Biometric-based digital identity recognition and security management system

Abstract

The application provides a kind of digital identity recognition and security management system based on biological characteristics, it is related to digital identity recognition and security management technical field, by obtaining the biological characteristic collection information containing physiological and behavioral characteristic data, the biological characteristic collection information is processed to obtain the biological characteristic correlation diagram by feature correlation mapping, the correlation diagram is matched with the preset security benchmark atlas, and the matching verification result is obtained, the digital identity authentication voucher containing identity information is generated according to the matching verification result, and the security permission configuration operation is executed according to the digital identity authentication voucher to control the access permission to target resource, which enriches the identity recognition data dimension, improves the accuracy and reliability, and builds a more secure and flexible management system.

Description

Technical Field

[0001] This invention relates to the field of digital identity recognition and security management technology, and more specifically, to a biometric-based digital identity recognition and security management system. Background Technology

[0002] In the digital age, digital identity recognition and security management systems are crucial for ensuring secure access to various digital resources. Traditional digital identity recognition methods primarily rely on single biometric data, such as fingerprints or facial images. However, single biometric data has several limitations. On the one hand, single biometrics are easily affected by external factors and can change or be forged. For example, fingerprints may change due to skin damage, wear and tear, or contact with certain chemicals, and facial images may be affected by factors such as lighting, facial expressions, makeup, and facial occlusions, leading to a decrease in recognition accuracy. On the other hand, relying solely on a single biometric for identity recognition cannot comprehensively and accurately reflect an individual's true identity information, making it easy for criminals to exploit vulnerabilities for identity theft, thus posing a serious threat to the security of digital resources. Furthermore, existing digital identity security management systems often have relatively simple and fixed permission configurations, lacking mechanisms for flexible adjustments based on dynamic changes in biometrics, making it difficult to adapt to the complex and ever-changing needs of the digital environment. Summary of the Invention

[0003] In view of the aforementioned problems, and in conjunction with the first aspect of the present invention, embodiments of the present invention provide a method for digital identity recognition and security management based on biometrics, the method comprising:

[0004] Acquire biometric data, which includes biometric data from different sources, and the biometric data includes physiological data and behavioral data.

[0005] The biometric information is processed by feature association mapping to obtain a biometric association graph, which is used to reflect the inherent relationship between different biometric data.

[0006] The biometric association map is matched and verified with a preset security benchmark map to obtain a matching verification result, which is used to indicate the degree of consistency between the biometric association map and the security benchmark map.

[0007] A digital identity verification credential is generated based on the matching and verification results. The digital identity verification credential contains identity identification information corresponding to the biometric association map.

[0008] A security permission configuration operation is performed based on the digital authentication credential, and the result of the security permission configuration operation is used to control access permissions to the target resource.

[0009] In another aspect, embodiments of the present invention also provide a biometric-based digital identity recognition and security management system, including a processor and a machine-readable storage medium connected to the processor. The machine-readable storage medium is used to store programs, instructions, or code, and the processor is used to execute the programs, instructions, or code in the machine-readable storage medium to implement the above-described method.

[0010] Based on the above, this invention acquires biometric data, including physiological and behavioral data, from different sources. It then performs feature association mapping on this biometric data to obtain a biometric association graph. This allows for in-depth analysis of the intrinsic relationships between different biometric data. The biometric association graph is matched and verified against a preset security benchmark graph, accurately determining the degree of fit between the two. Based on the matching and verification results, a digital identity verification credential containing identity information is generated, achieving precise digital identity identification. Finally, security permission configuration operations are performed based on the digital identity verification credential. This allows for flexible adjustment of access permissions to target resources according to dynamic changes in biometrics, effectively ensuring secure access to digital resources. Attached Figure Description

[0011] Figure 1 This is a schematic diagram of the execution flow of the biometric-based digital identity recognition and security management method provided in the embodiments of the present invention.

[0012] Figure 2 This is a schematic diagram of exemplary hardware and software components of a biometric-based digital identity recognition and security management system provided in an embodiment of the present invention. Detailed Implementation

[0013] The present invention will now be described in detail with reference to the accompanying drawings. Figure 1 This is a flowchart illustrating a biometric-based digital identity recognition and security management method according to an embodiment of the present invention. The following is a detailed description of the biometric-based digital identity recognition and security management method.

[0014] Step S110: Obtain biometric data collection information, which includes biometric data from different collection sources, and the biometric data includes physiological data and behavioral data.

[0015] In this embodiment, the application scenario of digital identity recognition and security management of employees within a financial institution is used for illustration. In this application scenario, the biometric information of employees is collected from multiple collection sources, which are distributed in various aspects of the employees' daily work.

[0016] When employees enter the office area, a fingerprint scanner at the entrance collects their fingerprints. This scanner captures detailed information such as the distribution of ridges, the direction of valleys, and the location of endpoints and bifurcation points. This information constitutes fingerprint physiological feature data, which includes multiple dimensions, each corresponding to a specific feature parameter of the fingerprint.

[0017] When employees log into the internal business system, their typing behavior data is collected through a keylogger. This typing behavior data includes the time interval between keys, the duration of each key press, and the difference in pressure applied by different fingers when pressing keys, with each feature described by corresponding dimensions.

[0018] The webcams on office computers regularly capture employees' facial feature data, including facial contours, relative positions of facial features, and subtle dynamic changes in facial muscles. This data is physiological and contains multiple descriptive dimensions.

[0019] When employees use mobile devices to work remotely, the sensors on the devices collect data on their hand gestures while holding the devices. This data is considered behavioral data and includes information from multiple dimensions, such as the trajectories of fingers on the screen, the distribution of grip strength, and the frequency of gesture changes.

[0020] When performing important business operations, an iris scanning device can be activated to collect employees' iris feature data. This is physiological feature data, which includes multiple dimensions of feature parameters such as the unique pattern of iris texture and pigment distribution.

[0021] During the acquisition of the aforementioned biometric data, all data undergoes privacy protection processing. For highly sensitive physiological characteristic data such as fingerprints and iris scans, asymmetric encryption algorithms are used to encrypt the data, converting the raw data into an encrypted form before transmission and storage. During the data collection phase, the scope of collection is strictly controlled, acquiring only the necessary features related to identity verification and avoiding any personal privacy information unrelated to identity verification.

[0022] It is worth noting that the data collection process strictly adheres to the principles of legality, legitimacy, and minimum necessity, resolutely preventing excessive data collection. For personal biometric data, such as fingerprints and facial recognition information, collection is only conducted with the explicit consent of the data subject, and key information such as the purpose, use, and data retention period are clearly communicated. When collecting biometric data from employees of financial institutions, it is explained in detail that this data will be used for digital identity verification and security management to ensure secure access to institutional resources. Furthermore, obtaining data through deception, coercion, inducement, or illegal channels is strictly prohibited to avoid infringing upon the legitimate rights and interests of data subjects.

[0023] Regarding data licensing, standardized licensing agreements are signed with data subjects. These agreements clearly define the scope of data use; for example, collected biometric data may only be used for internal identity verification and access control, and may not be used for other unauthorized commercial purposes or shared with third parties. For sensitive biometric data, such as physiological data related to health status, separate consent is obtained, and special provisions such as written consent are strictly adhered to.

[0024] Step S120: Perform feature association mapping processing on the biometric information to obtain a biometric association graph, which is used to reflect the inherent relationship between different biometric data.

[0025] After obtaining the biometric information, feature association mapping processing is performed on the biometric information.

[0026] Step S121: Extract the dynamic feature attributes of various types of biometric data from the biometric data collection information. The dynamic feature attributes include the time-varying attributes of physiological feature data and the pattern attributes of behavioral feature data. The time-varying attributes of physiological feature data are used to describe the subtle changes in physiological features over time, and the pattern attributes of behavioral feature data are used to describe the recurring patterns of behavioral features.

[0027] For fingerprint physiological feature data, the time-varying attributes in its dynamic feature attributes are reflected in the subtle shifts in the positions of endpoints and bifurcation points in fingerprint images acquired at different times, as well as the minute changes in ridge width. By comparing fingerprint data acquired at different time points, these time-varying characteristics are extracted to form a set of time-varying fingerprint attributes, where each element corresponds to a feature dimension that changes over time.

[0028] The time-varying attributes of facial feature data include muscle movements caused by changes in facial expressions and differences in skin tone caused by changes in lighting. By continuously capturing facial images, the patterns and magnitudes of these changes are analyzed to form a set of time-varying facial attributes.

[0029] While the time-varying properties of iris feature data are relatively stable, they may still undergo slight texture changes due to factors such as eye fatigue and lighting conditions. Capturing these changes forms a set of time-varying iris properties.

[0030] For typing behavior characteristic data, its pattern attributes are reflected in the changing rhythm of employees' typing when logging into the system at different times, such as the difference in typing speed between morning and afternoon, and the input patterns of commonly used words. By analyzing a large amount of typing behavior data, these recurring patterns are identified, forming a set of pattern attributes for typing behavior.

[0031] The pattern attributes of gesture data for holding devices reveal employees' hand gesture habits in different operating scenarios, such as the changing patterns of finger placement when clicking specific function buttons and the changing patterns of speed when swiping the screen. Continuous analysis of this gesture data extracts recurring patterns, forming a set of gesture pattern attributes.

[0032] Step S122: Construct a correlation factor matrix based on the dynamic feature attributes. Each element of the correlation factor matrix corresponds to the correlation influence coefficient of the two types of biometric data under different dimensions. The correlation influence coefficient is positively correlated with the change range of the dynamic feature attributes.

[0033] After extracting the dynamic feature attributes of various biometric data, a correlation factor matrix is ​​constructed based on these attributes.

[0034] Step S1221: Determine the set of related dimensions, which includes the morphological dimension of physiological characteristics, the frequency dimension of behavioral characteristics, and the time dimension shared by both.

[0035] The morphological dimension of physiological features describes the physical form of the features, such as the thickness of fingerprint ridges, the relative distances between facial features, and the density of iris texture. Each physiological feature has multiple specific descriptive indicators under the morphological dimension. The frequency dimension of behavioral features describes the frequency and periodicity of behavioral features, such as the number of times a specific key combination occurs during typing or the repetition frequency of a specific gesture. Each behavioral feature also has multiple specific descriptive indicators under the frequency dimension. The temporal dimension is shared by both physiological and behavioral features, and is used to measure how features change over time. For example, the collection interval of fingerprint features at different times or the distribution of typing behavior at different times of the day. The temporal dimension also has multiple specific measurement methods.

[0036] Step S1222: For each type of biometric data, extract the feature values ​​of its dynamic feature attributes in each dimension of the associated dimension set to form a feature value matrix. The rows of the feature value matrix represent the biometric data type, the columns represent the associated dimensions, and the elements represent the feature values ​​of the corresponding dimensions.

[0037] Taking fingerprint physiological feature data as an example, in the morphological dimension, quantized values ​​such as ridge thickness and endpoint density are extracted; in the temporal dimension, quantized values ​​such as the interval between different acquisition time points and the rate of feature change are extracted. For typing behavior feature data, in the frequency dimension, quantized values ​​such as the frequency of occurrence of specific key combinations and the number of keystrokes per unit time are extracted; in the temporal dimension, quantized values ​​such as the duration and interval of typing behavior at different times are extracted.

[0038] The extracted feature values ​​are arranged according to the biometric data type and the association dimension to form a feature value matrix. The rows of the matrix correspond to biometric data types such as fingerprint, face, iris, typing behavior, and gesture, respectively. The columns correspond to the morphological dimension, frequency dimension, and time dimension, respectively. Each element in the matrix is ​​the feature value of the corresponding biometric data type in the corresponding association dimension. For example, the element in the first row and first column of the matrix is ​​a feature value of the fingerprint feature in the morphological dimension; the element in the first row and third column is a feature value of the fingerprint feature in the time dimension; the element in the second row and second column is a feature value of the facial feature in the frequency dimension (since the face is a physiological feature, the frequency dimension may not be applicable, and can be marked as zero or a specific meaningless value), and so on, to form a complete feature value matrix.

[0039] Step S1223: Calculate the absolute value of the difference between the eigenvalues ​​of any two types of biometric data in each associated dimension to obtain the dimension difference matrix. The elements of the dimension difference matrix correspond one-to-one with the elements of the eigenvalue matrix.

[0040] Calculate the absolute value of the difference between the eigenvalues ​​of any two types of biometric data in each associated dimension. Select two types of biometric data from the eigenvalue matrix, such as fingerprints and faces. First, calculate the difference between the eigenvalues ​​of the two in the morphological dimension and take its absolute value; then calculate the difference between the eigenvalues ​​of the two in the time dimension and take its absolute value; for the frequency dimension, since the face is a physiological feature, there may be no effective eigenvalue in this dimension. In this case, the absolute value of the difference can be regarded as zero or processed according to a specific rule.

[0041] In the same manner, calculate the absolute value of the feature value difference in each correlation dimension for all pairwise combinations of biometric data, such as fingerprint and iris, fingerprint and typing behavior, fingerprint and gesture, face and iris, face and typing behavior, face and gesture, iris and typing behavior, iris and gesture, and typing behavior and gesture.

[0042] These calculation results are arranged in the same row and column structure as the eigenvalue matrix to form a dimensionality difference matrix. Each element in this dimensionality difference matrix corresponds one-to-one with an element in the eigenvalue matrix, representing the absolute value of the difference between the eigenvalues ​​of the two types of biometric data in the corresponding associated dimension.

[0043] Step S1224: The dimension difference matrix is ​​transformed according to the preset correlation influence function, and the absolute value of the difference is converted into the correlation influence coefficient. The output value of the correlation influence function increases as the input value decreases, ensuring that the correlation influence coefficient is positively correlated with the change range of the dynamic feature attribute.

[0044] The dimensional difference matrix is ​​transformed according to a preset correlation influence function. The correlation influence function is set according to the principle that the output value increases as the input value decreases. That is, the smaller the absolute value of the difference between the feature values ​​of two types of biometric data in a certain dimension, the larger the correlation influence coefficient is, indicating that the two types of biometric data are more correlated in that dimension; conversely, the larger the absolute value of the difference, the smaller the correlation influence coefficient is, indicating that the correlation is lower.

[0045] The specific form of the correlation effect function can vary. For example, it can be the reciprocal of the absolute value of the difference followed by scaling within a certain range, or it can be a piecewise function mapping. Regardless of the form used, it is essential to ensure that the transformed correlation effect coefficients are within a uniform range for subsequent comparisons and calculations.

[0046] By applying this correlation influence function, each element (i.e., the absolute value of the difference) in the dimension difference matrix is ​​converted into the corresponding correlation influence coefficient, thus obtaining a new matrix in which all elements are correlation influence coefficients.

[0047] Step S1225: Arrange the association influence coefficients under different association dimensions in dimensional order to construct an association factor matrix. Each element of the association factor matrix corresponds to the association influence coefficient of two types of biometric data under different dimensions. The association influence coefficient is positively correlated with the change range of dynamic feature attributes.

[0048] The association influence coefficients under different association dimensions are arranged in dimensional order to construct an association factor matrix. The rows and columns of the association factor matrix correspond to different biometric data types, and each element in the matrix is ​​a set containing multiple association influence coefficients, each corresponding to a different association dimension.

[0049] For example, the elements in the first row and second column of the correlation factor matrix include the correlation coefficients between fingerprints and faces in the morphological dimension, the correlation coefficients in the frequency dimension (which may be zero or a specific value), and the correlation coefficients in the time dimension. Following this method, the correlation coefficients of all two types of biometric data in each correlation dimension are filled into the corresponding positions in the matrix to form a complete correlation factor matrix. Each element in this correlation factor matrix accurately corresponds to the correlation coefficient of the two types of biometric data in different dimensions, and these correlation coefficients are positively correlated with the magnitude of change in dynamic feature attributes.

[0050] Step S123: Use the association factor matrix to perform association path mining on the biometric data in the biometric data collection information, identify the transitive association chains, and form a multi-level association path set. Each path in the multi-level association path set contains at least three sequentially associated biometric data.

[0051] The association factor matrix is ​​used to perform association path mining on the biometric data in the biometric data collection information.

[0052] Step S1231: Use the biometric data in the biometric data collection information as nodes to construct an initial node set, which contains all the biometric data in the biometric data collection information.

[0053] An initial node set is constructed by treating various biometric data from the biometric data collection as independent nodes. Each node represents a specific type of biometric data. For example, a fingerprint node represents all collected fingerprint physiological data, a face node represents all collected facial physiological data, an iris node represents all collected iris physiological data, a typing behavior node represents all collected typing behavior feature data, and a gesture node represents all collected gesture feature data of the device being held, etc. The initial node set contains nodes corresponding to all biometric data in the biometric data collection, and each node has its unique identifier and corresponding feature information.

[0054] Step S1232: Based on the correlation factor matrix, calculate the comprehensive correlation coefficient between any two nodes. The comprehensive correlation coefficient is the weighted average of the corresponding elements in the correlation factor matrix, and the weights are set according to the importance of the dimensions.

[0055] Based on the correlation factor matrix, the comprehensive correlation coefficient between any two nodes is calculated. For any two nodes (i.e., two types of biometric data), the corresponding element is found in the correlation factor matrix, which contains the correlation influence coefficients between the two nodes in the morphological, frequency, and temporal dimensions.

[0056] Based on the importance of each dimension, assign corresponding weights to each dimension. For example, in the identity recognition scenario of financial institutions, the morphological dimension may be considered more important for the correlation between physiological features, while the temporal dimension may be more important for the correlation between behavioral features. Therefore, a higher weight can be assigned to the morphological dimension, while relatively lower or different weights can be assigned to the frequency and time dimensions. The specific weight values ​​are determined based on the needs of the actual application scenario and historical data verification.

[0057] The correlation coefficient between the two nodes is obtained by multiplying the correlation coefficient of each dimension by its corresponding weight, summing these products, and then dividing by the sum of the weights. This comprehensive correlation coefficient integrates the correlation effects from multiple dimensions, providing a more complete reflection of the degree of correlation between the two nodes.

[0058] Step S1233: Based on the preset association threshold, select node pairs that exceed the threshold from the comprehensive association coefficient, determine them as directly associated node pairs, and form a directly associated set.

[0059] Based on a preset association threshold, the comprehensive association coefficients between all calculated nodes are filtered. The setting of the association threshold needs to be determined by analyzing the distribution of comprehensive association coefficients of normally associated node pairs in historical data, taking into account the requirements for the degree of association in the actual application scenario.

[0060] Node pairs with a comprehensive correlation coefficient exceeding the correlation threshold are identified as directly correlated node pairs, indicating a significant direct correlation between them. All such directly correlated node pairs are grouped together to form a directly correlated set. For example, if the comprehensive correlation coefficient between a fingerprint node and a facial node exceeds the threshold, they constitute a directly correlated node pair; similarly, the comprehensive correlation coefficient between a facial node and an iris node also exceeds the threshold, and these are all included in the directly correlated set.

[0061] Step S1234: Select a pair of directly related nodes from the directly related set as the starting node pair. With one node as the starting point and the other node as the intermediate node, find nodes that are directly related to the intermediate node and are not included in the current path as extension nodes.

[0062] Select a pair of directly related nodes from the set of directly related nodes as the starting node pair. Assuming the selected starting node pair is a fingerprint node and a face node, then the fingerprint node can be used as the starting point and the face node as the intermediate node.

[0063] In the set of directly associated nodes, look for nodes that are directly associated with the intermediate node (face node) and are not included in the current path (the current path is fingerprint node-face node) as extension nodes. For example, if the face node and the iris node are a directly associated node pair, and the iris node is not in the current path, then the iris node can be used as an extension node.

[0064] Step S1235: Connect the starting point, intermediate node and extension node in sequence to form a three-level association path containing three nodes, and record the path and the corresponding comprehensive association coefficient.

[0065] Connect the starting point (fingerprint node), the intermediate node (face node), and the extended node (iris node) in sequence to form a three-level association path containing three nodes: fingerprint node-face node-iris node.

[0066] Simultaneously, record the path and its corresponding comprehensive correlation coefficient. The comprehensive correlation coefficient of the path can be calculated using the comprehensive correlation coefficients of the directly related segments within the path. For example, the average of the comprehensive correlation coefficients of each segment can be taken, or other calculation methods that can reflect the overall correlation degree of the path can be used. For the path of fingerprint node-face node-iris node, its comprehensive correlation coefficient can be the average of the comprehensive correlation coefficients of fingerprint and face and face and iris.

[0067] Step S1236: Using the extended node as the new intermediate node, repeat the above extension process until no new extended node can be found or the preset path length limit is reached, forming a longer multi-level associated path.

[0068] Using the extended node (iris node) as the new intermediate node, repeat the above extension process. In the set of directly associated nodes, find nodes that are directly associated with the iris node but are not included in the current path (fingerprint node-face node-iris node) as new extended nodes. For example, if the iris node and the typing behavior node are a directly associated node pair, and the typing behavior node is not in the current path, then the typing behavior node becomes the new extended node.

[0069] The current path is extended to fingerprint node - face node - iris node - typing behavior node, forming a four-level association path, and the path and the corresponding comprehensive association coefficient are recorded.

[0070] Continue using new extended nodes (typing behavior nodes) as intermediate nodes and repeat the above process until no new extended nodes can be found (i.e., there are no nodes directly related to the typing behavior node and not in the current path), or the preset path length limit is reached (e.g., the preset path length limit is five levels of nodes), thus forming a longer multi-level associated path.

[0071] Step S1237: Repeat the above path mining process for all directly related node pairs. After removing duplicate paths, a multi-level related path set is formed. Each path in the multi-level related path set contains at least three sequentially related biometric data.

[0072] The path mining process described above is repeated for all directly related node pairs in the directly related set. For example, if a face node and a typing behavior node are selected as the starting node pair, the path is extended according to the above steps to form the corresponding related path; if a typing behavior node and a gesture node are selected as the starting node pair, the path is extended in the same way.

[0073] After all path mining processes are completed, all obtained associated paths are examined to remove duplicate paths (i.e., paths with identical node sequences). The remaining paths are then grouped together to form a multi-level associated path set, in which each path contains at least three sequentially associated nodes corresponding to biometric data.

[0074] Step S124: Perform path strength calculation on each associated path in the multi-level associated path set. The path strength is the cumulative product of all associated influence coefficients in the path, resulting in a set of path strength values.

[0075] For each associated path in the multi-level associated path set, path strength is calculated. Path strength is calculated as the cumulative product of all association influence coefficients in the path. Taking a certain associated path as an example, suppose the path includes node A-node B-node C-node D, where the association influence coefficients of node A and node B in each dimension are a1, a2, and a3, respectively; the association influence coefficients of node B and node C in each dimension are b1, b2, and b3, respectively; and the association influence coefficients of node C and node D in each dimension are c1, c2, and c3, respectively.

[0076] First, calculate the product of the association influence coefficients between every two adjacent nodes. For example, the product of the association influence coefficients between node A and node B is a1×a2×a3, between node B and node C it is b1×b2×b3, and between node C and node D it is c1×c2×c3. Then, accumulate and multiply these products to obtain the path strength, which is (a1×a2×a3)×(b1×b2×b3)×(c1×c2×c3).

[0077] In the same way, calculate the path strength of each associated path in the multi-level associated path set, and organize all the calculation results into a set of path strength values.

[0078] Step S125: Filter the multi-level associated path set according to the path strength value set, retain the associated paths whose path strength values ​​exceed the preset path threshold, and generate the filtered associated path set.

[0079] The multi-level associated path set is filtered based on the path strength value set. The preset path threshold is determined based on the path strength distribution of valid associated paths in historical data and is used to distinguish between valid and invalid paths.

[0080] Each path strength value in the path strength value set is compared with a preset path threshold, and associated paths whose path strength values ​​exceed the threshold are retained. For example, if the path strength value of a path is X and the preset path threshold is Y, the path is retained when X is greater than Y, and removed when X is less than or equal to Y.

[0081] All the retained associated paths are organized together to generate a filtered set of associated paths.

[0082] Step S126: The filtered set of associated paths is mapped using a node and edge structure to obtain a biofeature association graph. The biofeature association graph is used to reflect the inherent relationship between different biofeature data, where nodes represent biofeature data and edges represent associated paths and their corresponding path strength values.

[0083] The filtered set of associated paths is mapped into a graph using a node and edge structure. Each biometric data point corresponds to a node, which is represented in the graph by a specific graphic symbol, such as a circle or square. Different types of biometric data can be distinguished by different colored graphic symbols.

[0084] Each associated path corresponds to an edge, with the two ends of the edge connecting to adjacent nodes in the path. The path strength value corresponding to the associated path is labeled next to the edge to visually reflect the strength of the association.

[0085] Through the above graph mapping process, the filtered set of associated paths is transformed into a biometric association graph. For example, a fingerprint node is connected to a face node through an edge, with the path strength value between the two marked on the edge; a face node is connected to an iris node through another edge, with the corresponding path strength value also marked on the edge, and so on, forming a biometric association graph, thus effectively reflecting the inherent relationship between different biometric data.

[0086] Step S130: Perform a matching verification process between the biometric association map and the preset security benchmark map to obtain a matching verification result. The matching verification result is used to indicate the degree of consistency between the biometric association map and the security benchmark map.

[0087] After obtaining the biometric association map, it is matched and verified with the preset security benchmark map.

[0088] Step S131: Obtain a preset security baseline map. The security baseline map includes a set of multi-level associated paths and path strength values ​​corresponding to known legitimate identities. The description method of the set of multi-level associated paths and path strength values ​​corresponding to known legitimate identities is completely consistent with that of the set of multi-level associated paths and path strength values ​​in the biometric association map.

[0089] A preset security baseline map is obtained. This map is constructed during system initialization based on biometric data of known legitimate individuals. Known legitimate individuals include all current employees of the financial institution. When an employee joins the company, the system collects their complete biometric data and constructs a corresponding multi-level set of association paths and path strength values ​​using the same methods and processes as those used to generate the biometric association map, thus forming the security baseline map.

[0090] The multi-level associated path set and path strength values ​​in the security benchmark map are completely consistent with the description method in the biometric association map, including the node representation method, edge connection rules, path strength value calculation method, etc., to ensure that the two can be effectively matched and verified.

[0091] Step S132: Extract the multi-level association path set and the corresponding path strength value from the biometric association graph to form a path information set to be matched. Each element in the path information set to be matched contains an association path and a corresponding path strength value.

[0092] Extract the set of multi-level association paths and their corresponding path strength values ​​from the biometric association graph. Traverse each edge and node in the biometric association graph to identify all association paths, each path consisting of a series of sequentially connected nodes. Simultaneously, record the path strength value for each path, which is consistent with the path strength value labeled on the edge in the biometric association graph.

[0093] These associated paths and their corresponding path strength values ​​are organized into a set of path information to be matched. Each element in the set is an associated path and its corresponding path strength value. For example, one element might be a fingerprint node-face node-iris node and its corresponding path strength value.

[0094] Step S133: Extract the multi-level associated path set and the corresponding path strength value from the security benchmark map to form a benchmark path information set. Each element in the benchmark path information set contains an associated path and a corresponding path strength value.

[0095] Extract the multi-level associated path set and corresponding path strength values ​​from the security baseline map. Using the same method as extracting the set of paths to be matched, traverse the security baseline map, identify all associated paths, and record the path strength value corresponding to each path.

[0096] This information is organized into a baseline path information set. Each element in the baseline path information set is also an associated path and its corresponding path strength value, and its structure is consistent with the elements in the path information set to be matched.

[0097] Step S134: Perform path structure comparison processing on the set of path information to be matched and the set of reference path information to identify homologous paths with completely consistent biometric data sequences in the paths, and form a set of homologous paths.

[0098] Step S1341: Select an associated path from the set of path information to be matched as the current comparison path. The current comparison path contains multiple biometric data arranged in order and the corresponding path strength value.

[0099] Select an associated path from the set of path information to be matched as the current comparison path. Assume that the selected current comparison path is fingerprint node-typing behavior node-gesture node. This current comparison path contains nodes corresponding to the three biometric data of fingerprint, typing behavior and gesture arranged in sequence, as well as the path strength value corresponding to the path.

[0100] Step S1342: Extract the biometric data sequence from the current comparison path to form a data sequence to be compared. The order of the data sequence to be compared is completely consistent with the order of appearance of the biometric data in the current comparison path.

[0101] Extract the biometric data sequence from the current comparison path. That is, extract the corresponding biometric data according to the order of the nodes in the path to form the comparison data sequence. For the fingerprint node-typing behavior node-gesture node in the current comparison path, the corresponding comparison data sequence is fingerprint, typing behavior, and gesture, and the order of arrangement is completely consistent with the order of appearance of the nodes in the path.

[0102] Step S1343: Traverse each associated path in the baseline path information set, extract the biometric data sequence in each associated path, and form a baseline data sequence.

[0103] Each associated path in the baseline path information set is traversed. For each path, the biometric data sequence in the path is extracted using the same method as the extraction of the data sequence to be compared, forming a baseline data sequence. For example, if one path in the baseline path information set is a fingerprint node-typing behavior node-gesture node, its corresponding baseline data sequence is fingerprint, typing behavior, and gesture; another path is a face node-iris node-typing behavior node, and its corresponding baseline data sequence is face, iris, and typing behavior.

[0104] Step S1344: Perform element-by-element comparison between the data sequence to be compared and each reference data sequence. If there is a completely identical reference data sequence, mark the associated path in the corresponding reference path information set and the current comparison path as the same source path and add them to the temporary same source set.

[0105] The data sequences to be compared (fingerprints, typing behavior, gestures) are compared element by element with each reference data sequence. Element by element comparison means that, in the order of the sequences, the first element in the data sequence to be compared is compared with the first element in the reference data sequence, the second element is compared with the second element, and so on, until all elements have been compared.

[0106] If all elements of a reference data sequence are exactly the same as those of the data sequence to be compared, such as fingerprints, typing behavior, or gestures, then the associated path corresponding to the reference data sequence and the current comparison path are marked as the same source path, and these two paths are added to the temporary same source set.

[0107] Step S1345: Select the next associated path from the set of path information to be matched as the current comparison path, and repeat the above comparison process until all associated paths in the set of path information to be matched have been processed.

[0108] Select the next associated path from the set of path information to be matched as the current comparison path. For example, select the face node-iris node-typing behavior node. Then process it according to the method of steps S1342 to S1344, extract the data sequence to be compared, compare it with the benchmark data sequence, mark the same source path and add it to the temporary same source set.

[0109] Repeat this process until all associated paths in the set of path information to be matched have been processed as the current comparison path.

[0110] Step S1346: After deduplicating the associated paths in the temporary same-origin set, a same-origin path set is formed.

[0111] The temporary set of related paths is deduplicated. It checks if any two paths in the temporary set are exactly the same; if so, only one is retained. The resulting set after deduplication is the set of related paths.

[0112] Step S135: Calculate the ratio of the path strength value of each path in the biometric association map to the path strength value in the safety baseline map for each path in the homologous path set, and obtain the path strength ratio set.

[0113] Calculate the ratio of the path strength value in the biometric association map to the path strength value in the security baseline map for each path in the same path set. For each path in the same path set, obtain its path strength value in the biometric association map from the path information set to be matched, and obtain its path strength value in the security baseline map from the baseline path information set. Then, divide the former by the latter to obtain the strength ratio of the path.

[0114] The intensity ratios of all paths are compiled together to form a path intensity ratio set.

[0115] Step S136: Calculate the proportion of the number of paths contained in the homologous path set to the total number of paths in the biometric association graph, and generate a comprehensive matching index by combining the average ratio of the path intensity ratio set. The numerical range of the comprehensive matching index is positively correlated with the degree of matching.

[0116] The proportion of paths in the same path set to the total number of paths in the biometric association graph is calculated. The total number of paths in the biometric association graph is the total number of paths contained in the set of paths to be matched. The proportion of paths is obtained by dividing the number of paths in the same path set by the total number of paths.

[0117] To calculate the average ratio of the set of path intensity ratios, add up all the intensity ratios in the set and then divide by the number of ratios to get the average ratio.

[0118] The comprehensive consistency index is generated by combining the proportion of path counts and the average ratio according to a set weight. For example, the proportion of path counts can be multiplied by 0.6, the average ratio by 0.4, and then the products are added together. The higher the comprehensive consistency index, the better the consistency between the biometric association map and the safety baseline map; the lower the value, the lower the consistency.

[0119] Step S137: Use the comprehensive consistency index as the matching verification result, which is used to indicate the degree of consistency between the biometric association map and the safety benchmark map.

[0120] The calculated comprehensive consistency index is used as the matching verification result, which directly reflects the degree of consistency between the biometric association map and the safety benchmark map.

[0121] Step S140: Generate a digital identity verification credential based on the matching verification result. The digital identity verification credential contains identity identification information corresponding to the biometric association map.

[0122] Step S141: Analyze the comprehensive matching index in the matching verification result, and determine whether the comprehensive matching index reaches the preset credential validity threshold. The preset credential validity threshold is used to define the validity of digital identity verification credentials.

[0123] The system analyzes the comprehensive matching index in the verification results and compares it with a preset credential validity threshold. This threshold, set by the system based on security level requirements, determines whether a valid digital identity verification credential can be generated. If the comprehensive matching index reaches or exceeds this threshold, it indicates a high degree of agreement between the biometric association map and the security baseline map, allowing for the generation of a valid credential. If the threshold is not reached, a valid credential cannot be generated, and it may be necessary to re-collect biometric data or perform further verification.

[0124] Step S142: If the comprehensive matching index reaches the preset credential validity threshold, then extract the core identity feature set corresponding to the biometric association graph. The core identity feature set includes biometric data constituting the longest association path and the corresponding dynamic feature attributes. The core identity feature set will be fully referenced in subsequent steps.

[0125] When the comprehensive matching index reaches the preset threshold for credential validity, the core identity feature set corresponding to the biometric association graph is extracted. In the biometric association graph, the association path containing the most nodes is found, i.e., the longest association path. All biometric data in this path, along with their corresponding dynamic feature attributes (including time-varying attributes and pattern attributes), are extracted to constitute the core identity feature set. For example, if the longest association path is fingerprint node-face node-iris node-typing behavior node-gesture node, then the core identity feature set includes biometric data such as fingerprint, face, iris, typing behavior, and gesture, as well as their respective time-varying or pattern attributes. This core identity feature set will be fully referenced in subsequent steps.

[0126] Step S143: Perform feature obfuscation processing on the core identity feature set, and cross-recombine the dynamic feature attributes with the biometric data in the associated path according to the preset obfuscation rules to obtain the obfuscated identity feature set. The obfuscated identity feature set retains the correlation of the original features but hides the direct correspondence.

[0127] Step S1431: Parse the core identity feature set, separate the biometric data sequence and the corresponding dynamic feature attribute set. The biometric data sequence is a sequence of biometric data in the associated path arranged in order. The dynamic feature attribute set contains the time-varying attribute or pattern attribute corresponding to each biometric data.

[0128] The core identity feature set is analyzed, and the biometric data within it is separated according to the order of appearance in the longest association path to form a biometric data sequence, such as fingerprints, face, iris, typing behavior, and gestures. Simultaneously, the dynamic feature attributes corresponding to each biometric data are separated to form a set of dynamic feature attributes, such as time-varying attributes of fingerprints, face, iris, typing behavior patterns, and gesture patterns.

[0129] Step S1432: Obtain a preset obfuscation rule, which includes feature crossover order, attribute offset, and recombination mapping table. The feature crossover order specifies the recombination order of dynamic feature attributes and biometric data. The attribute offset is used to adjust the presentation format of attribute values. The recombination mapping table is used to record the correspondence between the original features and the obfuscated features.

[0130] The system retrieves preset obfuscation rules, which are pre-defined to guide the feature obfuscation process. The feature crossover order specifies the recombination order of dynamic feature attributes and biometric data; for example, it might specify recombinating the dynamic feature attribute of the first biometric data with the third, and so on. Attribute offsets are a series of parameters used to adjust the attribute values ​​of dynamic feature attributes, changing their presentation without disrupting their correlation. The recombination mapping table records the correspondence between the original biometric data and dynamic feature attributes and the obfuscated features, used for subsequent possible parsing.

[0131] Step S1433: According to the feature crossing order, the attribute values ​​in the dynamic feature attribute set are sequentially assigned to non-adjacent biometric data in the biometric data sequence to form a preliminary cross feature group.

[0132] The attribute values ​​in the dynamic feature attribute set are assigned to non-adjacent biometric data in the biometric data sequence according to the feature crossover order. For example, the feature crossover order specifies that time-varying attributes of fingerprints are assigned to iris data, time-varying attributes of faces are assigned to typing behavior data, time-varying attributes of iris are assigned to gesture data, pattern attributes of typing behavior are assigned to fingerprint data, and pattern attributes of gestures are assigned to face data. This assignment in the above order forms preliminary crossover feature groups, such as time-varying attributes of iris data-fingerprints, time-varying attributes of typing behavior data-faces, etc.

[0133] Step S1434: Adjust the dynamic feature attribute values ​​in the preliminary cross feature group according to the attribute offset. The adjusted attribute values ​​are linearly related to the original values ​​but have different values.

[0134] The dynamic feature attribute values ​​in the initial cross-feature group are adjusted based on the attribute offset. For example, for a certain dynamic feature attribute value, if the attribute offset is a fixed value, the attribute value is added to or subtracted from the offset; if the offset is a ratio, the attribute value is multiplied by the ratio. The adjusted attribute value maintains a linear relationship with the original value, meaning that the original value can be obtained through reverse calculation, but the two values ​​are different, thus further hiding the original feature.

[0135] Step S1435: Based on the recombination mapping table, perform label replacement processing on the initial cross-feature group after offset adjustment, replace the original labels of biometric data and dynamic feature attributes with obfuscated labels, and retain the inherent correlation.

[0136] The initial cross-feature groups after offset adjustment are labeled according to the reconstructed mapping table. The reconstructed mapping table assigns a corresponding obfuscation label to each original biometric data and dynamic feature attribute; for example, fingerprint data is replaced with label A, facial data with label B, time-varying fingerprint attributes with label a, and time-varying facial attributes with label b, etc. All original labels in the initial cross-feature groups are replaced with their corresponding obfuscation labels. After replacement, the inherent correlation between features is preserved, but the original direct correspondence is hidden.

[0137] Step S1436: Rearrange the cross-feature groups after label replacement according to the order of the associated paths to form a confused identity feature set. The confused identity feature set retains the correlation of the original features but hides the direct correspondence.

[0138] The cross-feature groups after label replacement are rearranged according to the longest associated path. For example, the corresponding obfuscated cross-feature groups are arranged in the order of fingerprint node-face node-iris node-typing behavior node-gesture node to form an obfuscated identity feature set. Although this identity feature set hides the direct correspondence between biometric data and dynamic feature attributes, it preserves the inherent correlation between them.

[0139] Step S144: Extract the top-level path information from the biometric association graph. The top-level path information refers to a set number of association paths with the highest path strength value and their corresponding path strength values.

[0140] Extract top-level path information from the biometric association graph.

[0141] Step S1441: Traverse all associated paths in the biometric association graph, extract the path strength value corresponding to each associated path, and form a path strength value list. The path strength value list contains the path strength values ​​of all associated paths in the biometric association graph.

[0142] Traverse all associated paths in the biometric association graph, extract the path strength value corresponding to each path one by one, and arrange these values ​​in any order to form a path strength value list. This path strength value list contains the path strength values ​​of all associated paths in the biometric association graph.

[0143] Step S1442: Sort the path strength value list in descending order, arranging the path strength values ​​in descending order to form a sorted strength list.

[0144] Sort the path intensity value list in descending order, and rearrange the path intensity values ​​in the list in descending order to form a sorted intensity list. For example, the list before sorting is [5, 3, 8, 2, 7], and the intensity list after sorting is [8, 7, 5, 3, 2].

[0145] Step S1443: Based on the preset threshold for the number of top-level paths, select the first set number of path intensity values ​​from the sorted intensity list to determine the corresponding associated paths. The threshold for the number of top-level paths is set according to the diversity of biological characteristics.

[0146] Based on a preset threshold for the number of top-level paths, the system selects the top 3 path intensity values ​​from the sorted intensity list. This threshold is set according to the diversity of biometrics; the more diverse the biometrics, the higher the threshold can be. For example, if the threshold is set to 3, then the top 3 path intensity values ​​from the sorted intensity list will be selected.

[0147] Based on these selected path strength values, the corresponding association paths are found in the biometric association graph.

[0148] Step S1444: Extract the associated paths and their corresponding path strength values ​​to form an initial top-level path candidate set. The initial top-level path candidate set includes a set number of associated paths with the highest path strength values ​​and their corresponding path strength values.

[0149] Extract these corresponding associated paths and their path strength values, and organize them together to form an initial top-level path candidate set. For example, if the associated paths corresponding to the first 3 selected path strength values ​​are fingerprint node-face node-iris node, face node-typing behavior node-gesture node, and iris node-typing behavior node-gesture node, then the initial top-level path candidate set will contain these three paths and their corresponding path strength values.

[0150] Step S1445: Check whether there is an inclusion relationship among the associated paths in the initial top-level path candidate set. If so, retain the path with the higher path strength value.

[0151] Check if there are any inclusion relationships among the associated paths in the initial top-level path candidate set. An inclusion relationship means that all nodes of one path are contained in another path, and the node order is consistent. For example, if one path is fingerprint node-face node-iris node, and another path is fingerprint node-face node-iris node-typing behavior node, then the former is contained in the latter.

[0152] If the above inclusion relationship exists, the path with the higher path strength value is retained. For example, among the two paths above, if the latter has a higher path strength value, the latter is retained and the former is discarded; if the former has a higher path strength value, the former is retained and the latter is discarded.

[0153] Step S1446: Determine the processed initial top-level path candidate set as top-level path information, wherein the top-level path information refers to a set number of associated paths with the highest path strength value and their corresponding path strength values.

[0154] After inclusion relationship checks and processing, the initial top-level path candidate set is determined as the top-level path information. This top-level path information contains a set number of associated paths with the highest path strength values ​​and their corresponding path strength values. These paths do not have inclusion relationships with each other, which can more comprehensively reflect the important associations between biometric data.

[0155] Step S145: Associate and bind the obfuscated identity feature set and top-level path information to form a core credential element set, which includes the obfuscated identity feature set and top-level path information.

[0156] The obfuscated identity feature set and top-level path information are then associated and bound together. A specific association identifier links them, allowing for quick retrieval of the corresponding element from one element during subsequent use. For example, the obfuscated identity feature set and top-level path information are assigned the same association code to achieve this binding, forming a core set of credential elements that fully encompasses both the obfuscated identity feature set and the top-level path information.

[0157] Step S146: Add a dynamic expiration identifier to the set of core elements of the credential. The dynamic expiration identifier is generated based on the time-varying attributes of biometrics and is used to indicate the validity period of the digital identity verification credential.

[0158] Add dynamic validity markers to the core elements of the voucher. The generation of these markers is based on the time-varying attributes of biometric features. For example, a reasonable validity period is calculated based on the rate of change of the time-varying attributes of physiological features such as fingerprints and facial features. If the time-varying attributes of physiological features change rapidly, the validity period is shorter; if the change is slower, the validity period is longer.

[0159] A dynamic validity period identifier can be a time interval that includes a start time and an end time, or it can be an end time calculated based on the start time and the validity period, used to clearly indicate the validity period of digital identity verification credentials.

[0160] Step S147: The set of core elements of the credential after adding dynamic expiration mark is encapsulated in an encrypted format to generate a digital identity verification credential, which contains identity information corresponding to the biometric association map.

[0161] The core elements of the voucher, after being marked with a dynamic expiration date, are encapsulated according to a preset encryption format. The encryption format employs a high-strength encryption algorithm, such as RSA, to encrypt the core elements of the voucher, ensuring its security during transmission and storage.

[0162] During the encapsulation process, identity information corresponding to the biometric association map is also added. This identity information is unique and used to identify the identity corresponding to the digital authentication credential. The final generated digital authentication credential is an encrypted and encapsulated data packet containing all the necessary elements.

[0163] Step S150: Perform a security permission configuration operation based on the digital authentication credential. The result of the security permission configuration operation is used to control access permissions to the target resource.

[0164] Step S151: Parse the digital identity verification credential and extract the identity information corresponding to the biometric association graph, the obfuscated identity feature set, the top-level path information, and the dynamic expiration mark contained therein.

[0165] The digital identity verification credential is parsed using the same decryption algorithm as during encapsulation. This process decrypts the core elements of the encrypted credential, extracting the identity information, obfuscated identity feature set, top-level path information, and dynamic expiration identifier. The parsing process ensures that the extracted information is complete, accurate, and consistent with the content during encapsulation.

[0166] Step S152: Verify the validity of the dynamic validity period identifier, check whether the current time is within the valid duration indicated by the dynamic validity period identifier, and if it exceeds the valid duration, trigger the voucher update process.

[0167] Verify the validity of the dynamic validity period identifier by comparing the current time with the validity period indicated by the identifier. If the current time is within the validity period, the dynamic validity period identifier is valid; if the current time exceeds the validity period, the identifier is invalid, and the voucher update process is triggered.

[0168] The credential update process will prompt that biometric data needs to be collected again, and digital identity verification credentials will be regenerated according to steps S110 to S140.

[0169] Step S153: Query the dynamic permission rule base according to the identity information and top-level path information. The dynamic permission rule base stores the permission level classification standard corresponding to different identity information combined with top-level path information. The permission level classification standard is used to determine the access scope and operation restrictions of the target resource.

[0170] Based on the extracted identity and top-level path information, the dynamic permission rule base is queried. The dynamic permission rule base is a database maintained by the system that stores a large number of permission rules. Each rule corresponds to a specific combination of identity and top-level path information and specifies the corresponding permission level classification standards.

[0171] The permission level classification standard details the access scope (e.g., which databases and file directories can be accessed) and operation restrictions (e.g., read-only, no modification, can execute specific commands) of a given identity under the association relationship corresponding to the current top-level path information, for different target resources. By querying, the permission level classification standard that matches the current identity information and top-level path information can be found.

[0172] Step S154: Based on the queried permission level classification standard and combined with the dynamic feature attributes in the obfuscated identity feature set, determine the real-time permission configuration content. The real-time permission configuration content includes a list of target resources that are allowed to be accessed, the executable operations for each resource, and the operation frequency limit.

[0173] In financial institutions, determining the real-time permission configuration content requires multiple specific steps based on the queried permission level classification standards and the dynamic feature attributes in the obfuscated identity feature set, in order to ensure that the permission configuration not only complies with the rules but also adapts to real-time feature changes.

[0174] For example, step S1541: parse the permission level division standard, determine the basic resource access scope and basic operation permissions corresponding to different permission levels, the basic resource access scope includes multiple target resource types, and the basic operation permissions specify the executable operations for each resource type.

[0175] The permission level classification standard is analyzed, and the different permission levels are clearly defined. For example, the basic resource access scope corresponding to Level 1 permission includes internal public document libraries and general office software; the basic resource access scope corresponding to Level 2 permission adds department-level data shared folders to the basic resource access scope; and Level 3 permission further includes query permissions for core business databases.

[0176] Regarding basic operation permissions, for internal public document libraries, level one permissions allow viewing and downloading; for departmental data sharing folders, level two permissions allow viewing, downloading, and editing; and for core business databases, level three permissions allow querying, but prohibit modification and deletion. These basic resource access scopes and basic operation permissions form the basis for determining real-time permission configurations.

[0177] Step S1542: Extract the dynamic feature attributes from the obfuscated identity feature set, and separate the time-varying physiological feature attributes and behavioral feature pattern attributes.

[0178] The dynamic feature attributes are extracted from the obfuscated identity feature set. Due to the feature obfuscation process, the corresponding original feature categories need to be reverse-parsed using a pre-defined reconstruction mapping table, but the specific original values ​​are not restored. For example, obfuscated features corresponding to fingerprint time-varying attributes and facial time-varying attributes are identified from the obfuscated feature set and classified as physiological time-varying attributes; obfuscated features corresponding to typing behavior pattern attributes and gesture pattern attributes are identified and classified as behavioral feature pattern attributes.

[0179] The separated physiological characteristics include the subtle shift trends of fingerprint features over time and the frequency of facial muscle movements; the behavioral characteristics include the occurrence patterns of specific key combinations in typing behavior and the frequency and rhythm changes of gesture operations.

[0180] Step S1543: Analyze and process the time-varying attributes of physiological characteristics according to the preset feature and permission mapping rules, and determine the permission adjustment coefficient. The permission adjustment coefficient is used to expand or narrow the access range of basic resources.

[0181] The preset feature-permission mapping rules set corresponding permission adjustment rules for different changes in the time-varying attributes of physiological features. For example, if the change in the time-varying attributes of fingerprints is within the normal range (determined by comparison with historical baselines), the corresponding permission adjustment coefficient is 1.0, and the basic resource access range remains unchanged; if the change is less than the normal range and shows a stable trend, indicating high feature consistency, the permission adjustment coefficient is 1.2, and the basic resource access range is expanded by 20% on the original basis, for example, level one permissions can additionally access some semi-public technical documents; if the change is greater than the normal range, the permission adjustment coefficient is 0.8, and the basic resource access range is reduced by 20%, for example, level one permissions can only access some content in the internal public document library.

[0182] The time-varying attributes of the isolated physiological characteristics are quantitatively analyzed, the ratio of their variation amplitude to the historical baseline is calculated, and the corresponding permission adjustment coefficient is determined by comparing the characteristics with the permission mapping rules.

[0183] Step S1544: Based on the behavioral feature pattern attribute, query the operation frequency rule base to obtain the upper limit of operation frequency corresponding to the pattern attribute. The upper limit of operation frequency is used to limit the number of operations on the target resource.

[0184] The operation frequency rule base stores the operation frequency limit standards corresponding to different behavioral characteristic pattern attributes. For example, in the typing behavior pattern attribute, if the key press frequency per unit time is within the normal range, the corresponding document download operation frequency limit is 50 times per hour; if the key press frequency is higher than the normal range, it indicates that the operation may be more frequent, and the document download operation frequency limit is adjusted to 30 times per hour; if the key press frequency is lower than the normal range, the operation frequency limit is 60 times per hour.

[0185] Based on the separated behavioral feature patterns, such as typing frequency and gesture operation intervals, a matching query is performed in the operation frequency rule base to obtain the corresponding operation frequency limit. This operation frequency limit is set separately for different target resource types. For example, the operation frequency limit is different for internal public document libraries and department-level data sharing folders.

[0186] Step S1545: Expand or shrink the basic resource access range according to the permission adjustment coefficient to obtain the adjusted resource access range and determine the list of target resources that are allowed to be accessed.

[0187] The basic resource access scope determined in step S1541 is processed according to the permission adjustment coefficient obtained in step S1543. For example, the basic resource access scope of level 2 permissions includes the internal public document library, general office software, and department-level data sharing folder. When the permission adjustment coefficient is 1.1, the scope is expanded by 10%, adding access permissions to the department-level temporary project folder; when the permission adjustment coefficient is 0.9, the scope is shrunk by 10%, removing access permissions to some sensitive subdirectories in the department-level data sharing folder.

[0188] After expansion or contraction, the adjusted resource access scope is obtained. All specific resource entries included in the scope are organized into a list of target resources that are allowed to be accessed. The list clearly lists the resource name, storage path, and other identification information.

[0189] Step S1546: Associate and integrate the basic operation permissions with the operation frequency limit to determine the executable operations and corresponding operation frequency limits for each resource.

[0190] Associating the basic operation permissions in step S1541 with the operation frequency limits in step S1544, a corresponding frequency limit is assigned to each executable operation for each resource type. For example, the basic operation permissions for a department-level data sharing folder include viewing, downloading, and editing, with corresponding operation frequency limits of 100 times per hour, 50 times per hour, and 20 times per hour, respectively. After integration, the specific permission configuration for this resource is formed: viewing is allowed (≤100 times / hour), downloading is allowed (≤50 times / hour), and editing is allowed (≤20 times / hour).

[0191] For newly added resources in the adjusted resource access scope, configure them according to the basic operation permissions of their type and the corresponding operation frequency limit; for removed resources, they will no longer be included in the permission configuration.

[0192] Step S1547: Summarize the list of allowed target resources, the executable operations for each resource, and the operation frequency limits to form real-time permission configuration content. The real-time permission configuration content includes the list of allowed target resources, the executable operations for each resource, and the operation frequency limits.

[0193] The list of allowed target resources obtained in step S1545 is summarized along with the executable operations and operation frequency limits for each resource determined in step S1546. These are then categorized and organized according to resource type to form structured real-time permission configuration content. For example: Internal public document library: allowed viewing (≤200 times / hour), allowed downloading (≤80 times / hour); Department-level data sharing folder: allowed viewing (≤100 times / hour), allowed downloading (≤50 times / hour), allowed editing (≤20 times / hour); Newly added semi-public technical documents: allowed viewing (≤30 times / hour).

[0194] This real-time permission configuration comprehensively reflects the specific access permissions of the current identity after biometric association analysis.

[0195] Step S155: Associate the real-time permission configuration content with the identity information in the digital identity verification credential to generate a permission and identity binding record.

[0196] The real-time permission configuration content is associated and stored with the identity information in the digital authentication credentials. In the system's permission database, a record is created for this identity information. The record contains the corresponding real-time permission configuration content, namely, the list of allowed target resources, the executable operations for each resource, and the operation frequency limits, thus generating a permission-identity binding record.

[0197] The aforementioned associated storage ensures that the corresponding permission configuration can be quickly retrieved using the identity information during subsequent access control processes.

[0198] Step S156: Send a permission configuration instruction to the resource access control center. The permission configuration instruction contains permission and identity binding records to trigger the resource access control center to update the access permission list. After the resource access control center updates the access permission list, it generates a permission configuration completion feedback. The result of the security permission configuration operation is used to control access permissions to the target resource.

[0199] A permission configuration command is sent to the resource access control center. This command contains permission and identity binding records. The resource access control center is the core module responsible for managing access permissions to the target resource. Upon receiving the permission configuration command, it can update its own maintained access permission list based on the permission and identity binding records contained within.

[0200] The access permission list records the access permissions corresponding to each identity information. The updated list accurately reflects the real-time permission configuration content. After the resource access control center completes the update of the access permission list, it can generate a permission configuration completion feedback, which is sent to the system's execution module to indicate that the security permission configuration operation has been successfully completed.

[0201] The results of security permission configuration operations are directly applied to the access permission list of the resource access control center. When the identity attempts to access the target resource, the resource access control center will perform permission verification based on the records in the access permission list to determine whether access is allowed and what operations are allowed to be performed, thereby achieving effective control over the access permissions of the target resource.

[0202] Figure 2 The illustration shows exemplary hardware and software components of a biometric-based digital identity and security management system 100 that can implement the ideas of this application, according to some embodiments of this application. For example, a processor 120 can be used in the biometric-based digital identity and security management system 100 and to perform the functions in this application.

[0203] The biometric-based digital identity recognition and security management system 100 can be a general-purpose server or a special-purpose server, both of which can be used to implement the biometric-based digital identity recognition and security management method of this application. Although only one server is shown in this application, for convenience, the functions described in this application can be implemented in a distributed manner on multiple similar platforms to balance the load.

[0204] For example, a biometric-based digital identity and security management system 100 may include a network port 110 connected to a network, one or more processors 120 for executing program instructions, a communication bus 130, and various forms of storage media 140, such as a disk, ROM, or RAM, or any combination thereof. Exemplarily, the biometric-based digital identity and security management system 100 may also include program instructions stored in ROM, RAM, or other types of non-transitory storage media, or any combination thereof. The methods of this application can be implemented according to these program instructions. The biometric-based digital identity and security management system 100 also includes an I / O interface 150 between the computer and other input / output devices.

[0205] For ease of explanation, only one processor is described in the biometric-based digital identity recognition and security management system 100. However, it should be noted that the biometric-based digital identity recognition and security management system 100 of this application may also include multiple processors, and therefore the steps performed by one processor described in this application may also be performed jointly or individually by multiple processors. For example, if the processor of the biometric-based digital identity recognition and security management system 100 performs steps A and B, it should be understood that steps A and B may also be performed jointly by two different processors or individually by one processor. For example, the first processor performs step A, the second processor performs step B, or the first processor and the second processor jointly perform steps A and B.

[0206] Furthermore, embodiments of the present invention also provide a readable storage medium, wherein computer-executable instructions are preset in the readable storage medium, and when the processor executes the computer-executable instructions, the above-mentioned biometric-based digital identity recognition and security management method is implemented.

[0207] It should be noted that, in order to simplify the description of the present invention and thus help to understand one or more embodiments of the invention, multiple features may sometimes be grouped into one embodiment, drawing or description thereof in the foregoing description of the embodiments of the present invention.

Claims

1. A biometric-based digital identity recognition and security management system, characterized in that, Includes a processor and a memory, the memory being used to store a program, and the processor being used to execute the program in the memory to perform the following steps: Acquire biometric data, which includes biometric data from different sources, and the biometric data includes physiological data and behavioral data. The biometric information is processed by feature association mapping to obtain a biometric association graph, which is used to reflect the inherent relationship between different biometric data. The biometric association map is matched and verified with a preset security benchmark map to obtain a matching verification result, which is used to indicate the degree of consistency between the biometric association map and the security benchmark map. A digital identity verification credential is generated based on the matching and verification results. The digital identity verification credential contains identity identification information corresponding to the biometric association map. A security permission configuration operation is performed based on the digital identity verification credential, and the result of the security permission configuration operation is used to control access permissions to the target resource; The step of performing feature association mapping processing on the collected biometric information to obtain a biometric association map includes: Extract the dynamic feature attributes of various biometric data from the biometric data collection information; Based on the dynamic feature attributes, an association factor matrix is ​​constructed. Each element of the association factor matrix corresponds to the association influence coefficient of the two types of biometric data under different dimensions. The association influence coefficient is positively correlated with the change range of the dynamic feature attributes. The biometric data in the biometric collection information is processed by the association factor matrix to identify the transitive association chains and form a multi-level association path set. For each associated path in the multi-level associated path set, the path strength is calculated. The path strength is the cumulative product of all associated influence coefficients in the path, resulting in a set of path strength values. The multi-level associated path set is filtered based on the path strength value set, and associated paths whose path strength values ​​exceed a preset path threshold are retained to generate a filtered associated path set. The filtered set of associated paths is mapped using a node and edge structure to obtain a biometric association graph. The construction of the association factor matrix based on the dynamic feature attributes includes: Determine the set of associated dimensions, which includes the morphological dimension of physiological characteristics, the frequency dimension of behavioral characteristics, and the time dimension shared by both. For each type of biometric data, extract the feature values ​​of its dynamic feature attributes in each dimension of the associated dimension set to form a feature value matrix; Calculate the absolute value of the difference in feature values ​​of any two types of biometric data in each associated dimension to obtain the dimension difference matrix; The dimensional difference matrix is ​​transformed according to the preset correlation influence function, and the absolute value of the difference is converted into the correlation influence coefficient. The correlation influence coefficients under different correlation dimensions are arranged in dimensional order to construct a correlation factor matrix.

2. The biometric-based digital identity recognition and security management system according to claim 1, characterized in that, The dynamic feature attributes include time-varying attributes of physiological feature data and pattern attributes of behavioral feature data. The time-varying attributes of physiological feature data are used to describe the subtle changes in physiological features over time, and the pattern attributes of behavioral feature data are used to describe the recurring patterns of behavioral features. Each path in the multi-level associated path set contains at least three sequentially associated biometric data. The nodes of the biometric association graph represent biometric data, and the edges represent association paths and corresponding path strength values. The rows of the eigenvalue matrix represent the data type of the biological feature, the columns represent the associated dimensions, and the elements represent the feature values ​​of the corresponding dimensions. The output value of the correlation influence function increases as the input value decreases, ensuring that the correlation influence coefficient is positively correlated with the change range of the dynamic feature attribute.

3. The biometric-based digital identity recognition and security management system according to claim 1, characterized in that, The process involves using the association factor matrix to perform association path mining on the biometric data in the collected biometric information, identifying transitive association chains, and forming a multi-level association path set, including: Using the biometric data in the biometric information as nodes, an initial node set is constructed, which contains all the biometric data in the biometric information. Based on the correlation factor matrix, the comprehensive correlation coefficient between any two nodes is calculated. The comprehensive correlation coefficient is the weighted average of the corresponding elements in the correlation factor matrix, and the weights are set according to the importance of the dimensions. Based on the preset association threshold, node pairs that exceed the threshold are selected from the comprehensive association coefficient and identified as directly associated node pairs, forming a directly associated set; Select a pair of directly related nodes from the set of directly related nodes as the starting node pair. With one node as the starting point and the other node as the intermediate node, find nodes that are directly related to the intermediate node and are not included in the current path as extension nodes. Connect the starting point, intermediate nodes, and extension nodes in sequence to form a three-level association path containing three nodes, and record the path and the corresponding comprehensive association coefficient. Using the extended node as the new intermediate node, repeat the above extension process until no new extended node can be found or the preset path length limit is reached, forming a longer multi-level associated path. The above path mining process is repeated for all directly related node pairs. After removing duplicate paths, a multi-level related path set is formed. Each path in the multi-level related path set contains at least three sequentially related biometric data.

4. The biometric-based digital identity recognition and security management system according to claim 1, characterized in that, The step of matching and verifying the biometric association map with a preset security benchmark map to obtain the matching and verification result includes: Obtain a preset security baseline map, which includes a set of multi-level associated paths and path strength values ​​corresponding to known legitimate identities. The description method of the set of multi-level associated paths and path strength values ​​corresponding to known legitimate identities is completely consistent with that of the multi-level associated path set and path strength values ​​in the biometric association map. Extract the multi-level association path set and the corresponding path strength value from the biometric association graph to form a path information set to be matched. Each element in the path information set to be matched contains an association path and a corresponding path strength value. Extract the multi-level associated path set and the corresponding path strength value from the security benchmark map to form a benchmark path information set. Each element in the benchmark path information set contains an associated path and a corresponding path strength value. The path structure comparison process is performed on the set of path information to be matched and the set of baseline path information to identify homologous paths with completely identical biometric data sequences, forming a set of homologous paths. Calculate the ratio of the path strength value of each path in the biometric association map to the path strength value in the safety baseline map for each path in the homologous path set to obtain a set of path strength ratios; The proportion of the number of paths contained in the homologous path set to the total number of paths in the biometric association graph is statistically analyzed, and combined with the average ratio of the path intensity ratio set, a comprehensive matching index is generated. The numerical range of the comprehensive matching index is positively correlated with the degree of matching. The comprehensive consistency index is used as the matching verification result, which is used to indicate the degree of consistency between the biometric association map and the safety benchmark map.

5. The biometric-based digital identity recognition and security management system according to claim 4, characterized in that, The process of comparing the path structure of the set of paths to be matched and the set of baseline path information to identify homologous paths with completely identical biometric data sequences is described, forming a set of homologous paths, including: Select an associated path from the set of path information to be matched as the current comparison path. The current comparison path contains multiple biometric data arranged in order and the corresponding path strength value. Extract the biometric data sequence from the current comparison path to form a data sequence to be compared. The order of the data sequence to be compared is completely consistent with the order of appearance of the biometric data in the current comparison path. Traverse each associated path in the baseline path information set, extract the biometric data sequence from each associated path, and form a baseline data sequence; The data sequence to be compared is compared element by element with each reference data sequence. If there is a completely identical reference data sequence, the associated path in the corresponding reference path information set and the current comparison path are marked as the same source path and added to the temporary same source set. Select the next associated path from the set of path information to be matched as the current comparison path, and repeat the above comparison process until all associated paths in the set of path information to be matched have been processed. After deduplicating the associated paths in the temporary same-origin set, a same-origin path set is formed.

6. The biometric-based digital identity recognition and security management system according to claim 1, characterized in that, The step of generating digital identity verification credentials based on the matching verification result includes: The comprehensive matching index in the matching verification result is analyzed to determine whether the comprehensive matching index reaches the preset credential validity threshold. The preset credential validity threshold is used to define the validity of digital identity verification credentials. If the comprehensive matching index reaches the preset certificate validity threshold, the core identity feature set corresponding to the biometric association graph is extracted. The core identity feature set includes biometric data that constitutes the longest association path and the corresponding dynamic feature attributes. The core identity feature set will be fully referenced in subsequent steps. The core identity feature set is subjected to feature obfuscation processing. Dynamic feature attributes are cross-recombined with biometric data in the associated path according to preset obfuscation rules to obtain an obfuscated identity feature set. The obfuscated identity feature set retains the correlation of the original features but hides the direct correspondence. Extract the top-level path information from the biometric association graph. The top-level path information refers to a set number of association paths with the highest path strength value and their corresponding path strength values. The obfuscated identity feature set and top-level path information are associated and bound to form a core credential element set, which includes the obfuscated identity feature set and top-level path information. A dynamic expiration identifier is added to the set of core elements of the credential. The dynamic expiration identifier is generated based on the time-varying attributes of biometrics and is used to indicate the validity period of the digital identity verification credential. The core elements of the credential, after adding a dynamic expiration date, are encapsulated in an encrypted format to generate a digital identity verification credential, which contains identity information corresponding to a biometric association graph.

7. The biometric-based digital identity recognition and security management system according to claim 6, characterized in that, The process of obfuscating the core identity feature set involves cross-recombining dynamic feature attributes with biometric data in the associated path according to preset obfuscation rules to obtain an obfuscated identity feature set, including: The core identity feature set is analyzed to separate the biometric data sequence and the corresponding dynamic feature attribute set. The biometric data sequence is a sequence of biometric data in the associated path arranged in order. The dynamic feature attribute set contains the time-varying attribute or pattern attribute corresponding to each biometric data. Obtain a preset obfuscation rule, which includes feature crossover order, attribute offset, and recombination mapping table. The feature crossover order specifies the recombination order of dynamic feature attributes and biometric data. The attribute offset is used to adjust the presentation format of attribute values. The recombination mapping table is used to record the correspondence between the original features and the obfuscated features. According to the aforementioned feature crossing order, the attribute values ​​in the dynamic feature attribute set are sequentially assigned to non-adjacent biometric data in the biometric data sequence to form preliminary cross feature groups; Based on the attribute offset, the dynamic feature attribute values ​​in the initial cross feature group are offset and adjusted. The adjusted attribute values ​​are linearly related to the original values ​​but have different values. According to the recombination mapping table, the initial cross feature groups after offset adjustment are labeled and replaced with obfuscated labels to replace the original labels of biometric data and dynamic feature attributes, while preserving the inherent correlation. The cross-feature groups after label replacement are rearranged according to the order of the associated paths to form a confused identity feature set. The confused identity feature set retains the correlation of the original features but hides the direct correspondence.

8. The biometric-based digital identity recognition and security management system according to claim 6, characterized in that, The extraction of top-level path information from the biometric association graph includes: Traverse all associated paths in the biometric association graph, extract the path strength value corresponding to each associated path, and form a path strength value list. The path strength value list contains the path strength values ​​of all associated paths in the biometric association graph. The path strength value list is sorted in descending order, and the path strength values ​​are arranged in descending order to form a sorted strength list; Based on a preset threshold for the number of top-level paths, a set number of path intensity values ​​are selected from the sorted intensity list to determine the corresponding associated paths. The threshold for the number of top-level paths is set according to the diversity of biological characteristics. Extract the associated paths and their corresponding path strength values ​​to form an initial top-level path candidate set. The initial top-level path candidate set contains a set number of associated paths with the highest path strength values ​​and their corresponding path strength values. Check if there is an inclusion relationship between the associated paths in the initial top-level path candidate set. If so, retain the path with the higher path strength value. The processed initial top-level path candidate set is determined as the top-level path information, which refers to a set number of associated paths with the highest path strength value and their corresponding path strength values.

9. The biometric-based digital identity recognition and security management system according to claim 1, characterized in that, The step of performing security permission configuration operations based on the digital identity verification credential includes: The digital identity verification credential is parsed to extract the identity information corresponding to the biometric association graph, the obfuscated identity feature set, the top-level path information, and the dynamic expiration identifier contained therein; Verify the validity of the dynamic validity period identifier, check whether the current time is within the valid duration indicated by the dynamic validity period identifier, and if it exceeds the valid duration, trigger the voucher update process; The dynamic permission rule base is queried based on the identity information and top-level path information. The dynamic permission rule base stores the permission level classification standards corresponding to different identity information combined with top-level path information. The permission level classification standards are used to determine the access scope and operation restrictions of the target resource. Based on the queried permission level classification standard, and combined with the dynamic feature attributes of the obfuscated identity feature set, the real-time permission configuration content is determined. The real-time permission configuration content includes a list of target resources that are allowed to be accessed, the executable operations for each resource, and the operation frequency limit. The real-time permission configuration content is associated with the identity information in the digital identity verification credential and stored together to generate a permission and identity binding record. A permission configuration instruction is sent to the resource access control center. The permission configuration instruction contains permission and identity binding records to trigger the resource access control center to update the access permission list. After the resource access control center updates the access permission list, it generates a permission configuration completion feedback. The result of the security permission configuration operation is used to control access permissions to the target resource.

Images