Plant station user security authentication management method and system based on multi-type biological recognition

Abstract

The invention discloses a plant station user security authentication management method and system based on multi-type biological recognition, and the method comprises the steps: controlling a biological authentication mode through mode selection, inputting the biological information of a corresponding person by a system administrator, and binding the biological information with an account of the corresponding person; the offset file for verifying the password is encrypted and stored, the key is a value mapped by a user name, when the password is verified, the offset file and the key are obtained through decryption, the password is decrypted by using an sm4 algorithm, the integrity of the password is verified by using sm3, biological information verification is carried out if the verification is passed, and living body detection is carried out firstly; and comparing the biological feature vector with a biological feature template pre-stored in a library after the verification is passed, and successfully logging in after the verification is passed. The anti-interference, anti-counterfeiting and compliance requirements of the authentication technology in the power production environment are met, the identity of an operator is ensured to be true and credible, and the information safety protection capability of a power system is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of power monitoring systems, in particular to a power station user security authentication management method and system based on multi-type biometric recognition. BACKGROUND

[0002] Current power station monitoring systems mainly rely on the username+password method, which has many risk factors, such as the use of personnel sharing, which cannot ensure that the actual operator and the login identity are consistent, is easy to be brute-forced, and the residual of the personnel who have left is not recovered in time. The power station monitoring system has higher requirements for user login verification security, multi-scene applicability diversity, and convenience. However, the existing username+password method cannot meet the requirements of the power station monitoring system. SUMMARY

[0003] The purpose of the present application is to provide a power station user security authentication management method and system based on multi-type biometric recognition, which solves the anti-interference, anti-fake, and compliance requirements of authentication technology in the power production environment by biometric feature selection and password double-factor collaborative authentication and liveness detection enhancement, ensures the authenticity and credibility of the operator identity, and improves the information security protection capability of the power system.

[0004] Technical scheme: The power station user security authentication management method based on multi-type biometric recognition provided by the present application comprises the following steps:

[0005] New users corresponding to the relevant personnel of the power system in the station are created, and the multi-type biological information of the users is collected;

[0006] The current biometric authentication mode is determined according to the environment in the power station;

[0007] Password verification and biometric information verification are performed when the user logs in, and the user is allowed to log in after the password verification and biometric information verification are both successful;

[0008] An audit service is constructed, all login operations are sent to the audit service through the audit service for audit recording, and the password verification and biometric information verification form an audit log for traceability and verification of the failure link.

[0009] Further, a login error number threshold is set, and if the number of login errors of the user exceeds the login error number threshold, the login user is locked, and the system administrator unlocks the login permission.

[0010] Further, an emergency channel is established, the emergency channel is modified by the system administrator and the security administrator to temporarily isolate the biometric information verification mode, and the emergency channel is used to deal with the emergency situation of biometric collection verification hardware damage.

[0011] Further, the password is verified by a national secret algorithm, and the key and the offset are encrypted and stored.

[0012] When the user logs in, after the integrity check of the password is passed, the liveness detection is performed, then the collected biological feature information is matched with the biological feature information library, and after all the checks are passed, it is considered that the identity authentication is successful, and the login is allowed.

[0013] Further, the type of biological information verification includes fingerprint verification, face verification, iris verification, and double verification of face and iris.

[0014] According to the environment in the plant station, the current biological authentication mode is determined, including:

[0015] In the strong light irradiation environment, fingerprint verification or iris verification is used;

[0016] In the environment where gloves cannot be removed, humid, dusty and oily, face verification or iris verification is used.

[0017] Further, the fingerprint feature library is stored on the server, and the stored is an encrypted biological feature template, which is encrypted by using an AES algorithm, and the data encryption key is stored in the fingerprint instrument hardware, and the fingerprint feature displayed on the server is an encrypted file.

[0018] The encrypted biological feature template of face and iris is stored in the hardware after encryption, and the key is stored in the corresponding instrument hardware.

[0019] Further, the password creation has complexity requirements, including length and special character.

[0020] The plant station user security authentication management system based on multiple types of biological identification provided by the application comprises:

[0021] The login management unit is used for newly creating corresponding users for the relevant personnel of the power system in the station, collecting multiple types of biological information of the user, determining the current biological authentication mode according to the environment in the plant station, and performing password verification and biological information verification when the user logs in, and allowing login after the password verification and biological information verification are both successfully authenticated.

[0022] The audit unit is used for constructing an audit service, and all login operations are sent to the audit service through the audit service for audit record, and the password verification and biological information verification form an audit log for traceability to check the failure link.

[0023] The computer readable storage medium provided by the application stores a computer program, and the computer program is executed by a processor to realize the plant station user security authentication management method based on multiple types of biological identification.

[0024] The computer program product provided by the application comprises a computer program, and the computer program is executed by a processor to realize the plant station user security authentication management method based on multiple types of biological identification.

[0025] Beneficial effects: Compared with existing technologies, the advantages of this invention are as follows: This invention adds an authentication dimension to single-password authentication. By comparing biometric information, it breaks the single-point-of-failure dilemma of traditional cryptographic systems. Furthermore, the irreproducibility of biometric features can form orthogonal protection with the dynamic nature of cryptography, increasing the cost of attacks. It can also effectively alleviate the problem of password sharing among power industry personnel due to shift work. Attached Figure Description

[0026] Figure 1 This is a flowchart illustrating the user registration process according to an embodiment of the present invention.

[0027] Figure 2 This is a flowchart illustrating the login process according to an embodiment of the present invention.

[0028] Figure 3 This is a flowchart of the liveness detection and feature comparison process according to an embodiment of the present invention. Detailed Implementation

[0029] The plant user security authentication management method based on multi-type biometrics described in this invention includes the following steps.

[0030] Step 1: Divide the bioinformatics patterns and map all biovalidation patterns using a bioinformatics pattern management tool.

[0031] Furthermore, the biometric verification function defines fingerprint recognition, facial recognition, iris recognition, and multimodal recognition modes. System administrators can use the biometric mode management tool to select the biometric verification mode. Access to this tool is verified; non-system administrators cannot perform this operation.

[0032] Furthermore, in two-factor authentication, using physical keys such as Ukeys is difficult to carry and store, and they are easily damaged, hindering the operation process. Strong electromagnetic environments can cause inaccurate fingerprint collection, and special environments such as wearing a helmet or having dirt on the face can cause inaccurate facial recognition. Low temperatures can cause inaccurate iris recognition. The two-factor authentication of this invention uses a combination of multiple types of biometric authentication modes. System administrators can select the appropriate biometric authentication mode for the current site environment through a biometric mode management tool. For example, in environments with strong light, fingerprint or iris recognition can be used; in situations where gloves cannot be removed, or in damp, dusty, or oily environments, face or iris recognition can be used; in normal situations, face, fingerprint, or iris recognition can be used for greater convenience and speed; and in high-security scenarios, iris and face can be used for joint verification.

[0033] Step 2: Establish a database of electricity users' characteristics. Biometric information can be collected by the system administrator through biometric management tools, and the collected biometrics are bound to their accounts.

[0034] Further, the power personnel feature library fingerprint is stored on the server, and the stored is an encrypted biometric template, the encryption algorithm uses AES algorithm for encryption, the data encryption key is stored in the fingerprint instrument hardware, the fingerprint feature displayed on the server is an encrypted file, the face and iris encrypted biometric template is directly encrypted and stored in the hardware, the key is also stored in the corresponding instrument hardware, which is more secure and faster in biometric comparison rate. The encrypted biometric template existing on the local server can only be managed by the system administrator user through the biometric management tool to manage the biometric information.

[0035] Further, the face and iris use wide dynamic binocular visible light combined with infrared camera, the wide dynamic range can be up to 105dB, and the fingerprint information is collected by the electromagnetic shielding fingerprint collection instrument.

[0036] Further, the biometric information verification factor includes fingerprint verification mode, face verification mode, iris verification mode, and face and iris dual verification mode.

[0037] 1) In the fingerprint verification mode, the fingerprint collection verification uses an electromagnetic shielding fingerprint collection instrument, and the feature collection comparison is performed after the blood flow dynamic analysis and living body detection, and the identity verification is passed after the comparison is successful, and the user login is locked if the comparison fails three times.

[0038] 2) In the face verification, the face collection verification uses a visible light camera, and the feature comparison is performed after three-dimensional depth living body detection, and the identity verification is passed after the comparison is successful, and the user login is locked if the comparison fails three times.

[0039] 3) In the iris verification, the iris collection uses an infrared camera, and the living body detection is performed by micro-movement of the pupil, and the feature comparison is performed after the living body detection is passed, and the verification is passed after the comparison is successful, and the user login is locked if the comparison fails three times.

[0040] 4) In the face and iris dual verification, a visible light and infrared binocular camera terminal is used for verification, the collector is first detected for living body, and then the visible light is used to collect the face feature and the infrared is used to collect the iris feature, and the two features are fused and compared with the feature library, if the comparison is unsuccessful, the comparison failure is prompted, and the comparison is re-performed, if the comparison is unsuccessful for three times, the user login is locked.

[0041] Step 3, use the user management tool and the biometric management tool to manage the power personnel password and the biometric verification information respectively, the user management tool is the main tool, and the user account information is overall maintained, the biometric feature management tool is the derivative tool, and the user biometric information is managed, and the obtained user list is the existing user.

[0042] Further, considering that the station monitoring system is mostly unattended, the effective period of the related biological information is one year.

[0043] Step 4, two-factor collaborative authentication is set in the permission service, first, the username and password are checked, the password is checked by the national secret algorithm, the key and the offset are encrypted and stored, and then the integrity of the password is checked. All pass the second factor biological information identity check; the biological information is first detected for living body, and then the biological feature information is compared with the library to determine whether it matches, and all the checks are passed to successfully authenticate the identity. If any step fails, the authentication fails.

[0044] Further, the username and password have complexity requirements when created, such as length, special character inclusion, etc. The password encryption method is encrypted by the national secret SM4 algorithm, wherein the offset and the key are encrypted and stored, and the password is calculated for integrity protection by the SM3 algorithm. The related password is stored in the database after encryption, and the integrity check code corresponding to the password is stored in the database according to the username. The new user is recorded by the system administrator using the biological feature management tool to bind the user to the biological feature, and the username and password are checked when logging in. After the check is passed, the biological information is verified. The biological information is verified first, and then the feature is compared after passing the living body detection. After the comparison is successful, the identity authentication is successful.

[0045] Further, the dual biological information verification of the embodiment synchronously collects the face image and iris image of the user by the camera, and performs living body detection on the recognized image. After passing the living body detection, the face feature vector and the iris feature vector are extracted and compared with the pre-stored biological feature template in the library. The face and iris feature comparison passes more than 85%, and the feature fusion weight is controlled according to the temperature. When collecting the image, the infrared camera is used to obtain the image in a single collection process, the three-dimensional depth detection is performed on the collected image, the micro-motion detection is performed on the pupil, and the correlation feature between the face and the pupil is detected.

[0046] Step 5, build an audit service, all login operations are sent to the audit service for audit record through the audit service, and the password check login and the second factor check will form an audit log for traceability to check the failure link. The number of login errors is limited in the permission service, and if the number of login errors reaches the limit, the login user is locked, and the system administrator needs to unlock it. An emergency channel is established for the system, and the emergency channel must be modified by the system administrator and the security administrator to temporarily isolate the biological verification mode. It can cope with the situation of biological collection verification hardware damage, but the emergency situation needs to ensure the normal operation of the business on site.

[0047] The technical solutions of the present application will be further described below with reference to the accompanying drawings.

[0048] As Figure 1 The user registration process of the application is shown, when the information of the related power system personnel is added, the username and password are first recorded, then the system administrator uses the biological information collection tool to collect the biological information of the corresponding personnel, the collected biological characteristics are stored in the library after encryption, and the biological information is bound with the username.

[0049] As Figure 2 The login process of the application is shown, the related user first inputs the password for verification, the encrypted stored key and offset are obtained during verification, then the SM4 algorithm of the national secret algorithm is used for encryption and decryption, and the integrity calculation is carried out, when the password decryption verification passes and the integrity calculation passes, the biological verification mode is entered for biological information verification, when the living body detection passes, the characteristic value is compared and checked, and the matching is successful. Allow login.

[0050] As Figure 3 The living body detection process of the application is shown, first, the collected data is detected for living body, if the detection does not pass, it is re-collected, and if it fails three times, the user login is locked, in the normal case, the face weight coefficient accounts for 0.6, the iris accounts for 0.4, and the feature comparison domain value needs to exceed 85%, the temperature sensor and electromagnetic radiation detector are deployed in the system to sense the environmental characteristics and dynamically adjust the multi-modal weight, when the electromagnetic interference is greater than 5V / m, the face weight coefficient is adjusted to 0.3, the iris weight coefficient is adjusted to 0.7, and the feature comparison domain value needs to exceed 90%, when the temperature sensor senses that the environmental temperature is less than-15 degrees Celsius, the face weight is adjusted to 0.7, the iris weight is 0.3, and the feature comparison domain value needs to exceed 88%.

[0051] The modification and information update process of the application includes: when the power personnel updates the user password alone, if the password is forgotten, the system administrator can help modify it, the first login needs to reset the password after modification, or the password can be updated by itself, the first login does not need to be reset when the password is updated by itself; when updating the biological information, the system administrator needs to update and record it, and it cannot be updated alone by using the biological management tool. And the password and biological information are managed independently, the biological information does not need to be modified when the password is modified, and the password does not need to be modified when the biological information is updated.

[0052] The audit traceability process of the application includes: the user operation is recorded as an audit log, for example, new user, password modification, user login, etc., the password verification fails in the user login verification process, and the biological information verification failure is recorded in the audit log. The identification rate, the audit content can be checked by the audit administrator through the audit tool, so as to trace the login failure condition caused by what kind of reason.

[0053] The emergency mode of the application includes: if there is a biological collection hardware problem, a secondary verification emergency channel can be opened by a safety administrator to maintain normal user login and ensure business stability.

[0054] The power station user security authentication management system based on multi-type biological recognition comprises:

[0055] A login management unit is configured to newly create a corresponding user for a power system related personnel in a station, collect multi-type biological information of the user, determine a current biological authentication mode according to an environment in the power station, perform password verification and biological information verification when the user logs in, and allow login after the password verification and the biological information verification are both successful.

[0056] An audit unit is configured to construct an audit service, send all login operations to the audit service for audit record through the audit service, and form an audit log through the password verification and the biological information verification, so as to trace and check a failure link.

[0057] The computer readable storage medium stores a computer program, and the computer program is executed by a processor to realize the power station user security authentication management method based on multi-type biological recognition.

[0058] The computer program product comprises a computer program, and the computer program is executed by a processor to realize the power station user security authentication management method based on multi-type biological recognition. The computer readable storage medium can comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage devices, magnetic disk storage devices or other magnetic storage devices, flash memories or any other media that can be used to store program codes in the form of instructions or data structures and can be accessed by a computer.

[0059] The processor is configured to execute the computer program stored in the memory to realize each step in the method related to the above embodiments.

Claims

1. A method for security authentication management of plant users based on multi-type biometrics, characterized in that, Includes the following steps: Personnel within the station's power system created corresponding users and collected various types of biometric information from them. The current biometric authentication model is determined based on the environment within the plant / site. When a user logs in, both password verification and biometric verification are performed. Login is allowed only after both password verification and biometric verification are successful. An audit service is built, and all login operations are sent to the audit service for audit recording. Password verification and biometric verification form audit logs to trace and verify failed steps.

2. The plant / station user security authentication management method based on multi-type biometrics according to claim 1, characterized in that, Set a threshold for the number of login errors. If a user's number of login errors exceeds the threshold, the user's login privileges will be locked and unlocked by the system administrator.

3. The method for security authentication management of plant users based on multi-type biometrics according to claim 1, characterized in that, An emergency channel is established, in which the system administrator and security administrator collaborate to modify the authentication mode, temporarily isolating the biometric verification mode to deal with emergencies caused by damage to the biometric verification hardware.

4. The plant / station user security authentication management method based on multi-type biometrics according to claim 1, characterized in that, The password is verified using the national cryptographic algorithm, and the key and offset are encrypted and stored. When a user logs in, after the password integrity check passes, a liveness detection is performed. Then, the collected biometric information is matched with the biometric information database. If all checks pass, the identity authentication is considered successful, and login is allowed.

5. The method for security authentication management of plant users based on multi-type biometrics according to claim 1, characterized in that, Biometric verification types include fingerprint verification, face verification, iris verification, and dual verification of face and iris. Based on the environment within the plant, the current biometric authentication model includes: In environments with strong light, use fingerprint or iris verification; In environments where gloves cannot be removed, or where there is moisture, dust, or oil, use facial recognition or iris recognition.

6. The method for security authentication management of plant users based on multi-type biometrics according to claim 5, characterized in that, The fingerprint feature is stored on the server and is stored as an encrypted biometric template. It is encrypted using the AES algorithm, and the data encryption key is stored in the fingerprint device hardware. On the server, the fingerprint features are displayed as an encrypted file. The encrypted biometric templates of face and iris are stored in hardware, while the keys are stored in the corresponding instrument hardware.

7. The plant / station user security authentication management method based on multi-type biometrics according to claim 1, characterized in that, Password creation has complexity requirements, including length and the inclusion of special characters.

8. A security authentication management system for factory / station users based on multi-type biometrics, characterized in that, include: The login management unit is used by relevant personnel of the power system within the station to create corresponding users and collect various types of biometric information from users; it determines the current biometric authentication mode based on the environment within the plant; when a user logs in, password verification and biometric information verification are performed, and login is allowed only after both password verification and biometric information verification are successful. The audit unit is used to build an audit service. All login operations are sent to the audit service for audit recording. Password verification and biometric verification form an audit log to trace and verify failed steps.

9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the plant user security authentication management method based on multi-type biometrics as described in any one of claims 1-7.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the plant user security authentication management method based on multi-type biometrics as described in any one of claims 1-7.

Images