Identity verification system based on big data

Abstract

The invention discloses an identity verification system based on big data. The identity verification system comprises a data acquisition module, a distributed storage module, a data encryption authentication module, an information input module and a data matching module, the data acquisition module is used for acquiring user identity information and storing the user identity information in the distributed storage module, the information input module is used for receiving user login information, and the data encryption authentication module is used for acquiring the user identity information stored in the distributed storage module according to the login information to perform key authentication; in the data matching module, matching is completed through a secret key and user identity information encryption information, after matching succeeds, the system is logged in by triggering a system switch, and after matching fails, the system is triggered to be closed to refuse login. The method and the device are used for solving the technical problem that in the prior art, in the data collection process, the privacy problem and the replicability of biological characteristics cannot ensure the safety of user identity information data.

Description

Technical Field

[0001] The present invention relates to the technical field of identity verification, and in particular to an identity verification system based on big data. Background Art

[0002] In the era of big data, traditional identity verification methods such as passwords, user names, and security questions have gradually exposed many shortcomings. On the one hand, these methods are easy to be cracked, especially in the current situation of frequent data leaks, and simple information combinations cannot effectively resist malicious attacks; on the other hand, as users become more active on different platforms, more and more account information needs to be remembered, which not only increases the memory burden of users, but may also lead to more password choices, further reducing security.

[0003] In recent years, biometric technology and identity authentication based on behavioral analysis have begun to gain attention, providing a safer and more convenient solution for identity verification. However, these technologies also face technical risks, including privacy issues during data collection and the reproducibility of biometric features, which cannot guarantee the security of user identity information data.

[0004] In addition, traditional identity verification systems often rely on centralized databases. This architecture is inefficient when faced with large-scale data, and once the database is attacked, the consequences are disastrous. Summary of the invention

[0005] The purpose of the present invention is to provide an identity verification system based on big data to solve the problems described in the background technology.

[0006] The technical solution of the present invention is achieved in this way:

[0007] An identity verification system based on big data, comprising: a data acquisition module, a distributed storage module, a data encryption authentication module, an information entry module and a data matching module;

[0008] The data acquisition module is used to collect user identity information and store the user identity information in the distributed storage module. The information entry module is used to receive user login information. The data encryption authentication module obtains the user identity information in the distributed storage module memory according to the login information for key authentication. The data matching module completes the matching by using the key and the encrypted information of the user identity information. After the match is successful, the system switch is triggered to log in to the system. If the match fails, the system is triggered to shut down and login is rejected.

[0009] A further technical solution is that the user identity information includes user ID card information and face, eye iris and fingerprint feature information.

[0010] A further technical solution is that the distributed storage module includes a data security unit, and the data security unit is used to build a data trust library.

[0011] A further technical solution is that the data security unit is used to construct a data trust library, which is implemented using Agent technology, and the steps are as follows:

[0012] The Agent first visits the node N, compares the first counter value corresponding to the Agent data with the second counter value of the currently visited node N, and if the second counter value is greater than the first counter value, updates it to a third counter value, and saves the third counter value data in the node N storage;

[0013] After multiple counter values ​​in the node N are compared, the counter value comparison range is narrowed, the minimum counter value is extracted from the node N storage, and the child node corresponding to the minimum counter value is used as the node to be visited next;

[0014] After extracting the best access node, it is marked, and multiple nodes are added to the Agent to continue accessing;

[0015] After the Agent visits all nodes, all the best access nodes are obtained, and the construction of the data trust library is completed.

[0016] A further technical solution is that extracting the best access node includes:

[0017] The Agent technology uses the network node with the smallest counter value as the node for the next network access;

[0018] If the node with the minimum counter value has not been visited for three consecutive times, the node with the minimum counter value is the best visited node;

[0019] If it is visited more than 3 times, the node corresponding to the node with the second smallest counter value is extracted as the visit object, and so on, until the best visit node is obtained.

[0020] A further technical solution is that the data encryption authentication module analysis step includes:

[0021] Using the network working time protocol technology to synchronize the login terminal time with the server used by the user, and obtaining the user access result according to the distributed storage module;

[0022] Using irreversible calculation method to obtain the dynamic key accessed by the login terminal, and complete the symmetric encryption of user authentication;

[0023] The user authentication information is encrypted twice using the authentication code to complete the user identity authentication of the login terminal.

[0024] A further technical solution is that the user needs to enter his / her user name N in the login terminal before accessing the mobile terminal. U And the static password w p , and according to the irreversible algorithm, obtain the user's current access control address Am;

[0025] Under the irreversible algorithm, the username N U and the password w p Calculate and solve the dynamic key K C , complete the symmetric encryption process, which can be obtained by the following formula:

[0026] K C =f k (A M ,N u ,W p )

[0027] Where: f k For symmetric encryption calculation, before encrypting the login terminal data, symmetric encryption is performed on the server to obtain the data required by the user.

[0028] A further technical solution is that the matching of the encrypted information of the user identity information with the key in the data matching module includes:

[0029] The distributed storage module sends the session key to the user through the network;

[0030] The user decrypts the received session key using his own private key;

[0031] The distributed storage module decrypts the data using the decrypted session key;

[0032] The user verifies the digital signature using the public key of the distributed storage module to ensure that the data has not been tampered with and is indeed from the distributed storage module.

[0033] A further technical solution is that after the matching is successful, the system is logged into by triggering a system switch, wherein the triggering system includes:

[0034] After the matching is completed according to the data matching module, the AI ​​face-changing image is detected by the recognition module;

[0035] The recognition module includes an image acquisition unit, an optical recognition unit and a fuzzy interface recognition unit. The image acquisition unit is used to capture the user's facial image when the user logs into the system, and is combined with the optical recognition unit to recognize the facial halo pattern. Finally, the fuzzy interface recognition unit recognizes whether the face has been replaced by AI based on the facial halo pattern recognized by the optical recognition unit.

[0036] A further technical solution is that the recognition module detects the AI ​​face-changing image in a specific detection method as follows:

[0037] Using a camera to collect user facial images;

[0038] Converting the user's facial image into a grayscale image;

[0039] Extracting features from the grayscale image using an image processing algorithm;

[0040] Comparing the features extracted from the grayscale image with known user facial features in a database;

[0041] A fuzzy set is used to identify whether AI face-swapping exists in the user's facial image.

[0042] The beneficial effects of the present invention are:

[0043] The data collection module collects user identity information from the public security database or the user's own trusted device, and stores the user identity information in the distributed storage module. The distributed storage module has the advantage of trust being dispersed to multiple nodes in the network, reducing the dependence on a single entity and increasing the system's elasticity and anti-attack ability. The information entry module is convenient for receiving user login information. The data encryption authentication module obtains the user identity information in the memory of the distributed storage module according to the login information for key authentication. The amount of calculation is the lowest, which can greatly reduce the deviation caused by the amount of calculation and enhance the identity authentication capability. In the data matching module, the key is used to complete the matching with the encrypted information of the user identity information. After the match is successful, the system is logged in by triggering the system switch. If the match fails, the system is triggered to shut down and refuse to log in, thereby solving the privacy problem and the reproducibility of biometrics in the data collection process in the prior art, and the technical problem that the security of user identity information data cannot be guaranteed. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 is a system block diagram of the present invention;

[0045] Figure 2 is a system block diagram of the identification module of the present invention;

[0046] Figure 3 A flow chart of the method for building a data trust library;

[0047] Figure 4 A flow chart of the method for extracting the best node;

[0048] Figure 5 A flow chart of the method for analyzing the data encryption authentication module;

[0049] Figure 6Flowchart of the method for detecting AI face-swapping by the recognition module. DETAILED DESCRIPTION

[0050] In order to better understand the technical content of the present invention, specific embodiments are provided below, and the present invention is further described in conjunction with the accompanying drawings.

[0051] See also Figure 1 to Figure 2 The present invention provides an identity verification system based on big data, including: a data acquisition module, a distributed storage module, a data encryption authentication module, an information entry module and a data matching module; the data acquisition module is used to collect user identity information, wherein the user identity information includes user ID card information and face, iris and fingerprint feature information. The user identity information is stored in the distributed storage module, the information entry module is used to receive user login information, the data encryption authentication module obtains the user identity information in the memory of the distributed storage module according to the login information, performs key authentication, and completes the matching in the data matching module through the key and the encrypted information of the user identity information. After the matching is successful, the system switch is triggered to log in to the system, and the matching failure triggers the system to close and refuse login.

[0052] Specifically, the user identity information is collected from the public security database or the user's own trusted device through the data collection module, and the user identity information is stored in the distributed storage module. The distributed storage module has the advantage that trust is dispersed to multiple nodes in the network, reducing the dependence on a single entity and increasing the elasticity and anti-attack of the system. The information entry module is convenient for receiving user login information. The data encryption authentication module obtains the user identity information in the memory of the distributed storage module according to the login information for key authentication. The amount of calculation is the lowest, which can greatly reduce the deviation caused by the amount of calculation and enhance the identity authentication capability. In the data matching module, the key is used to complete the matching with the encrypted information of the user identity information. After the match is successful, the system switch is triggered to log in to the system. If the match fails, the system is triggered to shut down and refuse to log in, thereby solving the privacy problem and the reproducibility of biometrics in the data collection process in the prior art, and the technical problem that the security of user identity information data cannot be guaranteed.

[0053] The distributed storage module includes a data security unit, which is used to build a data trust library.

[0054] Specifically, Agent technology is used to implement the process, and the steps are as follows:

[0055] S101: The Agent first visits the node N, compares the first counter value corresponding to the Agent data with the second counter value of the currently visited node N, and if the second counter value is greater than the first counter value, updates it to the third counter value, and saves the third counter value data in the storage of the node N;

[0056] The mobile agent mechanism provides an efficient, flexible and powerful method to manage and update node status in the distributed storage module. It is suitable for scenarios where node status changes frequently and requires fast response, such as comparing the corresponding first counter value in the agent data with the second counter value of the currently visited node N and recording the update to the third counter value.

[0057] S102: After multiple counter value comparisons are completed in node N, the counter value comparison range is narrowed, the minimum counter value is extracted from the node N storage, and the child node corresponding to the minimum counter value is used as the node to be visited next;

[0058] Through the node access strategy based on counter value, we can not only optimize the workflow of mobile agent and improve system performance, but also enhance the flexibility and responsiveness of the system, while ensuring the effective use of resources and data consistency.

[0059] S103: After extracting the best access node, mark it, add multiple node new data in the Agent, and continue to access;

[0060] By marking the best access nodes and updating the Agent's internal data, the performance and efficiency of the distributed storage module in data processing, resource management, system response and maintenance can be effectively improved.

[0061] S104: After the Agent visits all nodes, it obtains all the best access nodes and completes the construction of the data trust library.

[0062] Building a data trust library not only improves the accuracy and timeliness of data, but also provides necessary information support for the management and optimization of distributed storage modules.

[0063] Furthermore, the best access nodes are extracted including:

[0064] S1031: The Agent technology uses the network node with the minimum counter value as the node for the next network access;

[0065] S1032: If the node with the minimum counter value has not been visited for three consecutive times, the node with the minimum counter value is the best visited node;

[0066] S1033: If the node is visited more than three times, the node corresponding to the node with the next smallest counter value is extracted as the visit object, and so on, until the best visit node is obtained.

[0067] During the operation of the mobile agent, in order to reduce the network overhead to the minimum, the node algorithm with the minimum access overhead is selected.

[0068] In a preferred embodiment, the data encryption authentication module analysis step includes:

[0069] S201: Synchronize the login terminal time with the server used by the user using the network working time protocol technology, and obtain the user access result according to the distributed storage module;

[0070] Various components need to work together to complete complex tasks. Time synchronization can ensure that these components run in the same time frame, avoiding coordination failures due to time differences.

[0071] S202: Using an irreversible calculation method to obtain a dynamic key for accessing the login terminal, and completing symmetric encryption for user authentication;

[0072] The dynamic key generated by the irreversible calculation method using a hash function is not easily reverse engineered. Even if an attacker obtains the hash value of the key, it is difficult to infer the original key, thereby protecting the user's authentication information. Symmetric encryption algorithms use the same key for encryption and decryption, and the use of dynamic keys reduces the need for long-term key storage, reducing the complexity and risk of key management. Symmetric encryption refers to an encryption algorithm that uses the same key for encryption and decryption. Common symmetric encryption algorithms include AES, DES, or 3DES.

[0073] S203: The user authentication information is encrypted twice using the authentication code to complete the user identity authentication of the login terminal.

[0074] By using the authentication code for secondary encryption, the security and reliability of user authentication can be significantly improved while maintaining user convenience.

[0075] Furthermore, before accessing the mobile terminal, the user needs to enter his / her user name N in the login terminal. U And the static password w p , and according to the irreversible algorithm, the user's current access control address Am is obtained;

[0076] Under the irreversible algorithm, the username N U and the password w p Calculate and solve the dynamic key K C , complete the symmetric encryption process, which can be obtained by the following formula:

[0077] K C =f k (A M ,N u ,W p )

[0078] Where: f kFor symmetric encryption calculation, before encrypting the login terminal data, symmetric encryption is performed on the server to obtain the data required by the user.

[0079] Symmetrically encrypting data on the server side during the login process can bring many security advantages, especially when obtaining the data required by the user.

[0080] In a preferred embodiment, matching the encrypted information of the user identity information with the key in the data matching module includes:

[0081] S301: The distributed storage module sends the session key to the user through the network;

[0082] S302: The user decrypts the received session key using his own private key;

[0083] S303: The distributed storage module decrypts the data using the decrypted session key;

[0084] S304: The user verifies the digital signature using the public key of the distributed storage module to ensure that the data has not been tampered with and is indeed from the distributed storage module.

[0085] Specifically, by using session keys for data encryption, even if the private key is leaked, past and future communications are still protected because the session key is a one-time secret key and is only used for this communication, which enhances security. The use of session keys reduces the burden of long-term key management because a new session key can be generated for each communication, which reduces the risk of key leakage. Digital signatures ensure that the data has not been tampered with during transmission and that the data does come from the claimed sender, that is, the distributed storage module. This provides dual guarantees of data integrity and source authentication. It is more efficient to use session keys to encrypt and decrypt actual data. Users do not need to manage complex key pairs, but only need to use their own private keys to decrypt session keys, which simplifies the user-side operation process and improves the user experience.

[0086] In a preferred embodiment, after the match is successful, the system is logged into by triggering a system switch, wherein the triggering system includes:

[0087] After the data matching module completes the matching, the AI ​​face-changing image is detected through the recognition module;

[0088] The recognition module includes an image acquisition unit, an optical recognition unit and a fuzzy interface recognition unit. The image acquisition unit is used to capture the user's facial image when the user logs into the system, and combines it with the optical recognition unit to recognize the facial halo pattern. Finally, the fuzzy interface recognition unit recognizes whether the face has been replaced by AI based on the facial halo pattern recognized by the optical recognition unit.

[0089] The image acquisition unit can use a camera to convert facial visual information into digital signals for further processing and analysis. The optical recognition unit uses optical character recognition technology to identify and parse the unique features of the face from the image. The fuzzy interface recognition unit uses machine learning, computer vision and signal processing technology to analyze the consistency and naturalness of facial movements in the video, such as blinking frequency, head rotation and lip shape changes when speaking. Starting from image acquisition, the optical recognition unit extracts and locates facial features, and finally the fuzzy interface recognition unit determines whether these features are natural and whether there are signs of tampering, so as to identify the content of AI face-changing.

[0090] Among them, optical character recognition technology uses edge detection and color segmentation technology to locate the face area in the image through the face, and locates the key facial feature points, such as the position of the eyes, nose, mouth, and facial contour through feature point positioning. Then, through facial feature extraction, facial features such as texture, color and shape are extracted from the located area for subsequent comparison and analysis.

[0091] The specific steps are as follows:

[0092] S401: using a camera to collect a user's facial image;

[0093] S402: Convert the user's facial image into a grayscale image;

[0094] S403: extracting features from the grayscale image using an image processing algorithm;

[0095] S404: comparing the features in the extracted grayscale image with known user facial features in the database;

[0096] S405: Using fuzzy sets to identify whether there is AI face-swapping in the user's facial image.

[0097] The principle of this step is consistent with the working principle of the above-mentioned image acquisition unit, optical recognition unit and fuzzy interface recognition unit, and will not be repeated here.

[0098] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. An identity verification system based on big data, characterized in that: include: Data acquisition module, distributed storage module, data encryption and authentication module, information entry module and data matching module; The data acquisition module is used to collect user identity information and store the user identity information in the distributed storage module. The information entry module is used to receive user login information. The data encryption authentication module obtains the user identity information in the distributed storage module memory according to the login information for key authentication. The data matching module completes the matching by using the key and the encrypted information of the user identity information. After the match is successful, the system switch is triggered to log in to the system. If the match fails, the system is triggered to shut down and login is rejected.

2. The identity verification system based on big data according to claim 1, characterized in that: The user identity information includes user ID card information and face, iris and fingerprint feature information.

3. The identity verification system based on big data according to claim 1, characterized in that: The distributed storage module includes a data security unit, and the data security unit is used to build a data trust library.

4. The identity verification system based on big data according to claim 3, characterized in that: The data security unit is used to build a data trust library, which is implemented using Agent technology. The steps are as follows: The Agent first visits the node N, compares the first counter value corresponding to the Agent data with the second counter value of the currently visited node N, and if the second counter value is greater than the first counter value, updates it to a third counter value, and saves the third counter value data in the node N storage; After multiple counter values ​​in the node N are compared, the counter value comparison range is narrowed, the minimum counter value is extracted from the node N storage, and the child node corresponding to the minimum counter value is used as the node to be visited next; After extracting the best access node, it is marked, and multiple nodes are added to the Agent to continue accessing; After the Agent visits all nodes, all the best access nodes are obtained, and the construction of the data trust library is completed.

5. The identity verification system based on big data according to claim 4, characterized in that: The extracting of the best access node comprises: The Agent technology uses the network node with the smallest counter value as the node for the next network access; If the node with the minimum counter value has not been visited for three consecutive times, the node with the minimum counter value is the best visited node; If it is visited more than 3 times, the node corresponding to the node with the second smallest counter value is extracted as the visit object, and so on, until the best visit node is obtained.

6. The identity verification system based on big data according to claim 1, characterized in that: The data encryption authentication module analysis step includes: Using the network working time protocol technology to synchronize the login terminal time with the server used by the user, and obtaining the user access result according to the distributed storage module; Using irreversible calculation method to obtain the dynamic key accessed by the login terminal, and complete the symmetric encryption of user authentication; The user authentication information is encrypted twice using the authentication code to complete the user identity authentication of the login terminal.

7. The identity verification system based on big data according to claim 6, characterized in that: Before accessing the mobile terminal, the user needs to enter his / her user name N in the login terminal. U And the static password w p , and according to the irreversible algorithm, obtain the user's current access control address Am; Under the irreversible algorithm, the username N U and the password w p Calculate and solve the dynamic key K C , complete the symmetric encryption process, which can be obtained by the following formula: K C =f k (A M ,N u ,W p ) Where: f k For symmetric encryption calculation, before encrypting the login terminal data, symmetric encryption is performed on the server to obtain the data required by the user.

8. The identity verification system based on big data according to claim 1, characterized in that: The matching of the encrypted information of the user identity information with the key in the data matching module includes: The distributed storage module sends the session key to the user through the network; The user decrypts the received session key using his own private key; The distributed storage module decrypts the data using the decrypted session key; The user verifies the digital signature using the public key of the distributed storage module to ensure that the data has not been tampered with and is indeed from the distributed storage module.

9. The identity verification system based on big data according to claim 1, characterized in that: After the match is successful, the system is logged into by triggering the system switch, wherein the triggering system includes: After the matching is completed according to the data matching module, the AI ​​face-changing image is detected by the recognition module; The recognition module includes an image acquisition unit, an optical recognition unit and a fuzzy interface recognition unit. The image acquisition unit is used to capture the user's facial image when the user logs into the system, and is combined with the optical recognition unit to recognize the facial halo pattern. Finally, the fuzzy interface recognition unit recognizes whether the face has been replaced by AI based on the facial halo pattern recognized by the optical recognition unit.

10. The identity verification system based on big data according to claim 9, characterized in that: The specific detection method of the recognition module for detecting AI face-changing images is as follows: Using a camera to collect user facial images; Converting the user's facial image into a grayscale image; Extracting features from the grayscale image using an image processing algorithm; Comparing the features extracted from the grayscale image with known user facial features in a database; A fuzzy set is used to identify whether AI face-swapping exists in the user's facial image.

Images