Zero-trust equipment access control method and device based on image recognition

Abstract

The invention discloses a zero-trust equipment access control method and device based on image recognition, and the method comprises the steps: creating a sample library which is used for storing a text image or a pattern image; an identification pattern is added to the image in the sample library, and the identification pattern divides the image into identification areas; based on the images in the sample library, using Tesseract to generate a training database, and using the training database to train an image recognition model; and implanting the image recognition model into a zero-trust IAM authentication system, wherein the zero-trust IAM authentication system uses the image recognition model to authenticate the graphic code sent by the client. According to the technical scheme, the safety, reliability and flexibility of equipment authentication under the zero-trust model are improved, and accurate identification and authorization of credit granting users and equipment are achieved.

Description

Technical Field

[0001] The present invention relates to the field of computer network technology, and in particular to a method and device for controlling zero-trust device access based on image recognition. Background Art

[0002] Zero Trust is a security concept that assumes that the internal network is no more trustworthy than the external network, so all users who attempt to access resources need to be authenticated and authorized, no matter where they are located, thereby increasing the security of access. The zero trust model relies on a strong IAM (Identity and Access Management) system to ensure that only the right users and devices can access resources. At the same time, the network is divided into multiple smaller subnets to limit the lateral movement of attackers. Access rights are dynamically granted or denied based on user identity, device health status, and the context of the request.

[0003] In a zero-trust access system, image recognition may be used to verify user information. However, commonly used image recognition technologies, such as QR codes, do not provide any encryption or security mechanisms. Any user and any device can obtain the corresponding information by scanning and decoding. Therefore, QR code technology is not suitable for some confidential scenarios. Summary of the invention

[0004] The main purpose of the present invention is to provide a control method and device for zero-trust device access based on image recognition, aiming to improve the security, reliability and flexibility of device authentication under the zero-trust model, and to achieve accurate identification and authorization of trusted users and devices.

[0005] To achieve the above object, the present invention proposes a method for controlling zero-trust device access based on image recognition, comprising:

[0006] Create a sample library to store text images or pattern images;

[0007] Adding a logo pattern to an image in the sample library, wherein the logo pattern divides the image into a recognition area;

[0008] Based on the images in the sample library, a training database is generated using Tesseract, and an image recognition model is trained using the training database;

[0009] The image recognition model is implanted into a zero-trust IAM authentication system, and the zero-trust IAM authentication system uses the image recognition model to authenticate the graphic code sent by the client.

[0010] In one embodiment of the present invention, in the step of adding an identification pattern to the image in the sample library and dividing the image into recognition areas by the identification pattern, the identification pattern is a pattern located at three corners of the same virtual rectangle, and the area covered by the virtual rectangle is the recognition area.

[0011] In one embodiment of the present invention, the step of generating a training database using Tesseract based on the images in the sample library, and training an image recognition model using the training database includes:

[0012] Based on the images in the sample library, use the tools provided by Tesseract to prepare training data and generate a training database;

[0013] Create feature files of text images and pattern images in the sample library and associate them with the training database;

[0014] Use Tesseract's training tool to perform the image recognition model training process;

[0015] The trained data is verified for accuracy, and image recognition models that fail the verification are repeatedly trained or similar values ​​are discarded, ultimately generating a qualified image recognition module.

[0016] In one embodiment of the present invention, the step of implanting the image recognition model into the zero-trust IAM authentication system, wherein the zero-trust IAM authentication system uses the image recognition model to authenticate the graphic code sent by the client includes:

[0017] The server associates the graphic code information with the zero-trust IAM authentication system;

[0018] The client sends a graphic code to the server;

[0019] The zero-trust IAM authentication system identifies graphic codes through image recognition models and uploads identification data for authentication.

[0020] In one embodiment of the present invention, the step of the zero-trust IAM authentication system identifying a graphic code through an image recognition model includes:

[0021] By identifying the identification pattern, the identification area of ​​the graphic code and the direction of the graphic code are determined;

[0022] After the identification area is determined, a secondary identification is performed directly opposite the identification area.

[0023] The present invention also proposes a storage device for storing a computer program, wherein the computer program, when executed by a processor, executes the method for controlling zero-trust device access based on image recognition as described in any one of the above items.

[0024] The technical solution of the present invention uses the image recognition model trained by the open source engine Tesseract, combined with zero-trust IAM authentication, to achieve dual verification of trusted users and devices. Compared with the traditional QR code authentication method, the present invention has higher security and reliability, is suitable for various confidential scenarios, can achieve point-to-point authorization, and effectively prevent unauthorized devices and users from illegal access. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying creative work.

[0026] Figure 1 A schematic diagram of the steps of a method for controlling zero-trust device access based on image recognition according to the present invention;

[0027] Figure 2 A schematic diagram of the steps of using Tesseract to train an image recognition model in the present invention;

[0028] Figure 3 The figure is a flow chart of the steps of authenticating a graphic code sent by a client using an image recognition model according to the present invention.

[0029] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0031] Reference Figure 1 The present invention proposes a control method for zero-trust device access based on image recognition, comprising:

[0032] S100, creating a sample library for storing text images or pattern images;

[0033] S200, adding a marking pattern to an image in a sample library, wherein the marking pattern divides the image into a recognition area;

[0034] S300, generating a training database using Tesseract based on the images in the sample library, and training an image recognition model using the training database;

[0035] S400, implanting the image recognition model into a zero-trust IAM authentication system, and the zero-trust IAM authentication system uses the image recognition model to authenticate the graphic code sent by the client.

[0036] A large number of text images or pattern images stored in the sample library are used as original image data. By adding identification patterns, recognition areas are divided on the images, and authentication can be performed by identifying the recognition areas.

[0037] Tesseract is an open source text recognition (OCR) engine, which is currently recognized as the best and most accurate open source OCR system. It can convert printed text images into editable text and can process various image file formats, such as JPEG, PNG, TIFF, etc. Tesseract uses a series of image processing, feature extraction and machine learning technologies to achieve the recognition process. The basis of the Tesseract algorithm is to use a trained model to recognize characters and improve recognition accuracy through context and language models.

[0038] After using Tesseract to train the image recognition model, the image recognition model is implanted into the zero-trust IAM authentication system. Zero trust is a security concept that assumes that the internal network is no more trustworthy than the external network. Therefore, all users who attempt to access resources need to be authenticated and authorized, no matter where they are located, thereby increasing the security of access. The zero-trust model relies on a strong IAM (Identity and Access Management) system to ensure that only the correct users and devices can access resources. At the same time, the network is divided into multiple smaller subnets to limit the lateral movement of attackers. Access rights are dynamically granted or denied based on user identity, device health status, and the context of the request. The zero-trust IAM authentication system uses the trained image recognition model to authenticate the graphic code sent by the client. The authentication dimensions include whether the graphic code is used, whether the graphic code matches, and user authentication.

[0039] In one embodiment of the present invention, in step S200 of adding an identification pattern to the image in the sample library and dividing the image into recognition areas by the identification pattern, the identification pattern is a pattern located at three corners of the same virtual rectangle, and the area covered by the virtual rectangle is the recognition area.

[0040] In this case, the logo pattern contains elements such as Braille anchor points and data modules, which are highly complex and unique and difficult to be forged or tampered with. At the same time, combined with the Tesseract OCR engine, rapid recognition and analysis of the marked image is achieved. By identifying the three Braille-like logo patterns, the recognition area and image direction of the target image code are located.

[0041] Reference Figure 2 In one embodiment of the present invention, the step S300 of generating a training database using Tesseract based on the images in the sample library and training an image recognition model using the training database includes:

[0042] S310, based on the images in the sample library, use the tools provided by Tesseract to prepare training data and generate a training database;

[0043] S320, creating feature files of text images and pattern images in the sample library and associating them with the training database;

[0044] S330, executing a training process of an image recognition model using a Tesseract training tool;

[0045] S340, perform accuracy verification on the trained data, perform repeated secondary training or discard similar values ​​for the image recognition model that fails the verification, and finally generate a qualified image recognition module.

[0046] Using Tesseract to train image recognition models has the following advantages: Customized adaptation, which is easy to customize according to specific recognition needs, improving recognition accuracy and adaptability. Improve accuracy. Through training, the model can be optimized to improve accuracy. Especially for some specific text styles or scenes with poor image quality, the trained model is often able to better recognize. Customized labels and classifications, the trained model also facilitates customized labels and graphic classification tasks, which is undoubtedly very suitable in this case. Protect privacy and security. For applications that need to run locally or in a private environment, data privacy and security can be better protected by training the Tesseract model locally.

[0047] Reference Figure 3 In one embodiment of the present invention, the step S400 of implanting the image recognition model into the zero-trust IAM authentication system and the zero-trust IAM authentication system using the image recognition model to authenticate the graphic code sent by the client includes:

[0048] S410, the server associates the graphic code information with the zero-trust IAM authentication system;

[0049] S420, the user end sends a graphic code to the server end;

[0050] S430, the zero-trust IAM authentication system identifies the graphic code through the image recognition model and uploads the identification data for authentication.

[0051] After the zero-trust IAM authentication system is implanted with the image recognition model trained by Tesseract, it also needs to associate the graphic code information, that is, the image information in the sample library. When the user sends the graphic code to the server, the image recognition model is used to identify it and compare it with the graphic code information. Then the identification data is uploaded for authentication. The authentication dimensions include whether the graphic code is used, whether the graphic code matches, and user authentication, etc., in order to achieve a more accurate and secure authentication effect.

[0052] In one embodiment of the present invention, the step S430 of the zero-trust IAM authentication system identifying the graphic code through the image recognition model includes:

[0053] S431, by identifying the identification pattern, determining the identification area of ​​the graphic code and the direction of the graphic code;

[0054] S432, after the recognition area is determined, a secondary recognition is performed directly on the recognition area.

[0055] After receiving the graphic code, the first step is to find the logo pattern on the graphic code, which contains elements such as Braille anchor points and data modules. It is highly complex and unique and difficult to be forged or tampered with. By identifying the three Braille-like logo patterns, the recognition area and image direction of the target image code are located, and then the recognition area is re-recognized to achieve a relatively accurate recognition effect.

[0056] The technical solution of the present invention uses the image recognition model trained by the open source engine Tesseract, combined with zero-trust IAM authentication, to achieve dual verification of trusted users and devices. Compared with the traditional QR code authentication method, the present invention has higher security and reliability, is suitable for various confidential scenarios, can achieve point-to-point authorization, and effectively prevent unauthorized devices and users from illegal access.

[0057] Various objects such as various messages / information / equipment / network elements / systems / devices / actions / operations / processes / concepts that may appear in this application are named. It can be understood that these specific names do not constitute a limitation on the relevant objects. The names assigned may change with factors such as scenarios, contexts or usage habits. The understanding of the technical meaning of the technical terms in this application should be mainly determined from the functions and technical effects embodied / executed in the technical scheme.

[0058] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0059] In the embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0060] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0061] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0062] It should also be understood that in various embodiments of the present application, the first, second, etc. are only used to indicate that multiple objects are different. For example, the first time window and the second time window are only used to indicate different time windows. They should not have any impact on the time window itself, and the first, second, etc. mentioned above should not impose any limitations on the embodiments of the present application.

[0063] It should also be understood that in the various embodiments of the present application, unless otherwise specified or there is a logical conflict, the terms and / or descriptions between different embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form new embodiments according to their internal logical relationships.

[0064] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a computer-readable storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned computer-readable storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0065] The present application also provides a computer program product, which includes instructions. When the instructions are executed, the network switch and the network system perform operations of the network switch and the network system corresponding to the above method.

[0066] The present application also provides a network system, the system comprising:

[0067] one or more memories for storing instructions; and

[0068] One or more processors are used to call and run the instructions from the memory to execute the method as described above.

[0069] The present application also provides a chip system, which includes a processor for implementing the functions involved in the above content, such as generating, receiving, sending, or processing the data and / or information involved in the above method.

[0070] The chip system may be composed of chips, or may include chips and other discrete devices.

[0071] The processor mentioned in any of the above places can be a CPU, a microprocessor, an ASIC, or one or more integrated circuits for executing programs for controlling the above-mentioned feedback information transmission method.

[0072] In a possible design, the chip system also includes a memory, which is used to store necessary program instructions and data. The processor and the memory can be decoupled and respectively set on different devices, connected by wire or wireless means to support the chip system to implement various functions in the above embodiments. Alternatively, the processor and the memory can also be coupled on the same device.

[0073] Optionally, the computer instructions are stored in a memory.

[0074] Optionally, the memory is a storage unit within the chip, such as a register, a cache, etc. The memory can also be a storage unit within the terminal located outside the chip, such as a ROM or other types of static storage devices that can store static information and instructions, RAM, etc.

[0075] It can be understood that the memory in the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories.

[0076] The non-volatile memory may be a ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), or a flash memory.

[0077] The volatile memory may be a RAM, which is used as an external cache. There are many different types of RAM, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory.

[0078] The embodiments of this specific implementation method are all preferred embodiments of the present application, and are not intended to limit the protection scope of the present application. Therefore, all equivalent changes made based on the structure, shape, and principle of the present application should be included in the protection scope of the present application.

Claims

1. A zero-trust device access control method based on image recognition, characterized in that: include: Create a sample library to store text images or pattern images; Adding a logo pattern to an image in the sample library, wherein the logo pattern divides the image into a recognition area; Based on the images in the sample library, a training database is generated using Tesseract, and an image recognition model is trained using the training database; The image recognition model is implanted into a zero-trust IAM authentication system, and the zero-trust IAM authentication system uses the image recognition model to authenticate the graphic code sent by the client.

2. The method for controlling zero-trust device access based on image recognition according to claim 1, characterized in that: In the step of adding a logo pattern to the image in the sample library and dividing the image into recognition areas by the logo pattern, the logo pattern is a pattern located at three corners of the same virtual rectangle, and the area covered by the virtual rectangle is the recognition area.

3. The method for controlling zero-trust device access based on image recognition according to claim 2, characterized in that: The steps of generating a training database using Tesseract based on the images in the sample library and training an image recognition model using the training database include: Based on the images in the sample library, use the tools provided by Tesseract to prepare training data and generate a training database; Create feature files of text images and pattern images in the sample library and associate them with the training database; Use Tesseract's training tool to perform the image recognition model training process; The trained data is verified for accuracy, and image recognition models that fail the verification are repeatedly trained or similar values ​​are discarded, ultimately generating a qualified image recognition module.

4. The method for controlling zero-trust device access based on image recognition according to claim 3, characterized in that: The steps of implanting the image recognition model into the zero-trust IAM authentication system, and the zero-trust IAM authentication system using the image recognition model to authenticate the graphic code sent by the client include: The server associates the graphic code information with the zero-trust IAM authentication system; The client sends a graphic code to the server; The zero-trust IAM authentication system identifies graphic codes through image recognition models and uploads identification data for authentication.

5. The method for controlling zero-trust device access based on image recognition according to claim 4, characterized in that: The step of the zero-trust IAM authentication system identifying the graphic code through the image recognition model includes: By identifying the identification pattern, the identification area of ​​the graphic code and the direction of the graphic code are determined; After the identification area is determined, a secondary identification is performed directly opposite the identification area.

6. A storage device, characterized in that: Used to store a computer program, which, when executed by a processor, executes the method for controlling zero-trust device access based on image recognition as described in any one of claims 1 to 5.

Images