Multi-mobile-terminal collaborative storage authentication system and method based on biological feature enhancement

Abstract

The invention discloses a multi-mobile-terminal collaborative storage authentication system and method based on biological feature enhancement, and relates to the field of information security certification, and the method comprises the steps: collecting registration data of each authorized mobile terminal, and constructing and storing an enhanced biological feature authentication model, an equipment fingerprint feature vector library and a user behavior baseline model; comparing with a pre-stored model according to the real-time biological characteristics and the real-time equipment fingerprint characteristic vector to obtain a fusion authentication result; if the authentication is passed, generating an initial trust score by the device role of the terminal and the matching degree, and authorizing to establish a session; dynamically correcting according to the behavior deviation degree of continuously collected user real-time behavior data and the user behavior baseline model to obtain a real-time trust score; and according to the abnormal change of the real-time trust score or other security events, triggering abnormal judgment, starting a multi-machine collaborative review mechanism, and executing security response. The problems that the authentication misjudgment rate is high, the system safety is low, and the credibility of authentication identification is not high are solved.

Description

Technical Field

[0001] This invention relates to the field of information security authentication, specifically to a multi-mobile terminal collaborative storage authentication system and method based on biometric enhancement. Background Technology

[0002] With the widespread adoption of mobile computing and cloud storage technologies, it has become commonplace for users to access sensitive personal or corporate data through various terminals such as smartphones, tablets, and wearable devices. Ensuring secure storage access hinges on reliable identity authentication.

[0003] In existing technologies, authentication systems often rely on single devices and single features. If a device is lost or malfunctions and poses a risk, the lack of effective auxiliary verification and collaborative response mechanisms makes it difficult to make accurate judgments, resulting in high authentication error rates, low system security, and low credibility of authentication identification.

[0004] Therefore, there is a need for an integrated authentication system that can integrate multi-dimensional trust evidence, achieve dynamic monitoring throughout the entire lifecycle from access to session, and intelligently mobilize resources from multiple devices for collaborative defense. Summary of the Invention

[0005] This application provides a multi-mobile terminal collaborative storage authentication system and method based on biometric enhancement, aiming to solve the problems of high authentication false judgment rate, low system security, and low authentication and recognition credibility in the prior art.

[0006] In view of the above problems, this application provides a multi-mobile terminal collaborative storage authentication system and method based on biometric enhancement.

[0007] Firstly, this application provides a multi-mobile terminal collaborative storage authentication system based on biometric enhancement, including: The data acquisition module is used to collect registration data from each authorized mobile terminal, and to construct and store an enhanced biometric authentication model, a device fingerprint feature vector library, and a user behavior baseline model based on the registration data. The fusion authentication comparison module is used to obtain the fusion authentication result by comparing the real-time biometric features and real-time device fingerprint feature vector with the pre-stored model when the terminal initiates authentication. If the authentication is successful, an initial trust score is generated based on the device role and matching degree of the terminal that initiated the authentication, and the session is authorized to be established. The trust score correction module is used to dynamically correct the initial trust score during the session based on the deviation between the continuously collected real-time user behavior data and the user behavior baseline model, so as to obtain and update the real-time trust score. The abnormal event determination module is used to trigger anomaly determination based on abnormal changes in the real-time trust score or other security events, and to initiate a multi-machine collaborative review mechanism. Based on the arbitration result of the collaborative review, a security response is executed.

[0008] Secondly, this application provides a multi-mobile terminal collaborative storage authentication method based on biometric enhancement, including: Collect registration data from each authorized mobile terminal, and construct and store an enhanced biometric authentication model, a device fingerprint feature vector library, and a user behavior baseline model based on the registration data; When a terminal initiates authentication, it compares its real-time biometric features and real-time device fingerprint feature vector with a pre-stored model to obtain a fusion authentication result. If the authentication is successful, an initial trust score is generated based on the device role and matching degree of the terminal that initiated the authentication, and authorization is granted to establish a session. During the session, the initial trust score is dynamically adjusted based on the deviation between the continuously collected real-time user behavior data and the user behavior baseline model, and the real-time trust score is obtained and updated. An anomaly determination is triggered based on abnormal changes in the real-time trust score or other security events, and a multi-machine collaborative review mechanism is initiated. Based on the arbitration result of the collaborative review, a security response is executed.

[0009] One or more technical solutions provided in this application have at least the following technical effects or advantages: This application first utilizes environmental interference information to enhance biometric features, addressing the high false rejection rate of traditional biometrics in variable environments. It collects and constructs lightweight hardware device fingerprints and user behavior baseline models, enabling accurate analysis of device authenticity and user operating habits. The biometric and behavioral models are encrypted and stored with the device fingerprint database, improving data security and efficient collaboration. Second, by fusing local biometric comparison with centralized device fingerprint verification, it achieves integrated authentication, reducing the risk of single credential theft. Finally, it introduces an adaptive weight allocation mechanism based on device role and historical matching stability to obtain a quantified initial trust score, providing a scientific quantitative starting point for subsequent dynamic monitoring.

[0010] Furthermore, by continuously comparing real-time behavior with the baseline model, abnormal deviations in user behavior are detected and quantified. Trust scores are then dynamically adjusted based on environmental risk events, achieving proactive authentication defense. Finally, intelligent judgment is made by monitoring trust scores, and algorithms such as particle swarm optimization are used to select the optimal solution for arbitration. This accurately distinguishes between real attacks and false alarms, significantly reducing the false positive rate, ensuring user experience, and improving the system's decision-making accuracy in dealing with complex threats.

[0011] In summary, this approach collectively achieves end-to-end adaptive security enhancement, from strong identity authentication and dynamic trust assessment to intelligent collaborative risk management. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is a schematic diagram of the structure of a multi-mobile terminal collaborative storage authentication system based on biometric enhancement; Figure 2 This is a flowchart illustrating a multi-mobile terminal collaborative storage authentication method based on biometric enhancement.

[0014] The labels in the attached diagram are explained as follows: Data acquisition module 11, fusion authentication comparison module 12, trust score correction module 13, abnormal event judgment module 14. Detailed Implementation

[0015] This application provides a multi-mobile terminal collaborative storage authentication system and method based on biometric enhancement, which is used to address the problems of high authentication false positive rate, low system security, and low authentication reliability in the prior art.

[0016] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0017] It should be noted that the terms "comprising" and "having" are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or modules that are not explicitly listed or that are inherent to these processes, methods, products, or devices.

[0018] Example 1, as Figure 1 As shown, this application provides a multi-mobile terminal collaborative storage authentication system based on biometric enhancement, the system comprising: The data acquisition module 11 is used to collect registration data from each authorized mobile terminal, and to construct and store an enhanced biometric authentication model, a device fingerprint feature vector library, and a user behavior baseline model based on the registration data. In this embodiment, an authorized mobile terminal refers to a mobile device that has been authorized by the user and reviewed by the background and can participate in collaborative authentication within the same trust domain; registration data refers to the raw data collected from each authorized terminal and its user during the system initialization phase; the enhanced biometric authentication model is an optimized user biometric reference template; the device fingerprint feature vector library is a structured database that stores the unique hardware identity of each authorized mobile terminal; and the user behavior baseline model is a description of the user's normal interaction behavior pattern.

[0019] First, a collaborative authentication network is formed using multiple devices. A client runs on each device and completes the registration process, collecting data. Then, environmental information is used to optimize biometric data based on the raw data, constructing an enhanced biometric authentication model resistant to changes in light intensity. The corresponding device fingerprint feature vectors are obtained and fused with user behavior data to form a user behavior baseline model.

[0020] In one embodiment, the data acquisition module 11 is used for: Collect the biometric features of registered users and environmental interference information during the collection process. The biometric features include at least fingerprints and 3D facial features, and the environmental interference information includes at least light intensity and background noise. Collect a lightweight device fingerprint of the authorized mobile terminal, wherein the lightweight device fingerprint includes at least Bluetooth radio frequency subtle features and sensor hardware deviation features; Collect initial behavioral data of the user, which includes at least the operation time interval and the angle at which the user holds the terminal.

[0021] In this embodiment, the biometric features of the registered user and environmental interference information during the collection process are first collected. Biometric features include at least fingerprints and 3D facial features, while environmental interference information includes at least light intensity and background noise. Specifically, a registered user refers to an authorized, legitimate user whose identity information will be recorded and used for subsequent verification; biometric features are unique and measurable physiological characteristics of humans; 3D facial features are obtained by using technologies such as structured light or time-of-flight to acquire depth information of the user's facial surface, forming a three-dimensional point cloud or mesh model; environmental interference information refers to physical parameters in the surrounding environment that may affect the collection quality or the representation of biometric features during biometric collection; light intensity refers to the brightness of the light in the collection environment; and background noise refers to the level of sound interference in the collection environment, which can affect signal clarity.

[0022] When a user's mobile device is included in the authentication system, the system guides the user through the registration process. First, the system uses the mobile device's fingerprint sensor to capture a high-quality fingerprint image. Simultaneously, the system uses the camera to guide the user's movements and captures the user's facial 3D geometric information from different angles. During this process, the system also activates the mobile device's ambient light sensor and microphone to record the light intensity and background noise level at the moment of capture. This data is used as metadata to bind the raw biometric data to the collected data.

[0023] Furthermore, a lightweight device fingerprint of the authorized mobile terminal is collected. The lightweight device fingerprint includes at least Bluetooth radio frequency subtle features and sensor hardware deviation features. Specifically, the lightweight device fingerprint refers to the set of features that can highly identify the device from its hardware; the Bluetooth radio frequency subtle features are the unique signals that the radio frequency front-end of the same model of Bluetooth module can transmit; and the sensor hardware deviation features are the characteristic values ​​of the sensors built into the mobile terminal.

[0024] Specifically, after a user registers their biometrics using an authorized mobile terminal, the device's fingerprint acquisition module is activated. First, the authorized mobile terminal's Bluetooth module enters a special detection mode, measuring the radio frequency response when transmitting specific signal packets to form a digital vector describing the uniqueness of the Bluetooth radio frequency. Next, the authorized mobile terminal's sensors are invoked to collect raw data over a period of time in a static state. Through statistical analysis, sensor hardware deviation characteristics, such as the zero-bias constant of the accelerometer and gyroscope, and the nonlinear coefficients of the sensitivity of each axis, are calculated.

[0025] Finally, initial user behavior data is collected, which includes at least the operation time interval and the holding angle of the terminal. Initial behavior data refers to the patterned operation data exhibited by the user when interacting with the mobile terminal under normal circumstances; the operation time interval refers to the time difference between two consecutive user actions; and the holding angle of the terminal refers to the user's posture angle of the terminal in space when using it.

[0026] Specifically, during the registration phase, users are guided through a simulated daily usage process, while timestamps and sensor data are continuously recorded in the background. Data analysis is used to calculate typical user operation intervals. Gyroscope data is processed to calculate typical grip angles. All data is then integrated to form quantified behavioral characteristic descriptors.

[0027] In one embodiment, the data acquisition module 11 is further configured to: The enhanced biometric authentication model is constructed by using the environmental interference information to enhance the biometric features. Robust features are extracted from the lightweight device fingerprint to generate a device fingerprint feature vector that is bound to the device identity, forming a device fingerprint feature vector library; The initial behavioral data is modeled to form the user behavior baseline model; The enhanced biometric authentication model and the user behavior baseline model are encrypted and stored locally on each mobile terminal, and the device fingerprint feature vector library is encrypted and stored in the storage device's main control MCU.

[0028] In this embodiment, environmental interference information is first used to enhance the biometric features, constructing an enhanced biometric authentication model. Environmental interference information refers to data collected synchronously with the biometric features, describing the environmental conditions at which the features were acquired, primarily including light intensity and background noise. Enhancement processing utilizes this environmental information to guide the biometric recognition algorithm, maintaining or improving recognition performance under various environmental conditions. The enhanced biometric authentication model is a feature set containing multiple sets of environmental adaptation parameters, ensuring high-precision authentication under different conditions.

[0029] Specifically, by utilizing environmental interference information acquired synchronously during data collection, the original features are preprocessed and normalized to extract facial geometric and texture features. Acoustic signal features generated by a normal living body in a quiet environment with background noise are recorded as a baseline for user behavior, so as to better distinguish non-living signals generated in noisy environments or by playing recorded videos.

[0030] Secondly, robust features are extracted from lightweight device fingerprints to generate device fingerprint feature vectors that are bound to the device identity, forming a device fingerprint feature vector library. Lightweight device fingerprints are raw, subtle feature data collected from the device hardware; robust features refer to stable components extracted from the raw sensor signals that characterize the hardware's essence and resist environmental fluctuations and time drift.

[0031] Specifically, statistical analysis is performed on the raw Bluetooth signal to extract the median of the statistical distribution of features such as carrier frequency offset as robust features. For sensor data, long-term sampling is conducted while the device is stationary to eliminate short-term noise and calculate the inherent hardware deviation characteristics of the sensor. Several selected robust feature values ​​are then combined sequentially to generate a fingerprint feature vector. Finally, this vector is associated with the device to form a device fingerprint feature vector library.

[0032] Furthermore, the initial behavioral data is modeled to form a user behavior baseline model. This baseline model consists of a parameter threshold range or a multidimensional normal distribution, serving as a benchmark for judging whether subsequent real-time operations are abnormal.

[0033] Specifically, the data is first cleaned and preprocessed. Then, the statistical characteristics of the operation time interval are calculated. Similarly, the mean and standard deviation are calculated for the holding angle. Next, assuming the behavioral characteristics follow a normal distribution, a two-dimensional baseline model is formed. During the session, the system continuously compares the user's real-time behavior with the user behavior baseline model, calculates the behavioral deviation, and dynamically adjusts the trust score to achieve continuous identity credibility assessment and risk perception.

[0034] Finally, the enhanced biometric authentication model and user behavior baseline model are encrypted and stored locally on each mobile terminal, and the device fingerprint feature vector library is encrypted and stored in the storage device's main control MCU. Here, encrypted storage refers to the process of encrypting the data using cryptographic algorithms before writing it to the storage medium; locally on each mobile terminal refers to the data being physically stored in the secure area of ​​each mobile device's own non-volatile memory; and the storage device's main control MCU refers to a trusted central control unit.

[0035] In this embodiment, multi-dimensional comprehensive collection of biometric features, environmental information, device hardware fingerprints, and initial behavioral data is used to obtain raw data with multiple credentials, providing key input for the subsequent construction of an enhanced model resistant to environmental interference. Secondly, model construction and hierarchical storage achieve an optimal balance between security and efficiency. The biometric authentication model and user behavior baseline model are encrypted and stored locally on each mobile terminal to protect privacy and eliminate the risk of biometric authentication model leakage. The globally compared device fingerprint feature vector library is centrally encrypted and stored in the main control MCU to ensure consistency in device authentication and facilitate efficient centralized management and cross-device collaboration.

[0036] The fusion authentication comparison module 12 is used to obtain the fusion authentication result by comparing the real-time biometric features and real-time device fingerprint feature vector with the pre-stored model when the terminal initiates authentication; if the authentication is successful, an initial trust score is generated based on the device role and matching degree of the terminal initiating authentication, and the session is authorized to be established. In this embodiment, the fusion authentication result is an authentication decision that combines at least two independent factors; the device role is a weighted identifier assigned based on factors such as device type and security level; and the initial trust score is an initial credit score generated for the session.

[0037] Specifically, when a user triggers an authentication request, the user's fingerprint is collected in the local secure environment and compared with a locally stored enhanced biometric authentication model to generate a real-time device fingerprint feature vector. Historical data is extracted from the device fingerprint feature vector library, and the matching degree between the two is calculated. Based on the matching degree, a fusion authentication result is derived, generating an initial trust score. Based on this score and the successful authentication result, authorization is granted to establish a session.

[0038] In one embodiment, the fusion authentication comparison module 12 is used for: The terminal initiating authentication compares its real-time biometrics with the enhanced biometric authentication model locally to obtain a first comparison result; The terminal that initiates the authentication generates the real-time device fingerprint feature vector and sends it to the main control MCU. The main control MCU calculates the matching degree between the real-time device fingerprint feature vector and the pre-stored device fingerprint feature vector. When the first comparison result is successful and the matching degree is higher than the preset threshold, a credible fusion authentication result is obtained.

[0039] In this embodiment, the terminal initiating authentication first compares its real-time biometrics with the enhanced biometric authentication model locally to obtain a first comparison result. The real-time biometrics are user biometric data collected and preprocessed by the terminal's sensors in real-time when the authentication request is initiated; the first comparison result is a preliminary conclusion drawn from this local biometric comparison.

[0040] The system collects the user's current real-time biometric features, and then the operating system calls the enhanced biometric authentication model stored in the local secure area to calculate the real-time collected data with the model and obtain the first comparison result.

[0041] Secondly, the terminal initiating the authentication generates a real-time device fingerprint feature vector and sends it to the main control MCU. The main control MCU calculates the matching degree between the real-time device fingerprint feature vector and the pre-stored device fingerprint feature vector. The main control MCU is the central control unit, responsible for coordinating multiple devices, storing global information, and performing arbitration.

[0042] After obtaining the first comparison result, the device fingerprint acquisition module is activated to scan the Bluetooth chip status and sensor readings. Using the same feature extraction algorithm as during registration, a real-time device fingerprint feature vector is generated. Subsequently, the corresponding pre-stored device fingerprint feature vector is located and retrieved from the secure storage area. Next, the main control MCU runs a distance metric algorithm to calculate the matching degree between the two vectors.

[0043] For example, the cosine similarity algorithm is used to calculate the matching degree between the real-time device fingerprint feature vector and the pre-stored device fingerprint feature vector. Let the real-time device fingerprint feature vector be A=(a1,a2,a3,a4) and the pre-stored device fingerprint feature vector be B=(b1,b2,b3,b4). First, the dot product A of the two vectors is calculated. B=a1 b1+a2 b2+a3 b3+a4 b4, then calculate the magnitudes of the two vectors |A| and |B| respectively. Finally, according to the cosine similarity calculation formula, the ratio of the dot product of the two vectors to the product of their magnitudes is used as the matching degree, for example, the matching degree is 45%.

[0044] Finally, when the first comparison result is successful and the matching degree is higher than the preset threshold, a trusted fusion authentication result is obtained. The preset threshold is a pre-configured numerical limit used to determine whether the matching degree is high enough to consider the device identity trustworthy; the fusion authentication result is an authentication decision that combines the biometric authentication result and the device fingerprint verification result.

[0045] Specifically, the process begins with obtaining the initial comparison result, followed by a matching degree calculation result from the main control MCU. This matching degree is then compared to a preset threshold. The final fusion authentication result is considered "trustworthy and passed" if both conditions are met: a successful initial comparison result and a matching degree exceeding the preset threshold. If either condition is not met, the fusion authentication result is "trustworthy and failed."

[0046] For example, the preset threshold can be configured by administrators. If the matching degree is greater than the preset threshold and the first comparison result is successful, the fusion authentication result is considered trustworthy and passes. If the first comparison result is successful, but the matching degree is less than or equal to the preset threshold, the fusion authentication result is considered unsuccessful. For example, if the preset threshold is set to 70% and the matching degree is 45%, 45% < 70%, therefore the fusion authentication result is considered trustworthy and fails.

[0047] In one embodiment, the fusion authentication comparison module 12 is further configured to: The device role of the authenticated terminal is determined, and the historical matching sequence of the terminal that initiated the authentication, which consists of multiple device fingerprint matching scores generated in the historical authentication process, is retrieved. Calculating the historical matching stability coefficient of the authentication-initiating terminal based on the historical matching degree sequence includes: calculating the coefficient of variation of the historical matching degree sequence, and mapping the historical matching stability coefficient based on the coefficient of variation, wherein the historical matching stability coefficient is inversely proportional to the coefficient of variation; Based on the device role and the historical matching stability coefficient, the trusted weight of the device fingerprint matching degree in this authentication is dynamically determined through a preset adaptive weight allocation rule. Based on the basic weight assigned to the device role and the weighted device fingerprint matching degree, the initial trust score is calculated and generated through a score synthesis function, which serves as the initial value of the real-time trust score.

[0048] In this embodiment, the device role of the authenticated terminal is determined, and a historical matching degree sequence consisting of multiple device fingerprint matching degrees generated by the terminal initiating the authentication in historical authentication is retrieved. Here, historical authentication refers to all past authentication records successfully initiated and verified by the same terminal before the current authentication event; the historical matching degree sequence is the device fingerprint matching degree value calculated and recorded by the main control MCU in each historical authentication.

[0049] Specifically, after the fusion authentication result is deemed trustworthy, the process proceeds to generate an initial trust score. First, the main control MCU needs to obtain the device role and simultaneously retrieve the authentication history of the authentication terminal. From the main control MCU's log database, it finds the device fingerprint matching degree corresponding to the authentication terminal's past successful authentications, and arranges them in reverse chronological order to form a historical matching degree sequence, reflecting the authentication performance of the terminal's hardware fingerprint over a period of time.

[0050] Secondly, the historical matching stability coefficient of the terminal initiating authentication is calculated based on the historical matching degree sequence. This includes calculating the coefficient of variation of the historical matching degree sequence and mapping the historical matching stability coefficient based on the coefficient of variation. The historical matching stability coefficient is inversely proportional to the coefficient of variation. The historical matching stability coefficient measures the degree of fluctuation or consistency of the device fingerprint matching degree in historical authentication; the coefficient of variation is the ratio of the standard deviation to the mean, used to measure the dispersion of a set of data.

[0051] Specifically, the standard deviation and mean of the obtained historical matching degree sequence are calculated, and the ratio of the standard deviation to the mean is used as the coefficient of variation of the historical matching degree sequence. Then, the historical matching stability coefficient is obtained through a coefficient of variation mapping. A mapping is then performed based on the inverse relationship between the historical matching stability coefficient and the coefficient of variation.

[0052] For example, the ratio of the average value to the coefficient of variation of the historical matching sequence is used as the historical matching stability coefficient, with a value ranging from 0 to 1. A higher value indicates greater stability. Specifically, a smaller coefficient of variation indicates a more stable sequence, and a larger historical matching stability coefficient. Assume that after mapping, the historical matching stability coefficient is 0.85.

[0053] Furthermore, based on the device role and historical matching stability coefficient, the trusted weight of the device fingerprint matching degree in this authentication is dynamically determined through a preset adaptive weight allocation rule. The adaptive weight allocation rule is a predefined, dynamically adjustable mathematical or logical rule.

[0054] Specifically, the device role and historical matching stability coefficient are input into the preset adaptive weight allocation rule, and the weight value is calculated in real time according to the specific context of the authentication each time.

[0055] For example, if the historical matching stability coefficient is 0.85, then the confidence weight value is 0.72.

[0056] Finally, based on the base weights assigned to the device role and the weighted device fingerprint matching degree, an initial trust score is calculated using a score synthesis function, serving as the initial value for the real-time trust score. Here, the base weights assigned to the device role refer to the fixed weights associated with the device role and allocated to factors other than the device fingerprint matching degree in the trust score synthesis; the weighted device fingerprint matching degree is the numerical value of the device fingerprint matching degree obtained during authentication; and the score synthesis function is a synthesis function similar to a weighted sum / product model.

[0057] Specifically, the basic weight of the device role is first obtained based on the device type, then the weighted value of the device fingerprint matching degree is calculated based on the adaptive weight, and finally the two input scores are combined into a function.

[0058] For example, the weighted sum function can be: Initial Trust Score = [Basic Weight of Device Role × Device Fingerprint Matching Degree + Trusted Weight Value × Device Fingerprint Matching Degree] × 100. Substituting the basic weight of the device role, the trusted weight value, and the device fingerprint matching degree into the weighted sum function, we get the initial trust score = [0.6 × 0.45 + 0.72 × 0.45] × 100 = 58.4 points.

[0059] Among them, the trusted weight of the device fingerprint matching degree in this authentication is dynamically determined through a preset adaptive weight allocation rule, including: Define the basic value vector W of device role weight, and the threshold X of historical matching stability coefficient; When the historical matching stability coefficient S is less than or equal to the threshold X, the device is determined to be stable, and the current trusted weight W1 = W α, where α is a stability reward factor greater than 1; When the historical matching stability coefficient S is greater than the threshold X, it is determined that the device status is fluctuating, and the current confidence weight W1 = W β (X / S), where β is a volatility penalty factor less than 1.

[0060] In this embodiment, a basic value vector W for device role weights and a threshold X for historical matching stability coefficients are first defined. The threshold X for historical matching stability coefficients is a preset critical value used to distinguish between stable and fluctuating historical performance of a device.

[0061] Specifically, define all device roles and their corresponding base value vector W. For example, assume all device roles include: primary device, secondary device, and wearable device. According to the security policy, the primary device is the most critical and is assigned the highest base weight.

[0062] For example, a vector W = [0.6, 0.3, 0.1] is defined, where the weight of the primary device is 0.6, the weight of the auxiliary device is 0.3, the weight of the wearable device is 0.1, and the threshold X for the historical matching stability coefficient is set to 0.9.

[0063] Secondly, when the historical matching stability coefficient S is less than or equal to the threshold X, the device is considered to be in a stable state, and the current trusted weight W1 = W α, where α is a stability reward factor greater than 1. The stability reward factor α is a preset constant multiplier greater than 1. When a device is determined to be stable, the stability reward factor is used to reward the matching result, increasing the initial trust level.

[0064] For example, if the stability reward factor α is set to 1.2, and the historical matching stability coefficient S = 0.85 < 0.9, then the device is considered to be in a stable state, and the confidence weight W1 = 0.6 × 1.2 = 0.72.

[0065] Finally, when the historical matching stability coefficient S is greater than the threshold X, the device state is determined to be fluctuating, and the current trust weight W1 = W β (X / S), where β is a fluctuation penalty factor less than 1. The fluctuation penalty factor β is a preset constant multiplier less than 1. When a device is judged to be fluctuating, the system should impose a penalty on its current matching result, reducing the initial trust level.

[0066] For example, if the stability reward factor β is set to 0.8, and the historical matching stability coefficient S = 0.95 < 0.9, then the device status is determined to be fluctuating, and the credible weight W1 = 0.95 × 0.8 × (0.9 / 0.95) = 0.72.

[0067] In this embodiment, an authentication logic that integrates local biometric verification and device fingerprint set verification is first employed. Biometrics are compared locally at the initiating terminal, while device fingerprints are centrally compared by the main control MCU. This protects privacy and enables rapid authentication and identification, while ensuring the authenticity of the device identity. Subsequently, the stability coefficient of the device's historical matching sequence is calculated, and the trust weight of the current device fingerprint matching is dynamically determined by combining the device's role. Finally, an initial trust score generated through a score synthesis function yields a comprehensive quantitative index that integrates real-time authentication strength, historical device reliability, and device type strategy, providing scientific data support for dynamic security management of sessions.

[0068] Trust score correction module 13 is used to dynamically correct the initial trust score based on the deviation between the continuously collected real-time user behavior data and the user behavior baseline model during the session, so as to obtain and update the real-time trust score. In this embodiment, the session duration is the entire time period from the start of the session until the user actively exits or the system forcibly terminates the session; real-time behavioral data is user operation data continuously collected from the terminal initiating authentication, and its type corresponds to the initial behavioral data at the time of registration; behavioral deviation is a measure of the degree of difference between the real-time behavioral data and the user behavior baseline model. The real-time trust score is a score reflecting the real-time trustworthiness of the current session, obtained after continuous adjustment of the initial trust score.

[0069] After successful access to the encrypted photo album, the underlying modules of the operating system continuously collect real-time user behavior data, including the timestamp sequence of the click and the current device holding angle, and upload it in real time or store it locally to the security module. The real-time behavior data is quickly compared with a pre-stored user behavior baseline model to calculate the behavior deviation value, and the trust score is adjusted according to the behavior's consistency with user habits.

[0070] In one embodiment, the trust score correction module 13 is used for: During the session, the main control MCU continuously receives real-time behavioral data reported by the terminal that initiated the authentication; The real-time behavior data is compared with the user behavior baseline model to calculate the real-time behavior deviation. Based on the current real-time trust score, a score correction amount is calculated according to the magnitude and direction of the behavioral deviation and whether a preset environmental risk event has occurred; The real-time trust score is updated based on the score correction amount.

[0071] In this embodiment, during the session, the main control MCU continuously receives real-time behavioral data reported by the terminal initiating authentication. The session period refers to the entire time interval from the start of authorized session establishment to the point where the session is actively terminated by the user or forcibly ended by the system.

[0072] Specifically, after a user successfully completes the fusion authentication, the system authorizes and establishes a session, allowing the user access. From the start of the session, the user's authorized device is used as the authentication initiating terminal, activating the operating system's underlying behavior monitoring module to collect the user's real-time behavior data. The timestamps of screen touches are recorded to calculate the operation interval; simultaneously, the inertial measurement unit calculates the phone's holding angle in real time. After encapsulating the data, it is periodically reported to the system's main control MCU, or when significant behavioral events are detected. The main control MCU's communication module continuously receives data packets from the authentication initiating terminal.

[0073] Secondly, the real-time behavior data is compared with the user behavior baseline model to calculate the real-time behavior deviation. Specifically, after receiving the real-time behavior data from the terminal initiating authentication, the main control MCU immediately starts the analysis engine, calls the established user behavior baseline model, and calculates the comprehensive real-time behavior deviation value.

[0074] For example, the calculation steps for behavioral deviation are as follows: First, the raw real-time behavioral data reported by the terminal is preprocessed and features are extracted, transforming it into a computable feature vector. Next, the user's historical behavioral baseline model is combined, and the real-time features are compared with the behavioral baseline model. Then, the behavioral deviation of a single dimension is calculated for each feature; the behavioral deviation is the ratio of the absolute value of the difference between the real-time feature value and the corresponding historical behavioral baseline value to the historical behavioral baseline value. Finally, the behavioral deviation is obtained through weighted summation, and all single-feature deviations are merged into a single real-time behavioral deviation value. The magnitude and direction of this value will serve as key inputs for subsequent calculations of the trust score correction. The weights in the weighted summation process depend on the degree of influence of each dimension of behavioral features on the behavioral deviation.

[0075] Assuming the weights of the operation interval and the phone holding angle are w1 and w2 respectively, the behavior deviation is calculated as: (|Real-time operation interval - Historical operation interval behavior baseline| / Historical operation interval behavior baseline) × w1 + (|Real-time phone holding angle - Historical phone holding angle behavior baseline| / Historical phone holding angle behavior baseline) × w2. Assuming that for a user's real-time behavior data: {operation interval, holding angle}, calculated based on the user behavior baseline model, the behavior deviation value is 0.25, and the direction is negative.

[0076] Secondly, based on the current real-time trust score, a score correction amount is calculated according to the magnitude and direction of behavioral deviation and whether a preset environmental risk event has occurred. The preset environmental risk event refers to a contextual event predefined in the system policy that is independent of user behavior but significantly increases security risk; the score correction amount is the extent to which the current real-time trust score should be adjusted based on the current risk assessment.

[0077] For example, based on the current real-time trust score, a preset correction rule is applied to calculate the score correction amount. Corresponding trust score values ​​are set for the occurrence of preset environmental risk events. Specifically, the trust score values ​​are 20 for high risk, 15 for medium risk, and 10 for low risk. If a risk event occurs, the corresponding value is deducted from the current real-time trust score; if it does not occur, no deduction is made. Based on the direction of behavioral deviation—increasing or decreasing deviation—the value is multiplied by the current real-time trust score to obtain the behavioral deviation score correction value. Finally, the environmental risk events are summed to obtain the score correction amount.

[0078] For example, if the environmental risk event is low-risk, the score correction is the product of the behavioral deviation and the current real-time trust score, plus the score correction value for the environmental risk event. Score correction value = Behavioral deviation × Current real-time trust score + Score correction value for the environmental risk event. The behavioral deviation is in the opposite direction to the current real-time trust score, i.e., score correction value = -0.25 × 58.4 - 10 = -24.6 points.

[0079] Finally, the real-time trust score is updated based on the score correction amount. Specifically, the score correction amount is added to the current real-time trust score to obtain the updated real-time trust score: Updated Real-Time Trust Score = Current Real-Time Trust Score + Score Correction Amount.

[0080] For example, the updated real-time trust score is 58.4 - 24.6 = 33.8.

[0081] In this embodiment, by receiving real-time behavioral data from the main control MCU during the session, comparing it with the user behavior baseline model, calculating the behavioral deviation, and dynamically updating the real-time trust score accordingly, it can effectively defend against post-authentication attacks. Furthermore, by using the behavioral anomaly score, the assessment of security risks becomes more intuitive. It can be combined with preset environmental risk events for comprehensive judgment, achieving accurate and flexible risk response, and providing a quantitative basis for higher-level collaborative review.

[0082] The abnormal event determination module 14 is used to trigger an abnormal determination based on the abnormal change of the real-time trust score or other security events, and to start a multi-machine collaborative review mechanism, and execute a security response based on the arbitration result of the collaborative review.

[0083] In this embodiment, other security events are risk signals other than changes in trust scores; anomaly determination is a decision-making process that automatically judges the security risk of the current session according to preset rules; the multi-machine collaborative review mechanism is a process in which, when a session on a single terminal is determined to be abnormal, one or more other authorized mobile terminals in the same trust domain are mobilized to independently investigate and verify the anomaly using their respective environmental awareness and authentication capabilities; the arbitration result is the final conclusion drawn after logical judgment based on the evidence from the terminal that initiated the anomaly determination by the main control MCU, as well as the evidence from other collaborative review terminals.

[0084] Specifically, if an abnormal behavior pattern is detected and the real-time trust score drops beyond a preset threshold, an anomaly assessment is triggered. A multi-device collaborative review mechanism is then activated: based on the device's role and trustworthiness, the most suitable review terminal is automatically selected from other devices, a review request is sent, current ambient sound is collected, wearing status is detected, and arbitration is conducted by considering both behavioral deviations and the user's normal status.

[0085] In one embodiment, the abnormal event determination module 14 is used for: Continuously monitor the changes in the real-time trust score; When the real-time trust score drops by more than a preset drop threshold within a unit of time, an anomaly determination is triggered, and an anomaly determination result is obtained. The anomaly determination result includes the anomaly type and the context data at the time of the anomaly. The main control MCU locks the session whose anomaly determination result is abnormal, and selects the verification terminal based on the credibility of the pre-stored device fingerprint feature vector of other authorized mobile terminals other than the terminal that initiated the authentication and the device role; the credibility of the pre-stored device fingerprint feature vector is proportional to the average value of the historical matching degree sequence of the corresponding authorized mobile terminal and the historical matching stability coefficient; Send a review request containing the exception type to the selected review terminal, and receive auxiliary verification evidence returned by the review terminal; The main control MCU integrates the anomaly judgment result, the credibility of the pre-stored device fingerprint feature vector, and auxiliary verification evidence to obtain the arbitration result, which includes attacks and false alarms. A security response is executed based on the arbitration result, and the security response includes at least terminating the session and issuing an alert, and restoring the session.

[0086] In this embodiment, the changes in the real-time trust score are first continuously monitored. Continuous monitoring refers to the process by which the system, in the background, uninterruptedly reads and records the values ​​of specific variables at constant time intervals or in a near-real-time manner.

[0087] Specifically, after authentication and session establishment using the device, the main control MCU is responsible for continuously monitoring the session. The main control MCU has an internal monitoring daemon that reads the trust score associated with the session at regular intervals and compares it with previously recorded historical values.

[0088] For example, the recorded score sequence over a consecutive 10 seconds could be: [58.4, 45, 45, 45, 45...], in points.

[0089] Secondly, when the real-time trust score decreases by more than a preset drop threshold within a unit of time, an anomaly detection is triggered, and an anomaly detection result is obtained. The anomaly detection result includes the anomaly type and context data at the time of the anomaly. Here, the unit of time is a preset time window length used to calculate the rate of score change; the drop magnitude is the amount by which the real-time trust score decreases within a specified unit of time; and the preset drop threshold is a pre-configured value representing the maximum allowable decrease in the trust score within a unit of time.

[0090] Specifically, the main control MCU detects a decrease in the device's trust score within a 10-second timeframe. If the decrease exceeds a preset threshold, the condition is met, and an anomaly detection is immediately triggered. Upon triggering, the system executes the anomaly detection logic and obtains a structured anomaly detection result. This result includes at least: anomaly type and context data. Anomaly types include low device fingerprint matching and a sudden drop in real-time trust score; context data captures and encapsulates detailed data at the moment of the anomaly, including the time of occurrence, the associated terminal device ID, and the network environment at the time.

[0091] Furthermore, the main control MCU locks the session whose anomaly determination result is abnormal, and selects a verification terminal based on the pre-stored device fingerprint feature vector credibility and device role of other authorized mobile terminals besides the terminal that initiated the authentication. Here, locking refers to an immediate control measure taken by the main control MCU for sessions determined to be abnormal; other authorized mobile terminals refer to other legitimate devices that have completed registration and are currently online within the same trust domain, excluding the currently abnormal device; the pre-stored device fingerprint feature vector credibility is a comprehensive score calculated for each authorized terminal, representing the reliability of the terminal's hardware identity; selecting a verification terminal means that the main control MCU selects one or more other available authorized terminals to participate in the independent investigation and verification of the abnormal event.

[0092] Specifically, upon triggering an anomaly detection, the main control MCU immediately performs a locking operation, placing the session of the primary device in a locked-awaiting-review state and suspending its access permissions. Next, the main control MCU needs to select the terminal to be reviewed. First, it lists all other currently online and available devices under the account, excluding the primary device. Then, it reviews the profile of each device and calculates or reads its pre-stored device fingerprint feature vector confidence level.

[0093] Furthermore, the reliability of the pre-stored device fingerprint feature vector is proportional to the average value of the historical matching degree sequence of the corresponding authorized mobile terminal and the historical matching stability coefficient. The average value of the historical matching degree sequence refers to the arithmetic mean of the matching degrees obtained by comparing the real-time device fingerprint feature vector with the pre-stored device fingerprint feature vector in multiple past authentications. The historical matching stability coefficient is a statistic calculated based on the aforementioned historical matching degree sequence, used to measure the fluctuation or dispersion of the sequence.

[0094] Specifically, credibility and device role are considered comprehensively. Devices with higher device role weight can provide more accurate evidence, and the testimony of devices with high credibility is generally more reliable; therefore, the device with the highest credibility is selected as the verification terminal for this case. Credibility is determined by two factors: the average value of the historical matching sequence and the historical matching stability coefficient, and is directly proportional to both. A higher average value of the historical matching sequence indicates that the device fingerprint usually matches very well; a higher historical matching stability coefficient indicates less fluctuation in matching accuracy and a more stable device status.

[0095] For example, the device role corresponding to the highest confidence level calculated by a certain device is the verification terminal.

[0096] Furthermore, a verification request containing the anomaly type is sent to the selected verification terminal, and auxiliary verification evidence is received from the verification terminal. The auxiliary verification evidence consists of verification results returned by other selected trusted terminals based on the verification request; the environmental consistency evidence consists of on-site environmental audio and geographic location information collected by the verification terminal, used for cross-comparison with the environment at the time of the anomaly.

[0097] Specifically, after selecting a verification terminal, a verification request message is immediately constructed. Subsequently, the request is sent to and received from the verification terminal via an encrypted channel. Depending on the request type, the verification terminal initiates the corresponding evidence collection process, summarizes the collected information, generates auxiliary verification evidence, integrates it, and returns this evidence to the main control MCU.

[0098] Furthermore, the arbitration result is obtained by combining the main control MCU's anomaly judgment result, the credibility of the pre-stored device fingerprint feature vector, and auxiliary verification evidence. The arbitration result includes both attacks and false alarms. A weighted fusion analysis is then performed on the above evidence. The arbitration result is the final judgment generated after the comprehensive analysis process.

[0099] Specifically, based on the anomaly determination results, the credibility of the pre-stored device fingerprint feature vector, and auxiliary verification evidence, the main control MCU begins a comprehensive analysis.

[0100] For example, a device with a historically high stability coefficient will have a higher weight in the submitted device fingerprint evidence. If multiple verification terminals with high credibility of pre-stored device fingerprint feature vectors consistently return auxiliary evidence that no anomalies were found, it may overturn an anomaly alarm triggered by a single, low-credibility device. For instance, the device terminal may exhibit highly abnormal behavior, but the verification terminal may show that the user's physiological state and environment are completely normal. If the device terminal and the verification terminal mutually verify that the device is lost, the arbitration result of the comprehensive judgment is a false alarm.

[0101] Finally, a security response is executed based on the arbitration result. This security response includes at least terminating the session and issuing an alert, and restoring the session. Specifically, executing the security response involves implementing a set of specific operational instructions to eliminate the threat or restore normal service based on the arbitration conclusion; terminating the session and issuing an alert is the most severe response taken when the arbitration result indicates an attack; and restoring the session is the response taken when the arbitration result indicates a false alarm, which involves unlocking the abnormal session and restoring its normal access permissions.

[0102] Specifically, based on the arbitration result obtained by the main control MCU, the corresponding security response is executed. If the arbitration result indicates an attack, the session termination operation is immediately performed, forcibly ending the device terminal's session, clearing the server-side session state, and simultaneously performing an alarm operation and sending alarm information. If the arbitration result indicates a false alarm, the session recovery operation is performed, the main control MCU unlocks the session, and sends a command to the device terminal allowing it to continue access. Simultaneously, the session's real-time trust score may be increased, and monitoring continues.

[0103] Specifically, based on the credibility of the pre-stored device fingerprint feature vectors and device roles of authorized mobile terminals other than the terminal initiating authentication, the verification terminal is selected, including: Obtain all other authorized mobile terminals that are currently online and available, and construct a set of terminals to be filtered; Based on the terminal set, a particle swarm is initialized, where the position vector of each particle represents a terminal selection combination. The fitness function value of the particle is proportional to the credibility of the pre-stored device fingerprint feature vector of each terminal in the terminal selection combination and its device role weight. By iteratively updating the position vectors of the particles, the particle swarm searches for regions with higher fitness until the convergence condition is met. The terminal selection combination represented by the particle with the highest fitness during the iteration process is determined as the core terminal.

[0104] In this embodiment, all currently online and available authorized mobile terminals are first acquired and constructed as a set of terminals to be screened. This set of terminals is a candidate terminal list formed after conditional filtering and construction. The problem of selecting the optimal verification terminal is modeled as a combinatorial optimization problem of finding the globally optimal solution within the terminal set, ensuring the feasibility and efficiency of the verification terminal selection process.

[0105] Secondly, based on the terminal set, a particle swarm is initialized, where the position vector of each particle represents a terminal selection combination. The fitness function value of a particle is proportional to the credibility of the pre-stored device fingerprint feature vector and the device role weight of each terminal within the terminal selection combination. Initialization is the process of randomly generating or assigning an initial position vector to each particle in the particle swarm according to certain rules before the algorithm begins iteration. The particle swarm is a swarm intelligence optimization algorithm that simulates the social behavior of flocks of birds or schools of fish; each particle represents a potential solution to the problem. The position vector is a mathematical vector whose dimension or the value of each component directly encodes the solution to the problem. The terminal selection combination is a subset consisting of one or more terminals, representing possible solutions selected from the terminal set to be screened.

[0106] Specifically, n terminals are selected from the currently available terminal set as core terminals. A particle swarm containing M particles is initialized. The position vector of each particle is an n-dimensional vector, representing the selection result of the core terminals. At the same time, the sum of the products of the credibility and role weight of all selected terminals in the combination is calculated according to the fitness function, and the fitness of each core terminal, i.e., particle, is calculated. That is, for M randomly generated particles, their initial fitness is calculated.

[0107] Next, by iteratively updating the particle position vectors, the particle swarm is guided to search for regions with higher fitness until the convergence condition is met. The search for higher fitness regions involves sharing information among particles, guiding the entire swarm to gradually abandon low-fitness solutions and collectively gather and explore potentially better terminal combinations. The convergence condition is a pre-defined algorithm termination criterion.

[0108] Specifically, the algorithm iterates starting with M randomly selected particles. After the first iteration, the fitness of all particles is calculated. The position of the particle with the highest fitness is recorded as the current global best position. At the start of the second iteration, the new velocity of each particle is calculated, and the new position drives the particles to maintain a certain exploration inertia, memorizing historically better positions while learning from the best position found by the group. Since the current global best position has high fitness, under the pull of the social coefficient, more and more particles will move their position vectors towards the direction of the current global best position. After several iterations, the particles gather in the optimized region.

[0109] For example, suppose that after the 15th iteration, the global optimal fitness remains stable for the next 5 iterations without reaching a higher value. At this point, the convergence condition is satisfied, the iteration stops, and the maximum fitness is obtained.

[0110] Ultimately, the terminal selection combination represented by the particle with the highest fitness during the iteration process is determined as the verification terminal. Specifically, after the algorithm stops meeting the convergence condition, the corresponding globally optimal particle position remains stable. This particle is taken as the particle with the highest fitness during the iteration process, and the terminal selection combination represented by the particle with the highest fitness is determined as the verification terminal to be initiated for this abnormal event. Subsequently, the main control MCU will send a verification request based on this decision.

[0111] For example, if the algorithm converges and the global optimal fitness is 1.2, the terminal selection combination represented by the global optimal particle is determined as the verification terminal to be initiated for this abnormal event.

[0112] In this embodiment, when a sudden drop in the real-time trust score of a single-device session triggers an anomaly, the main control MCU locks the session and initiates multi-device verification. Based on the trustworthiness of the pre-stored device fingerprint feature vectors and the device roles of other online terminals, the most suitable verification terminal is selected, and a verification request containing the anomaly type is sent to it. The MCU also receives the auxiliary verification evidence returned by the terminal. All information is then integrated for arbitration to distinguish between attacks and false alarms, and either alarm termination or session recovery is executed. This reduces misjudgments caused by false alarms from single-device sensors or accidental abnormal user behavior. It ensures more reliable arbitration in complex multi-device environments, curbing real attacks while avoiding interference with legitimate users.

[0113] The embodiments of this application, through the above specific implementation methods, achieve the following technical effects: In this embodiment, the data acquisition module 11 first obtains raw data with multiple credentials through multi-dimensional comprehensive acquisition of biometric features, environmental information, device hardware fingerprints, and initial behavioral data, providing key input for the subsequent construction of an enhanced model resistant to environmental interference. Secondly, model construction and hierarchical storage are performed, achieving an optimal balance between security and efficiency. The biometric model and behavioral baseline model are encrypted and stored locally on each mobile terminal to protect privacy and eliminate the risk of biometric authentication model leakage. The globally compared device fingerprint feature vector library is centrally encrypted and stored in the main control MCU to ensure the consistency of device authentication and facilitate efficient centralized management and cross-device collaboration.

[0114] Secondly, through the fusion authentication comparison module 12, an authentication logic that integrates local biometric verification and device fingerprint set verification is implemented. Biometrics are compared locally at the initiating terminal, while device fingerprints are centrally compared by the main control MCU, protecting privacy and enabling rapid authentication and identification responses while ensuring the authenticity of the device identity. Subsequently, the stability coefficient of the device is calculated by retrieving its historical matching degree sequence, and the trust weight of the current device fingerprint matching degree is dynamically determined in conjunction with the device role. Finally, an initial trust score generated by a score synthesis function yields a comprehensive quantitative index that integrates real-time authentication strength, historical device reliability, and device type strategy, providing scientific data support for dynamic security management of sessions.

[0115] Furthermore, the trust score correction module 13 uses real-time behavioral data received by the main control MCU during the session, compares it with the user behavior baseline model, calculates the behavioral deviation, and dynamically updates the real-time trust score accordingly. This effectively defends against post-authentication attacks. In addition, the abnormal behavior score makes the assessment of security risks more intuitive. It can be combined with preset environmental risk events to make a comprehensive judgment, achieve accurate and flexible risk response, and provide a quantitative basis for higher-level collaborative review.

[0116] Finally, through the anomaly event determination module 14, when a sudden drop in the real-time trust score of a single-device session triggers an anomaly, the main control MCU locks the session and initiates multi-machine verification. Based on the trustworthiness of the pre-stored device fingerprint feature vectors and the device roles of other online terminals, the most suitable verification terminal is selected, a verification request containing the anomaly type is sent to it, and the auxiliary verification evidence returned by it is received. All information is then integrated for arbitration to distinguish between attacks and false alarms, and either alarm termination or session recovery is executed. This reduces misjudgments caused by false alarms from single-device sensors or accidental abnormal user behavior. It ensures more reliable arbitration in complex multi-device environments, curbing real attacks while avoiding interference with legitimate users.

[0117] Example 2, as Figure 2 As shown, this application provides a multi-mobile terminal collaborative storage authentication method based on biometric enhancement, the method comprising: S100: Collect registration data from each authorized mobile terminal, and construct and store an enhanced biometric authentication model, a device fingerprint feature vector library, and a user behavior baseline model based on the registration data; Specifically, step S100 includes the following sub-steps: The system collects the biometric features of registered users and environmental interference information during the collection process. The biometric features include at least fingerprints and 3D facial features, and the environmental interference information includes at least light intensity and background noise. Collect a lightweight device fingerprint of the authorized mobile terminal, wherein the lightweight device fingerprint includes at least Bluetooth radio frequency subtle features and sensor hardware deviation features; Collect initial behavioral data of the user, which includes at least the operation time interval and the angle at which the user holds the terminal.

[0118] In this step S100, based on the registration data, an enhanced biometric authentication model, a device fingerprint feature vector library, and a user behavior baseline model are constructed and stored, including: The enhanced biometric authentication model is constructed by using the environmental interference information to enhance the biometric features. Robust features are extracted from the lightweight device fingerprint to generate a device fingerprint feature vector that is bound to the device identity, forming a device fingerprint feature vector library; The initial behavioral data is modeled to form the user behavior baseline model; The enhanced biometric authentication model and the user behavior baseline model are encrypted and stored locally on each mobile terminal, and the device fingerprint feature vector library is encrypted and stored in the storage device's main control MCU.

[0119] S200: When a terminal initiates authentication, it compares its real-time biometric features and real-time device fingerprint feature vector with a pre-stored model to obtain a fusion authentication result; if the authentication is successful, it generates an initial trust score based on the device role and matching degree of the terminal that initiated the authentication, and authorizes the establishment of a session. Specifically, step S200 includes the following sub-steps: The terminal initiating authentication compares its real-time biometrics with the enhanced biometric authentication model locally to obtain a first comparison result; The terminal that initiates the authentication generates the real-time device fingerprint feature vector and sends it to the main control MCU. The main control MCU calculates the matching degree between the real-time device fingerprint feature vector and the pre-stored device fingerprint feature vector. When the first comparison result is successful and the matching degree is higher than the preset threshold, a credible fusion authentication result is obtained.

[0120] In this step S200, an initial trust score is generated based on the device role and matching degree of the terminal initiating authentication, including: Obtain the device role of the terminal that initiated the authentication, and retrieve the historical matching degree sequence generated by the terminal initiating the authentication in the historical authentication, which consists of multiple device fingerprint matching degrees; Calculating the historical matching stability coefficient of the authentication-initiating terminal based on the historical matching degree sequence includes: calculating the coefficient of variation of the historical matching degree sequence, and mapping the historical matching stability coefficient based on the coefficient of variation, wherein the historical matching stability coefficient is inversely proportional to the coefficient of variation; Based on the device role and the historical matching stability coefficient, the trusted weight of the device fingerprint matching degree in this authentication is dynamically determined through a preset adaptive weight allocation rule. Based on the basic weight assigned to the device role and the weighted device fingerprint matching degree, the initial trust score is calculated and generated through a score synthesis function, which serves as the initial value of the real-time trust score.

[0121] In this step S200, the trusted weight of the device fingerprint matching degree in this authentication is dynamically determined according to the preset adaptive weight allocation rule, including: Define the basic value vector W of device role weight, and the threshold X of historical matching stability coefficient; When the historical matching stability coefficient S is less than or equal to the threshold X, the device is determined to be stable, and the current trusted weight W1 = W α, where α is a stability reward factor greater than 1; When the historical matching stability coefficient S is greater than the threshold X, it is determined that the device status is fluctuating, and the current confidence weight W1 = W β (X / S), where β is a volatility penalty factor less than 1.

[0122] S300: During the session, the initial trust score is dynamically corrected based on the deviation between the continuously collected real-time user behavior data and the user behavior baseline model, and the real-time trust score is obtained and updated. Specifically, step S300 includes the following sub-steps: During the session, the main control MCU continuously receives real-time behavioral data reported by the terminal that initiated the authentication; The real-time behavior data is compared with the user behavior baseline model to calculate the real-time behavior deviation. Based on the current real-time trust score, a score correction amount is calculated according to the magnitude and direction of the behavioral deviation and whether a preset environmental risk event has occurred; The real-time trust score is updated based on the score correction amount.

[0123] S400: Trigger an anomaly determination based on the abnormal change in the real-time trust score or other security events, and initiate a multi-machine collaborative review mechanism. Execute a security response based on the arbitration result of the collaborative review.

[0124] Specifically, step S400 includes the following sub-steps: Continuously monitor the changes in the real-time trust score; When the real-time trust score drops by more than a preset drop threshold within a unit of time, an anomaly determination is triggered, and an anomaly determination result is obtained. The anomaly determination result includes the anomaly type and the context data at the time of the anomaly. The main control MCU locks the session whose anomaly determination result is abnormal, and selects the verification terminal based on the credibility of the pre-stored device fingerprint feature vector of other authorized mobile terminals other than the terminal that initiated the authentication and the device role; the credibility of the pre-stored device fingerprint feature vector is proportional to the average value of the historical matching degree sequence of the corresponding authorized mobile terminal and the historical matching stability coefficient; Send a review request containing the exception type to the selected review terminal, and receive auxiliary verification evidence returned by the review terminal; The main control MCU integrates the anomaly judgment result, the credibility of the pre-stored device fingerprint feature vector, and auxiliary verification evidence to obtain the arbitration result, which includes attacks and false alarms. A security response is executed based on the arbitration result, and the security response includes at least terminating the session and issuing an alert, and restoring the session.

[0125] In this step S400, based on the credibility of the pre-stored device fingerprint feature vector and the device role of other authorized mobile terminals besides the terminal initiating authentication, a verification terminal is selected, including: Obtain all other authorized mobile terminals that are currently online and available, and construct a set of terminals to be filtered; Based on the terminal set, a particle swarm is initialized, where the position vector of each particle represents a terminal selection combination. The fitness function value of the particle is proportional to the credibility of the pre-stored device fingerprint feature vector of each terminal in the terminal selection combination and its device role weight. By iteratively updating the position vectors of the particles, the particle swarm searches for regions with higher fitness until the convergence condition is met. The terminal selection combination represented by the particle with the highest fitness during the iteration process is determined as the core terminal.

[0126] The embodiments of this application, through the above specific implementation methods, achieve the following technical effects: In this embodiment, firstly, multi-dimensional comprehensive collection of biometric features, environmental information, device hardware fingerprints, and initial behavioral data is used to obtain raw data with multiple credentials, providing key input for subsequent construction of an enhanced model resistant to environmental interference. Secondly, model construction and hierarchical storage are performed to achieve an optimal balance between security and efficiency. The biometric model and behavioral baseline model are encrypted and stored locally on each mobile terminal to protect privacy and eliminate the risk of leakage of the biometric authentication model; the device fingerprint feature vector library for global comparison is centrally encrypted and stored in the main control MCU to ensure the consistency of device authentication and facilitate efficient centralized management and cross-device collaboration.

[0127] Secondly, an authentication logic that integrates local biometric verification and device fingerprint verification is employed. Biometrics are compared locally at the initiating terminal, while device fingerprints are centrally compared by the main control MCU. This protects privacy and enables rapid authentication and identification responses, while ensuring the authenticity of the device identity. Subsequently, the stability coefficient of the device is calculated by retrieving its historical matching degree sequence, and the trust weight of the current device fingerprint matching degree is dynamically determined in conjunction with the device role. Finally, an initial trust score generated by a score synthesis function yields a comprehensive quantitative index that integrates real-time authentication strength, historical device reliability, and device type strategy, providing scientific data support for dynamic security management of sessions.

[0128] Furthermore, by receiving real-time behavioral data from the main control MCU during the session, comparing it with the user behavior baseline model, calculating the behavioral deviation, and dynamically updating the real-time trust score accordingly, it effectively defends against post-authentication attacks. It also makes the assessment of security risks more intuitive through behavioral anomaly scores, and can make comprehensive judgments in combination with preset environmental risk events to achieve accurate and flexible risk response, providing a quantitative basis for higher-level collaborative review.

[0129] Ultimately, when a sudden drop in the real-time trust score of a single-device session triggers an anomaly, the main control MCU locks the session and initiates multi-device verification. Based on the trustworthiness of pre-stored device fingerprint feature vectors and device roles of other online terminals, the most suitable verification terminal is selected, and a verification request containing the anomaly type is sent to it. The MCU also receives supplementary verification evidence returned by the terminal. All information is then integrated for arbitration to distinguish between attacks and false alarms, and either alarm termination or session recovery is executed. This reduces misjudgments caused by false alarms from single-device sensors or accidental abnormal user behavior. It ensures more reliable arbitration in complex multi-device environments, curbing real attacks while avoiding interference with legitimate users.

[0130] It should be noted that the order of the embodiments described above is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. Furthermore, the above description focuses on specific embodiments of this specification. Additionally, the processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired results. In some implementations, multitasking and parallel processing are possible or may be advantageous.

[0131] The above description is only a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A multi-mobile terminal adaptive cooperative storage authentication system based on biometric feature enhancement, characterized in that, The system comprises: a data acquisition module, configured to acquire registration data of each authorized mobile terminal, and construct and store an enhanced biometric authentication model, a device fingerprint feature vector library, and a user behavior baseline model according to the registration data; a fusion authentication comparison module, configured to, when authentication is initiated by a terminal, compare real-time biometric features and real-time device fingerprint feature vectors of the terminal with the pre-stored models to obtain a fusion authentication result; if the authentication is passed, generate an initial trust score according to a device role and a matching degree of the terminal that initiates the authentication, and authorize the establishment of a session; a trust score correction module, configured to, during the duration of the session, dynamically correct the initial trust score according to a behavior deviation degree of continuously acquired real-time behavior data of a user and the user behavior baseline model, to obtain and update a real-time trust score; an abnormal event determination module, configured to determine an abnormal event according to an abnormal change of the real-time trust score or other security events, and start a multi-machine cooperative review mechanism, and execute a security response according to an arbitration result of the cooperative review.

2. The multi-mobile terminal adaptive cooperative storage authentication system based on biometric feature enhancement according to claim 1, characterized in that, The acquisition of the registration data of each authorized mobile terminal comprises: acquiring biometric features of a registered user and environmental interference information at the time of acquisition, wherein the biometric features at least include fingerprints and 3D facial features, and the environmental interference information at least includes illumination intensity and background noise; acquiring a lightweight device fingerprint of the authorized mobile terminal, wherein the lightweight device fingerprint at least includes Bluetooth radio frequency subtle features and sensor hardware deviation features; acquiring initial behavior data of the user, wherein the initial behavior data at least includes operation time intervals and terminal holding angles.

3. The multi-mobile terminal adaptive cooperative storage authentication system based on biometric feature enhancement according to claim 2, characterized in that, The construction and storage of the enhanced biometric authentication model, the device fingerprint feature vector library, and the user behavior baseline model according to the registration data comprise: enhancing the biometric features by using the environmental interference information to construct the enhanced biometric authentication model; extracting robust features from the lightweight device fingerprint to generate a device fingerprint feature vector bound to a device identity, and form a device fingerprint feature vector library; modeling the initial behavior data to form the user behavior baseline model; encrypting and storing the enhanced biometric authentication model and the user behavior baseline model locally in each mobile terminal, and encrypting and storing the device fingerprint feature vector library in a storage device master control unit (MCU).

4. The multi-mobile terminal adaptive cooperative storage authentication system based on biometric feature enhancement according to claim 1, characterized in that, The comparison of the real-time biometric features and the real-time device fingerprint feature vectors with the pre-stored models to obtain the fusion authentication result comprises: comparing, by the terminal that initiates the authentication, real-time biometric features of the terminal with the enhanced biometric authentication model locally to obtain a first comparison result; generating, by the terminal that initiates the authentication, real-time device fingerprint feature vectors of this time and sending the real-time device fingerprint feature vectors to the master control unit (MCU), and calculating, by the master control unit (MCU), a matching degree of the real-time device fingerprint feature vectors and pre-stored device fingerprint feature vectors; when the first comparison result is successful and the matching degree is higher than a preset threshold, obtaining a fusion authentication result of trusted passing.

5. The multi-mobile terminal adaptive cooperative storage authentication system based on biometric feature enhancement according to claim 1, characterized in that, The generation of the initial trust score according to the device role and the matching degree of the terminal that initiates the authentication comprises: obtaining a device role of the terminal initiating the authentication, and calling a historical matching degree sequence generated by the terminal initiating the authentication in historical authentication, the historical matching degree sequence being composed of multiple device fingerprint matching degrees; calculating a historical matching stability coefficient of the terminal initiating the authentication according to the historical matching degree sequence, including: calculating a variation coefficient of the historical matching degree sequence, and obtaining the historical matching stability coefficient according to the variation coefficient mapping, wherein the historical matching stability coefficient is inversely proportional to the variation coefficient; dynamically determining a trusted weight of the device fingerprint matching degree in the current authentication according to the device role and the historical matching stability coefficient through a preset adaptive weight allocation rule; generating the initial trust score as an initial value of the real-time trust score through a score synthesis function according to a basic weight given by the device role and the weighted device fingerprint matching degree.

6. The multi-mobile terminal adaptive cooperative storage authentication system based on biometric feature enhancement according to claim 5, characterized in that, dynamically determining a trusted weight of the device fingerprint matching degree in the current authentication through a preset adaptive weight allocation rule, including: defining a device role weight basic value vector W and a threshold X of the historical matching stability coefficient; When the historical matching stability coefficient S is less than or equal to a threshold value X, it is determined that the device state is stable, and the current confidence weight W1=W α, where a is a stability reward factor greater than 1. When the historical match stability coefficient S is greater than a threshold value X, it is determined that the device state fluctuates, and the current confidence weight W1=W β (X / S), wherein β is a fluctuation penalty factor less than 1.

7. The multi-mobile terminal adaptive cooperative storage authentication system based on biometric feature enhancement of claim 1, wherein during the session duration, dynamically correcting the initial trust score according to a behavior deviation degree of the continuously collected real-time behavior data of the user and the user behavior baseline model, obtaining and updating the real-time trust score, including: during the session, the master MCU continuously receives the real-time behavior data reported by the terminal initiating the authentication; comparing the real-time behavior data with the user behavior baseline model to calculate a real-time behavior deviation degree; based on the current real-time trust score, calculating a score correction amount according to the size and direction of the behavior deviation degree and whether a preset environmental risk event occurs; updating the real-time trust score based on the score correction amount.

8. The multi-mobile terminal adaptive cooperative storage authentication system based on biometric feature enhancement according to claim 1, characterized in that, triggering an abnormality judgment according to an abnormal change of the real-time trust score or other security events, and starting a multi-machine cooperative review mechanism, and executing a security response according to an arbitration result of the cooperative review, including: continuously monitoring the change of the real-time trust score; triggering an abnormality judgment when a decline amplitude of the real-time trust score in a unit time exceeds a preset sudden drop threshold, and obtaining an abnormality judgment result, the abnormality judgment result including an abnormality type and context data at the time of the abnormality occurrence; the master MCU locks a session with an abnormality judgment result, and selects a review terminal according to a pre-stored device fingerprint feature vector trust degree of an authorized mobile terminal other than the terminal initiating the authentication and a device role, the pre-stored device fingerprint feature vector trust degree being proportional to an average value of a historical matching degree sequence of the corresponding authorized mobile terminal and a historical matching stability coefficient; sending a review request including the abnormality type to the selected review terminal, and receiving auxiliary verification evidence returned by the review terminal; the master MCU obtains an arbitration result by comprehensively considering the abnormality judgment result, the pre-stored device fingerprint feature vector trust degree and the auxiliary verification evidence, the arbitration result including an attack and a false alarm; executing a security response based on the arbitration result, the security response at least including terminating the session and alarming, and resuming the session.

9. The multi-mobile terminal adaptive cooperative storage authentication system based on biometric feature enhancement according to claim 8, characterized in that, According to the pre-stored device fingerprint feature vector credibility of other authorized mobile terminals except the terminal initiating authentication and the device role, a review terminal is selected, comprising: All currently online and available other authorized mobile terminals are acquired to form a terminal set to be screened; Based on the terminal set, a particle swarm is initialized, wherein a position vector of each particle represents a terminal selection combination, and a fitness function value of the particle is proportional to the pre-stored device fingerprint feature vector credibility of each terminal in the terminal selection combination and the device role weight; The position vector of the particle is iteratively updated to make the particle swarm search for a region with a higher fitness, until a convergence condition is met; The terminal selection combination represented by the particle with the highest fitness in the iteration process is determined as the review terminal.

10. A multi-mobile terminal cooperative storage authentication method based on biometric feature enhancement, characterized by, The method is applied to the multi-mobile terminal cooperative storage authentication system based on biometric feature enhancement according to any one of claims 1-9, and the method comprises: Registration data of each authorized mobile terminal is collected, and based on the registration data, an enhanced biometric authentication model, a device fingerprint feature vector library and a user behavior baseline model are constructed and stored; When a terminal initiates authentication, the real-time biometric feature and the real-time device fingerprint feature vector of the terminal are compared with the pre-stored model based on the real-time biometric feature and the real-time device fingerprint feature vector to obtain a fusion authentication result; if the authentication is passed, an initial trust score is generated according to the device role and the matching degree of the terminal initiating authentication, and a session is authorized to be established; During the session duration, the initial trust score is dynamically revised based on the behavior deviation of the continuously collected real-time user behavior data and the user behavior baseline model to obtain and update a real-time trust score; An abnormality judgment is triggered according to an abnormal change of the real-time trust score or other security events, and a multi-terminal cooperative review mechanism is started, and a security response is executed according to an arbitration result of the cooperative review.

Images