris data server to store the iris feature information and the basic identity information is the same as the key used by the iris data server to transmit the iris feature information and the basic identity information The keys are different; and, when the user to be authenticated logs in to a different service subsystem, the iris data server and the different service subsystems negotiate different keys to encrypt the iris feature information.

Secondly, the communication channel in the information management system is an encrypted transmission channel using a VPN private network.

That is to say, when the iris data server sends data (such as registration images, iris feature information) to each business subsystem, sensitive information can be encrypted before transmission, or encrypted after compression, to improve encryption speed and transmission speed. In order to increase the security of the whole system, the encryption key during transmission may be different from the encryption key during local storage on the iris data server. For example, the iris data server uses the A key to encrypt the registration information stored locally. When sending data to the business subsystem, it first takes out the local encrypted data and decrypts the A key, and then uses the B key to re-encrypt it before downloading. send. Moreover, each business subsystem can negotiate with the iris data server to set different keys.

The present invention uses iris characteristic information for identity authentication, which can fundamentally eliminate potential safety hazards caused by the loss of one-card, passwords, and digital certificates, and is simpler and more convenient for users, and identity authentication can be completed without carrying any carrier, which can effectively Improve business efficiency, realize safe and reliable exchange of data between departments, realize all-round security monitoring, and form an overall joint office system supported by biological intelligence informatization.

Apparently, the above-mentioned embodiments of the present invention are only examples for clearly illustrating the present invention, and are not intended to limit the implementation of the present invention. Those of ordinary skill in the art can also make It is impossible to exhaustively list all the implementation modes here, and any obvious changes or changes derived from the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims (9)

1. A kind of 1. information management system based on iris recognition identification certification, it is characterised in that including：

   Iris information gathers and registration module, for gathering the iris feature information of user, to the basic identity information of user into Row registration, and the iris feature information and basic identity information of user are uploaded to iris data server；

   Iris data server, for collecting and storing the iris feature information and basic identity information of each user, establishes system One shared user profile database, and believe to the iris feature information and basic identity of iris authentication module offer user Breath；

   Iris authentication module, for by the iris feature information of user's collection in worksite to be certified and the iris data service The iris feature information of device storage is contrasted, and the identity of user to be certified is verified, and authorize it after being verified Log in each service sub-system；

   Wherein, the iris authentication module includes：

   System administration submodule, for carrying out system user management, system user Role Management, system user rights management and being System user authentication management；

   User management submodule, for carrying out user management, user property management and user authority management；

   Empowerment management submodule, for carrying out Role Management, task management, resource management and operational administrative；

   Certificate Authority submodule, for carrying out iris recognition certification, fingerprint recognition certification and cipher authentication；

   Data management submodule, shares pipe for carrying out daily record preservation management, log query management, daily record export management and daily record Reason；

   The system administration submodule, the user management submodule, the empowerment management submodule, the Certificate Authority submodule Block and the data management submodule are connected with the iris data server.
2. 2. information management system according to claim 1, it is characterised in that the basic identity information includes the surname of user Name, gender, unit, department, post and registered images, the registered images include the face information of user, the registered images It is encrypted using Base64 algorithms, does not regularly replace key.
3. 3. information management system according to claim 1, it is characterised in that the rainbow stored in the iris data server Film characteristic information includes the iris feature information of user's binocular, iris data server described in the iris feature Information Pull with it is each The key that a service sub-system is consulted is encrypted, and does not regularly replace key.
4. 4. information management system as claimed in any of claims 1 to 3, it is characterised in that the service sub-system Including：

   Computer techno-stress lands safely subsystem, for the body being responsible for when office information system network and relating computer log in Part certification；

   Employee's discrepancy work attendance statistics subsystem, for the personnel identity certification being responsible for when gate inhibition comes in and goes out, and in identification daily record base Staff attendance statistics on plinth；

   Concerning security matters carrier circulation control subsystem, it is true for being responsible for the lending to concerning security matters carrier and giving back progress operating personnel's identity Recognize；

   Safe cabinet security management subsystem, operating personnel's control of authority is carried out for being responsible for locking safe cabinet；

   Documentation borrows subsystem, and operating personnel's identity validation is carried out for being responsible for the lending to security files and giving back；

   Document outgoing management subsystem, operating personnel's authority for being responsible for performing printing, duplicating when document exports task are recognized Card.
5. 5. information management system as claimed in any of claims 1 to 3, it is characterised in that described information management system System includes multiple iris information collections and registration module, and multiple iris information collections are with registration module at the same time to multiple users Carry out the parallel acquisition of iris feature information.
6. 6. information management system as claimed in any of claims 1 to 3, it is characterised in that described information management system Communication channel in system is the encrypted transmission channel using VPN dedicated networks.
7. 7. a kind of information management system based on as claimed in claim 1 based on iris recognition identification certification is known based on iris The approaches to IM of other authentication, it is characterised in that comprise the following steps：

   Iris information gathers the iris feature information with registration module collection user, and the basic identity information of user is noted Volume；

   The iris feature information and basic identity information of user are uploaded to iris number by the iris information collection with registration module According to server；

   The iris data server collects and stores the iris feature information and basic identity information of each user, establishes unified Shared user profile database；

   When user to be certified logs in each service sub-system, iris capturing that the iris authentication module is carried using it Device context gathers the iris feature information of user to be certified, and by the iris feature information of collection in worksite and the iris data The server storage and iris feature information provided is contrasted, if both are consistent, is verified, the iris identity is recognized Card module mandate the user logs in each service sub-system.
8. 8. approaches to IM according to claim 7, it is characterised in that the iris data server is to the iris The key that characteristic information and the basic identity information use when being stored is with the iris data server to the iris The key that characteristic information and the basic identity information use when being transmitted differs.
9. 9. approaches to IM according to claim 7, it is characterised in that when user to be certified logs in different business Consult different keys during system, between the iris data server and different service sub-systems to believe the iris feature Breath is encrypted.