Defence apparatus and method against physical backdoor attacks on biometric identification systems

Abstract

The application provides a defense device and method for a physical backdoor attack on a biological information recognition system, and belongs to the field of information security. The biological information recognition system is used for collecting multi-modal biological signals and authentication. The defense device comprises: a coupling path blocking module: from active shielding, passive filtering and voltage stabilization, the conduction of malicious noise in the physical connection path is cut off or weakened, and the stability of the front-end physical environment is ensured. A physical domain signal purification module: from real-time monitoring of signals, feature analysis to interference suppression, a closed loop is formed, and the noise transmitted from the power supply circuit to the collection device is reduced. A digital domain semantic verification module: verifies the collected multi-modal biological signals, and judges whether there are abnormal or backdoor injection attack signs. A system control and management module: realizes communication between external devices and each module, and makes decisions according to the digital domain semantic verification result. The application can effectively block the physical interference signals used for injecting backdoors, and ensure the safety and reliability of the biological information recognition system.

Description

Technical Field

[0001] This invention relates to the field of information security, specifically to defensive devices and methods against physical backdoor attacks on biometric identification systems. In particular, it relates to a three-tiered defense architecture based on "coupling path blocking—physical domain signal purification—digital domain semantic verification," and related technologies such as noise feature analysis, dynamic adaptive filtering, and multimodal biometric signal verification. Background Technology

[0002] With the rapid development of information technology and artificial intelligence, biometric identification technology has been widely and deeply applied in various fields due to its significant advantages such as uniqueness, stability, and convenience. In the financial sector, biometric identification technology is used for identity verification in mobile payments to ensure transaction security; in the security sector, it helps access control systems achieve precise personnel access control; in the field of smart devices, functions such as facial unlocking and fingerprint recognition have become standard features of smartphones, greatly improving user experience and device security. Therefore, ensuring the security of biometric identification systems is crucial for user privacy and public safety.

[0003] A biometric identification system consists of two parts: a biometric data acquisition device and an identity verification system. The biometric data acquisition device collects biometric data, such as facial features, iris details, voice characteristics, and fingerprint information. Common biometric data acquisition devices include cameras, microphones, and fingerprint sensors. The identity verification system is responsible for processing, storing, and comparing the collected biometric data to confirm or verify an individual's identity. Its core components include key modules such as feature extraction, data storage, pattern matching, and decision-making mechanisms.

[0004] However, in recent years, a new and highly threatening type of physical backdoor injection attack has quietly emerged, posing a serious threat to the security of biometric identification systems. The attack process of this type of attack is as follows: Figure 1As shown, attackers exploit the dependence of biometric data acquisition devices on a stable power supply. Using specially designed malicious devices, such as malicious power supplies, speakers, and laser emitters, they inject carefully modulated malicious interference signals into the power supply or transducer of biometric data acquisition devices like cameras and microphones. Since the normal operation of biometric data acquisition devices depends on a stable external environment, these malicious interference signals severely disrupt the device's normal operation. For example, interfering with the camera's power supply introduces abnormal adversarial bands during image acquisition. These bands appear as irregular stripes or spots in the captured images, interfering with the extraction and analysis of biometric features by deep image recognition algorithms. This blurs or distorts previously clear facial features, leading to incorrect or unrecognizable identification. Similarly, for microphones, malicious acoustic interference signals manifest as high-intensity adversarial noise. This noise mixes with normal speech signals, severely degrading the quality of audio data received by the speech recognition system. Deep speech recognition algorithms struggle to accurately extract key speech features such as voiceprints when processing audio containing significant noise, thus failing to correctly identify the user. This allows attackers to easily bypass the identity verification system and illegally gain system privileges.

[0005] Physical backdoor attacks on biometric identification systems, which use physical interference to disrupt signals, are highly covert and difficult to defend against, posing a significant threat to information security. Although biometric identification technology is constantly developing and improving, and related security measures are gradually being strengthened, defensive measures against such physical backdoor attacks remain extremely limited. Existing security solutions mostly focus on software-level algorithm optimization, which is insufficient to completely eradicate attack signals and provide effective protection. In conclusion, to effectively address this severe security challenge and ensure the secure and reliable operation of biometric identification systems, there is an urgent need to develop an innovative and efficient defense method and device to fill the technological gap in this area. Summary of the Invention

[0006] The purpose of this invention is to provide a defense device and method against physical backdoor attacks on biometric identification systems, so as to effectively block physical interference signals used to inject backdoors and detect data samples injected by backdoors, thereby ensuring the security and reliability of biometric identification systems.

[0007] To achieve the above objectives, the present invention adopts the following technical solution:

[0008] A defensive device against physical backdoor attacks on biometric identification systems, wherein the biometric identification system comprises a biometric information acquisition device and an identity recognition system, wherein the biometric information acquisition device acquires multimodal biometric signals and the identity recognition system authenticates them; the defensive device includes:

[0009] The coupling path blocking module is used to cut off or weaken the transmission of malicious noise on the physical connection path from three aspects: active shielding, passive filtering and voltage stabilization, so as to ensure the stability of the physical environment of the front end of the biometric identification system.

[0010] The physical domain signal purification module is installed on the power circuit of the bio-information acquisition device. Compared with the coupling path blocking module, it is closer to the bio-information acquisition device. It is used to form a closed loop from real-time monitoring and feature analysis of power and environmental signals to interference suppression, thereby reducing noise transmitted to the bio-information acquisition device through the power circuit.

[0011] The digital domain semantic verification module is used to verify the multimodal biological signals collected by the bioinformation acquisition device to determine whether there are any abnormal behaviors or signs of backdoor injection attacks.

[0012] The system control and management module is used to enable communication between external devices and various modules, and to execute decisions based on the verification results of the digital domain semantic verification module: if the digital domain semantic verification module determines that there is abnormal behavior or signs of backdoor injection attack, it will issue an alarm, lock the identity recognition system and activate the backup verification mechanism; otherwise, it will input the multimodal biosignals collected by the biometric information acquisition device into the subsequent identity recognition system to perform the verification process.

[0013] As a preferred embodiment of the present invention, the coupling path blocking module includes:

[0014] The active shielding unit uses a high-permeability metal shielding cover to cover the sensitive circuit part of the bio-information acquisition device, forming a closed active shielding space around the sensitive circuit.

[0015] The passive shielding unit, which uses a passive filter, is connected to the power circuit of the bio-information acquisition device.

[0016] The voltage regulation unit, which uses a voltage regulator chip, is connected to the power circuit of the bio-information acquisition device and is located downstream of the passive shielding unit.

[0017] As a preferred embodiment of the present invention, the physical domain signal purification module includes:

[0018] The noise signal acquisition unit uses a current sensor and a voltage sensor, which are connected to the power circuit near the bio-information acquisition device to acquire power and environmental signals from the power circuit.

[0019] The noise feature analysis unit analyzes the spectral characteristics of power supply and environmental signals, comparing the current signal's spectral characteristics with known noise patterns and those under normal conditions to identify the presence of noise and its corresponding noise feature parameters. These noise feature parameters include the noise type, frequency range, and power spectral density. If the signal matches the spectral characteristics under normal conditions, it is directly provided to the bioinformation acquisition device. If the signal matches noise, the noise intensity is calculated based on the power spectral density. Signals with noise intensity exceeding a threshold are input to the interference suppression unit; otherwise, the signal is directly provided to the bioinformation acquisition device.

[0020] The active interference suppression unit uses a long short-term memory network model to predict the noise characteristic parameters at the next moment, takes the interference signal that is inverse of the predicted signal and injects it into the power supply circuit to filter the power supply and environmental signals, and provides the filtered signal to the bio-information acquisition device.

[0021] As a preferred embodiment of the present invention, the method of using a long short-term memory network model to predict the noise characteristic parameters at the next time step, and injecting the interference signal inversely to the predicted signal into the power supply circuit to filter power supply and environmental signals, includes:

[0022] Data collection and preprocessing: The power supply and environmental signals, noise types, frequency ranges and power spectral density data are sampled at a fixed frequency on the power circuit of the bioinformatics acquisition device. After min-max normalization to eliminate dimensional differences, time domain, frequency domain and time-frequency domain features are extracted to form feature vectors.

[0023] A long short-term memory network model is constructed. This model is used to predict the power and environmental signals at the next time step by taking the feature vectors of power and environmental signals at historical time as input, and to generate an interference signal that is inversely phase to the predicted signal and inject it into the power circuit.

[0024] As a preferred embodiment of the present invention, the noise signal acquisition unit further includes a process of amplifying, filtering, and analog-to-digital converting the acquired power supply and environmental signals to obtain digital signals, wherein the digital signals serve as input to the noise feature analysis unit.

[0025] As a preferred embodiment of the present invention, the digital domain semantic verification module includes:

[0026] The multimodal feature extraction network unit is used to preprocess the input biological information data, then use CNN to extract feature data for anomaly detection, and normalize the feature data.

[0027] The semantic verification unit uses an SVM model to determine whether the normalized feature data is abnormal data. The abnormal data represents abnormal behavior or signs of backdoor injection attacks in the input bioinformatics data.

[0028] As a preferred embodiment of the present invention, the system control and management module includes:

[0029] The remote control and communication unit is used to connect to the various modules of the system using modules with wireless communication capabilities, and to communicate with external devices based on communication protocols; the external devices allow users to view the working status and collected data of each module in real time, as well as to control the operating parameters of the modules.

[0030] The integrated analysis and decision-making unit is used to make decisions based on the verification results of the digital domain semantic verification module: if the digital domain semantic verification module determines that there is abnormal behavior or signs of backdoor injection attack, it will issue an alarm, lock the identity recognition system and activate the backup verification mechanism; otherwise, it will input the multimodal biological signals collected by the biometric information acquisition device into the subsequent identity recognition system for processing.

[0031] As a preferred embodiment of the present invention, the backup verification mechanism includes inputting a backup password and secondary biometric verification.

[0032] The above-mentioned defense method against physical backdoor attacks on biometric identification systems includes the following steps:

[0033] Step 1: During the initialization phase of the biometric information acquisition device and identity recognition system, the active shielding unit is automatically activated to completely isolate the sensitive circuits of the biometric information acquisition device from the external electromagnetic environment.

[0034] Step 2: Once the power supply is connected to the system, the passive filter unit immediately starts working to perform preliminary filtering of power supply noise entering the system;

[0035] Step 3: During power supply operation, the voltage regulator unit monitors the changes in input voltage in real time. When malicious power supply noise causes the input voltage fluctuation to exceed the set threshold, the voltage regulator unit automatically adjusts the internal circuit parameters to maintain the stability of the output voltage.

[0036] Step 4: The physical domain signal purification module continuously monitors power and environmental signals in real time. Based on spectrum analysis and pattern recognition technology, it identifies the presence of noise and the corresponding noise characteristic parameters. If the signal matches the spectrum characteristics under normal conditions, proceed to step 5; if the signal matches noise, the noise intensity is calculated based on the power spectral density, and signals with noise intensity higher than the threshold are suppressed.

[0037] Step 5: The digital domain semantic verification module verifies the collected multimodal biological signals from the semantic layer to determine whether there are any abnormal behaviors or signs of backdoor injection attacks.

[0038] If any abnormal behavior or signs of backdoor injection attack are detected, an alarm will be issued, the identity recognition system will be locked, and a backup verification mechanism will be activated; otherwise, the multimodal biosignals collected by the biometric information acquisition device will be input into the subsequent identity recognition system for processing.

[0039] Furthermore, when the biosignal verification result is normal, the verification time and biometric information of this verification are recorded; when the biosignal verification result is abnormal, an alarm is issued, the identity recognition system is locked, and the backup verification mechanism is activated.

[0040] Compared with existing technologies, the defense method and apparatus for physical backdoor attacks on biometric identification systems provided by this invention have the following advantages:

[0041] 1. A three-tiered defense architecture based on "coupled path blocking - physical domain signal purification - digital domain semantic verification" is constructed to defend against physical backdoor attacks on biometric identification systems from the physical, signal and semantic levels, effectively improving the reliability and effectiveness of the defense.

[0042] 2. The defense method based on noise feature analysis, dynamic adaptive filtering and multimodal biosignal verification can accurately detect and suppress malicious power noise, while performing semantic layer verification on the collected biosignals to promptly detect and handle anomalies and prevent attackers from bypassing the identity recognition system.

[0043] 3. The control and management module enables centralized control and management of the entire defense device, while also providing remote monitoring and management functions. This facilitates the configuration and maintenance of the defense device by users, thereby improving the intelligence level and manageability of the defense device. Attached Figure Description

[0044] Figure 1 This is a schematic diagram of the physical backdoor attack process targeting biometric identification systems;

[0045] Figure 2 This is a block diagram of a defense device against physical backdoor attacks on biometric identification systems proposed in this invention.

[0046] Figure 3 This is a flowchart of a defense method against physical backdoor attacks on biometric identification systems proposed in this invention. Detailed Implementation

[0047] The present invention will be further described below with reference to the accompanying drawings and embodiments. The accompanying drawings are merely illustrative diagrams of the present invention. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software, or in one or more hardware modules or integrated circuits, or in different network and / or processor systems and / or microcontroller systems.

[0048] This invention proposes a defense method and device against physical backdoor attacks on biometric identification systems. It can effectively suppress malicious physical signals used to carry out backdoor attacks, prevent attackers from launching physical backdoor attacks on biometric identification systems by interfering with biometric information collection devices, and ensure the security and reliability of the identity recognition system.

[0049] Taking the defense against backdoor attacks on facial recognition neural networks caused by malicious power signal interference with cameras as an example, the specific implementation process is as follows:

[0050] First, construct the deep neural network physical backdoor defense device proposed in this invention, such as... Figure 2 As shown, the device consists of four parts: a coupling path blocking module, a physical domain signal cleanup module, a digital domain semantic verification module, and a system control and management module. The specific components of each module are as follows:

[0051] (I) Coupling Path Blocking Module

[0052] The coupling path blocking module is used to cut off or weaken the transmission of malicious noise on the physical connection path from three aspects: active shielding, passive filtering and voltage regulation, so as to ensure the stability of the physical environment of the front end of the biometric identification system. It consists of an active shielding unit, a passive filtering unit and a voltage regulation unit.

[0053] Active shielding unit: A shielding cover made of a high-permeability metal material (such as copper or aluminum) is used, and its size should be large enough to completely cover the sensitive circuit parts of the biometric information acquisition device. The shielding cover is sealed by welding or screw fastening to ensure that external electromagnetic interference cannot propagate into the internal circuitry through space. For example, for small biometric chips, a custom-sized metal shielding cover can be made to form a closed active shielding space around the chip.

[0054] Passive Filtering Unit: A passive filter composed of inductors and capacitors is designed based on the operating frequency range of the system power supply. For example, if the system power supply operates in the 50Hz-60Hz AC frequency band, an inductor-capacitor combination with appropriate inductance (e.g., 10mH) and capacitance (e.g., 100μF) can be selected and connected to the transmission line according to a π-type or T-type filter circuit structure. Here, the transmission line refers to the power supply line of the bio-information acquisition device. Through the frequency selectivity of the filter, noise in specific frequency bands in the transmission line is effectively attenuated, thus initially purifying the power supply and environmental signals entering the system.

[0055] Voltage Regulator Unit: A high-precision, wide-input-range voltage regulator chip (such as LM7805) is selected and connected to the power supply circuit. Filter capacitors (e.g., 100μF input, 10μF output) are connected to the input and output terminals of the regulator chip to further stabilize the voltage. When malicious power supply noise causes the input voltage to fluctuate within a certain range (e.g., ±10%), the regulator chip can automatically adjust its internal circuit parameters to ensure the output voltage remains stable at the system's required rated value (e.g., 5V), providing a stable operating voltage environment for the system hardware.

[0056] (II) Physical Domain Signal Cleanup Module

[0057] The physical domain signal purification module is installed on the power circuit of the bio-information acquisition device. Compared with the coupling path blocking module, it is closer to the bio-information acquisition device. It is used to form a closed loop of processing from real-time monitoring and feature analysis of power and environmental signals to interference suppression, reducing the noise transmitted to the bio-information acquisition device through the power circuit. It consists of a noise acquisition unit, a noise feature analysis unit, and an interference suppression unit.

[0058] Noise Acquisition Unit: High-precision current and voltage sensors (such as Hall current sensors and voltage transformers) are installed near the bioinformatics acquisition device along the transmission line. These sensors acquire power and environmental signals in real time, amplify, filter, and perform analog-to-digital conversion to obtain digital signals, which are then transmitted to the subsequent noise characteristic analysis unit for further analysis.

[0059] Noise Feature Analysis Unit: This unit employs a high-performance digital signal processor (such as a DSP chip) as its core processing unit. It utilizes spectrum analysis algorithms (such as Fast Fourier Transform, FFT) to perform spectrum analysis on the power supply and ambient signals, obtaining the signal's spectral characteristics. In this embodiment, the spectral characteristics include at least power spectral density, frequency resolution, and frequency range.

[0060] By employing pattern recognition technology, the spectral characteristics of the current signal are compared with known noise patterns (such as impulse noise, white noise, and other pattern libraries) and the spectral characteristics under normal conditions to identify the presence of noise and the corresponding noise characteristic parameters. The noise characteristic parameters include the type of noise, frequency range, and power spectral density, providing a precise basis for subsequent interference suppression.

[0061] If the signal matches the spectral characteristics under normal conditions, the signal is input to the digital domain semantic verification module based on the logic judgment circuit; if the signal matches noise, the noise intensity is further calculated based on the power spectral density, and the signal with noise intensity higher than the threshold is input to the interference suppression unit based on the logic judgment circuit; otherwise, it is input to the digital domain semantic verification module.

[0062] Interference suppression unit: It uses a long short-term memory network model to predict the noise characteristic parameters of the next moment, takes the interference signal that is inverse of the predicted signal and injects it into the power supply circuit to filter the power supply and environmental signals, and provides the filtered signal to the bio-information acquisition device.

[0063] In one specific embodiment of the present invention, a long short-term memory network model is used to predict the noise characteristic parameters at the next time step, and the interference signal inverse of the predicted signal is injected into the power supply circuit to filter power supply and environmental signals as follows:

[0064] Data collection and preprocessing: The power supply and environmental signals, noise types, frequency ranges and power spectral density data are sampled at a fixed frequency on the power circuit of the bioinformatics acquisition device. After min-max normalization to eliminate dimensional differences, time domain, frequency domain and time-frequency domain features are extracted to form feature vectors.

[0065] A Long Short-Term Memory (LSTM) network model is constructed. This model uses feature vectors of historical power and environmental signals as input to predict the power and environmental signals at the next time step and generates an interference signal that is inversely phase to the predicted signal to inject into the power circuit. During the training phase, normal time-series signal data is collected, and the dataset is divided into training, validation, and test sets at 70%, 15%, and 15% respectively. Loss functions such as mean squared error are used according to the task definition, and optimizers such as stochastic gradient descent or Adam are selected. Parameters are updated iteratively multiple times, and hyperparameters are adjusted based on the validation set results to prevent overfitting or underfitting. After the model training is complete, the real-time collected data is preprocessed and input into the model, which then outputs a predicted value for the future interference signal. By using conventional coupling circuits, interference signals are injected into the transmission line to achieve active noise cancellation and dynamic adaptive filtering.

[0066] (III) Digital Domain Semantic Validation Module

[0067] The digital domain semantic verification module is used to verify the multimodal biological signals collected by the bioinformation acquisition device to determine whether there are abnormal behaviors or signs of backdoor injection attacks. It consists of a multimodal feature extraction network unit and a semantic verification unit.

[0068] The multimodal feature extraction network unit is used to preprocess the input biometric data, then use a CNN network to extract feature data for anomaly detection, and normalize the feature data. Here, multimodal means that the input biometric data contains multiple different types of modalities, such as face images, audio signals, and fingerprint data. The input biometric data may be one or more of face images, audio signals, and fingerprint data. If there are multiple types of data, each type of biometric data is judged separately during the defense phase. During the training phase, there is no need to distinguish the data types. Face images, audio signals, and fingerprint data containing both abnormal and normal data are collected and preprocessed. Normal data refers to natural, unobstructed frontal faces captured by a camera, normal speech recordings, or clear fingerprints captured by a fingerprint scanner. Abnormal data refers to perturbations added to normal face images by attack algorithms such as FGSM and PGD, or the insertion of silent segments, speech rate adjustment (time stretching), addition of white noise, filtering of specific frequency bands (such as high-pass filtering), frequency band perturbations, etc., in normal audio signals, or erosion / dilation operations to simulate fingerprint data defects, rotation / translation to simulate fingerprint data acquisition offset, etc. The preprocessing of the collected biometric data is as follows: for audio signals, they are converted into Mel spectrograms; for face images, Mel spectrograms, and fingerprint images, the size is normalized, for example, to 224×224.

[0069] The semantic verification unit uses an SVM model to determine whether normalized feature data is anomalous. Anomalous data represents abnormal behavior or signs of backdoor injection attacks in the input bioinformatics data. The CNN network and SVM model are jointly trained to enable it to identify anomalous bioinformatics data.

[0070] (iv) System Control and Management Module

[0071] The system control and management module enables communication between external devices and various modules, and executes decisions based on the verification results of the digital domain semantic verification module: if the digital domain semantic verification module determines that there is abnormal behavior or signs of a backdoor injection attack, it issues an alarm, locks the identity recognition system, and activates a backup verification mechanism; otherwise, it inputs the multimodal biosignals collected by the biometric information acquisition device into the subsequent identity recognition system to perform the verification process. It consists of a remote control and communication unit and a comprehensive analysis and decision-making unit.

[0072] Remote Monitoring and Communication Unit: This unit uses a module with wireless communication capabilities connected to the system's main control unit. It communicates with external devices (such as smartphones and remote servers) based on communication protocols. Users can monitor the working status and collected data (such as power noise levels and biosignal acquisition status) of each module in real time via a mobile application or remote management software. They can also remotely control the device's operating parameters (such as adjusting filter parameters and verification thresholds) to achieve remote monitoring and management. In this embodiment, the module with wireless communication capabilities can be a Wi-Fi module, Bluetooth module, or GSM module, and the corresponding communication protocol can be TCP / IP, Bluetooth, etc. Comprehensive Analysis and Decision Unit: This unit uses a central processing unit as its core processing unit. It executes decisions based on the verification results of the digital domain semantic verification module: if the digital domain semantic verification module determines that there is abnormal behavior or signs of a backdoor injection attack, it issues an alarm, locks the identity recognition system, and activates a backup verification mechanism; otherwise, it inputs the multimodal biosignals collected by the bioinformation acquisition device into the subsequent identity recognition system for processing to ensure the safe and stable operation of the system.

[0073] The deep neural network physical backdoor defense method disclosed in this invention is implemented as follows: Figure 3 As shown, it includes the following stages and steps:

[0074] S1, Transmission Path Noise Blocking Phase

[0075] This stage is like setting up multiple layers of rigorous defenses at the "entrance" of the system, from shielding against spatial noise interference to initially filtering transmission line noise, and then to stabilizing the voltage, step by step, gradually reducing the potential threat of malicious physical interference signals to the system, laying a solid foundation for subsequent more in-depth signal processing and verification.

[0076] One possible implementation process is as follows:

[0077] S11: During the initialization phase of the biometric data acquisition device and identity recognition system, the active shielding unit automatically activates to ensure that the metal shielding cover is correctly installed and properly sealed, completely isolating the sensitive circuits of the biometric data acquisition device from the external electromagnetic environment. By testing the grounding resistance of the shielding cover (which should be less than 1Ω) and the shielding effectiveness (e.g., shielding effectiveness should be greater than 60dB within a specific frequency range), the shielding effect is ensured to meet the requirements, effectively preventing external electromagnetic interference from propagating through space and affecting the system.

[0078] S12: Once the power supply is connected to the system, the passive filter unit immediately begins operation. Based on the frequency characteristics of the filter, it performs initial filtering of power supply noise entering the system.

[0079] S13: During power supply operation, the voltage regulator unit monitors input voltage changes in real time. When malicious power supply noise causes input voltage fluctuations to exceed a set threshold (e.g., ±5%), the voltage regulator unit automatically adjusts its internal circuit parameters by changing the output voltage adjustment value of the regulator chip to maintain the output voltage stable at the system's required rated value (e.g., 5V ± 0.1V). Simultaneously, it records the time and amplitude of voltage fluctuations for subsequent analysis and processing.

[0080] S2, Physical Domain Power Cleanup Phase

[0081] This stage involves further refined signal processing, from real-time signal monitoring and feature analysis to targeted interference suppression, forming a complete and intelligent processing loop. Through these steps, abnormal noise in the environment can be detected and effectively combated in a timely manner, ensuring that the environmental signals input to the system are as pure as possible and reducing potential safety risks caused by noise.

[0082] One possible implementation process is as follows:

[0083] S21: The noise detection unit continuously monitors power and environmental signals in real time, and uses sensors and signal detection circuits installed on the transmission line to collect power and environmental signals at a high sampling frequency.

[0084] Let the power supply and ambient signals be continuous-time signals x(t), with a sampling frequency f. s (f s Sampling is performed on the sample (≥20kHz), and the sampling process satisfies the Nyquist sampling theorem to obtain the discrete-time sequence x[n]=x(nT) s ),in The sampling period is n = 0, 1, 2, ... Next, the sampled data is preprocessed.

[0085] In this embodiment, the preprocessing method includes signal amplification, filtering (removing high-frequency noise and low-frequency interference), and analog-to-digital conversion to convert the collected analog power supply and environmental signals into digital signals for subsequent analysis and processing. Specifically: First, the sampled signal x[n] is amplified by A, and the amplified signal X[n] is: X[n] = A × x[n]. Then, a cascaded low-pass and high-pass filter is used to remove high-frequency noise and low-frequency interference. Let the unit impulse response of the low-pass filter be h. lp [n], the unit impulse response of the high-pass filter is h hp [n], then the filtered signal X2[n] is: X2[n]=(X1[n]*h lp [n]*h hp[n]), where * denotes convolution operation. The filtered analog signal X2[n] is converted into a digital signal y[n] by an analog-to-digital converter (ADC). The quantization bits of the ADC are b, and the quantized formula can be expressed as: Where V ref The reference voltage for the ADC is , and round(·) represents the rounding operation.

[0086] S22: The preprocessed power and environmental signals are transmitted to the noise feature analysis unit. The noise feature analysis unit uses techniques such as spectrum analysis and pattern recognition to perform in-depth analysis of the signals.

[0087] In this embodiment, the spectral characteristics of the signal are first calculated, which are power spectral density or frequency resolution. The signal is then compared with a known noise pattern library to determine the noise type, frequency range, and intensity. The noise types include impulse noise, white noise, and periodic noise. The frequency range is generally between 100Hz and 10kHz.

[0088] For example, the power spectral density P of the preprocessed power supply and ambient signal y[n] can be calculated using a spectrum analysis algorithm. f (f) Let the N-point discrete Fourier transform of y[n] be Y[k], then the power spectral density estimate is:

[0089]

[0090] Where |Y[k]| represents the magnitude of Y[k], and the frequency resolution is... The frequency component distribution of the signal is obtained by performing spectral analysis.

[0091] Using pattern recognition technology, the power spectral density of the current signal is compared with known noise patterns. Assume there are M noise patterns in the known noise pattern library, and the power spectral density of each pattern is P. m [k], m = 1, 2, ..., M. Calculate P. y [k] and P m The similarity S between [k] m Taking Euclidean distance as an example, similarity can be expressed as:

[0092]

[0093] The noise type was determined based on the noise pattern with the highest similarity. Furthermore, the power spectral density P was analyzed. y [k], determines that the power spectral density value is greater than a certain threshold P. th The corresponding frequency range [f min ,f maxThis refers to the frequency range of the noise. Noise intensity can be represented by calculating the average or maximum value of the power spectrum within this frequency range; for example, taking the maximum value:

[0094] S23: Based on the results of noise characteristic analysis, if the noise intensity I is greater than the preset anomaly threshold I... th If abnormal noise is detected, the active interference suppression unit is activated.

[0095] S3, Digital Domain Semantic Verification Phase

[0096] This phase expands the defensive perspective from the physical power supply or environmental signal level to the digital domain's biosignal verification level. By collecting multimodal biosignals and verifying them at the semantic layer, it is possible to further prevent physical backdoor attacks on biometric identification systems from the perspective of user authentication, increasing the difficulty and complexity of attacks and improving the overall security of the system.

[0097] One possible implementation process is as follows:

[0098] S31: Multimodal feature extraction network unit, which is used to preprocess the input biological information data, then use CNN to extract feature data for anomaly detection, and normalize the feature data.

[0099] Here, biometric data is directly acquired by a biometric data acquisition device, which is used to collect biometric data such as facial features, iris details, voice features, and fingerprint information. Common biometric data acquisition devices include cameras, microphones, and fingerprint sensors. This invention does not limit the specific type of biometric data acquisition device.

[0100] S32: Use the SVM model to determine whether the normalized feature data belongs to anomalous data. The anomalous data represents abnormal behavior or signs of backdoor injection attack in the input bioinformatics data.

[0101] S4, System Decision and Processing Phase

[0102] This stage is the final decision-making and response phase of the entire defense method. Based on the detection and verification results of the previous stages, it makes accurate and timely judgments and takes appropriate actions. Whether it's the normal termination process when security is determined or the decisive handling when anomalies are detected, it demonstrates the integrity and effectiveness of the defense method, ensuring that the system can respond appropriately to physical backdoor attacks on biometric identification systems.

[0103] One possible implementation process is as follows:

[0104] S41: If the biosignal verification result is normal, it is determined that there are currently no signs of backdoor injection attacks, and the entire defense process is successfully completed. The multimodal biosignals collected by the bio-information acquisition device are input into the subsequent identity recognition system for processing, and the system continues to maintain normal operation. Simultaneously, relevant information about this verification (such as verification time, biometric information, etc.) is recorded for subsequent querying and auditing. Here, the identity recognition system is responsible for processing, storing, and comparing the collected biometric data to confirm or verify individual identity. Its core includes key modules such as feature extraction, data storage, pattern matching, and decision-making mechanisms. This invention does not limit the specific type of identity recognition system.

[0105] S42: If the biosignal verification result is abnormal, the decision-making unit immediately discards the collected biometric information to prevent attackers from using abnormal biometric information for illegal operations. Simultaneously, according to system settings, further corresponding measures are taken. For example, an alarm is issued through the system's alarm device to notify the system administrator or relevant personnel; the identity recognition system is locked to prohibit any user from performing identity verification operations; a backup verification mechanism is activated, such as requiring the user to enter a backup password or performing secondary biometric verification (such as iris recognition, voiceprint recognition, etc.) to ensure system security.

[0106] The above examples are merely specific embodiments of the present invention. Obviously, the present invention is not limited to the above embodiments and can have many variations. For example, the biometric information collection device is not limited to cameras and microphones, but can also include fingerprints, etc. In practical applications, the defense methods and devices of the present invention can be flexibly adjusted and optimized according to the specific needs and characteristics of different identity recognition systems to achieve the best defense effect. Simultaneously, the defense device should be regularly maintained and tested, and data such as the noise pattern library and biometric templates should be updated to ensure that the system's performance and security are always in good condition. All variations that can be directly derived or conceived by those skilled in the art from the content disclosed in this invention should be considered within the scope of protection of this invention.

Claims

1. A defense device against a physical backdoor attack of a biological information recognition system, the biological information recognition system being composed of a biological information collection device and an identity recognition system, a multi-modal biological signal being collected by the biological information collection device and being authenticated by the identity recognition system; characterized in that, The defense device comprises: A coupling path blocking module for cutting off or weakening the conduction of malicious noise on the physical connection path from three aspects of active shielding, passive filtering and voltage stabilization, so as to guarantee the stability of the physical environment in front of the biological information recognition system; A physical domain signal purification module installed on the power supply circuit of the biological information acquisition device, which is closer to the biological information acquisition device than the coupling path blocking module, for forming a processing closed loop from real-time monitoring, feature analysis to interference suppression of the power supply and environmental signals, so as to reduce the noise transmitted to the biological information acquisition device through the power supply circuit; A digital domain semantic verification module for verifying the multi-modal biological signals collected by the biological information acquisition device and judging whether there is abnormal behavior or backdoor injection attack evidence; A system control and management module for realizing the communication of external devices to each module, and for executing decision according to the verification result of the digital domain semantic verification module: if the digital domain semantic verification module judges that there is abnormal behavior or backdoor injection attack evidence, an alarm is sent, the identity recognition system is locked and the backup verification mechanism is started; otherwise, the multi-modal biological signals collected by the biological information acquisition device are input into the subsequent identity recognition system for verification.

2. The defense apparatus against physical backdoor attacks for a biometric information recognition system according to claim 1, characterized in that, The coupling path blocking module comprises: An active shielding unit adopting a high-permeability metal shielding cover to cover the sensitive circuit part of the biological information acquisition device and form a closed active shielding space around the sensitive circuit; A passive shielding unit adopting a passive filter connected to the power supply circuit of the biological information acquisition device; A voltage stabilization unit adopting a voltage stabilization chip connected to the power supply circuit of the biological information acquisition device and located downstream of the passive shielding unit.

3. The defense apparatus against a physical backdoor attack on a biometric information recognition system according to claim 1, characterized by, The physical domain signal purification module comprises: A noise signal acquisition unit adopting a current sensor and a voltage sensor connected to the power supply circuit close to the biological information acquisition device for collecting power supply and environmental signals from the power supply circuit; A noise feature analysis unit for analyzing the frequency spectrum features of the power supply and environmental signals, comparing the frequency spectrum features of the current signals with the known noise mode and the frequency spectrum features in the normal state, identifying whether there is noise and corresponding noise feature parameters; the noise feature parameters include the type, frequency range and power spectrum density of the noise; if the signal matches the frequency spectrum features in the normal state, the signal is directly provided to the biological information acquisition device; if the signal matches the noise, the noise intensity is calculated according to the power spectrum density, the signal with noise intensity higher than the threshold is input into the interference suppression unit, otherwise the signal is directly provided to the biological information acquisition device; An active interference suppression unit adopting a long short-term memory network model to predict the noise feature parameters at the next moment, inject the interference signal of the inverse of the predicted signal into the power supply circuit to filter the power supply and environmental signals, and provide the filtered signals to the biological information acquisition device.

4. The defense apparatus against physical backdoor attacks for a biometric information recognition system according to claim 3, characterized in that, The long short-term memory network model for predicting the noise feature parameters at the next moment, the interference signal of the inverse of the predicted signal injected into the power supply circuit to filter the power supply and environmental signals, comprises: Data collection and preprocessing: The power supply and environmental signals, noise types, frequency ranges and power spectral density data are sampled at a fixed frequency on the power circuit of the bioinformatics acquisition device. After min-max normalization to eliminate dimensional differences, time domain, frequency domain and time-frequency domain features are extracted to form feature vectors. A long short-term memory network model is constructed. This model is used to predict the power and environmental signals at the next time step by taking the feature vectors of power and environmental signals at historical time as input, and to generate an interference signal that is inversely phase to the predicted signal and inject it into the power circuit.

5. The defense apparatus against physical backdoor attacks for a biometric information recognition system according to claim 3, characterized in that, The noise signal acquisition unit also includes the process of amplifying, filtering, and analog-to-digital converting the acquired power and environmental signals to obtain digital signals, which serve as the input to the noise feature analysis unit.

6. The defense apparatus against physical backdoor attacks for a biometric information recognition system according to claim 1, characterized in that, The aforementioned digital domain semantic verification module includes: The multimodal feature extraction network unit is used to preprocess the input biological information data, then use CNN to extract feature data for anomaly detection, and normalize the feature data. The semantic verification unit uses an SVM model to determine whether the normalized feature data is abnormal data. The abnormal data represents abnormal behavior or signs of backdoor injection attacks in the input bioinformatics data.

7. The defense apparatus against physical backdoor attacks for a biometric information recognition system according to claim 1, characterized in that, The system control and management module includes: The remote control and communication unit is used to connect to the various modules of the system using modules with wireless communication capabilities, and to communicate with external devices based on communication protocols; the external devices allow users to view the working status and collected data of each module in real time, as well as to control the operating parameters of the modules. The integrated analysis and decision-making unit is used to make decisions based on the verification results of the digital domain semantic verification module: if the digital domain semantic verification module determines that there is abnormal behavior or signs of backdoor injection attack, it will issue an alarm, lock the identity recognition system and activate the backup verification mechanism; otherwise, it will input the multimodal biological signals collected by the biometric information acquisition device into the subsequent identity recognition system for processing.

8. The defense apparatus against physical backdoor attacks for a biometric information recognition system according to claim 7, characterized in that, The backup verification mechanism includes inputting a backup password and secondary biometric verification.

9. A defense method based on the defense device against a physical backdoor attack on a biometric information recognition system according to claim 2, characterized by, Includes the following steps: Step 1: During system initialization, the active shielding unit is activated to isolate the sensitive circuits of the bio-information acquisition device from the external electromagnetic environment; Step 2: After the power supply is connected to the system, the passive filtering unit immediately performs preliminary filtering of the input power supply noise; Step 3: During the operation of the power supply, the voltage regulation unit monitors the input voltage in real time. If the voltage fluctuation exceeds the threshold, it automatically adjusts the internal parameters to maintain a stable output. Step 4: The physical domain signal purification module monitors power and environmental signals, identifies noise and noise characteristic parameters based on spectrum analysis and pattern recognition technology. If the signal matches the spectrum characteristics under normal conditions, proceed to step 5; if the signal matches noise, calculate the noise intensity based on the power spectral density, and suppress signals with noise intensity higher than the threshold. Step 5: The digital domain semantic verification module verifies the collected multimodal biological signals from the semantic layer to determine whether there are any abnormal behaviors or signs of backdoor injection attacks. If any abnormal behavior or signs of backdoor injection attack are detected, an alarm will be issued, the identity recognition system will be locked, and a backup verification mechanism will be activated; otherwise, the multimodal biosignals collected by the biometric information acquisition device will be input into the subsequent identity recognition system for processing.

10. The defense method of the defense apparatus against a physical backdoor attack on a biometric information recognition system according to claim 9, characterized by, When the biosignal verification result is normal, the verification time and biometric information of this verification are recorded; when the biosignal verification result is abnormal, an alarm is issued, the identity recognition system is locked, and the backup verification mechanism is activated.

Images