Multi-factor identity authentication method, system and equipment for resisting stress attack

Abstract

The invention discloses a multi-factor identity authentication method, system and equipment for resisting stress attacks. The method comprises the following steps: performing facial feature verification on a to-be-authenticated user according to identity authentication information to obtain a facial verification result; performing micro-expression recognition on the to-be-authenticated user to obtain a micro-expression recognition result; when the micro-expression recognition result is verification failure, sending the micro-expression recognition result to the client; the client sends a password input by a user to the server according to a micro-expression recognition result; performing hash verification on the password input by the user to obtain a password verification result; when the password verification result is a normal result, allowing the to-be-authenticated user to enter the system, and comprehensively analyzing user audio data carried by the identity authentication information to obtain a comprehensive analysis result; and when the comprehensive analysis result is a normal result, confirming that the to-be-authenticated user passes identity authentication. The method can effectively cope with stress attacks, improves the security and privacy of identity authentication, and can be widely applied to the technical field of computers.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a multi-factor identity authentication method, system, and device for resisting coercive attacks. Background Art

[0002] With the widespread use of smart devices, a vast amount of data is stored within them, posing a significant security challenge to protecting this data. Currently, smart device security primarily relies on fingerprint and facial recognition. However, in the event of a duress attack, where the attacker, while present alongside the legitimate user, threatens the legitimate user to authenticate the device, the authentication system still accesses the legitimate user's biometric information, which is considered a duress attack.

[0003] In the related technology, there is an identity authentication method based on fingerprint press detection for dealing with coercive attacks. This method requires collecting normal press fingerprints and forced press fingerprints in advance, and determines whether the user is under coercive attack by verifying the fingerprint status during identity authentication. This method is more effective in dealing with coercive attacks on current smart devices, but most smart devices currently use facial feature recognition for identity authentication. The method based on fingerprint press detection cannot effectively deal with coercive attacks on facial feature recognition.

[0004] In summary, the technical problems existing in the relevant technologies need to be improved. Summary of the Invention

[0005] The embodiments of the present application are intended to at least partially address one of the technical problems in the related art. To this end, the main purpose of the embodiments of the present application is to provide a multi-factor identity authentication method, system, and device that can effectively counteract coercive attacks and improve the security and privacy of identity authentication.

[0006] To achieve the above objectives, an embodiment of the present application provides a multi-factor identity authentication method for resisting coercion attacks, which is applied to a server and includes the following steps:

[0007] Receive the identity authentication information corresponding to the user to be authenticated sent by the client;

[0008] Performing facial feature verification on the user to be authenticated based on the identity authentication information to obtain a facial verification result;

[0009] When the facial verification result is successful, performing micro-expression recognition on the user to be authenticated to obtain a micro-expression recognition result;

[0010] When the micro-expression recognition result is a verification failure, the micro-expression recognition result is sent to the client; so that the client obtains the user input password of the user to be authenticated according to the micro-expression recognition result, and sends the user input password to the server;

[0011] Perform hash verification on the password input by the user to obtain a password verification result;

[0012] When the password verification result is normal, the user to be authenticated is allowed to enter the system, and the user audio data carried by the identity authentication information is comprehensively analyzed to obtain a comprehensive analysis result;

[0013] When the comprehensive analysis result is a normal result, it is confirmed that the user to be authenticated has passed the identity authentication.

[0014] In some embodiments, the identity authentication information includes user characteristic behavior information, and the user characteristic behavior information includes facial biometric data. The facial feature verification of the user to be authenticated based on the identity authentication information to obtain a facial verification result includes:

[0015] Preprocessing the facial biometric data to obtain facial feature data to be input;

[0016] Inputting the facial feature data to be input into a facial recognition convolutional neural network for feature extraction processing, and outputting a target facial feature vector;

[0017] Matching the target facial feature vector with the user facial feature vector stored in the database to obtain a facial feature matching result; wherein the facial feature matching result includes a facial feature matching similarity;

[0018] When the facial feature matching similarity is greater than or equal to a preset similarity threshold, the facial feature matching result is regarded as a successful facial verification result;

[0019] When the facial feature matching similarity is less than a preset similarity threshold, the facial feature matching result is regarded as a facial verification result of failed verification.

[0020] In some embodiments, when the facial verification result is successful, performing micro-expression recognition on the user to be authenticated to obtain a micro-expression recognition result includes:

[0021] When the facial verification result is successful, the user video data carried in the identity authentication information is input into the micro-expression recognition convolutional neural network for dynamic micro-expression recognition, and a micro-expression probability score is output;

[0022] The micro-expression recognition result is determined according to the micro-expression probability score and a preset micro-expression probability score threshold.

[0023] In some embodiments, performing hash verification on the password input by the user to obtain a password verification result includes:

[0024] Encrypting the user input password using a hash algorithm to obtain an encrypted input password;

[0025] Comparing the hash value corresponding to the encrypted input password with the hash value stored in the database to determine the password category of the user input password;

[0026] When the hash value corresponding to the encrypted input password is consistent with the hash value of the normal password stored in the database, determining that the password type of the user input password is a normal password, and taking the result that the password type is a normal password as a normal password verification result;

[0027] When the hash value corresponding to the encrypted input password is consistent with the emergency password hash value stored in the database, the password category of the user input password is determined to be an emergency password, and the result that the password category is an emergency password is used as the password verification result of the duress attack.

[0028] In some embodiments, the method further comprises:

[0029] When the password type of the password input by the user is a normal password, deleting the user video data stored in the database; wherein the user video data is the data carried in the identity authentication information;

[0030] When the password type of the password entered by the user is an emergency password, the system enters a security mode, hides the user sensitive data carried in the identity authentication information, and performs an alarm process based on the user location information carried in the identity authentication information.

[0031] In some embodiments, when the password verification result is a normal result, the user to be authenticated is allowed to enter the system, and a comprehensive analysis is performed on the user audio data carried by the identity authentication information to obtain a comprehensive analysis result, including:

[0032] When the password verification result is normal, allowing the user to be authenticated to enter the system;

[0033] Randomly select a number of target user audio data from all user audio data carried by the identity authentication information;

[0034] Using Mel-frequency cepstral coefficients to perform feature extraction processing on the audio data of each target user to obtain a number of speech feature vectors;

[0035] Input each of the speech feature vectors into a pre-trained deep learning model for classification processing, and output a number of speech emotion scores;

[0036] Determine, based on each of the speech emotion scores, a user emotion classification result corresponding to each of the target user audio data; wherein the user emotion classification result includes a normal classification result and an abnormal classification result;

[0037] When all the user emotion classification results are the normal classification results, confirming that the user to be authenticated has not been subjected to a coercive attack, and taking the result that the user to be authenticated has not been subjected to a coercive attack as a normal comprehensive analysis result;

[0038] When at least one of the common classification results exists in each of the user emotion classification results, it is determined that the user to be authenticated is under duress attack, and the result that the user to be authenticated is under duress attack is used as an abnormal comprehensive analysis result.

[0039] In some embodiments, the method further comprises:

[0040] When it is confirmed that the user to be authenticated is not under duress, deleting all user audio data carried in the identity authentication information;

[0041] When it is confirmed that the user to be authenticated is under duress attack, a system logout operation is performed on the user to be authenticated, and identity abnormality information and a re-authentication instruction are sent to the client.

[0042] To achieve the above objectives, another aspect of the present invention provides a multi-factor identity authentication system for resisting coercive attacks, which is applied to a server and includes the following modules:

[0043] The identity authentication information receiving module is used to receive the identity authentication information corresponding to the user to be authenticated sent by the client;

[0044] A facial feature verification module is used to verify the facial features of the user to be authenticated based on the identity authentication information to obtain a facial verification result;

[0045] A micro-expression recognition module is used to perform micro-expression recognition on the user to be authenticated when the facial verification result is successful, and obtain a micro-expression recognition result;

[0046] a micro-expression recognition result sending module, configured to send the micro-expression recognition result to the client when the micro-expression recognition result indicates verification failure, so that the client obtains the user input password of the user to be authenticated based on the micro-expression recognition result, and sends the user input password to the server;

[0047] A password verification module is used to perform hash verification on the password input by the user to obtain a password verification result;

[0048] An audio comprehensive analysis module is used to allow the user to be authenticated to enter the system when the password verification result is normal, and to perform a comprehensive analysis on the user audio data carried by the identity authentication information to obtain a comprehensive analysis result;

[0049] The identity authentication result confirmation module is used to confirm that the user to be authenticated has passed the identity authentication when the comprehensive analysis result is a normal result.

[0050] To achieve the above-mentioned purpose, another aspect of an embodiment of the present application provides an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor implements the above-mentioned method when executing the computer program.

[0051] To achieve the above objectives, another aspect of an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described above is implemented.

[0052] The embodiments of the present application include at least the following beneficial effects: The present application provides a multi-factor identity authentication method, system, and device for resisting coercion attacks. The scheme receives identity authentication information corresponding to a user to be authenticated from a client; performs facial feature verification on the user to be authenticated based on the identity authentication information to obtain a facial verification result; when the facial verification result is successful, performs micro-expression recognition on the user to be authenticated to obtain a micro-expression recognition result; when the micro-expression recognition result is a verification failure, sends the micro-expression recognition result to the client; so that the client obtains the user input password of the user to be authenticated based on the micro-expression recognition result and sends the user input password to the server; performs hash verification on the user input password to obtain a password verification result; when the password verification result is normal, allows the user to enter the system and performs comprehensive analysis on the user audio data carried in the identity authentication information to obtain a comprehensive analysis result; when the comprehensive analysis result is normal, confirms that the user to be authenticated has passed the identity authentication. The embodiments of the present application use multi-factor authentication methods such as facial feature verification, micro-expression recognition, password verification, and comprehensive analysis of user audio data to verify the user's identity from different dimensions, which can effectively resist coercion attacks, improve the security and privacy of identity authentication, and enhance user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 This is a schematic diagram of an implementation environment provided by an embodiment of the present application;

[0054] Figure 2A flowchart of a multi-factor identity authentication method for resisting coercion attacks provided in an embodiment of the present application;

[0055] Figure 3 This is a flowchart of an identity registration system for a multi-factor identity authentication system that resists coercion attacks provided by an embodiment of the present application;

[0056] Figure 4 This is a schematic diagram of the structure of a convolutional neural network for dynamic micro-expression recognition provided by an embodiment of the present application;

[0057] Figure 5 This is a flowchart of information sampling and verification when using a password to log in to a multi-factor identity authentication system that resists coercion attacks provided by an embodiment of the present application;

[0058] Figure 6 This is a flowchart of recording information analysis of a multi-factor identity authentication system against coercion attacks provided by an embodiment of the present application;

[0059] Figure 7 This is an overall flow chart of a multi-factor identity authentication method for resisting coercion attacks provided by an embodiment of the present application;

[0060] Figure 8 This is a schematic diagram of the structure of a multi-factor identity authentication system for resisting coercive attacks provided by an embodiment of the present application;

[0061] Figure 9 This is a schematic diagram of the hardware structure of the electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0062] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of the present application. They are merely examples of systems and methods consistent with some aspects of the embodiments of the present application as detailed in the appended claims.

[0063] It will be understood that the terms "first", "second", etc. used in this application may be used herein to describe various concepts, but unless otherwise specified, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, without departing from the scope of the embodiments of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" and "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0064] The terms "at least one", "plurality", "each", "any", etc. used in this application include "at least one", "two" or more, "plurality" or "each", "any" or "any one", "each" or "any one" in the context of the present invention, and "at least one" or "at least one" includes one, two or more, "plurality" or "any one" includes two or more, "each" or "each one" in the context of the present invention, and "any" or "any one

[0065] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing the embodiments of this application only and are not intended to limit this application.

[0066] Before explaining the embodiments of the present application in detail, some of the nouns and terms involved in the embodiments of the present application are first explained. The nouns and terms involved in the embodiments of the present application are subject to the following explanations.

[0067] With the widespread use of smart devices, a vast amount of data is stored within them, posing a significant security challenge to protecting this data. Currently, smart device security primarily relies on fingerprint and facial recognition. However, in the event of a duress attack, where the attacker, while present alongside the legitimate user, threatens the legitimate user to authenticate the device, the authentication system still accesses the legitimate user's biometric information, which is considered a duress attack.

[0068] In the related technology, there is an identity authentication method based on fingerprint press detection for dealing with coercive attacks. This method requires collecting normal press fingerprints and forced press fingerprints in advance, and determines whether the user is under coercive attack by verifying the fingerprint status during identity authentication. This method is more effective in dealing with coercive attacks on current smart devices, but most smart devices currently use facial feature recognition for identity authentication. The method based on fingerprint press detection cannot effectively deal with coercive attacks on facial feature recognition.

[0069] In view of this, embodiments of the present application provide a multi-factor identity authentication method, system, and device to resist coercion attacks. The scheme receives identity authentication information corresponding to a user to be authenticated from a client; performs facial feature verification on the user to be authenticated based on the identity authentication information to obtain a facial verification result; when the facial verification result is successful, performs micro-expression recognition on the user to be authenticated to obtain a micro-expression recognition result; when the micro-expression recognition result is a verification failure, the micro-expression recognition result is sent to the client; so that the client obtains the user input password of the user to be authenticated based on the micro-expression recognition result and sends the user input password to the server; performs hash verification on the user input password to obtain a password verification result; when the password verification result is normal, allows the user to enter the system and performs a comprehensive analysis of the user audio data carried in the identity authentication information to obtain a comprehensive analysis result; when the comprehensive analysis result is normal, confirms that the user to be authenticated has passed the identity authentication. The embodiments of the present application use multi-factor authentication methods such as facial feature verification, micro-expression recognition, password verification, and comprehensive analysis of user audio data to verify the user's identity from different dimensions, which can effectively resist coercion attacks, improve the security and privacy of identity authentication, and enhance user experience.

[0070] The multi-factor identity authentication method for resisting coercion attacks provided in the embodiments of the present application relates to the field of computer technology. The multi-factor identity authentication method for resisting coercion attacks provided in the embodiments of the present application can be applied to a terminal, can be applied to a server, or can be software running in a terminal or a server. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, and a car terminal, etc., but is not limited to this; the server side can be configured as an independent physical server, or as a server cluster or distributed system composed of multiple physical servers, or as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network) and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network; the software can be an application that implements a multi-factor identity authentication method for resisting coercion attacks, etc., but is not limited to the above forms.

[0071] The present application can be used in numerous general or special computer system environments or configurations. For example: personal computers, server computers, handheld devices or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs (Personal Computers, personal computers), minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0072] It should be noted that in each specific embodiment of the present application, when it comes to the need to perform relevant processing based on data related to the user's identity or characteristics, such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of such data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0073] See also Figure 1 , Figure 1 This is a schematic diagram of an implementation environment provided by an embodiment of the present application. Figure 1 , the implementation environment includes at least one terminal 102 and a server 101. The terminal 102 and the server 101 can be connected to the network in a wireless or wired manner to complete data transmission and exchange.

[0074] Server 101 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), as well as big data and artificial intelligence platforms.

[0075] In addition, server 101 can also be a node server in a blockchain network. Blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, and encryption algorithm.

[0076] The terminal 102 can be a smartphone, tablet computer, laptop computer, desktop computer, smart speaker, smart watch, etc. The terminal 102 can also be a vehicle-mounted terminal of the various device types described above, but is not limited thereto. The terminal 102 and the server 101 can be connected directly or indirectly via wired or wireless communication, which is not limited in this embodiment of the present application.

[0077] For example, based on Figure 1 In the implementation environment shown, the embodiment of the present application provides a multi-factor identity authentication method for resisting coercion attacks. The following mainly uses the multi-factor identity authentication method for resisting coercion attacks as an example to illustrate. It can be understood that the method can also be applied to the terminal 102. In the embodiment of the present application, the terminal 102 can be called a client.

[0078] See also Figure 2 , Figure 2 This is an optional flowchart of a multi-factor identity authentication method for resisting coercion attacks provided in an embodiment of the present application. Figure 2 The method in is applied to the server, Figure 2 The method may include but is not limited to steps S201 to S207.

[0079] Step S201: receiving identity authentication information corresponding to the user to be authenticated sent by the client;

[0080] The present invention provides a multi-factor authentication method for countering coercion attacks. This method is based on a multi-factor authentication system that combines password input with facial micro-expression recognition to counter coercion attacks using facial feature recognition. A coercion attack is one in which an attacker uses threats or intimidation to force a legitimate user to cooperate with the attacker in performing identity authentication.

[0081] In the embodiment of the present application, before the user performs identity authentication, the client needs to first perform identity registration on the server. In the specific implementation, the client sends an identity registration request to the server and enters identity information such as facial biometric information, normal password and emergency password into the server. Finally, the server returns the registration status. Figure 3 , Figure 3 This is an identity registration flow chart of a multi-factor identity authentication system for resisting coercion attacks provided by an embodiment of the present application, such as Figure 3As shown, the executor of identity registration is the client. The registration process of the multi-factor identity authentication system against coercive attacks provided by the embodiment of the present application is as follows: First, the user (client) sends an identity registration request to the server: This process occurs when the user first requests identity registration from the system; Then, the client prompts the user to enter facial biometric information: After receiving the user's identity registration request, the server returns a registration permission status to the client, and the client prompts the user to enter facial biometric information and apply for the client's camera permission. After the user agrees, the client starts the camera to assist the user in completing facial biometric information collection. After completing facial biometric information collection, the facial biometric information is sent to the server. After matching the new user, the server returns a successful facial biometric information collection status to the client; Then, the client prompts the user to enter a normal password: After the client receives the successful facial biometric information collection status returned by the server, it prompts The user enters a normal password. After the user enters the normal password, the client prompts the user to enter the normal password again to confirm. When the two normal passwords are consistent, the hashed normal password is sent to the server. The server saves the hashed normal password and returns the normal password collection success status to the client. Further, the client prompts the user to enter an emergency password: after receiving the normal password collection success status returned by the server, the client prompts the user to enter an emergency password. The emergency password cannot be consistent with the normal password. After the user enters the emergency password, the client prompts the user to enter the emergency password again to confirm. When the two emergency passwords are consistent, the client sends the hashed emergency password to the server. The server saves the hashed emergency password and returns the emergency password collection success status to the client. Finally, the client prompts the user that the registration is successful: after receiving the emergency password collection success status returned by the server, the client prompts the user that the registration is successful.

[0082] The identity authentication information may include user characteristic behavior information and user identity authentication request. The user characteristic behavior information includes the facial biometric data of the user to be authenticated, user location information, user audio data (recording information), and user video data (video information), etc. In a specific implementation, at the initial stage when the user to be authenticated logs into the system, the client will send the user identity authentication request issued by the user to be authenticated to the server. At the same time, the client will respond to the user identity authentication request issued by the user to be authenticated, start the data collection device to continuously sample the user's facial biometric data, user location information, user audio data, and user video data, etc., and send these user characteristic behavior information to the server. The server will store the user's location information, recording information, and video information in a database.

[0083] Specifically, for the collection of facial biometric data, it is mainly collected by starting the camera hardware through the client. For the collection of user location information, the GPS (Global Positioning System) module of the positioning device is used to obtain accurate geographic location information, including longitude, latitude and altitude. At the same time, the user's location is inferred by the information of nearby Wi-Fi (Wireless Fidelity, wireless network communication technology) hotspots and base stations. The two are combined to accurately obtain user location information. Before this, the user needs to authorize access to the location information. For the collection of recording information, it depends on the microphone of the recording device and the audio API (Application Programming Interface) of the operating system. Before this, the user needs to authorize access to the microphone. For the collection of video information, it depends on the camera and video processing API of the camera device. Before this, the user needs to authorize access to the camera. Optionally, facial biometric data can also be captured from the video information. Among them, when collecting multiple data (positioning information, recording information, video information), each data collection is accompanied by a timestamp to ensure that the data can be aligned. The positioning record is the time of obtaining the geographic location, the recording is the audio frame with a timestamp, and the video is accompanied by a timestamp for each frame. At the same time, a unified queue or database is used to store the collected data for data integration. This processing ensures the synchronization of multiple data (positioning information, recording information, video information) for subsequent processing and analysis.

[0084] It should be noted that in each specific embodiment of the present application, when it comes to the need to perform relevant processing based on data related to the user's identity or characteristics, such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of such data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0085] That is, when collecting sensitive user information, privacy regulations must be followed, and users must be informed through pop-ups or privacy policies, and the purpose and use of the data collected, as well as the length of time the data will be kept and the storage location. At the same time, data must be encrypted using HTTPS (HyperText Transfer Protocol Secure) to ensure that the data is not stolen during network transmission, and hash functions must be used to encrypt stored data.

[0086] Step S202: performing facial feature verification on the user to be authenticated based on the identity authentication information to obtain a facial verification result;

[0087] In some embodiments, step S202 may include: preprocessing facial biometric data to obtain facial feature data to be input; inputting the facial feature data to be input into a facial recognition convolutional neural network for feature extraction processing, and outputting a target facial feature vector; matching the target facial feature vector with the user facial feature vector stored in the database to obtain a facial feature matching result; wherein the facial feature matching result includes facial feature matching similarity; when the facial feature matching similarity is greater than or equal to a preset similarity threshold, the facial feature matching result is used as a facial verification result of successful verification; when the facial feature matching similarity is less than the preset similarity threshold, the facial feature matching result is used as a facial verification result of failed verification.

[0088] Among them, facial biometric data is mainly processed in the form of images. The process of preprocessing facial biometric data is: use the Haar feature algorithm to locate the face area in the image, perform face detection, align the face (such as based on the eye position) and crop, standardize the image size, and normalize the pixel value to the [0,1] or [-1,1] range. Expand the data set by rotation, flipping, cropping, etc., and finally obtain the preprocessed facial feature data to be input to enhance the generalization ability of the model.

[0089] For facial recognition convolutional neural networks, which are pre-trained network models, during the training process, a certain number of training data sets (such as facial images) are first obtained, and then the training data sets are preprocessed. The preprocessed training data sets are then input into the convolutional neural network, and facial features are extracted through the convolutional neural network. The network parameters are optimized using a loss function, and the convolutional neural network is trained to distinguish the facial features of different users. Finally, an optimized facial recognition convolutional neural network is obtained. The process of preprocessing the training data set is similar to the process of preprocessing facial biometric data, and will not be described in detail in the present embodiment.

[0090] The target facial feature vector refers to a set of numerical values that represent individual facial features after processing and extraction using a facial recognition convolutional neural network. After converting a captured facial image into a target facial feature vector, it can be compared with the feature vectors of known individuals stored in a database to determine the visitor's identity. In this embodiment of the present application, after obtaining the target facial feature vector, it is matched with the user's facial feature vector stored in the database to obtain a facial feature matching result. The user's facial feature vector stored in the database is the feature vector corresponding to the facial biometric information entered by the user during the initial identity registration phase.

[0091] Exemplarily, the process of the server verifying whether the facial information of the user to be authenticated is the user himself (facial feature verification process) is as follows: first, the facial biometric data (such as facial image) is preprocessed to obtain the facial feature data to be input; then, the facial feature data to be input is input into the facial recognition convolutional neural network for feature extraction processing, and the target facial feature vector is output; then, the target facial feature vector is matched with the user facial feature vector stored in the database, that is, the Euclidean distance between the target facial feature vector and the user facial feature vector stored in the database is calculated to obtain the facial feature matching result (that is, facial feature matching similarity); finally, based on the facial feature matching similarity, it is judged whether the login is made by the user himself (that is, whether the facial feature verification is passed). Specifically, if the matching similarity is greater than or equal to the set threshold, it is judged that the login is made by the user himself (facial feature verification is passed). If the login is made by the user himself, the next micro-expression recognition operation can be performed, and then it is judged whether the user is under coercion attack; if the matching similarity is less than the set threshold, it is judged that the login is not made by the user himself (facial feature verification is not passed), the login fails, and the system is exited.

[0092] Step S203: When the facial verification result is successful, micro-expression recognition is performed on the user to be authenticated to obtain a micro-expression recognition result;

[0093] In some embodiments, step S203 may include: when the facial verification result is successful, inputting the user video data carried in the identity authentication information into the micro-expression recognition convolutional neural network for dynamic micro-expression recognition, and outputting a micro-expression probability score; determining the micro-expression recognition result based on the micro-expression probability score and a preset micro-expression probability score threshold.

[0094] For the micro-expression recognition convolutional neural network, it is a pre-trained network model. In the embodiment of the present application, the server uses a Transformer style convolutional neural network (ConvNet) for visual recognition to perform dynamic micro-expression recognition on the received user video data. For the structure of the dynamic micro-expression recognition convolutional neural network, please refer to Figure 4 , Figure 4 is a structural diagram of a dynamic micro-expression recognition convolutional neural network provided in an embodiment of the present application; Figure 4 As shown in Figure 2, the micro-expression recognition convolutional neural network (ConvNet) adopts a pyramid architecture with four processing stages. Each stage has a different feature map resolution. Between two consecutive stages, a patch embedding block is used to reduce the resolution. This is a 2×2 convolution with a stride of 2, and different stages have different numbers of convolution blocks. The convolution modulation block (Conv Block) simplifies self-attention by convolution feature modulation value V. For a given input tag in, For a set of real numbers, a depthwise convolution with a kernel size of k×k and a Hadamard product are used to calculate the convolution output Z:

[0095]

[0096] Where Z represents the weighted sum of all pixels in the square area; A represents the similarity score matrix, which is used to measure the relationship between each pair of input tags; ⊙ represents the Hadamard product; W1 and W2 represent the weight matrices of the two linear layers respectively; DConv k×k Represents a depthwise convolution with a kernel size of k × k. The convolution operation associates each spatial location (h, w) with all pixels in a k × k square region centered at (h, w), and information interaction between channels can be achieved through a linear layer. The output of each spatial location is the weighted sum of all pixels in the square region.

[0097] In the specific implementation, the user video data is first input into the micro-expression recognition convolutional neural network (ConvNet) for dynamic micro-expression recognition to obtain a micro-expression probability score; then the micro-expression recognition result is determined based on the micro-expression probability score and the preset micro-expression probability score threshold. Specifically, if the classification result is determined to be "normal" based on the micro-expression probability score and the preset micro-expression probability score threshold, that is, the recognition is a normal state, the user is authorized to log in to the system and the account content is displayed normally; if the classification result is determined to be "panic" based on the micro-expression probability score and the preset micro-expression probability score threshold, that is, an abnormal state, the client prompts the user to be authenticated to enter a password to prevent misjudgment of micro-expressions.

[0098] It should be noted that the micro-expression recognition convolutional neural network (ConvNet) can also be set to directly output the classification results as "normal" or "abnormal", and the embodiments of the present application do not limit this.

[0099] In the embodiments of the present application, advanced deep learning technology is used to efficiently identify specific micro-expressions, effectively protecting the user's privacy from being leaked when encountering coercive attacks.

[0100] Step S204: When the micro-expression recognition result indicates that the verification fails, the micro-expression recognition result is sent to the client; so that the client obtains the user input password of the user to be authenticated according to the micro-expression recognition result, and sends the user input password to the server;

[0101] In the specific implementation, when the micro-expression recognition result is verification failure, the server sends the micro-expression recognition result to the client; then the client prompts the user to be authenticated to enter the password on the client based on the micro-expression recognition result. When the client obtains the user-entered password of the user to be authenticated, it sends the user-entered password to the server for password verification.

[0102] Step S205, performing hash verification on the password input by the user to obtain a password verification result;

[0103] In some embodiments, step S205 may include: using a hash algorithm to encrypt the password input by the user to obtain an encrypted input password; comparing the hash value corresponding to the encrypted input password with the hash value stored in the database to determine the password category of the password input by the user; when the hash value corresponding to the encrypted input password is consistent with the normal password hash value stored in the database, determining that the password category of the user input password is a normal password, and using the result that the password category is a normal password as a normal password verification result; when the hash value corresponding to the encrypted input password is consistent with the emergency password hash value stored in the database, determining that the password category of the user input password is an emergency password, and using the result that the password category is an emergency password as a password verification result of a duress attack.

[0104] In some embodiments, it may also include: when the password category of the password entered by the user is a normal password, deleting the user video data stored in the database; wherein the user video data is the data carried in the identity authentication information; when the password category of the password entered by the user is an emergency password, entering the system security mode, hiding the user sensitive data carried in the identity authentication information, and performing alarm processing based on the user location information carried in the identity authentication information.

[0105] Among them, the client prompts the user to enter the password. This is the initial stage when the user requests to log in to the system.

[0106] In the specific implementation, after receiving the password input by the user, the server encrypts the password input by the user through the hash algorithm SHA-256. The process of encrypting the password input by the user using the hash algorithm is as follows: First, the password message is expanded, and the original 512-bit message block M is expanded according to the message expansion formula. t Expanded to 64 32-bit message words (W0 to W 63 ):

[0107]

[0108] in,

[0109] Where Mt represents the original message block; σ transformation is mainly used in the message expansion stage, that is, when 16≤t≤63 rounds, the new message word W is calculated. t .

[0110] When 16≤t≤63, each W i The values of W are calculated previously. j The value of is calculated recursively, where W i The value of refers to the current value, W j The value refers to the W i The previously calculated value, that is, each W value is recursively calculated from the previously calculated W value; ROTR n (x) means to shift x right by n bits, and x>>n means to shift x right by n bits (with zero filling in the high bits), where x refers to the parameter of σ transformation. t After that, the compression function will be applied to the expanded message word W t The main calculation process of SHA-256 uses 64 rounds of hash calculations. The hash value calculation process for each round is as follows:

[0111]

[0112]

[0113] Among them, T1 calculates the "contribution of new messages"; T2 calculates the "majority transformation"; Ch(·) is a conditional selection function; x, y, and z are all input parameters. For example, if x=1, select y, otherwise select z.

[0114] In each round of hash calculation, 8 32-bit hash variables (a, b, c, d, e, f, g, h) are updated. In each of the 64 rounds of hash calculation, a predefined 32-bit constant K is used. t , these constants are generated from the fractional parts of the square roots of the first 64 prime numbers. Note that W t The 64 32-bit message words generated by message expansion. After all blocks are processed, the resulting 8 32-bit words are concatenated to generate the final 256-bit hash value.

[0115] See also Figure 5 , Figure 5 This is a flowchart of information sampling and verification when using a password to log in to a multi-factor identity authentication system that resists coercion attacks provided by an embodiment of the present application; Figure 5As shown, the information sampling and verification process when using a password to log in to a multi-factor identity authentication system for resisting coercion attacks provided by an embodiment of the present application is as follows: first, after the micro-expression recognizes an abnormal state, the client prompts the user to enter the password, and at the same time, the client turns on the camera hardware, voice hardware and positioning hardware to collect information (video information, recording information, positioning information), and sends the collected information to the server. It should be noted that user characteristic behavior information will be continuously collected in the initial stage when the user logs in to this system, and the collected information will be continuously sent to the server. The server will store the collected information in the Redis database, which is an open source in-memory key-value pair storage system; then, check the password entered by the user: compare the hash value of the password message entered by the user with the hash value stored in the database, where the number The hash value stored in the database is the hash value corresponding to the password entered by the user during the registration phase. If the hash value of the password message entered by the user is consistent with the hash value of the normal password stored in the database, it is determined that the password entered by the user is a normal password. The server then deletes the video information entered in the initial stage of logging into the system in the Redis database. Subsequently, the server randomly opens several recordings for comprehensive analysis to enhance the accuracy of user identity authentication. If the hash value of the password message entered by the user is consistent with the hash value of the emergency password stored in the database, it is determined that the password entered by the user is an emergency password. The system enters security mode and hides the user's sensitive data. The server then calls the external alarm API, requests an APIKEY from an alarm service provider, and uploads alarm information through a POST request. The alarm information includes alarm type, location information, etc.

[0116] Among them, the user's sensitive data will be marked in the Redis database in advance. Sensitive data includes: financial data in the account, personal identity data, etc. An emergency field will be set in the database. When the emergency password is entered, it will be marked as False, setting the data to an inaccessible state to ensure the security of the password.

[0117] Optionally, the server uses HTTPS (Hypertext Transfer Protocol Secure) to send a message to the client's login device to prompt the user to enter a password. The HTTPS protocol implements encrypted data transmission and ensures the integrity of the data during transmission. At the same time, the server sends a command to enable the client's recording hardware to sample multiple audio segments and sends the sampled audio files back to the server for storage via SFTP (Secure File Transfer Protocol). SFTP implements secure file transfer. The server also stores the ciphertext of the normal password and the emergency password provided by the user during registration. To prevent the user from confusing the normal password with the emergency password, the system requires the user to enter the normal password by default each time they log in and does not provide a password-remembering function. The emergency password is only required when the user is under duress.

[0118] It is understandable that if the password entered is a normal password, the micro-expression verification may be misjudged. The user enters the system normally, the server deletes the recorded video information, and randomly opens several recordings for comprehensive analysis; if the password entered is an emergency password, the system enters security mode, the server will alarm based on the saved location information, and hide the user's sensitive data.

[0119] Step S206: When the password verification result is normal, the user to be authenticated is allowed to enter the system, and a comprehensive analysis is performed on the user audio data carried in the identity authentication information to obtain a comprehensive analysis result;

[0120] In some embodiments, step S206 may include: when the password verification result is a normal result, allowing the user to be authenticated to enter the system; randomly selecting a number of target user audio data from all user audio data carried by the identity authentication information; using Mel-frequency cepstral coefficients to perform feature extraction processing on each target user audio data to obtain a number of speech feature vectors; inputting each speech feature vector into a pre-trained deep learning model for classification processing, and outputting a number of speech emotion scores; according to each speech emotion score, determining the user emotion classification result corresponding to each target user audio data; wherein the user emotion classification result includes a normal classification result and an abnormal classification result; when the emotion classification results of each user are all normal classification results, confirming that the user to be authenticated has not been subjected to a coercive attack, and taking the result that the user to be authenticated has not been subjected to a coercive attack as a normal comprehensive analysis result; when there is at least one normal classification result in each user emotion classification result, confirming that the user to be authenticated has been subjected to a coercive attack, and taking the result that the user to be authenticated has been subjected to a coercive attack as an abnormal comprehensive analysis result.

[0121] In some embodiments, it may also include: when it is confirmed that the user to be authenticated is not under duress, deleting all user audio data carried by the identity authentication information; when it is confirmed that the user to be authenticated is under duress, executing a system logout operation on the user to be authenticated, and sending identity anomaly information and re-verification instructions to the client.

[0122] In the specific implementation, when the password verification result is normal, the user to be authenticated is allowed to enter the system. After the user to be authenticated enters the system normally, in order to prevent the user from mistakenly entering the normal password to enter the system under duress or the facial micro-expression analysis from making a misjudgment, it is necessary to enable voice analysis to conduct a comprehensive judgment based on the user's environment. That is, after the user enters the password on the client, the server matches the locally stored ciphertext of the normal password with the encrypted text sent by the user. Even if the matching results are the same, for the sake of "double insurance", the server randomly selects n (for example, 3) files from the received audio files in a uniform distribution for comprehensive analysis. Please refer to Figure 6 , Figure 6 This is a flowchart of recording information analysis of a multi-factor identity authentication system against coercion attacks provided by an embodiment of the present application. Figure 6 As shown, the process of comprehensively analyzing the user audio data carried by the identity authentication information is as follows: First, for the collected audio file, the server uses Mel Frequency Cepstral Coefficients (MFCC) to extract the speech feature vector:

[0123] MFCC = log(Mel(STFT(x(t))))

[0124] Among them, Mel frequency cepstral coefficient is a feature extraction method in speech processing, STFT is short time Fourier transform, and x(t) represents the original time domain signal.

[0125] Then, the speech features are classified using a pre-trained deep learning model (Wav2Vec 2.0):

[0126] Emotion_Score=Softmax(W·MFCC+b)

[0127] Emotion_Score is the final output of the model, representing the predicted probability of the audio signal belonging to each emotion category. Softmax is the activation function that converts the model output into a probability distribution, allowing the output of each emotion category to be interpreted as the probability of belonging to that category. W is the weight matrix used to map the MFCC features to a higher-dimensional space and learn the characteristics of different emotion categories. b is the bias term used to adjust the output of each emotion category. The model outputs the final classification result based on the score, which includes "normal" (i.e., normal state) and "fear" (i.e., abnormal state).

[0128] Finally, the comprehensive analysis results and response strategies are determined based on the classification results. For example, if the classification results of the model for three randomly selected audio files are all "normal", it is considered that the user has not been subjected to a coercive attack. The server then deletes all audio files collected in this login and stops the process, effectively protecting the user's privacy. If one of the classification results of the model for three randomly selected audio files is "fear", the user is judged to have been subjected to a coercive attack. The server then uses HTTPS to send a "login credentials expired" message to the client and forcibly logs the user out of the system and then requires the user to log in again. Subsequently, the server sends an instruction to turn on the client's camera hardware to continuously sample the user's facial biometrics and other information, and returns to the stage of performing facial feature verification until the comprehensive analysis stage identifies it as a normal login.

[0129] Step S207: When the comprehensive analysis result is normal, confirm that the user to be authenticated has passed the identity authentication.

[0130] For example, if the classification results of the model for three randomly selected audio files are all "normal", it is considered that the user has not been subjected to a coercion attack, that is, the comprehensive analysis result is normal, and it is confirmed that the user to be authenticated can enter the system through identity authentication. Then the server will delete all audio files collected in this login and stop the process, effectively protecting the user's privacy.

[0131] The multi-factor identity authentication method against coercive attacks provided in the embodiments of the present application effectively avoids the leakage of user privacy when encountering coercive attacks, and has significantly improved security, robustness, versatility, and user experience.

[0132] In the embodiment of the present application, steps S201 to S207 are as follows: receiving the identity authentication information corresponding to the user to be authenticated sent by the client; performing facial feature verification on the user to be authenticated according to the identity authentication information to obtain a facial verification result; when the facial verification result is successful, performing micro-expression recognition on the user to be authenticated to obtain a micro-expression recognition result; when the micro-expression recognition result is a verification failure, the micro-expression recognition result is sent to the client; so that the client obtains the user input password of the user to be authenticated according to the micro-expression recognition result and sends the user input password to the server; performing hash verification on the user input password to obtain a password verification result; when the password verification result is normal, allowing the user to be authenticated to enter the system, and performing a comprehensive analysis on the user audio data carried in the identity authentication information to obtain a comprehensive analysis result; when the comprehensive analysis result is normal, confirming that the user to be authenticated has passed the identity authentication. The embodiment of the present application uses multi-factor authentication methods such as facial feature verification, micro-expression recognition, password verification, and comprehensive analysis of user audio data to verify the user's identity from different dimensions, which can effectively deal with coercion attacks, improve the security and privacy of identity authentication, and enhance user experience.

[0133] In order to explain the principle of the technical solution of the present invention in detail, the overall process of the present invention is described below in combination with some specific embodiments. It is easy to understand that the following is an explanation of the technical principle of the present invention and cannot be regarded as a limitation of the present invention.

[0134] See also Figure 7 , Figure 7 This is a general flow chart of a multi-factor identity authentication method for resisting coercion attacks provided by an embodiment of the present application. Figure 7 As shown, the overall process of the multi-factor identity authentication method for resisting coercion attacks can be divided into two stages (identity registration stage and identity authentication stage). The embodiment of this application is mainly described in terms of the identity authentication stage. Specifically:

[0135] (1) Identity registration stage: The client sends an identity registration request to the server to enter personal identity information. The specific execution process is as follows:

[0136] Before the user performs identity authentication, the client needs to perform identity registration on the server first. In the specific implementation, the client sends an identity registration request to the server and enters identity information such as facial biometric information, normal password and emergency password into the server, and finally the server returns the registration status. The executor of identity registration is the client. The registration process of the multi-factor identity authentication system against coercive attacks provided by the embodiment of the present application is as follows: First, the user (client) sends an identity registration request to the server: This process occurs when the user first requests identity registration from the system; Then, the client prompts the user to enter facial biometric information: After receiving the user's identity registration request, the server returns the registration permission status to the client. The client prompts the user to enter facial biometric information and apply for the client's camera permission. After the user agrees, the client starts the camera to assist the user to complete the facial biometric information collection. After completing the facial biometric information collection, the facial biometric information is sent to the server. After matching the new user, the server returns the user's facial biometric information collection success status to the client; Then, the client prompts the user to enter the normal password: After the client receives the facial biometric information collection success status returned by the server, it prompts the user to enter the normal password. The user enters a normal password. After the user enters the normal password, the client prompts the user to enter the normal password again to confirm. When the two normal passwords are consistent, the hashed normal password is sent to the server. The server saves the hashed normal password and returns a normal password collection success status to the client. Further, the client prompts the user to enter an emergency password: after receiving the normal password collection success status returned by the server, the client prompts the user to enter an emergency password. The emergency password cannot be consistent with the normal password. After the user enters the emergency password, the client prompts the user to enter the emergency password again to confirm. When the two emergency passwords are consistent, the client sends a hashed emergency password to the server. The server saves the hashed emergency password and returns an emergency password collection success status to the client. Finally, the client prompts the user that the registration is successful: after receiving the emergency password collection success status returned by the server, the client prompts the user that the registration is successful.

[0137] (2) Identity authentication stage: The client sends an identity authentication request to the server to verify whether the user can enter the system. The specific execution process is as follows:

[0138] 1) Data Collection. During the initial phase when a user logs into the system, the client sends a user identity authentication request to the server. At the same time, the client responds to the user identity authentication request and activates data collection equipment to continuously sample the user's facial biometric data, location information, audio data, and video data. The data is then sent to the server, which then stores the user's location information, audio data, and video data in a database.

[0139] 2) The server verifies whether the user to be authenticated is the user logging in (facial feature verification). The specific process of the server verifying whether the user to be authenticated is the user logging in is as follows: first, the facial biometric data (such as a facial image) is preprocessed to obtain the facial feature data to be input; then, the facial feature data to be input is input into the facial recognition convolutional neural network for feature extraction processing, and the target facial feature vector is output; then, the target facial feature vector is matched with the user facial feature vector stored in the database, that is, the Euclidean distance between the target facial feature vector and the user facial feature vector stored in the database is calculated to obtain the facial feature matching result (i.e., facial feature matching similarity); finally, based on the facial feature matching similarity, it is determined whether the user is logging in (i.e., whether the facial feature verification is passed). Specifically, if the matching similarity is greater than or equal to the set threshold, it is determined that the user is logging in (passing the facial feature verification). If the user is logging in, the next micro-expression recognition operation can be performed, and then it is determined whether the user is under duress attack; if the matching similarity is less than the set threshold, it is determined that the user is not the user logging in (facial feature verification has not been passed), the login fails, and the user exits the system.

[0140] 3) If it is determined that the user is logging in, dynamic micro-expression recognition is performed. First, the user's video data is input into the micro-expression recognition convolutional neural network (ConvNet) for dynamic micro-expression recognition to obtain a micro-expression probability score. The micro-expression recognition result is then determined based on the micro-expression probability score and a preset micro-expression probability score threshold. Specifically, if the micro-expression probability score and the preset micro-expression probability score threshold determine the classification result as "normal", i.e., the recognition is normal, the user is authorized to log in to the system and the account content is displayed normally. If the micro-expression probability score and the preset micro-expression probability score threshold determine the classification result as "panic", i.e., an abnormal state, the client prompts the authenticated user to enter a password to prevent misjudgment of micro-expressions.

[0141] 4) If the dynamic micro-expression determines that the user's micro-expression is in an abnormal state, the user is prompted to enter the password for password verification. After the micro-expression is identified as an abnormal state, the client prompts the user to enter the password. At the same time, the client turns on the camera hardware, voice hardware and positioning hardware to collect information (video information, recording information, positioning information), and sends the collected information to the server. It should be noted that the user's characteristic behavior information will be continuously collected in the initial stage when the user logs into the system, and the collected information will be continuously sent to the server. The server will store the collected information in the Redis database; then, check the password entered by the user: compare the hash value of the password message entered by the user with the hash value stored in the database, where the hash value stored in the database is the hash value corresponding to the password entered by the user during the registration stage. If the password entered by the user is If the hash value of the message is consistent with the hash value of the normal password stored in the database, the password entered by the user is judged to be a normal password, and the server will delete the video information recorded in the initial stage of logging into the system in the Redis database. Subsequently, the server randomly opens several recordings for comprehensive analysis to enhance the accuracy of user identity authentication; if the hash value of the password message entered by the user is consistent with the hash value of the emergency password stored in the database, the password entered by the user is judged to be an emergency password, and the system enters security mode and hides the user's sensitive data. The server will call the external alarm API, request an APIKEY of an alarm service provider, and upload the alarm information through a POST request. The alarm information includes alarm type, location information, etc.

[0142] 5) If the password entered by the user is considered normal, the server will randomly open several recordings for comprehensive analysis. If the password verification result is normal, the user is allowed to enter the system. After the user enters the system normally, in order to prevent the user from mistakenly entering the normal password to enter the system under duress or misjudging the facial micro-expression analysis, it is necessary to enable voice analysis and conduct a comprehensive judgment based on the user's environment. That is, after the user enters the password on the client, the server matches the ciphertext of the normal password stored locally with the encrypted text sent by the user. Even if the matching results are consistent, for the sake of "double insurance", the server randomly selects n (such as 3) files from the received audio files in a uniform distribution for comprehensive analysis; based on the comprehensive analysis results, it is determined whether the user is under duress attack and a response strategy is given. For example, if the classification results of the model for the 3 randomly selected audio files are all "normal", it is considered that the user is not under duress attack, then the server deletes all audio files collected in this login and stops the process, effectively protecting the user's privacy; if for the 3 randomly selected audio files, one of the classification results of the model is "fear", then the user is judged to be under duress attack, then the server uses HTTPS to send a "login credentials expired" message to the client and forcibly logs out of the system and requires the user to log in again. Subsequently, the server sends an instruction to turn on the client's camera hardware to continue sampling the user's facial biometrics and other information, and returns to the stage of performing facial feature verification until the comprehensive analysis stage identifies it as a normal login.

[0143] The embodiment of the present application proposes the use of micro-expression recognition technology to combat coercive attacks, effectively protecting the user's privacy and avoiding related security risks; secondly, the embodiment of the present application combines recording, video recording and positioning technologies, and inputs the collected audio and facial data and other information into the server for multi-dimensional analysis to determine whether the user is in a state of coercive attack, thereby protecting the user's identity authentication security and information security from multiple aspects.

[0144] It should be noted that this embodiment only briefly illustrates the general process of the multi-factor identity authentication method for resisting coercion attacks. The detailed description of each step can refer to the relevant content in the aforementioned embodiment and will not be repeated here. It can be understood that the present invention is not limited to this.

[0145] The embodiment of the present application receives the identity authentication information corresponding to the user to be authenticated sent by the client; performs facial feature verification on the user to be authenticated according to the identity authentication information to obtain a facial verification result; when the facial verification result is a successful verification, performs micro-expression recognition on the user to be authenticated to obtain a micro-expression recognition result; when the micro-expression recognition result is a failed verification, the micro-expression recognition result is sent to the client; so that the client obtains the user input password of the user to be authenticated according to the micro-expression recognition result, and sends the user input password to the server; performs hash verification on the user input password to obtain a password verification result; when the password verification result is a normal result, the user to be authenticated is allowed to enter the system, and performs a comprehensive analysis on the user audio data carried by the identity authentication information to obtain a comprehensive analysis result; when the comprehensive analysis result is a normal result, it is confirmed that the user to be authenticated has passed the identity authentication. The embodiment of the present application verifies the user identity from different dimensions by adopting multi-factor authentication methods such as facial feature verification, micro-expression recognition, password verification, and comprehensive analysis of user audio data, which can effectively deal with coercion attacks, improve the security and privacy of identity authentication, and enhance user experience.

[0146] In summary, the current related technologies do not take into account the widespread use of facial recognition, and only consider how to resist coercion attacks on devices that use fingerprint recognition. The present application is a multi-factor identity authentication system that combines text passwords, facial recognition, voice recognition, etc., and mainly determines whether the user is under a coercion attack state by analyzing the user's micro-expression. The present application takes into account that the reliability of deep learning technology is not high enough, and there may be misjudgments in facial micro-expression recognition and voice recognition. Therefore, the text password is combined as a comprehensive judgment. By adopting multi-factor authentication methods such as facial feature verification, micro-expression recognition, password verification, and comprehensive analysis of user audio data, the user's identity is verified from different dimensions, which can effectively deal with coercion attacks, improve the security and privacy of identity authentication, and enhance user experience. Moreover, the multi-factor identity authentication method for resisting coercion attacks provided in the embodiment of the present application has good versatility, compatibility and completeness, and can be used without obstacles on different platforms.

[0147] See also Figure 8 The present invention also provides a multi-factor identity authentication system 800 for resisting coercion attacks, which is applied to a server and can implement the multi-factor identity authentication method for resisting coercion attacks. The system includes the following modules:

[0148] The identity authentication information receiving module 801 is used to receive the identity authentication information corresponding to the user to be authenticated sent by the client;

[0149] A facial feature verification module 802 is configured to verify the facial features of the user to be authenticated based on the identity authentication information to obtain a facial verification result;

[0150] The micro-expression recognition module 803 is configured to perform micro-expression recognition on the user to be authenticated to obtain a micro-expression recognition result when the facial verification result is successful.

[0151] The micro-expression recognition result sending module 804 is configured to send the micro-expression recognition result to the client when the micro-expression recognition result indicates verification failure, so that the client obtains the user input password of the user to be authenticated based on the micro-expression recognition result and sends the user input password to the server;

[0152] The password verification module 805 is used to perform hash verification on the password input by the user to obtain a password verification result;

[0153] The audio comprehensive analysis module 806 is configured to allow the user to be authenticated to enter the system when the password verification result is normal, and to perform a comprehensive analysis on the user audio data carried in the identity authentication information to obtain a comprehensive analysis result;

[0154] The identity authentication result confirmation module 807 is used to confirm that the user to be authenticated has passed the identity authentication when the comprehensive analysis result is a normal result.

[0155] It can be understood that the contents of the above method embodiments are all applicable to the present system embodiments, the functions specifically implemented by the present system embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0156] The present application also provides an electronic device comprising a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the multi-factor identity authentication method for resisting coercive attacks. The electronic device can be any smart terminal, including a tablet computer and an in-vehicle computer.

[0157] It can be understood that the contents of the above method embodiments are applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0158] See also Figure 9 , Figure 9 The hardware structure of an electronic device according to another embodiment is shown. The electronic device includes:

[0159] The processor 901 can be implemented using a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0160] The memory 902 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 902 and is called by the processor 901 to execute the multi-factor identity authentication method for resisting coercion attacks in the embodiments of this application.

[0161] Input / output interface 903, used to implement information input and output;

[0162] Communication interface 904, used to implement communication interaction between this device and other devices, which can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WiFi, Bluetooth, etc.);

[0163] Bus 905 , which transmits information between various components of the device (e.g., processor 901 , memory 902 , input / output interface 903 , and communication interface 904 );

[0164] The processor 901 , the memory 902 , the input / output interface 903 and the communication interface 904 are connected to each other in communication within the device via a bus 905 .

[0165] An embodiment of the present application further provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the multi-factor identity authentication method against coercion attacks.

[0166] It can be understood that the contents of the above method embodiments are all applicable to the present storage medium embodiment, the functions specifically implemented by the present storage medium embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0167] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0168] The embodiments of the present application provide a multi-factor identity authentication method, a multi-factor identity authentication system, and an electronic device that resist coercion attacks. The method receives identity authentication information corresponding to a user to be authenticated from a client; performs facial feature verification on the user to be authenticated based on the identity authentication information to obtain a facial verification result; when the facial verification result is successful, performs micro-expression recognition on the user to be authenticated to obtain a micro-expression recognition result; when the micro-expression recognition result is a verification failure, the micro-expression recognition result is sent to the client; the client obtains the user input password of the user to be authenticated based on the micro-expression recognition result and sends the user input password to the server; performs hash verification on the user input password to obtain a password verification result; when the password verification result is normal, the user to be authenticated is allowed to enter the system, and performs comprehensive analysis on the user audio data carried in the identity authentication information to obtain a comprehensive analysis result; when the comprehensive analysis result is normal, the user to be authenticated is confirmed to have passed the identity authentication. The embodiments of the present application use multi-factor authentication methods such as facial feature verification, micro-expression recognition, password verification, and comprehensive analysis of user audio data to verify the user's identity from different dimensions, which can effectively resist coercion attacks, improve the security and privacy of identity authentication, and enhance user experience.

[0169] The embodiments described in the embodiments of this application are intended to more clearly illustrate the technical solutions of the embodiments of this application and do not constitute a limitation on the technical solutions provided by the embodiments of this application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0170] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0171] The system embodiment described above is merely illustrative. The units described as separate components may or may not be physically separate, i.e., they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment.

[0172] Those skilled in the art will appreciate that all or some of the steps in the methods, systems, and functional modules / units in the devices disclosed above may be implemented as software, firmware, hardware, or appropriate combinations thereof.

[0173] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0174] It should be understood that in this application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0175] In the several embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative. For example, the division of the above units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of systems or units, which can be electrical, mechanical or other forms.

[0176] The units described above as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0177] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0178] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes multiple instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: various media that can store programs, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0179] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but are not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and essence of the present invention should be within the scope of the present invention.

Claims

1. A multi-factor identity authentication method against coercion attacks, characterized in that: Applied to the server, the method comprises the following steps: Receive the identity authentication information corresponding to the user to be authenticated sent by the client; Performing facial feature verification on the user to be authenticated based on the identity authentication information to obtain a facial verification result; When the facial verification result is successful, performing micro-expression recognition on the user to be authenticated to obtain a micro-expression recognition result; When the micro-expression recognition result is a verification failure, the micro-expression recognition result is sent to the client; so that the client obtains the user input password of the user to be authenticated according to the micro-expression recognition result, and sends the user input password to the server; Perform hash verification on the password input by the user to obtain a password verification result; When the password verification result is normal, the user to be authenticated is allowed to enter the system, and the user audio data carried by the identity authentication information is comprehensively analyzed to obtain a comprehensive analysis result; When the comprehensive analysis result is a normal result, it is confirmed that the user to be authenticated has passed the identity authentication.

2. The method according to claim 1, characterized in that The identity authentication information includes user characteristic behavior information, and the user characteristic behavior information includes facial biometric data. The facial feature verification of the user to be authenticated is performed based on the identity authentication information to obtain a facial verification result, including: Preprocessing the facial biometric data to obtain facial feature data to be input; Inputting the facial feature data to be input into a facial recognition convolutional neural network for feature extraction processing, and outputting a target facial feature vector; Matching the target facial feature vector with the user facial feature vector stored in the database to obtain a facial feature matching result; wherein the facial feature matching result includes a facial feature matching similarity; When the facial feature matching similarity is greater than or equal to a preset similarity threshold, the facial feature matching result is regarded as a successful facial verification result; When the facial feature matching similarity is less than a preset similarity threshold, the facial feature matching result is regarded as a facial verification result of failed verification.

3. The method according to claim 1, characterized in that When the facial verification result is successful, performing micro-expression recognition on the user to be authenticated to obtain a micro-expression recognition result includes: When the facial verification result is successful, the user video data carried in the identity authentication information is input into the micro-expression recognition convolutional neural network for dynamic micro-expression recognition, and a micro-expression probability score is output; The micro-expression recognition result is determined according to the micro-expression probability score and a preset micro-expression probability score threshold.

4. The method according to claim 1, wherein The performing hash verification on the password input by the user to obtain a password verification result includes: Encrypting the user input password using a hash algorithm to obtain an encrypted input password; Comparing the hash value corresponding to the encrypted input password with the hash value stored in the database to determine the password category of the user input password; When the hash value corresponding to the encrypted input password is consistent with the hash value of the normal password stored in the database, determining that the password type of the user input password is a normal password, and taking the result that the password type is a normal password as a normal password verification result; When the hash value corresponding to the encrypted input password is consistent with the emergency password hash value stored in the database, the password category of the user input password is determined to be an emergency password, and the result that the password category is an emergency password is used as the password verification result of the duress attack.

5. The method according to claim 4, characterized in that The method further comprises: When the password type of the password input by the user is a normal password, deleting the user video data stored in the database; wherein the user video data is the data carried in the identity authentication information; When the password type of the password entered by the user is an emergency password, the system enters a security mode, hides the user sensitive data carried in the identity authentication information, and performs an alarm process based on the user location information carried in the identity authentication information.

6. The method according to claim 1, characterized in that When the password verification result is normal, the user to be authenticated is allowed to enter the system, and the user audio data carried by the identity authentication information is comprehensively analyzed to obtain a comprehensive analysis result, including: When the password verification result is normal, allowing the user to be authenticated to enter the system; Randomly select a number of target user audio data from all user audio data carried by the identity authentication information; Using Mel-frequency cepstral coefficients to perform feature extraction processing on the audio data of each target user to obtain a number of speech feature vectors; Input each of the speech feature vectors into a pre-trained deep learning model for classification processing, and output a number of speech emotion scores; Determine, based on each of the speech emotion scores, a user emotion classification result corresponding to each of the target user audio data; wherein the user emotion classification result includes a normal classification result and an abnormal classification result; When all the user emotion classification results are the normal classification results, confirming that the user to be authenticated has not been subjected to a coercive attack, and taking the result that the user to be authenticated has not been subjected to a coercive attack as a normal comprehensive analysis result; When at least one of the common classification results exists in each of the user emotion classification results, it is determined that the user to be authenticated is under duress attack, and the result that the user to be authenticated is under duress attack is used as an abnormal comprehensive analysis result.

7. The method according to claim 6, characterized in that The method further comprises: When it is confirmed that the user to be authenticated is not under duress, deleting all user audio data carried in the identity authentication information; When it is confirmed that the user to be authenticated is under duress attack, a system logout operation is performed on the user to be authenticated, and identity abnormality information and a re-authentication instruction are sent to the client.

8. A multi-factor identity authentication system against coercion attacks, characterized in that: Applied to the server, the system includes the following modules: The identity authentication information receiving module is used to receive the identity authentication information corresponding to the user to be authenticated sent by the client; A facial feature verification module is used to verify the facial features of the user to be authenticated based on the identity authentication information to obtain a facial verification result; A micro-expression recognition module is used to perform micro-expression recognition on the user to be authenticated when the facial verification result is successful, and obtain a micro-expression recognition result; a micro-expression recognition result sending module, configured to send the micro-expression recognition result to the client when the micro-expression recognition result indicates verification failure, so that the client obtains the user input password of the user to be authenticated based on the micro-expression recognition result, and sends the user input password to the server; A password verification module is used to perform hash verification on the password input by the user to obtain a password verification result; An audio comprehensive analysis module is used to allow the user to be authenticated to enter the system when the password verification result is normal, and to perform a comprehensive analysis on the user audio data carried by the identity authentication information to obtain a comprehensive analysis result; The identity authentication result confirmation module is used to confirm that the user to be authenticated has passed the identity authentication when the comprehensive analysis result is a normal result.

9. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images