Distributed internet-of-things terminal equipment identity authentication and authorization system

Abstract

The invention discloses a distributed internet-of-things terminal equipment identity authentication and authorization system, and the system employs a deep learning technology to carry out the face feature extraction of a face image of a to-be-verified user and a set of authorized user face images stored in a database, and employs the face features of the to-be-verified user as query features. And performing cross-domain query and matching degree evaluation on the face feature set of the authorized user to generate a face matching degree maximum score value, and further performing user identity authentication and access permission assignment based on comparison of the score value and a preset threshold value. In this way, the efficiency and accuracy of identity authentication can be remarkably improved, and meanwhile the calculation burden of the system is reduced.

Description

Technical Field

[0001] The present application relates to the field of intelligent matching, and more specifically, to a distributed IoT terminal device identity authentication and authorization system. Background Art

[0002] In modern power grid systems, with the widespread application of IoT technology, more and more terminal devices are connected to the power grid network. In order to ensure the security and reliability of terminal devices, the authentication and authorization of access users become particularly important. However, traditional IoT terminals lack application security mechanisms, let alone strong security and strong identity authentication mechanisms. Simple password verification can be easily cracked or bypassed, and it is easy to directly attack the device system and be controlled, becoming a new direction for network attacks. The large connection, large bandwidth, and low latency characteristics of 5G networks greatly increase the potential scale of attacks. Once a large number of devices are illegally controlled, unprecedented large-scale network attacks will be launched, paralyzing the basic network.

[0003] The invention patent with publication number CN118503951A proposes a digital identity authentication system based on face recognition, which adopts a distributed architecture to distribute services and data processing in different network areas to improve the security and reliability of the system. However, in the existing face recognition technology, a traversal query method is usually used to compare the face image of the user to be verified with the face images of authorized users stored in the database one by one, and match and authenticate by calculating the similarity between the face image to be verified and each authorized face image. This method is more effective when the number of users is small, but as the number of users increases, the amount of calculation will increase sharply, and the demand for computing resources is too high, which can easily lead to a slow system response speed and a decline in user experience.

[0004] Therefore, an optimized distributed IoT terminal device identity authentication and authorization system is expected. Summary of the invention

[0005] In order to solve the above technical problems, the present application is proposed. The embodiment of the present application provides a distributed IoT terminal device identity authentication and authorization system, which uses deep learning technology to extract facial features from the facial image of the user to be verified and the set of facial images of authorized users stored in the database, and uses the facial features of the user to be verified as query features to perform cross-domain query and match evaluation with the set of facial features of authorized users to generate a maximum facial matching score, and then authenticates the user identity and specifies access rights based on the comparison of the score with a preset threshold. In this way, the efficiency and accuracy of identity authentication can be significantly improved, while reducing the system computing burden.

[0006] According to one aspect of the present application, a distributed IoT terminal device identity authentication and authorization system is provided, which includes:

[0007] An image data acquisition module is used to acquire a face image of a user to be verified and extract a set of face images of authorized users from a database;

[0008] A face feature extraction module, used to extract the face features of each authorized user face image in the set of the face image of the user to be verified and the face image of the authorized user respectively to obtain a set of face feature vectors of the user to be verified and face feature vectors of the authorized user;

[0009] A cross-domain query matching module, used to perform cross-domain query matching on the set of the face feature vector to be verified and the face feature vector of the authorized user to obtain a face cross-domain query matching feature vector;

[0010] A matching degree generating module, used for generating a maximum face matching degree score value based on the face cross-domain query matching feature vector;

[0011] An identity verification module, configured to confirm that the identity verification of the user to be verified is successful in response to the maximum face matching score being greater than or equal to a preset matching threshold;

[0012] The access authority specifying module is used to specify the access authority of the user to be verified based on the identity tag of the user to be verified.

[0013] Compared with the prior art, the distributed IoT terminal device identity authentication and authorization system provided by the present application uses deep learning technology to extract facial features from the face image of the user to be verified and the collection of facial images of authorized users stored in the database, and uses the facial features of the user to be verified as query features to perform cross-domain query and match evaluation with the collection of facial features of authorized users to generate the maximum facial match score, and then authenticates the user identity and specifies access rights based on the comparison between the score and the preset threshold. In this way, the efficiency and accuracy of identity authentication can be significantly improved, while reducing the system computing burden. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] By describing the embodiments of the present application in more detail in conjunction with the accompanying drawings, the above and other purposes, features and advantages of the present application will become more apparent. The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0015] Figure 1A block diagram of a distributed IoT terminal device identity authentication and authorization system according to an embodiment of the present application;

[0016] Figure 2 Schematic diagram of data flow of a distributed IoT terminal device identity authentication and authorization system according to an embodiment of the present application. DETAILED DESCRIPTION

[0017] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0018] As shown in this application and claims, unless the context clearly indicates an exception, the words "a", "an", "an" and / or "the" do not refer to the singular and may also include the plural. Generally speaking, the terms "include" and "comprise" only indicate the inclusion of the steps and elements that have been clearly identified, and these steps and elements do not constitute an exclusive list. The method or device may also include other steps or elements.

[0019] Although the present application makes various references to certain modules in the system according to the embodiments of the present application, any number of different modules can be used and run on the user terminal and / or server. The modules are only illustrative, and different aspects of the system and method can use different modules.

[0020] Flowcharts are used in the present application to illustrate the operations performed by the system according to the embodiments of the present application. It should be understood that the preceding or following operations are not necessarily performed accurately in order. On the contrary, various steps may be processed in reverse order or simultaneously as required. Meanwhile, other operations may also be added to these processes, or a certain step or several steps of operations may be removed from these processes.

[0021] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0022] In existing face recognition technology, a traversal query method is usually used to compare the face image of the user to be verified with the face images of authorized users stored in the database one by one, and perform matching authentication by calculating the similarity between the face image to be verified and each authorized face image. This method is more effective when the number of users is small, but as the number of users increases, the amount of calculation will increase dramatically, and the demand for computing resources will be too high, which can easily lead to a slow system response speed and a decrease in user experience. Therefore, an optimized distributed IoT terminal device identity authentication and authorization system is expected.

[0023] In the technical solution of the present application, a distributed IoT terminal device identity authentication and authorization system is proposed. Figure 1 It is a block diagram of a distributed IoT terminal device identity authentication and authorization system according to an embodiment of the present application. Figure 2 Schematic diagram of data flow of a distributed IoT terminal device identity authentication and authorization system according to an embodiment of the present application. Figure 1 and Figure 2 As shown, according to the embodiment of the present application, the distributed IoT terminal device identity authentication and authorization system 300 includes: an image data acquisition module 310, which is used to acquire the face image of the user to be verified and extract a set of authorized user face images from the database; a face feature extraction module 320, which is used to extract the face features of each authorized user face image in the face image of the user to be verified and the set of authorized user face images respectively to obtain a face feature vector to be verified and a set of authorized user face feature vectors; a cross-domain query matching module 330, which is used to perform cross-domain query matching on the face feature vector to be verified and the set of authorized user face feature vectors to obtain a face cross-domain query matching feature vector; a matching degree generation module 340, which is used to generate a maximum face matching degree score value based on the face cross-domain query matching feature vector; an identity authentication confirmation module 350, which is used to confirm that the identity authentication of the user to be verified is successful in response to the maximum face matching degree score value being greater than or equal to a preset matching threshold; an access permission designation module 360, which is used to designate the access permission of the user to be verified based on the identity tag of the user to be verified.

[0024] In particular, the image data acquisition module 310 is used to acquire the facial image of the user to be verified and extract a set of facial images of authorized users from the database. It should be understood that facial images are an effective identity authentication method in biometric technology and provide highly personalized identification information. By comparing the facial image of the user to be verified with the facial images of known authorized users, the identity of the user can be directly and accurately verified.

[0025] In particular, the facial feature extraction module 320 is used to extract facial features of each authorized user facial image in the facial image of the user to be verified and the set of authorized user facial images to obtain a facial feature vector to be verified and a set of authorized user facial feature vectors. In a specific example of the present application, the facial image of the user to be verified and each authorized user facial image in the set of authorized user facial images are respectively passed through a facial feature extractor based on a hole convolutional neural network model to obtain a set of facial feature vectors to be verified and authorized user facial feature vectors. In order to improve the efficiency and accuracy of facial feature extraction, the present application adopts a hole convolutional neural network model with excellent performance in image processing tasks as a facial feature extractor to perform feature extraction on the facial image of the user to be verified and each authorized user facial image in the set of authorized user facial images. It should be understandable that the atrous convolutional neural network introduces holes (or called dilation rates) in the convolutional layer, so that the convolution kernel can cover a larger receptive field during the convolution operation, and extract richer facial feature information without increasing the number of parameters and the amount of calculation. It can simultaneously capture the global structural information and local detail features of the face (such as the position and shape of the eyes, nose, mouth and other parts), generate a set of facial feature vectors to be verified and facial feature vectors of authorized users, which helps to improve the accuracy and generalization ability of face recognition.

[0026] In particular, the cross-domain query matching module 330 is used to perform cross-domain query matching on the set of the face feature vector to be verified and the face feature vector of the authorized user to obtain the face cross-domain query matching feature vector. In a specific example of the present application, the face feature vector to be verified is used as the query feature vector, and the set of the face feature vectors of the authorized user is used as the set of library feature vectors. The face feature vector to be verified and the set of the face feature vector of the authorized user are input into a cross-domain attention gate query encoder based on the local association enhancement of the key matrix to obtain the face cross-domain query matching feature vector. User identity authentication is performed by performing feature query matching analysis on the set of the face feature vector to be verified and the face feature vector of the authorized user. It is worth mentioning that in order to avoid the high computational complexity problem caused by the traditional traversal query method, the present application proposes a cross-domain attention gate query encoder based on the local association enhancement of the key matrix to perform feature query matching analysis. Specifically, the facial feature vector to be verified is used as a query feature vector, and the set of facial feature vectors of the authorized users is used as a set of library feature vectors, which are jointly input into the cross-domain attention gate query encoder. The encoder first performs a linear transformation on each facial feature vector of the authorized users to adjust its feature representation dimension so that it is aligned with the feature dimension of the facial feature vector to be verified, so as to construct an initial key matrix. Then, the facial feature vector to be verified is used as a common soft anchor reference point, and the local correlation strength contained between each key vector is revealed by calculating the feature distribution difference energy coefficient between the facial feature vector to be verified and each key vector in the initial key matrix. Secondly, for the key vector corresponding to the feature distribution difference energy coefficient less than a predetermined difference threshold, its feature representation is updated using its mean vector with the facial feature vector to be verified, so as to further strengthen the facial feature representation of the authorized user that is more similar to the facial feature to be verified, and generate an updated key matrix to improve the pertinence and matching quality of the key matrix. Then, based on the facial feature vector to be verified, a query vector and a value vector are constructed, and each row vector in the updated key matrix is ​​used as a key vector. Through the self-attention calculation of the Transformer structure, cross-domain information integration is realized to obtain a cross-domain query attention vector between the facial features to be verified and the facial features of each authorized user. Finally, the position-based mean of each cross-domain query attention vector is calculated to integrate the matching information of all authorized users and generate a comprehensive face cross-domain query matching feature vector.

[0027] Specifically, in an embodiment of the present application, a cross-domain query match is performed on the face feature vector to be verified and the set of authorized user face feature vectors to obtain a face cross-domain query match feature vector, including: performing a linear transformation on each authorized user face feature vector in the set of authorized user face feature vectors to obtain an initial key matrix, wherein each row vector in the initial key matrix is ​​an authorized user face feature vector after each linear transformation; calculating a feature distribution difference energy coefficient between the face feature vector to be verified and each row vector in the initial key matrix to obtain a set of feature distribution difference energy coefficients; comparing each feature distribution difference energy coefficient in the set of feature distribution difference energy coefficients with a predetermined threshold, and in response to the The feature distribution difference energy coefficient is less than a predetermined difference threshold, and the row vector corresponding to the feature distribution difference energy coefficient and the mean vector between the face feature vector to be verified are used as the updated row vector to obtain an updated key matrix; the face feature vector to be verified is processed using a value embedding matrix to obtain a value vector; the face feature vector to be verified is used as a query vector and each row vector in the updated key matrix is ​​used as a key vector, and the query vector, the key vector and the value vector are input into a cross-domain attention gate query module based on a Transformer structure to obtain a sequence of face feature cross-domain query attention vectors; the position-wise mean vector of the sequence of face feature cross-domain query attention vectors is calculated to obtain the face cross-domain query matching feature vector.

[0028] More specifically, the process of calculating the feature distribution difference energy coefficients between the face feature vector to be verified and each row vector in the initial key matrix to obtain a set of feature distribution difference energy coefficients includes: extracting the difference features between the face feature vector to be verified and each row vector in the initial key matrix respectively to obtain a set of face-related difference feature vectors; calculating the energy coefficients of each face-related difference feature vector in the set of face-related difference feature vectors to obtain the set of feature distribution difference energy coefficients. Wherein, extracting the difference features between the face feature vector to be verified and each row vector in the initial key matrix respectively to obtain a set of face-related difference feature vectors includes: calculating the position point addition, position point subtraction and position point multiplication between the face feature vector to be verified and the row vector to obtain the first matching fusion result, the second matching fusion result and the third matching fusion result; after cascading the first matching fusion result, the second matching fusion result and the third matching fusion result into a multi-scale semantic matching vector of face features, one-dimensional convolution processing and maximum pooling processing are performed on them to obtain the face-related difference feature vector. More specifically, the feature distribution difference energy coefficient between the face feature vector to be verified and each row vector in the initial key matrix is ​​calculated to obtain a set of feature distribution difference energy coefficients, and it also includes: calculating the square of the difference between the maximum eigenvalue of the face-associated difference feature vector and its feature mean, the feature variance of the face-associated difference feature vector, and the weighted sum of the bias terms, and dividing the sum of the feature variance of the face-associated difference feature vector and the bias term by the weighted sum to obtain the feature distribution difference energy coefficient.

[0029] In summary, in the above embodiment, cross-domain query matching is performed on the set of the face feature vector to be verified and the face feature vector of the authorized user to obtain the face cross-domain query matching feature vector, including: processing the set of the face feature vector to be verified and the face feature vector of the authorized user with the following cross-domain query matching formula to obtain the face cross-domain query matching feature vector, wherein the cross-domain query matching formula is:

[0030] K={k1,k2,...,k n}

[0031] M o ={k 1′ ;k 2′ ;...;k n′}

[0032] k i′ =f(k i ,W k ) = k i W k +b k

[0033]

[0034]

[0035]

[0036] v v =v q W q +b q

[0037]

[0038]

[0039] Where K represents the set of facial feature vectors of the authorized user, k1, k2, k i and k n are the first, second, i-th and n-th authorized user face feature vectors in the set of authorized user face feature vectors, respectively, and the value of n is the number of feature vectors in the set of authorized user face feature vectors. k is the linear transformation matrix, b k , b q and λ are different bias terms, M o represents the initial bond matrix, k 1′ , k 2′ , k i′ and k n′ are the first, second, i-th and n-th row vectors in the initial key matrix, i.e., the facial feature vectors of the authorized user after linear transformation, v q represents the face feature vector to be verified, ⊙ represents the dot product, Indicates point addition, represents point subtraction, [·,·,·] represents a cascade operation, MaxPool(·) represents a maximum pooling operation, conv1D(·) represents a one-dimensional convolution operation, and R i represents the eigenvector of the associated difference of the i-th face, σ i 2 、max(R i ) and μ i denote the feature variance, maximum eigenvalue and feature mean of the eigenvector of the i-th face association difference, respectively, e(R i ) is the i-th feature distribution difference energy coefficient in the set of feature distribution difference energy coefficients, θ is a predetermined threshold, M i represents the update key matrix, k i″ represents the i-th row vector in the update key matrix, Wq is the value embedding matrix, v v is a value vector, softmax is a normalized exponential function, the value of d is the length of the row vector in the update key matrix, (·) T represents the transpose of a vector, v pi is the i-th face feature cross-domain query attention vector, and V represents the face cross-domain query matching feature vector.

[0040] In particular, the matching degree generation module 340 is used to generate a maximum face matching degree score based on the face cross-domain query matching feature vector. In a specific example of the present application, the face cross-domain query matching feature vector is input into a decoder-based face matching degree evaluator to obtain the maximum face matching degree score. Since the face cross-domain query matching feature vector contains the matching information of the facial features of the user to be verified and all authorized users, in order to further confirm the identity of the user, the present application uses a decoder-based face matching degree evaluator to perform decoding and regression processing on the face cross-domain query matching feature vector, and performs a nonlinear transformation on the face cross-domain query matching feature vector through a multi-layer neural network structure to extract deeper matching information therein, and uses a regression method to calculate the maximum face matching degree score at the output layer of the decoder.

[0041] In a preferred example, considering that the set of the facial feature vector to be verified and the set of the facial feature vector of the authorized user represent the image semantic features of the facial image of the user to be verified and the image semantic features of the facial image of the authorized user, respectively, when the facial feature vector to be verified is used as the query feature vector and the set of the facial feature vectors of the authorized user is used as the set of library feature vectors, and the facial feature vector to be verified and the set of the facial feature vector of the authorized user are input into a cross-domain attention gate query encoder based on local association enhancement of the key matrix, due to the difference in local association enhancement of the semantic features of the authorized facial image and the superimposed cross-domain attention gate query encoding difference, the face cross-domain query matching feature vector will have a diversified set expression distribution of image encoding semantic features. Therefore, it is expected to improve the balance between the regression mapping accuracy and completeness when the face cross-domain query matching feature vector is input into the decoder-based face matching evaluator for decoding regression, thereby improving the accuracy of the obtained maximum face matching score value.

[0042] Based on this, in the preferred example, inputting the face cross-domain query matching feature vector into a decoder-based face matching evaluator to obtain the maximum face matching score specifically includes:

[0043] Calculate the sum of the absolute values ​​of each eigenvalue of the face cross-domain query matching feature vector to obtain a first face cross-domain query matching space structure value, and calculate the square root of the sum of the squares of each eigenvalue of the face cross-domain query matching feature vector to obtain a second face cross-domain query matching space structure value;

[0044] Multiplying each feature value of the face cross-domain query matching feature vector by the first face cross-domain query matching space structure value and the second face cross-domain query matching space structure value respectively to obtain a first face cross-domain query matching structure reference value and a second face cross-domain query matching structure reference value corresponding to each feature value;

[0045] Multiplying each eigenvalue of the face cross-domain query matching feature vector by the length of the face cross-domain query matching feature vector and the square root of the length to obtain a first face cross-domain query matching scale transformation value and a second face cross-domain query matching scale transformation value corresponding to each eigenvalue;

[0046] Dividing the first face cross-domain query matching structure reference value by the difference between the first face cross-domain query matching space structure value and the first face cross-domain query matching scale transformation value to obtain a first face cross-domain query matching transformation adjustment value;

[0047] Dividing the second face cross-domain query matching structure reference value by the difference between the second face cross-domain query matching space structure value and the second face cross-domain query matching scale transformation value to obtain a second face cross-domain query matching transformation adjustment value;

[0048] Calculating a weighted sum of the first face cross-domain query matching transformation adjustment value and the second face cross-domain query matching transformation adjustment value to obtain each feature value of the optimized face cross-domain query matching feature vector;

[0049] The optimized face cross-domain query matching feature vector is input into a decoder-based face matching evaluator to obtain a maximum face matching score.

[0050] Here, the face cross-domain query matching feature vector, denoted as V, is optimized as follows:

[0051]

[0052]

[0053] v 2i =(α×v i ) / (α-L×v i )

[0054]

[0055] v i ∈V∈R 1×L

[0056] v 1i ∈V1∈R 1×L

[0057] v 2i ∈V2∈R 1×L

[0058] Where V is the face cross-domain query matching feature vector, R represents a real number set, and v i represents the feature value of the ith position of the face cross-domain query matching feature vector, L represents the length of the face cross-domain query matching feature vector, α represents the first face cross-domain query matching space structure value, β represents the second face cross-domain query matching space structure value, ⊙ represents the position point multiplication, ⊕ represents the position addition, V1 represents the second face cross-domain query matching transformation adjustment vector, v1 i represents the second face cross-domain query matching transformation adjustment value, V2 represents the first face cross-domain query matching transformation adjustment vector, v 2i represents the first face cross-domain query matching transformation adjustment value, ω represents the weighted hyperparameter, and V' represents the optimized face cross-domain query matching feature vector.

[0059] Therefore, in the preferred example, with respect to the spatial structure information of the feature set of the face cross-domain query matching feature vector in the high-dimensional space, the scale-based frame transformation of each feature value of the face cross-domain query matching feature vector is performed by taking the class-norm spatial structured representation of the face cross-domain query matching feature vector as a reference window, and the spatial structure-based frame attention weight adjustment of each feature value of the face cross-domain query matching feature vector is implemented to ensure the invariance of the spatial transformation (translation, scaling and rotation) of the face cross-domain query matching feature vector under the interaction of feature space, thereby improving the convergence and generalization effects of the decoding regression of the feature set of the face cross-domain query matching feature vector under the complex spatial structure representation, so as to achieve the balanced executableness between mapping accuracy and mapping completeness in the decoding regression process based on the discretized feature distribution of the face cross-domain query matching feature vector, and improve the accuracy of the maximum face matching score value obtained by the face cross-domain query matching feature vector input into the decoder-based face matching evaluator.

[0060] In particular, the identity verification module 350 is used to confirm that the identity verification of the user to be verified is successful in response to the maximum face matching score being greater than or equal to a preset matching threshold. That is, if the maximum face matching score is higher than the preset matching threshold, it means that there is an authorized user in the database whose facial features are highly matched with those of the user to be verified, thereby confirming that the identity verification of the user to be verified is successful. On the contrary, if the maximum face matching score is lower than the preset matching threshold, it means that the user to be verified is not an authorized user in the database, and its access request will be rejected.

[0061] In particular, the access rights designation module 360 ​​is used to designate the access rights of the user to be verified based on the identity tag of the user to be verified. That is, after confirming the identity of the user to be verified, the corresponding access rights will be assigned according to its identity tag. Among them, the identity tag is a predefined role type, such as administrator, operation and maintenance personnel, ordinary user, etc. At the same time, each identity tag corresponds to a set of specific access rights, which defines the resources that the user can access and the operations that can be performed.

[0062] As described above, the distributed IoT terminal device identity authentication and authorization system 300 according to the embodiment of the present application can be implemented in various wireless terminals, such as a server with a distributed IoT terminal device identity authentication and authorization algorithm. In a possible implementation, the distributed IoT terminal device identity authentication and authorization system 300 according to the embodiment of the present application can be integrated into the wireless terminal as a software module and / or a hardware module. For example, the distributed IoT terminal device identity authentication and authorization system 300 can be a software module in the operating system of the wireless terminal, or it can be an application developed for the wireless terminal; of course, the distributed IoT terminal device identity authentication and authorization system 300 can also be one of the many hardware modules of the wireless terminal.

[0063] Alternatively, in another example, the distributed IoT terminal device authentication and authorization system 300 and the wireless terminal may also be separate devices, and the distributed IoT terminal device authentication and authorization system 300 may be connected to the wireless terminal via a wired and / or wireless network, and transmit interactive information in accordance with an agreed data format.

[0064] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A distributed IoT terminal device identity authentication and authorization system, characterized in that: include: An image data acquisition module is used to acquire a face image of a user to be verified and extract a set of face images of authorized users from a database; A face feature extraction module, used to extract the face features of each authorized user face image in the set of the face image of the user to be verified and the face image of the authorized user respectively to obtain a set of face feature vectors of the user to be verified and face feature vectors of the authorized user; A cross-domain query matching module, used to perform cross-domain query matching on the set of the face feature vector to be verified and the face feature vector of the authorized user to obtain a face cross-domain query matching feature vector; A matching degree generating module, used for generating a maximum face matching degree score value based on the face cross-domain query matching feature vector; An identity verification module, configured to confirm that the identity verification of the user to be verified is successful in response to the maximum face matching score being greater than or equal to a preset matching threshold; The access authority specifying module is used to specify the access authority of the user to be verified based on the identity tag of the user to be verified.

2. The distributed IoT terminal device identity authentication and authorization system according to claim 1, characterized in that: The facial feature extraction module is used to: The facial image of the user to be verified and each authorized user facial image in the set of authorized user facial images are respectively passed through a facial feature extractor based on a hole convolutional neural network model to obtain a set of facial feature vectors of the user to be verified and a set of facial feature vectors of the authorized user.

3. The distributed IoT terminal device identity authentication and authorization system according to claim 2 is characterized in that: The cross-domain query matching module is used to: The face feature vector to be verified is used as the query feature vector, and the set of authorized user face feature vectors is used as the set of library feature vectors. The face feature vector to be verified and the set of authorized user face feature vectors are input into a cross-domain attention gate query encoder based on key matrix local association enhancement to obtain the face cross-domain query matching feature vector.

4. The distributed IoT terminal device identity authentication and authorization system according to claim 3 is characterized in that: The cross-domain query matching module includes: A linear transformation unit, used for performing a linear transformation on each authorized user face feature vector in the set of authorized user face feature vectors to obtain an initial key matrix, wherein each row vector in the initial key matrix is ​​a linearly transformed authorized user face feature vector; A feature distribution difference measurement unit, used for calculating the feature distribution difference energy coefficients between the feature vector of the face to be verified and each row vector in the initial key matrix to obtain a set of feature distribution difference energy coefficients; a key matrix updating unit, configured to compare each feature distribution difference energy coefficient in the set of feature distribution difference energy coefficients with a predetermined threshold, and in response to the feature distribution difference energy coefficient being less than the predetermined difference threshold, using a mean vector between a row vector corresponding to the feature distribution difference energy coefficient and a feature vector of the face to be verified as an updated row vector to obtain an updated key matrix; A value vector calculation unit, used for processing the face feature vector to be verified using a value embedding matrix to obtain a value vector; A cross-domain query unit, used to use the face feature vector to be verified as a query vector and each row vector in the update key matrix as a key vector, and input the query vector, the key vector and the value vector into a cross-domain attention gate query module based on a Transformer structure to obtain a sequence of cross-domain query attention vectors of face features; The global matching aggregation unit is used to calculate the positional mean vector of the sequence of the face feature cross-domain query attention vector to obtain the face cross-domain query matching feature vector.

5. According to the distributed IoT terminal device identity authentication and authorization system of claim 4, the feature distribution difference measurement unit comprises: A difference feature extraction subunit, used to respectively extract difference features between the face feature vector to be verified and each row vector in the initial key matrix to obtain a set of face-related difference feature vectors; The energy coefficient calculation subunit is used to calculate the energy coefficient of each face-related difference feature vector in the set of face-related difference feature vectors to obtain the set of feature distribution difference energy coefficients.

6. According to the distributed IoT terminal device identity authentication and authorization system of claim 5, the difference feature extraction subunit is used to: Calculate the position point addition, position point subtraction and position point multiplication between the face feature vector to be verified and the row vector to obtain a first matching fusion result, a second matching fusion result and a third matching fusion result; After the first matching fusion result, the second matching fusion result and the third matching fusion result are cascaded into a multi-scale semantic matching vector of facial features, one-dimensional convolution processing and maximum pooling processing are performed on them to obtain the facial association difference feature vector.

7. According to the distributed IoT terminal device identity authentication and authorization system of claim 6, the feature distribution difference measurement unit is used to: Calculate the square of the difference between the maximum eigenvalue of the face-associated difference feature vector and its eigenmean, the feature variance of the face-associated difference feature vector and the weighted sum of the bias term, and divide the sum of the feature variance of the face-associated difference feature vector and the bias term by the weighted sum to obtain the feature distribution difference energy coefficient.

8. The distributed IoT terminal device identity authentication and authorization system according to claim 7, characterized in that: The matching degree generating module is used for: The face cross-domain query matching feature vector is input into a decoder-based face matching degree evaluator to obtain the maximum face matching degree score value.

Images