An identity authentication method combining AI and cryptography

Abstract

The application relates to the technical field of intelligent security and protection, and discloses an identity authentication method combining AI and password technology. The method collects biological feature data through a multi-modal biological sensor, and the biological feature data is encrypted after being processed by a deep convolutional neural network. An identity authentication model is trained by using a federal learning framework combined with a differential privacy technology, and distributed verification is performed. A one-time dynamic password is generated based on a verification result, a matrix is constructed by binding the one-time dynamic password to user behavior space-time features, and an attribute-based encryption algorithm is used to control access permissions. An abnormal behavior detection model, a dynamic identity identification updating mechanism, a key updating strategy and a multi-factor authentication decision engine are further arranged. The method improves the security and accuracy of identity authentication, realizes fine permission management, and is suitable for the field of intelligent security and protection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of intelligent security and protection, and particularly to an identity authentication method combining AI and password technology. BACKGROUND

[0002] In today's digital age, intelligent security and protection systems are widely used in various fields, from home security to enterprise key area monitoring, to public place security, and their importance is increasingly prominent. Identity authentication, as the core link of intelligent security and protection systems, is directly related to the security and reliability of the entire system. However, traditional identity authentication technology has exposed many defects in the face of increasingly complex network environments and continuously improving security needs.

[0003] Early identity authentication methods based on passwords and passcodes, although simple and easy to use, have significant security risks. Users often set simple and repetitive passwords for ease of remembering, which makes passwords extremely easy to guess or obtain through brute force cracking methods. For example, in some social platforms or small e-commerce websites, due to the overly simple password settings, a large number of user accounts have been misused, personal information has been leaked, and users have suffered serious economic losses and privacy violations. Moreover, as the number of accounts users need to manage continues to increase, it becomes difficult to remember multiple complex passwords, and many users choose to use the same password on different platforms. Once a security vulnerability occurs on one platform, the accounts on other associated platforms will also be at risk.

[0004] The advent of biometric recognition technology has improved the security of identity authentication to some extent. However, traditional single biometric recognition technologies, such as fingerprint recognition and facial recognition, have obvious limitations. Fingerprint recognition is susceptible to the surface condition of the finger, such as injury, water, and stains, which can cause recognition failure; facial recognition is sensitive to factors such as light conditions, facial expression changes, makeup, and cosmetic procedures. For example, in a dimly lit environment, the accuracy of facial recognition systems will decrease significantly; when a user's finger is injured, a fingerprint recognition device may not be able to accurately identify fingerprint information. In addition, the amount of information contained in a single biometric feature is limited, making it difficult to provide high enough security to meet the needs of highly secure scenarios, such as core area access control in financial institutions and personnel access management in military bases.

[0005] With the development of Internet of Things and big data technology, a large amount of user data is transmitted and stored in the intelligent security system. Traditional identity authentication methods perform poorly in data privacy protection and cannot effectively prevent user information from being stolen and tampered with during transmission and storage. For example, in the smart home system, cameras, sensors and other devices collect a large amount of user life data. If there is a vulnerability in the identity authentication link, hackers may obtain these data by attacking the system, seriously infringing on the privacy of users. At the same time, in a distributed intelligent security environment, collaborative authentication and data sharing between different devices and nodes face great challenges. How to realize efficient distributed identity authentication under the premise of ensuring data security and privacy has become a problem to be solved in the current intelligent security field. For example, in a large commercial park or city-level security monitoring network, numerous monitoring cameras, access control devices and other devices need to work collaboratively to perform identity authentication, but traditional methods cannot meet the security and efficiency requirements in a distributed environment. SUMMARY

[0006] The present application aims to provide an AI and password technology integrated identity authentication method to solve the problems raised in the background art.

[0007] To achieve the above-mentioned purpose, the present application provides the following technical solution: an AI and password technology integrated identity authentication method, the method comprising:

[0008] Collecting biological feature data of a user through a multi-modal biological sensor, the multi-modal biological sensor comprising an iris scanning module, a voiceprint collecting module and a fingerprint collecting module; performing multi-scale feature extraction and fusion on the biological feature data based on a deep convolutional neural network to generate a high-dimensional biological feature vector; performing homomorphic encryption processing on the high-dimensional biological feature vector to construct an encrypted biological feature ciphertext;

[0009] Inputting the biological feature ciphertext into an identity authentication model in a federated learning framework, the federated learning framework adopting distributed node collaborative training, performing noise injection on model gradients based on differential privacy technology to generate privacy-protected global model parameters; performing distributed verification on the user identity through the global model parameters;

[0010] Dynamically generating a one-time dynamic password based on the verification result, the one-time dynamic password generating a random seed through a quantum random number generator and iteratively generating a dynamic password sequence in combination with a chaotic mapping algorithm; binding the dynamic password sequence with user behavior spatiotemporal features to construct a spatiotemporal dynamic password matrix;

[0011] The attribute-based encryption algorithm is used for access permission control on the spatiotemporal dynamic password matrix, a mapping relationship between user attributes and resource access rules is defined through a policy tree, and a ciphertext policy parameter is generated; and the authentication data is decrypted and authorized according to the ciphertext policy parameter, so that the identity authentication process is completed.

[0012] Preferably, the biological feature data is subjected to multi-scale feature extraction and fusion based on a deep convolutional neural network to generate a high-dimensional biological feature vector, which includes the following steps:

[0013] A multi-branch feature extraction network is constructed, each branch corresponding to one biological modality, the multi-branch network including an iris branch network, a voiceprint branch network, a fingerprint branch network and a behavior branch network; the iris branch network uses a hollow convolutional layer to extract local invariance features of iris texture, the voiceprint branch network uses a time-frequency transform layer and an attention mechanism to fuse the spectral features of speech, the fingerprint branch network uses a residual coding module to extract the ridge topology structure of fingerprint, and the behavior branch network uses a three-dimensional convolutional layer to capture the spatiotemporal correlation of dynamic behavior;

[0014] The multi-branch output features are subjected to dimension alignment through a cross-modality feature alignment module, and an adaptive weight distribution mechanism is used to dynamically adjust the fusion weights of the features of each modality; a feature relationship graph is constructed based on a graph convolutional network, and cross-modality feature graph structure fusion is realized through node embedding and edge weight calculation;

[0015] The fused features are subjected to sparse coding, and an autoencoder is used to reduce the dimension and remove the redundancy of the high-dimensional features to generate a compact biological feature vector.

[0016] Preferably, the federated learning framework uses distributed node collaborative training, and the model gradient is subjected to noise injection based on differential privacy technology, which includes the following steps:

[0017] An identity authentication sub-model is constructed at the local node, and the sub-model uses a lightweight neural network structure including an input layer, a gated recurrent unit layer and a fully connected layer;

[0018] In the local training stage, the model gradient is calculated based on the local biological feature data, and a Gaussian mechanism is used to add noise to the gradient matrix, and the noise intensity is dynamically adjusted according to the sensitivity threshold and the privacy budget;

[0019] In the model aggregation stage, the gradient ciphertext is aggregated through a secure multi-party computation protocol, and the Paillier homomorphic encryption algorithm is used to encrypt and transmit the gradient data; after the encrypted gradient is decrypted by the central server, the global gradient update quantity is generated based on the weighted average algorithm;

[0020] The legality of the gradient update of each node is verified through a zero-knowledge proof protocol to ensure the integrity and tamper resistance of the aggregation process.

[0021] Preferably, the generation of the one-time dynamic password comprises:

[0022] An initial random seed is generated by a quantum random number generator, and a true random number is generated by measuring a quantum entangled state with a photoelectric effect random pulse sequence;

[0023] The random seed is iteratively expanded based on a Logistic chaotic mapping algorithm, and the unpredictability of the chaotic sequence is dynamically adjusted by a bifurcation parameter;

[0024] The chaotic sequence is divided into multiple sub-segments, and a hash chain structure is used to cascade encrypt the sub-segments to generate a dynamic password primitive;

[0025] The spatiotemporal feature vector is constructed by combining the user behavior spatiotemporal characteristics, including geographic location coordinates, device motion acceleration, and operation time stamps; and the dynamic password primitive and the spatiotemporal feature vector are subjected to tensor product operation to generate a spatiotemporal dynamic password matrix.

[0026] Preferably, the access permission control of the spatiotemporal dynamic password matrix based on an attribute-based encryption algorithm comprises:

[0027] An attribute-based encryption system based on bilinear pairing is constructed, and a matching rule of user attribute set and resource access policy is defined;

[0028] The access policy is encoded into a monotonic access tree structure, and the leaf nodes correspond to user attributes, and the non-leaf nodes define logical gate threshold conditions;

[0029] A linear secret sharing scheme is used to split the master key to generate attribute-associated sub-key components;

[0030] When encrypting the spatiotemporal dynamic password matrix, the access tree structure is embedded in the ciphertext header, and the ciphertext policy parameters are generated based on elliptic curve point operation;

[0031] In the decryption phase, partial decryption and permission hierarchical control are realized through matching degree calculation of user attribute private key and ciphertext policy.

[0032] Preferably, the method further comprises:

[0033] An abnormal behavior detection model is constructed based on a generative adversarial network, and the model comprises a generator and a discriminator;

[0034] The generator adopts a variational autoencoder structure to learn the latent distribution by reconstructing normal user behavior sequences;

[0035] The discriminator adopts a spatiotemporal convolutional network to discriminate the authenticity of the input behavior sequence;

[0036] In the training phase, the generator and discriminator parameters are optimized by combining the adversarial loss function and the reconstruction loss function;

[0037] In the detection phase, the reconstruction error and discriminator confidence of the behavior sequence are calculated, and the abnormal behavior is determined and the secondary authentication is triggered by combining the dynamic threshold.

[0038] Preferably, the training of the abnormal behavior detection model comprises:

[0039] The user historical behavior data is sliced to construct the spatio-temporal behavior sequence sample;

[0040] The local spatio-temporal pattern of the sequence is extracted by using the sliding window mechanism, and the adversarial sample is generated by data augmentation;

[0041] The attention mechanism is introduced in the generator to dynamically focus on the reconstruction accuracy of the key behavior segment;

[0042] The gradient penalty term is embedded in the discriminator to improve the training stability by measuring the Wasserstein distance;

[0043] The progressive training strategy is adopted to gradually increase the length and complexity of the behavior sequence.

[0044] Preferably, the method further comprises:

[0045] Based on the secure hash chain, a dynamic identity update mechanism is constructed to bind the user identity and the device hardware fingerprint;

[0046] After each successful authentication, the current identity and timestamp are hashed by using the hash algorithm to generate the next period identity;

[0047] The integrity of the historical identity is verified by using the Merkle tree structure to ensure the non-tamperability of the identity chain;

[0048] The Byzantine fault-tolerant protocol is used to synchronize the identity state among the distributed nodes, and the global identity registry is updated after reaching consensus.

[0049] Preferably, the method further comprises:

[0050] In the key update phase, the long short-term memory network is used to predict the channel bit error rate, and the key distribution rate is dynamically adjusted;

[0051] The session key and identity binding key are generated by combining the key derivation function and the physical layer channel characteristics;

[0052] The transmission key is fault-tolerant encoded by using the quantum error correction code.

[0053] Preferably, the method further comprises:

[0054] A multi-factor authentication decision engine is constructed, which integrates biometric confidence, dynamic password verification results, behavioral anomaly scores, and device fingerprint matching degrees;

[0055] Fuzzy logic rules are used to define the weight allocation strategy of each factor, and the contribution degree of the evaluation index is quantified by the membership function;

[0056] The optimal authentication decision threshold is solved based on a multi-objective optimization algorithm, and the optimization objectives include minimizing the false recognition rate and minimizing the missed recognition rate;

[0057] The decision result is input into a state machine model to drive the state transition and permission level control of the authentication process.

[0058] Compared with the prior art, the beneficial effects of the present application are:

[0059] From the perspective of biometric feature acquisition and processing, multi-modal biometric sensors are used, integrating iris scanning, voiceprint acquisition and fingerprint acquisition modules, which can obtain more rich and comprehensive biometric feature data. Compared with traditional single biometric feature recognition, multi-modal fusion greatly improves the accuracy of identity authentication. Different biometric features have complementarity, such as the stability of iris features, the uniqueness of voiceprint features, and the detail of fingerprint features. The combination of multiple features can reduce the false recognition rate and the missed recognition rate. For example, in the access control system of high-end financial places, relying only on single fingerprint recognition, when the user's fingerprint is worn or stained, it may cause recognition error and cannot enter normally; while the multi-modal biometric feature fusion authentication method of the present application can provide effective authentication basis even if one of the biometric features fails, ensuring the accuracy and reliability of authentication.

[0060] Deep convolutional neural networks are used for multi-scale feature extraction and fusion, further mining the potential information of biometric feature data. The multi-branch feature extraction network is constructed, which extracts features for different biometric modalities. The iris branch network can effectively extract the local invariance features of iris texture, the voiceprint branch network can extract the speech spectrum features through the time-frequency transform layer and the attention mechanism, the fingerprint branch network can extract the fingerprint ridge topology structure by using the residual coding module, and the behavior branch network can capture the spatio-temporal correlation of dynamic behavior by using the three-dimensional convolution layer. This fine-grained feature extraction method makes the extracted biometric features more representative and identifiable, providing strong support for subsequent accurate identity authentication.

[0061] In the federated learning framework, distributed nodes collaboratively train the model combined with differential privacy technology to inject noise into the model gradient, which has multiple advantages. Distributed training makes full use of the computing resources of each node, improves training efficiency, and is suitable for large-scale intelligent security systems. In the city security monitoring network, monitoring nodes distributed in various regions can collaboratively train identity authentication models, reducing training time. At the same time, differential privacy technology protects user data privacy, effectively preventing user information leakage even if data is shared between different nodes. For example, in a community security system, monitoring devices in each community participate in training as nodes without leaking personal information of residents in the community, ensuring the privacy and security of residents.

[0062] The one-time dynamic password generation mechanism enhances the security of the authentication process. Random seeds are generated by quantum random number generators, combined with chaotic mapping algorithms to iteratively generate dynamic password sequences, and bound to construct a spatiotemporal dynamic password matrix with user behavior spatiotemporal features. This dynamic password has strong randomness and timeliness, and the password used each time is different, greatly reducing the risk of password cracking. Combined with user behavior spatiotemporal features, the password is associated with the real-time state of the user, further increasing the security and unpredictability of the password. In the mobile payment scenario, when users perform payment operations at different locations and different times, the dynamic password generated is closely combined with features such as the geographic location and operation time at that time, effectively preventing identity fraud risks in the payment process.

[0063] Based on the attribute-based encryption algorithm, access control is performed on the spatiotemporal dynamic password matrix, and the mapping relationship between user attributes and resource access rules is defined through a policy tree, realizing fine-grained permission management. In the security system within an enterprise, the access permissions of employees to different areas and resources can be accurately controlled according to their department, position, and other attributes. For example, employees in the R&D department can only access specific R&D areas and related materials, and employees in the finance department can only access finance-related resources, improving the security of enterprise information and resources.

[0064] The introduction of a generative adversarial network to build an abnormal behavior detection model can monitor user behavior in real time. In the training phase, the generator and discriminator parameters are jointly optimized by the adversarial loss function and the reconstruction loss function, so that the model can accurately learn the latent distribution of normal user behavior. In the detection phase, the reconstruction error and discriminator confidence of the behavior sequence are calculated, and the dynamic threshold is combined to determine abnormal behavior and trigger secondary authentication. This mechanism detects abnormal behavior in a timely manner and effectively prevents potential security threats. In security monitoring in public places such as airports and train stations, if a person exhibits abnormal behavior, such as lingering in a restricted area for a long time or behaving abnormally, the system can quickly detect and start a secondary authentication or alarm mechanism, ensuring the safety and order of public places.

[0065] The dynamic identity identification update mechanism of the security hash chain construction binds the user identity identification with the device hardware fingerprint, ensuring the uniqueness and security of the identity identification. After each successful authentication, the hash algorithm is used to perform hash operation on the current identification and timestamp to generate the next period identity identification, and the integrity of the historical identification is verified through the Merkle tree structure. The Byzantine fault tolerance protocol is used between the distributed nodes to synchronize the identity identification state, ensuring the non-tamperability of the identity chain and the consistency between the nodes. This series of measures effectively maintain the security and stability of the user identity in the distributed environment, preventing the identity from being tampered with or used.

[0066] In the key update phase, the long short-term memory network is used to predict the channel error rate, the key distribution rate is dynamically adjusted, the key derivation function and the physical layer channel characteristics are combined to generate the session key and the identity binding key, and the quantum error correction code is used for fault-tolerant encoding of the transmission key. These operations improve the security and reliability of key management, ensure the secure transmission and correct use of keys in complex network environment, and provide a solid encryption guarantee for the entire identity authentication process.

[0067] The multi-factor authentication decision engine is constructed, which integrates multiple factors such as biometric confidence, dynamic password verification result, behavior anomaly score and device fingerprint matching degree. The fuzzy logic rule is used to define the weight distribution strategy of each factor, the multi-objective optimization algorithm is used to solve the optimal authentication decision threshold, and the decision result is input into the state machine model to drive the state transition and permission hierarchical control of the authentication process. This multi-factor comprehensive decision method fully considers the importance and mutual relationship of different authentication factors, improves the scientificity and accuracy of authentication decision, realizes more fine and flexible permission hierarchical control, and further improves the overall security and user experience of the intelligent security system. BRIEF DESCRIPTION OF DRAWINGS

[0068] Figure 1 The working principle diagram of the AI and password technology integrated identity authentication method described in the application;

[0069] Figure 2 The flowchart of access permission control based on attribute-based encryption;

[0070] Figure 3 The step diagram of the abnormal behavior detection model based on the generative adversarial network;

[0071] Figure 4 The step diagram of the abnormal behavior detection model training. DETAILED DESCRIPTION

[0072] With reference to the drawings of the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of the present application.

[0073] Please refer to Figures 1-4 The present application provides an identity authentication method combining AI and cryptography, and the overall implementation scheme is as follows:

[0074] Biometric data acquisition and processing: The biometric data of the user is acquired by using a multi-modal biological sensor, which integrates an iris scanning module, a voiceprint acquisition module and a fingerprint acquisition module. The acquired data is transmitted to a processing system, and then multi-scale feature extraction and fusion are performed on the biometric data based on a deep convolutional neural network, thereby generating a high-dimensional biometric feature vector.

[0075] Biometric ciphertext construction: The generated high-dimensional biometric feature vector is homomorphically encrypted to construct encrypted biometric ciphertext, ensuring the security of the biometric data in the subsequent processing process.

[0076] Federated learning and identity verification: The biometric ciphertext is input into an identity authentication model in a federated learning framework. The federated learning framework adopts a distributed node collaborative training method. In the training process, the model gradient is noise-injected based on differential privacy technology, thereby generating privacy-protected global model parameters. These global model parameters are used to perform distributed verification on the user identity.

[0077] Dynamic password generation and matrix construction: According to the verification result, a random seed is generated by means of a quantum random number generator, and a dynamic password sequence is iteratively generated by combining a chaotic mapping algorithm, thereby generating a one-time dynamic password. The dynamic password sequence is bound with the user behavior spatiotemporal features (such as geographic location coordinates, device motion acceleration, operation timestamp, etc.), and a spatiotemporal dynamic password matrix is constructed.

[0078] Access control and identity authentication: The spatiotemporal dynamic password matrix is controlled based on an attribute-based encryption algorithm, the mapping relationship between user attributes and resource access rules is defined by a policy tree, and a ciphertext policy parameter is generated. The authentication data is decrypted and authorized according to the ciphertext policy parameter, and the identity authentication process is finally completed.

[0079] The implementation of the present application will be further described below in conjunction with Examples 1 to 7.

[0080] Example 1:

[0081] In the multi-scale feature extraction and fusion of biometric data, a high-dimensional biometric feature vector is generated, and the specific operation is as follows:

[0082] First, a multi-branch feature extraction network is constructed, which includes an iris branch network, a voiceprint branch network, a fingerprint branch network and a behavior branch network. Each branch network extracts features for different biological modalities. For the iris branch network, a hollow convolutional layer is used to extract the local invariance features of the iris texture. The hollow convolutional layer can expand the receptive field without increasing the number of parameters by introducing a hollow in the convolution kernel, so as to better capture the local features of the iris texture, and the convolution operation can be represented as:

[0083]

[0084] wherein, represents the output of the kth feature map at the (i,j) position, is the convolution kernel weight, is the input feature map, r is the hollow rate, b k is the bias, m and n represent the position index of the elements in the convolution kernel, wherein m corresponds to the row index and n corresponds to the column index.

[0085] The voiceprint branch network uses a time-frequency transformation layer and an attention mechanism to fuse the spectral features of the speech. The time-frequency transformation converts the time-domain speech signal to the frequency domain, which is convenient for extracting spectral features. The attention mechanism can dynamically focus on important features in different frequency bands, enhancing the weight of key features. Let the feature after time-frequency transformation be F, and the attention weight be α, then the fused feature F new is:

[0086]

[0087] wherein, n is the feature dimension, α i is the attention weight corresponding to the i-th dimension feature.

[0088] The fingerprint branch network uses a residual coding module to extract the fingerprint ridge topology, and solves the gradient vanishing problem in deep network training through a jump connection, which better preserves the detailed features of the fingerprint ridge. The behavior branch network uses a three-dimensional convolution layer to capture the spatio-temporal correlation of dynamic behavior, and the three-dimensional convolution kernel performs convolution operation in spatial and temporal dimensions at the same time, which can effectively extract the spatio-temporal features of dynamic behavior.

[0089] After that, the multi-branch output features are dimensionally aligned through the cross-modal feature alignment module, and the adaptive weight distribution mechanism is used to dynamically adjust the fusion weight of each modal feature. The feature relationship graph is constructed based on the graph convolution network, and the graph structure fusion of cross-modal features is realized through node embedding and edge weight calculation. Finally, the fused features are sparsely encoded, and the autoencoder is used to reduce the dimension and remove the redundant information of high-dimensional features, generating a compact biometric feature vector. The autoencoder is composed of an encoder and a decoder. The encoder maps high-dimensional features to a low-dimensional space, and the decoder reconstructs the low-dimensional features back to high-dimensional features. In this process, redundant information is removed to achieve dimension reduction.

[0090] Embodiment 2:

[0091] In the process of adopting distributed node collaborative training in the federated learning framework and injecting noise into the model gradient based on differential privacy technology:

[0092] First, an identity authentication sub-model is constructed at the local node. The sub-model adopts a lightweight neural network structure, including an input layer, a gated recurrent unit layer, and a fully connected layer. The input layer is responsible for receiving local biometric feature data. The gated recurrent unit layer can effectively process sequence data and capture the temporal dependence relationship in the data. The fully connected layer maps the processed features to the final output dimension.

[0093] In the local training stage, the model gradient is calculated based on the local biometric feature data. The gradient matrix is added with noise using the Gaussian mechanism, and the noise intensity is dynamically adjusted according to the sensitivity threshold Δ and the privacy budget After adding noise to the gradient The calculation formula is:

[0094]

[0095] where g is the original gradient, represents Gaussian noise with mean 0 and variance .

[0096] In the model aggregation stage, the gradient ciphertext aggregation is realized through the secure multi-party computation protocol, and the Paillier homomorphic encryption algorithm is used for encrypted transmission of gradient data. Let the encryption function be E, and the decryption function be D. The encrypted gradient is E(g). After receiving the encrypted gradient, the central server performs decryption operation D(E(g)), and generates the global gradient update based on the weighted average algorithm.

[0097] The legitimacy of the gradient update of each node is verified through a zero-knowledge proof protocol to ensure the integrity and tamper resistance of the aggregation process. The zero-knowledge proof protocol allows one party (prover) to prove to another party (verifier) that a certain proposition is true without revealing any information other than the proposition itself, thereby ensuring the security and legitimacy of the node gradient update.

[0098] Embodiment 3

[0099] The generation steps of the one-time dynamic password are as follows:

[0100] An initial random seed is generated using a quantum random number generator, which generates true random numbers based on the photoelectric effect random pulse sequence and quantum entanglement state measurement, ensuring the unpredictability of the random seed.

[0101] The random seed is iteratively expanded based on the Logistic chaotic mapping algorithm, and the iteration formula of the Logistic chaotic mapping algorithm is:

[0102] x n+1 =μ·x n ·(1-x n )

[0103] where x n is the value of the nth iteration, and μ is the bifurcation parameter. By dynamically adjusting the value of μ, the unpredictability of the chaotic sequence can be changed.

[0104] The chaotic sequence is divided into multiple segments, and a hash chain structure is used for cascading encryption of the segments to generate dynamic password primitives. The hash function can map data of any length to a fixed-length hash value, ensuring the integrity and security of the data.

[0105] Combining the spatiotemporal characteristics of user behavior, including geographic location coordinates (x, y), device motion acceleration a, and operation timestamp t, a spatiotemporal feature vector is constructed The dynamic password primitive and the spatiotemporal feature vector are subjected to tensor product operation to generate a spatiotemporal dynamic password matrix. Tensor product operation can combine two vectors or matrices of different dimensions according to specific rules to generate a new matrix structure, enhancing the security and complexity of the password.

[0106] Embodiment 4

[0107] When controlling access permissions to the spatiotemporal dynamic password matrix based on an attribute-based encryption algorithm:

[0108] First, an attribute-based encryption system based on bilinear pairing is constructed, and a user attribute set U = {u1, u2, …, u n} match rule of the resource access policy. Bilinear pairing is the core operation of attribute-based encryption system, which satisfies some special properties, such as bilinearity, non-degeneracy and computability.

[0109] The access policy is encoded as a monotone access tree structure, and the leaf nodes correspond to user attributes, and the non-leaf nodes define logical gate threshold conditions. For example, an AND gate indicates that only when all child nodes corresponding to the attributes are satisfied, the node is satisfied; or an OR gate indicates that as long as one child node corresponding to the attribute is satisfied, the node is satisfied.

[0110] The linear secret sharing scheme is used to split the master key K to generate attribute-associated sub-key components. Assuming that the master key is split into n sub-key components K1, K2, …, K n Each sub-key component is associated with a specific user attribute.

[0111] When encrypting the spatiotemporal dynamic password matrix, the access tree structure is embedded in the ciphertext header, and the ciphertext policy parameters are generated based on elliptic curve point operation. Elliptic curve point operation has important applications in cryptography, which can provide efficient encryption and decryption operations. In the decryption phase, the matching degree calculation between the user attribute private key and the ciphertext policy is used to realize partial decryption and permission hierarchical control. If the user's attributes meet the conditions in the access policy, the corresponding ciphertext can be successfully decrypted, and according to the degree of satisfaction, hierarchical management of permissions can also be realized, such as ordinary users can only access part of the resources, and advanced users can access more resources.

[0112] Embodiment 5:

[0113] When constructing an abnormal behavior detection model based on a generative adversarial network:

[0114] The model includes a generator and a discriminator. The generator uses a variational autoencoder structure to learn the latent distribution by reconstructing the normal user behavior sequence. The variational autoencoder approximates the posterior distribution, which is difficult to calculate, to a simple and computable distribution by introducing the method of variational inference. Let the normal user behavior sequence be x, and the reconstruction output of the generator be The reconstruction loss function can be expressed as:

[0115]

[0116] Where n is the length of the behavior sequence, x i and are the original behavior data and the reconstructed data at the i-th time step, respectively.

[0117] The discriminator adopts a spatio-temporal convolution network to discriminate the authenticity of the input behavior sequence. The spatio-temporal convolution network can extract features of the behavior sequence in both spatial and temporal dimensions, improving the discrimination performance. In the training phase, the generator and the discriminator are jointly optimized through an adversarial loss function L adv and a reconstruction loss function L rec The adversarial loss function is used to measure the difference between the fake samples generated by the generator and the real samples, prompting the generator to generate behavior sequences closer to the real samples, while enabling the discriminator to accurately distinguish between real samples and generated samples.

[0118] In the detection phase, the reconstruction error and the discriminator confidence of the behavior sequence are calculated, and the dynamic threshold is combined to determine abnormal behavior and trigger secondary authentication. If the reconstruction error exceeds the dynamic threshold or the discriminator confidence is lower than the set value, the behavior sequence is determined to be abnormal behavior, triggering secondary authentication, such as requiring the user to re-perform biometric identification or input a dynamic password to ensure the security of identity authentication.

[0119] Embodiment 6:

[0120] In training the abnormal behavior detection model, this embodiment adopts a series of fine and coordinated steps to ensure that the model can accurately identify abnormal behavior.

[0121] Slicing the user's historical behavior data is a key step in the entire training process. Since user behavior data is usually recorded continuously in chronological order, in order to facilitate the model to learn the behavior pattern, it is necessary to divide these continuous data into fixed-length spatio-temporal behavior sequence samples. For example, set the time length of each sample to T seconds, which contains the user's behavior actions, location, and other information at different time points within T seconds. Through this slicing method, continuous behavior data is converted into discrete sample units that can be processed by the model, laying the foundation for subsequent analysis of user behavior patterns.

[0122] A sliding window mechanism is used to extract local spatio-temporal patterns on the constructed spatio-temporal behavior sequence samples. The size and step length of the sliding window are two important parameters, the window size determines the local spatio-temporal range extracted each time, and the step length controls the interval of window sliding. Assuming the window size is W seconds and the step length is S seconds (S < W), the window starts from the beginning of the sample and slides S seconds each time, extracting the behavior data within the window as a local spatio-temporal pattern. In order to increase the generalization ability of the model and prevent overfitting, an adversarial sample is generated through data augmentation techniques. The specific method includes rotating, flipping, scaling, and other operations on the extracted local spatio-temporal pattern to simulate various possible normal behavior changes from different angles, enabling the model to learn more rich normal behavior features, so as to more accurately identify abnormal behavior during detection.

[0123] Introducing an attention mechanism into the generator is a key step in improving model performance. The generator employs a variational autoencoder structure, aiming to reconstruct normal user behavior sequences to learn their latent distribution. The attention mechanism allows the generator to dynamically focus on key behavioral segments during the reconstruction process, improving reconstruction accuracy. Taking a sequence containing user actions such as walking and device operation as an example, during walking, features like the rhythm and stride length are crucial information, while during device operation, the order and time intervals of operations are more important. The attention mechanism calculates the importance weight of each behavioral segment, allocating more attention to these key segments. Assume the behavioral sequence is x = [x1, x2, ..., x...]. T The attention weights are β = [β1, β2, ..., β]. T Then the weighted operation during reconstruction can be expressed as:

[0124]

[0125] Where, β i This represents the attention weight of the i-th action segment. This represents the reconstructed sequence of behaviors. In this way, the generator can more accurately capture the details of normal behavior, improving its learning performance on the potential distribution of normal behavior.

[0126] Embedding a gradient penalty term in the discriminator and employing the Wasserstein distance metric is a crucial method for ensuring training stability. The discriminator's primary task is to distinguish between genuine normal behavior sequences and fake samples generated by the generator. Compared to traditional distance metrics such as cross-entropy, Wasserstein distance more effectively measures the difference between two distributions and exhibits greater stability during generative adversarial network (GAN) training. The gradient penalty term prevents the discriminator from experiencing gradient vanishing or exploding problems during training. When the discriminator's gradient is too large or too small, the training process becomes unstable, making model convergence difficult. The gradient penalty term constrains the discriminator's gradient, keeping it within a reasonable range and ensuring smooth training. Specifically, the gradient penalty term is calculated based on the discriminator's gradient on the input samples, and the strength of the gradient penalty is controlled by adjusting the penalty coefficient.

[0127] The progressive training strategy gradually increases the length and complexity of the behavior sequence, which conforms to the learning rules of the model. In the early stage of training, since the parameters of the model have not been fully adjusted, directly inputting complex and long sequence behavior data may cause the model to be difficult to learn and converge. Therefore, start training from short and simple behavior sequences, and let the model learn basic behavior patterns and features first. As the training progresses, gradually increase the length and complexity of the behavior sequence, for example, gradually transition from short sequences containing only single behavior actions to long sequences containing multiple consecutive behavior actions and complex scene changes. In this way, the model can gradually adapt to more complex situations, continuously improve its understanding and recognition of various behavior patterns, and ultimately improve the performance of abnormal behavior detection.

[0128] Embodiment 7:

[0129] The construction of the dynamic identity update mechanism includes:

[0130] Based on the secure hash chain, the dynamic identity update mechanism binds the user identity ID with the device hardware fingerprint F. After each successful authentication, the SHA-3 algorithm is used to hash the current identity and timestamp t to generate the next period identity ID new , and the calculation formula is:

[0131] ID new =SHA-3(ID||t)

[0132] Where || represents the string concatenation operation. The integrity of the historical identity is verified by the Merkle tree structure to ensure the non-tamperability of the identity chain. The Merkle tree can efficiently verify the integrity of the data, and by hashing each node, a tree structure is constructed. Any tampering with the data will cause the root hash value of the tree to change. The Byzantine fault tolerance protocol is used to synchronize the identity state among distributed nodes, and after reaching consensus, the global identity registry is updated to ensure the consistency and accuracy of the identity of each node.

[0133] In the key update phase, the long short-term memory network is used to predict the channel error rate P. The long short-term memory network can effectively process time series data and capture long-term dependencies. According to the predicted channel error rate, the key distribution rate R is dynamically adjusted. The higher the error rate, the lower the key distribution rate, to ensure the accuracy of key transmission. Combined with the key derivation function KDF and the physical layer channel characteristics C, the session key K s is generated, which is bound to the identity key K b , and the generation process can be represented as:

[0134] K s =KDF(C,seed s )

[0135] K b =KDF(C,seed b )

[0136] wherein seed s and seed b are seeds for generating session key and identity binding key respectively. The quantum error correction code is used to fault-tolerant encode the transmission key, which can correct the errors occurred in the quantum bits during transmission and improve the reliability of key transmission.

[0137] A multi-factor authentication decision engine is constructed, which integrates the biometric confidence B, dynamic password verification result D, behavior anomaly score A and device fingerprint matching degree M. Fuzzy logic rules are used to define the weight allocation strategy of each factor, and the contribution degree of evaluation index is quantified by membership function. Let the weight of biometric confidence be w B , the weight of dynamic password verification result be w D , the weight of behavior anomaly score be w A , and the weight of device fingerprint matching degree be w M , then the comprehensive evaluation value S is:

[0138] S=w B ·B+w D ·D+w A ·A+w M ·M

[0139] The optimal authentication decision threshold is solved based on multi-objective optimization algorithm, and the optimization objectives include minimum false recognition rate and minimum missed recognition rate. The decision result is input into the state machine model to drive the state transition and permission grading control of the authentication process. If the comprehensive evaluation value S exceeds the decision threshold, the authentication is successful, and according to different evaluation value ranges, permission grading can also be performed, such as granting different levels of access permission.

[0140] It should be noted that in this text, relational terms such as first and second are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "contain" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device.

[0141] While embodiments of the application have been shown and described, it is to be understood that the embodiments described are merely exemplary of the principles and application of the present application. Numerous modifications and adaptions can be effected without departing from the spirit and scope of the present application, which is not limited to the exact construction and arrangement described. It is intended, therefore, to cover all modifications and adaptions that fall within the scope of the claims and their equivalents.

Claims

1. An identity authentication method of AI and cryptography fusion, characterized in that, Comprise: Collect biological feature data of a user through a multi-modal biosensor, the multi-modal biosensor comprising an iris scanning module, a voiceprint collection module and a fingerprint collection module; perform multi-scale feature extraction and fusion on the biological feature data based on a deep convolutional neural network to generate a high-dimensional biological feature vector; perform homomorphic encryption processing on the high-dimensional biological feature vector to construct an encrypted biological feature ciphertext; Input the biological feature ciphertext into an identity authentication model in a federated learning framework, the federated learning framework adopts distributed node collaborative training, and based on differential privacy technology, noise is injected into the model gradient to generate global model parameters with privacy protection; verify the user identity through the global model parameters in a distributed manner; Based on the verification result, a one-time dynamic password is dynamically generated, the one-time dynamic password generates a random seed through a quantum random number generator, and a dynamic password sequence is iteratively generated by combining a chaotic mapping algorithm; bind the dynamic password sequence with the user behavior spatiotemporal feature to construct a spatiotemporal dynamic password matrix; Control access rights of the spatiotemporal dynamic password matrix based on an attribute-based encryption algorithm, comprising: Construct an attribute-based encryption system based on bilinear pairing, define the matching rules of user attribute set and resource access policy; Encode the access policy into a monotonic access tree structure, the leaf nodes correspond to user attributes, and the non-leaf nodes define logical gate threshold conditions; Split the master key using a linear secret sharing scheme to generate attribute-associated sub-key components; When encrypting the spatiotemporal dynamic password matrix, embed the access tree structure in the ciphertext header, and generate ciphertext policy parameters based on elliptic curve point operations; In the decryption phase, partial decryption and permission grading control are achieved through matching degree calculation of user attribute private keys and ciphertext policies.

2. The identity authentication method of claim 1, wherein, Perform multi-scale feature extraction and fusion on the biological feature data based on a deep convolutional neural network to generate a high-dimensional biological feature vector, comprising: Construct a multi-branch feature extraction network, each branch corresponding to one biological modality, the multi-branch feature extraction network comprising an iris branch network, a voiceprint branch network, a fingerprint branch network and a behavior branch network; wherein the iris branch network uses a hollow convolutional layer to extract the local invariance features of iris texture, the voiceprint branch network uses a time-frequency transform layer and an attention mechanism to fuse the spectral features of speech, the fingerprint branch network uses a residual coding module to extract the fingerprint ridge topology, and the behavior branch network uses a three-dimensional convolutional layer to capture the spatiotemporal correlation of dynamic behavior; Align the dimensions of the multi-branch output features through a cross-modal feature alignment module, and dynamically adjust the fusion weights of each modality feature using an adaptive weight distribution mechanism; construct a feature relationship graph based on a graph convolutional network, and realize graph structure fusion of cross-modal features through node embedding and edge weight calculation; Perform sparse coding on the fused features, and use an autoencoder to reduce dimension and remove redundancy of the high-dimensional features to generate a compact biological feature vector.

3. The identity authentication method of claim 1, wherein, The federated learning framework adopts distributed node collaborative training, and based on differential privacy technology, noise is injected into the model gradient, comprising: Identity authentication sub-model is constructed at the local node, and the sub-model adopts a lightweight neural network structure, including an input layer, a gated recurrent unit layer, and a fully connected layer; In the local training stage, the model gradient is calculated based on the local biological feature data, a Gaussian mechanism is used to add noise to the gradient matrix, and the noise intensity is dynamically adjusted according to the sensitivity threshold and the privacy budget; In the model aggregation stage, the gradient ciphertext is aggregated through a secure multi-party computation protocol, and the Paillier homomorphic encryption algorithm is used for encrypted transmission of the gradient data; after the central server decrypts the encrypted gradient, the global gradient update quantity is generated based on the weighted average algorithm; The legality of the gradient update of each node is verified through a zero-knowledge proof protocol to ensure the integrity and tamper resistance of the aggregation process.

4. The identity authentication method of claim 1, wherein, The generation of the one-time dynamic password includes: An initial random seed is generated by a quantum random number generator, and a true random number is generated by measuring a quantum entangled state through a photoelectric effect random pulse sequence; The random seed is iteratively expanded based on a Logistic chaotic mapping algorithm, and the unpredictability of the chaotic sequence is dynamically adjusted through a bifurcation parameter; The chaotic sequence is divided into multiple segments, and the segments are cascaded and encrypted using a hash chain structure to generate a dynamic password primitive; The spatiotemporal feature vector is constructed by combining the user behavior spatiotemporal features, including geographic location coordinates, device motion acceleration, and operation time stamps; the dynamic password primitive and the spatiotemporal feature vector are subjected to tensor product operation to generate a spatiotemporal dynamic password matrix.

5. The identity authentication method of claim 1, wherein, Further comprising: An abnormal behavior detection model is constructed based on a generative adversarial network, and the model includes a generator and a discriminator; The generator adopts a variational autoencoder structure to learn the latent distribution by reconstructing normal user behavior sequences; The discriminator adopts a spatiotemporal convolutional network to determine the authenticity of the input behavior sequence; In the training stage, the generator and discriminator parameters are optimized through the joint optimization of the adversarial loss function and the reconstruction loss function; In the detection stage, the reconstruction error and the discriminator confidence of the behavior sequence are calculated, and the abnormal behavior is determined and the secondary authentication is triggered based on the dynamic threshold.

6. The identity authentication method of claim 5, wherein, The training of the abnormal behavior detection model includes: The user historical behavior data is sliced to construct a spatiotemporal behavior sequence sample; The sliding window mechanism is used to extract the local spatiotemporal pattern of the sequence, and the adversarial sample is generated through data augmentation; An attention mechanism is introduced in the generator to dynamically focus on the reconstruction accuracy of key behavior segments; A gradient penalty term is embedded in the discriminator to improve the training stability by measuring the Wasserstein distance; An incremental training strategy is adopted to gradually increase the length and complexity of the behavior sequence.

7. The identity authentication method of claim 1, wherein, Further comprising: A multi-factor authentication decision engine is constructed, and the engine integrates biological feature confidence, dynamic password verification results, and behavior anomaly scores; Fuzzy logic rules are used to define the weight allocation strategy of each factor, and the contribution degree of the evaluation index is quantified through the membership function; A multi-objective optimization algorithm is used to solve the optimal authentication decision threshold, and the optimization objectives include minimizing the false rejection rate and minimizing the false acceptance rate; The decision result is input into a state machine model to drive the state transition and permission hierarchical control of the authentication process.

Images