Terminal identity authentication method based on identity code

Abstract

The invention relates to a terminal identity authentication method based on an identity label password, which comprises the following steps: step 1, during identity registration, collecting user voice through a mobile terminal to establish an identity vector voiceprint model, extracting features, adding an identity label to generate a user ID, and generating a corresponding identity password system; and 2, during authentication, judging the legality of a user according to voice recognition, and encrypting and decrypting data based on an identity password and a symmetric encryption algorithm AES to realize terminal identity authentication so as to resist common attacks in the mobile internet. According to the invention, the capability of identifying illegal users and the capability of resisting network hostile attacks are greatly improved.

Description

Technical Field

[0001] The present invention belongs to the field of information communication technology, and relates to a terminal identity authentication method, in particular to a terminal identity authentication method based on an identity identification password. Background Art

[0002] With the rapid development of electric power mobile Internet and the widespread use of mobile devices, the security of identity authentication has become increasingly important. Traditional identity identification and authentication models still have problems such as identity theft and inability to prevent illegal behavior of internal users, and can no longer meet the security needs of identity authentication in mobile Internet services.

[0003] Therefore, without solving the above problem, the present invention proposes a terminal identity authentication method based on an identity identification password.

[0004] After searching, no public documents of the prior art identical or similar to the present invention were found. Summary of the invention

[0005] The purpose of the present invention is to overcome the deficiencies of the prior art and to propose a terminal identity authentication method based on an identity identification password, which greatly improves the ability to identify illegal users and the ability to resist malicious network attacks.

[0006] The present invention solves the practical problem by adopting the following technical solutions:

[0007] A terminal identity authentication method based on an identity identification password comprises the following steps:

[0008] Step 1: During identity registration, the user's voice is collected through a mobile terminal to establish an identity vector voiceprint model, and features are extracted and added to the identity identifier to generate a user ID and a corresponding identity password system;

[0009] Step 2: During authentication, the user's legitimacy is first determined based on voice recognition, and then the data is encrypted and decrypted based on the identity password combined with the symmetric encryption algorithm AES to implement terminal identity authentication to resist common attacks in the mobile Internet.

[0010] Moreover, the specific steps of step 1 include:

[0011] (1) The user's voice is collected through the device's sensor, and then the collected language data is preprocessed, voiceprint features are extracted, and an identity vector voiceprint model is established;

[0012] (2) The extracted user voiceprint features and the user's identity are combined to generate an identity ID, and the key generation center generates the corresponding user's public and private keys based on the identity algorithm.

[0013] Moreover, the identity vector voiceprint model of step 1 (1) is as shown in the formula:

[0014] M=m+Tw

[0015] Among them, M represents the GMM mean supervector of a speech segment, which is related to the speaker and the channel; m represents the mean supervector of the UBM, which is independent of the speaker and the channel; T represents a change subspace matrix; w represents a vector related to the speaker and the channel, and w is the i-vector containing the speaker information; in the i-vector model, each speech segment will be encoded as an identity vector, even if it is different speech of the same person.

[0016] Moreover, the specific steps of step 2 include:

[0017] (1) In the physical authentication stage, the user reads a randomly generated text on the device. The device collects and processes the voice and then matches it with the identity vector voiceprint model generated during registration to identify whether the current user is legitimate and perform corresponding processing;

[0018] (2) During the virtual identity authentication phase, when the user initiates a request for access on the device, the random number generator generates a random number and synchronizes the random number to the device and server; the server encrypts the random number using the symmetric AES algorithm and temporarily stores it on the server; when the user completes voice authentication on the device, the server encrypts the AES key using the public key and sends it to the device; if the voice authentication fails, the random number is deleted. The device decrypts the AES key using the private key obtained, and then the server sends the encrypted random number to the device, which decrypts and verifies it. If the match is successful, the mobile terminal identity authentication is successful, otherwise, the mobile terminal identity authentication is considered to have failed.

[0019] Furthermore, in step 2 (1), the device collects and processes the voice and then matches it with the identity vector voiceprint model generated during registration. The specific method for identifying whether the current user is legitimate is as follows:

[0020] The user's voice data is processed and its features are extracted. The extracted features are used as the input of the model. The minimum distance between feature values ​​is calculated by comparing with the feature library. A threshold needs to be set in voice confirmation. According to the calculated similarity, identity matching verification is performed to determine whether the user is legitimate.

[0021] Moreover, the specific method for performing the corresponding processing in step (1) of step 2 is:

[0022] 1) If the user is legitimate, the key generation center sends the user's private key to the client;

[0023] 2) If the user is illegal, the illegal user will be classified. If it is an unregistered user, the server will lock the client device; if it is a registered user, the newly collected voice data will be input into the model for training, and the user ID will be updated at the same time. The key generation center will regenerate the user key and delete the original data.

[0024] Advantages and beneficial effects of the present invention:

[0025] The present invention proposes a mobile terminal identity authentication method based on identity identification code (IBC). During registration, the user's voice is collected through the mobile terminal to establish an identity vector (i-vector) voiceprint model, and features are extracted and added to the identity identification to generate a user ID and a corresponding identity password system; during authentication, the legitimacy of the user is first judged based on voice recognition to prevent illegal user intrusion, and then the data is encrypted and decrypted based on the identity password combined with the symmetric encryption algorithm AES to implement terminal identity authentication to resist common attacks in the mobile Internet. Finally, experimental analysis shows that the scheme effectively improves the security of the power mobile Internet identity authentication process and has the advantages of low cost and high efficiency. In the power mobile Internet business scenario, this method greatly improves the ability to identify illegal users and resist malicious network attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 is a process flow chart of the present invention;

[0027] Figure 2 It is a diagram showing the result of the three authentication methods in the specific implementation mode of the present invention after simulating the attack to resist the attack;

[0028] Figure 3 This is a test result diagram of system space overhead for three authentication methods according to the specific implementation mode of the present invention with the amount of users. DETAILED DESCRIPTION

[0029] The embodiments of the present invention are further described in detail below with reference to the accompanying drawings:

[0030] A terminal identity authentication method based on identity identification password, such as Figure 1 As shown, the following steps are included:

[0031] Step 1: During identity registration, the user's voice is collected through a mobile terminal to establish an identity vector voiceprint model, and features are extracted and added to the identity identifier to generate a user ID and a corresponding identity password system;

[0032] The specific steps of step 1 include:

[0033] (1) The user's voice is collected through the device's sensor, and then the collected language data is preprocessed, voiceprint features are extracted, and an identity vector voiceprint model is established;

[0034] (2) The extracted user voiceprint features and the user's identity are combined to generate an identity ID, and the key generation center generates the corresponding user's public and private keys based on the identity algorithm.

[0035] The identity vector voiceprint model of step (1) of step 1 is as shown in the formula:

[0036] M=m+Tw

[0037] Among them, M represents the GMM mean supervector of a speech segment, which is related to the speaker and the channel; m represents the mean supervector of the UBM, which is independent of the speaker and the channel; T represents a change subspace matrix; w represents a vector related to the speaker and the channel, and w is the i-vector containing the speaker information; in the i-vector model, each speech segment will be encoded as an identity vector, even if it is different speech of the same person.

[0038] In this embodiment, the identity registration phase of step 1 includes the establishment of a voiceprint model and the generation of a user key. First, the user's voice is collected through the device's sensor, and then the collected language data is preprocessed, the voiceprint features are extracted, and the voiceprint model is established. At the same time, the extracted user voiceprint features and the user's identity are combined to generate an identity ID, and the key generation center generates the corresponding user's public and private keys according to the identity algorithm.

[0039] (1) Data preprocessing

[0040] The collected voice signal contains a lot of interference noise, such as: voice silence, invalid sound, environmental interference noise, etc. In view of these interferences, the system needs to pre-process the voice to obtain "clean" voice data that is conducive to voiceprint feature extraction and pattern matching. In addition to the processing of noise, the voice signal is a long-term non-stationary signal, which is not conducive to feature extraction and analysis. Therefore, the voice signal needs to be pre-emphasized, framed, windowed and endpoint detected. When the collected voice quality is poor, the voice needs to be processed by noise reduction filtering or voice enhancement compensation.

[0041] (2) Feature extraction

[0042] After the speech signal is preprocessed, extracting effective feature parameters is the key to building a speaker model. The extracted feature parameters need to be able to characterize the speaker's personal characteristics that are different from others and can be processed by the mathematical model. At the same time, in order to improve the processing efficiency of the back-end model, it is necessary to consider the dimension of the feature parameters and the degree of contribution to the information, and remove interference information that is not related to the speaker as much as possible to improve the performance of the system. Commonly used voiceprint features include linear prediction cepstral coefficients LPCC, Mel frequency cepstral coefficients MFCC, perceptual linear prediction PLP, etc. The human ear's perception of sound frequency does not change linearly. Based on this characteristic, we choose Mel frequency cepstral coefficients.

[0043] (3) Model building

[0044] At present, the main speaker recognition models include vector quantization (VQ), hidden Markov model (HMM), Gaussian mixture model (GMM), support vector machine (SVM), identity vector (i-vector), artificial neural network (ANN) and deep learning.

[0045] The model system based on identity vector is the most commonly used speaker recognition system. In the GMM-UBM model, each Gaussian component of the GMM can be combined to construct a Gaussian vector to represent the speaker identity. Usually the dimension of a Gaussian supervector can reach the order of 105. In order to effectively reduce the dimension of the supervector, the algorithm framework of factor analysis (FA) can be used to map the high-dimensional supervector to a low-dimensional basis vector space, which can reduce the dimension to several hundred dimensions. Not only that, the Gaussian supervector contains not only the speaker identity information, but also the channel noise information. Different channel noises will affect the classification performance of the model. Therefore, we need to separate the channel information and identity information to remove the redundant information of the supervector and enhance the recognition performance of the model. The joint factor analysis (JFA) method is an attempt to solve this problem. It is based on the factor analysis method and attempts to separate the identity factor and the channel factor. The calculation formula is:

[0046] M=s+c

[0047] S=m+Vy+Dz

[0048] C=Ux

[0049] Among them, M is the mean supervector of GMM, which consists of an identity-related supervector s and a channel-related supervector c. In vector S, m is a factor independent of the speaker, y is a factor related to the speaker, z is a residual factor related to the speaker, V is the eigentone matrix, and D is the diagonal residual matrix. In vector c, U is the eigenchannel matrix, and x is a channel-related factor. JFA can improve the performance of the GMM-UBM model. However, the lost channel factors still contain useful speaker information, which limits the further development of the model performance. Since voiceprint information and channel information cannot be completely independent, a supervector subspace is used to simultaneously model these two types of difference information, and an identity vector (i-vector) model is proposed. As shown in the formula:

[0050] M=m+Tw

[0051] Where M represents the mean supervector of the GMM of a speech segment, which is related to the speaker and channel; m represents the mean supervector of the UBM, which is independent of the speaker and channel; T represents a change subspace matrix; w represents a vector related to the speaker and channel, and w is the i-vector containing the speaker information. In the i-vector model, each speech segment is encoded as an identity vector, even if it is a different speech of the same person. The i-vector model transforms the speech image into a low-dimensional fixed-length vector, and then uses the phase distance measurement algorithm to classify the identity to which the vector belongs.

[0052] (4) User key generation

[0053] The user enters relevant identity information through the client, such as name, IP address, email address, mobile phone number, etc. One of them is selected and combined with the extracted user voiceprint feature to form a new user ID.

[0054] System initialization (Setup): Given a security parameter λ, select N-order additive cyclic groups G1 and G2 and multiplicative cyclic group GT respectively, and P1 and P2 are generators of additive cyclic groups G1 and G2 respectively. The key generation center KGC selects a bilinear pairing e:G1×G2→GT, and selects two secure hash functions H1:{0,1}*→Z*q, H2:{0,1}*→Z*q, randomly selects s∈[1,N-1] as the system parameter master key, and calculates Ppub=sP2 as the master key. KGC publishes system parameters params=<λ,G1,G2,e,N,Ppub,H1,H2>, and keeps s secret.

[0055] Key generation algorithm (KeyEx): For the user identity ID, KGC selects and publicly uses a private key generation function identifier hid, and calculates t1=H1(IDA‖hid, N)+s on the elliptic curve finite field FN. If t1=0, the master private key 0 needs to be regenerated, otherwise t2=s·t1-1 is calculated, the private key d=t2P1=s·P1 / [H1(ID‖hid, N)+s] and the public key Q=H1(ID‖hid, N)P1+Ppub.

[0056] Step 2: During authentication, the user's legitimacy is first determined based on voice recognition, and then the data is encrypted and decrypted based on the identity password combined with the symmetric encryption algorithm AES to implement terminal identity authentication to resist common attacks in the mobile Internet.

[0057] The specific steps of step 2 include:

[0058] (1) In the physical authentication stage, the user reads a randomly generated text on the device. The device collects and processes the voice and then matches it with the identity vector voiceprint model generated during registration to identify whether the current user is legitimate and perform corresponding processing;

[0059] In step 2 (1), the device collects and processes the voice and then matches it with the identity vector voiceprint model generated during registration. The specific method for identifying whether the current user is legitimate is as follows:

[0060] The user's voice data is processed and its features are extracted. The extracted features are used as the input of the model. The minimum distance between feature values ​​is calculated by comparing with the feature library. A threshold needs to be set in voice confirmation. According to the calculated similarity, identity matching verification is performed to determine whether the user is legitimate.

[0061] The specific method for performing the corresponding processing in step (1) of step 2 is:

[0062] 1) If the user is legitimate, the key generation center sends the user's private key to the client;

[0063] 2) If the user is illegal, the illegal user will be classified. If it is an unregistered user, the server will lock the client device; if it is a registered user, the newly collected voice data will be input into the model for training, and the user ID will be updated at the same time. The key generation center will regenerate the user key and delete the original data.

[0064] (2) During the virtual identity authentication phase, when the user initiates a request for access on the device, the random number generator generates a random number and synchronizes the random number to the device and server; the server encrypts the random number using the symmetric AES algorithm and temporarily stores it on the server; when the user completes voice authentication on the device, the server encrypts the AES key using the public key and sends it to the device; if the voice authentication fails, the random number is deleted. The device decrypts the AES key using the private key obtained, and then the server sends the encrypted random number to the device, which decrypts and verifies it. If the match is successful, the mobile terminal identity authentication is successful, otherwise, the mobile terminal identity authentication is considered to have failed.

[0065] In this embodiment, the mobile terminal identity authentication in step 2 includes two stages: physical authentication and virtual authentication. Physical authentication uses voice recognition to confirm the legitimacy of the visiting user; virtual authentication encrypts and verifies the random number generated by the random number generator based on the identity identification algorithm and the symmetric encryption algorithm AES.

[0066] In the physical authentication phase, the user reads randomly generated text on the device, and the device collects the voice for processing and matches it with the identity vector voiceprint model generated during registration ( Figure 2 ), identify whether the current user is legitimate. If the user is illegal, lock the device and take corresponding measures.

[0067] After obtaining the user's voice data, it is also necessary to process it and extract its features. The extracted features are used as the input of the model. The minimum distance between the feature values ​​is calculated by comparing with the feature library. A threshold needs to be set in voice confirmation, and this threshold can be adjusted according to the actual results. Based on the calculated similarity, identity matching verification is performed to determine whether the user is legitimate, and the system responds according to the results.

[0068] There are two response mechanisms to determine whether a user is legitimate based on model matching:

[0069] 1) If the user is legitimate, the key generation center sends the user's private key to the client;

[0070] 2) If the user is illegal, the illegal user is classified. If it is an unregistered user, the server will lock the client device; if it is a registered user, the newly collected voice data will be input into the model for training, and the user ID will be updated. The key generation center will regenerate the user key and delete the original data.

[0071] After the physical identity authentication, the virtual identity authentication uses public key encryption and private key decryption. Since public key encryption is used, it is difficult to prove that the encrypted ciphertext comes from the real sender, that is, it is difficult to prove the authenticity of the information, that is, it is difficult to verify the true identity of the information publisher. The use of public key for decryption undoubtedly reduces the confidentiality of the information. Encrypting and decrypting random numbers based on the identity identification algorithm and the symmetric encryption algorithm AES as the second line of defense for identity authentication improves the security of user identity authentication. The specific process is as follows:

[0072] When the user initiates a request for access on the device, the random number generator generates a random number and synchronizes the random number to the device and server; the server uses the symmetric AES algorithm to encrypt the random number and temporarily stores it on the server; when the user completes voice authentication on the device, the server uses the public key to encrypt the AES key and sends it to the device; if the voice authentication fails, the random number is deleted. The device uses the obtained private key to decrypt the AES key, and then the server sends the encrypted random number to the device, which decrypts and verifies it. If the match is successful, the mobile terminal identity authentication is successful, otherwise, the mobile terminal identity authentication is considered to have failed.

[0073] In this embodiment, in order to test the security of the mobile terminal identity authentication method based on the i-vector identity identification password proposed by the present invention and its space overhead performance, the following experiment is performed:

[0074] (1) Experimental setup

[0075] In order to test the security and space overhead performance of the mobile terminal identity authentication method based on i-vector identity identification password proposed in the present invention, this experiment uses MatlabR2014a to conduct simulation experiments on the Windows 10 64-bit operating system hardware platform. In this environment, the method is compared with the fingerprint authentication system design based on PKI (reference

[15] ) and the biometric authentication based on PKI (reference

[16] ) to verify the security and efficiency of the method of the present invention.

[0076] (2) Safety Testing

[0077] To verify the security of the solution of the present invention, we selected four common attack modes as shown in Table 1 and conducted 10 simulation attacks on the method of the present invention, the fingerprint authentication system design based on PKI, and the biometric authentication based on PKI, and counted the number of times these three attacks could not be resisted.

[0078] Table 1 Common attack modes

[0079]

[0080] The results of the above three authentication methods after simulating attacks are as follows: Figure 2 shown.

[0081] (3) Space overhead test

[0082] As for the space overhead, we choose to use the number of users as a variable to test the system space overhead. The efficiency of the method of the present invention is verified by comparing it with the PKI technology fingerprint matching method based on X.509 certificate and the biometric authentication method based on PKI. The test results are as follows: Figure 3 .

[0083] From the analysis of the results in the above figure, it can be seen that the space overhead of the method of the present invention is significantly lower than that of the fingerprint authentication system design based on PKI and the biometric authentication based on PKI. With the increase in the number of users, the space overhead of the method of the present invention increases slowly, while the latter two increase at a relatively high rate. The comparison shows that the space overhead of the method of the present invention is also significantly reduced compared to the traditional identity authentication based on the PKI system, thereby improving the efficiency of identity authentication.

[0084] As for the time complexity, the average time consumption is obtained by encrypting and decrypting information of different lengths 20 times as shown in Table 2.

[0085] Table 2 Average encryption and decryption time for different message lengths

[0086]

[0087] Wherein, Lm represents the information length in bytes, tencry represents the average encryption time, and tdecry represents the average decryption verification time. It can be seen from the experimental data that the method of the present invention has a relatively high efficiency.

[0088] The innovation of the present invention lies in:

[0089] The implementation of the mobile terminal identity authentication method based on the identity identification algorithm proposed in the present invention is mainly composed of the client and the server, involving two aspects of neural network and cryptography, and includes two stages: when registering, the user's voice is collected through the mobile terminal to establish an identity vector voiceprint model, and the features are extracted and added to the identity identification to generate the user ID and generate the corresponding identity password system; when authenticating, the user's legitimacy is first judged based on voice recognition, and then the data is encrypted and decrypted based on the identity password combined with the symmetric encryption algorithm AES to realize terminal identity authentication to resist common attacks in the mobile Internet. Experimental analysis shows that this scheme effectively improves the security of the power mobile Internet identity authentication process and has the advantages of low cost and high efficiency.

[0090] The present invention uses a mobile terminal to collect user voice to establish an identity vector voiceprint model, extracts features and adds identity identification to generate a user ID and generates a corresponding identity password system to complete user registration; during authentication, the legitimacy of the user is first determined based on voice recognition to prevent illegal user intrusion, and then the data is encrypted and decrypted based on the identity password combined with the symmetric encryption algorithm AES to implement terminal identity authentication to resist common attacks in the mobile Internet. Compared with other methods of the same type, this method effectively improves the security of the power mobile Internet identity authentication process and has the advantages of low cost and high efficiency, and improves the ability to identify illegal users and resist malicious network attacks in power mobile Internet business scenarios. However, there is still a lot of room for development in this area of ​​research. In the future, this multi-level identity authentication mode will gradually replace the traditional single authentication mode.

[0091] It should be emphasized that the embodiments of the present invention are illustrative rather than restrictive. Therefore, the present invention includes but is not limited to the embodiments described in the specific implementation modes. Any other implementation modes derived by those skilled in the art based on the technical solutions of the present invention also fall within the scope of protection of the present invention.

Claims

1. A terminal identity authentication method based on identity identification password, characterized in that: The following steps are involved: Step 1: During identity registration, the user's voice is collected through a mobile terminal to establish an identity vector voiceprint model, and features are extracted and added to the identity identifier to generate a user ID and a corresponding identity password system; Step 2: During authentication, the user's legitimacy is first determined based on voice recognition, and then the data is encrypted and decrypted based on the identity password combined with the symmetric encryption algorithm AES to implement terminal identity authentication to resist common attacks in the mobile Internet.

2. A terminal identity authentication method based on identity identification password according to claim 1, characterized in that: The specific steps of step 1 include: (1) The user's voice is collected through the device's sensor, and then the collected language data is preprocessed, voiceprint features are extracted, and an identity vector voiceprint model is established; (2) The extracted user voiceprint features and the user's identity are combined to generate an identity ID, and the key generation center generates the corresponding user's public and private keys based on the identity algorithm.

3. A terminal identity authentication method based on identity identification password according to claim 2, characterized in that: The identity vector voiceprint model of step (1) of step 1 is as shown in the formula: M=m+Tw Among them, M represents the GMM mean supervector of a speech segment, which is related to the speaker and the channel; m represents the mean supervector of the UBM, which is independent of the speaker and the channel; T represents a change subspace matrix; w represents a vector related to the speaker and the channel, and w is the i-vector containing the speaker information; in the i-vector model, each speech segment will be encoded as an identity vector, even if it is different speech of the same person.

4. A terminal identity authentication method based on identity identification password according to claim 1, characterized in that: The specific steps of step 2 include: (1) In the physical authentication stage, the user reads a randomly generated text on the device. The device collects and processes the voice and then matches it with the identity vector voiceprint model generated during registration to identify whether the current user is legitimate and perform corresponding processing; (2) During the virtual identity authentication phase, when the user initiates an access request on the device, the random number generator generates a random number and synchronizes the random number to the device and server; the server encrypts the random number using the symmetric AES algorithm and temporarily stores it on the server; when the user completes voice authentication on the device, the server encrypts the AES key using the public key and sends it to the device; if the voice authentication fails, the random number is deleted; the device decrypts the AES key using the obtained private key, and then the server sends the encrypted random number to the device, which decrypts and verifies it. If the match is successful, the mobile terminal identity authentication is successful, otherwise, the mobile terminal identity authentication is considered to have failed.

5. A terminal identity authentication method based on identity identification password according to claim 4, characterized in that: In step 2 (1), the device collects and processes the voice and then matches it with the identity vector voiceprint model generated during registration. The specific method for identifying whether the current user is legitimate is as follows: Process the user's voice data and extract its features. The extracted features are used as the input of the model, and the minimum distance between feature values ​​is calculated by comparing with the feature library. A threshold needs to be set in voice confirmation, and identity matching verification is performed based on the calculated similarity to determine whether the user is legitimate.

6. A terminal identity authentication method based on identity identification password according to claim 4, characterized in that: The specific method for performing the corresponding processing in step (1) of step 2 is: 1) If the user is legitimate, the key generation center sends the user's private key to the client; 2) If the user is illegal, the illegal user will be classified. If it is an unregistered user, the server will lock the client device; If the user is a registered user, the newly collected voice data will be input into the model for training, and the user ID will be updated. The key generation center will regenerate the user key and delete the original data.

Images