Anti-quantum identity authentication method based on two-dimensional dynamic primitives

Abstract

The invention discloses an anti-quantum identity authentication method based on a two-dimensional dynamic primitive, and belongs to the technical field of anti-quantum authentication, and the method comprises the steps: carrying out the dynamic feature collection from the identity feature dimension and behavior feature dimension of an access subject, carrying out the hierarchical processing and mapping index distribution of collected data, and obtaining an associated feature set; performing hierarchical encryption and ciphertext splicing on the associated feature set to obtain a composite authentication packet; respectively extracting an auxiliary layer ciphertext and a core layer ciphertext from the composite authentication packet, firstly performing auxiliary layer verification through the auxiliary layer ciphertext, then performing core layer verification through the core layer ciphertext, and outputting a verification result; and sending a corresponding operation instruction to the access control component according to the verification result, and outputting a final authentication result. Therefore, by implementing the application, the problem that the normal operation of the system is influenced by high authentication delay due to the fact that the existing anti-quantum authentication technology occupies more computing resources in the identity authentication process can be solved.

Description

Technical Field

[0001] This application belongs to the field of quantum-resistant authentication technology, specifically involving a quantum-resistant identity authentication method based on two-dimensional dynamic primitives. Background Technology

[0002] With the rapid development of quantum computing technology, traditional cryptographic algorithms (such as RSA and ECC) face severe security challenges. Their security mainly relies on the computational complexity of classical mathematical problems such as large number factorization and discrete logarithms. Therefore, authentication protocols based on traditional algorithms will lose their security in the future quantum era and cannot guarantee the identity authentication security of the access subject. Quantum computers, with quantum computing methods such as Shor's algorithm, can solve these problems in polynomial time. Existing quantum-resistant authentication algorithms include a core layer and an auxiliary layer (the core layer contains quantum-resistant cryptographic algorithms and related security models, while the auxiliary layer contains security certificate management and security architecture). They are mainly used for identity authentication and can be considered an anti-counterfeiting technology to ensure that users' digital identities and documents are not forged.

[0003] However, quantum-resistant authentication algorithms generally suffer from high computational complexity and high resource consumption. Their core and auxiliary layers do not have layered encryption design, and the same high-complexity algorithm is used regardless of the importance of the features. In resource-constrained environments such as microservice clusters, lightweight containers, or terminal devices, this can easily lead to high authentication latency, excessive CPU / memory usage, and even affect the normal operation of business systems, making it difficult to adapt to the high-efficiency operation requirements of lightweight scenarios. Summary of the Invention

[0004] This application proposes a quantum-resistant identity authentication method based on two-dimensional dynamic primitives, which can solve the problem that existing quantum-resistant authentication technologies consume a lot of computing resources during the identity authentication process, resulting in high authentication latency and thus affecting the normal operation of the system.

[0005] The first aspect of this application provides a quantum-resistant identity authentication method based on two-dimensional dynamic primitives, the method comprising:

[0006] Dynamic feature collection is performed from the identity and behavioral characteristics of the accessing entities, and the data collection results are processed in layers and mapped and indexed to obtain a set of related features.

[0007] The associated feature set is encrypted in layers and the ciphertext is concatenated using a preset key encryption method to obtain a composite authentication packet;

[0008] The auxiliary layer ciphertext and the core layer ciphertext are extracted from the composite authentication packet. First, the auxiliary layer verification is performed using the auxiliary layer ciphertext, and then the core layer verification is performed using the core layer ciphertext. The verification result is then output.

[0009] Based on the verification result, send the corresponding operation instruction to the access control component and output the final authentication result.

[0010] The above scheme collects dual features of the accessing entity—identity and behavioral characteristics—resulting in a two-dimensional dynamic primitive that is more difficult to forge than traditional single-identity authentication, ensuring high accuracy and reliability. Then, by performing layered encryption on the features in the associated feature set, feature classification is achieved, and different encryption algorithms are applied based on different classification results to achieve lightweight encryption and reduce encryption complexity. A hierarchical permission locking method is adopted, first verifying the auxiliary layer ciphertext and then verifying the core layer ciphertext, intercepting some invalid requests directly at the auxiliary layer, thus reducing the computational load on the core layer. Therefore, layered verification reduces the amount of data computation, effectively reducing verification latency and improving authentication efficiency, while achieving accurate identity authentication with fewer computing resources. Finally, the identity authentication result is output based on the verification results, achieving accurate identity authentication.

[0011] In one possible implementation of the first aspect, dynamic feature collection is performed from the identity and behavioral feature dimensions of the accessing subject, and the data collection results are processed hierarchically and mapped with indexes to obtain an associated feature set, specifically:

[0012] Based on the type of the accessing entity, dynamic features are collected from the entity's identity features and behavioral features to obtain a two-dimensional dynamic primitive; the two-dimensional dynamic primitive includes identity features and behavioral features.

[0013] The generated associated feature pairs are layered according to preset filtering conditions to obtain core layer features and auxiliary layer features; wherein, the associated feature pairs are obtained by matching the identity features and behavioral features one by one;

[0014] Generate a first mapping index for the core layer features, generate a second mapping index for the auxiliary layer features, and construct the associated feature set containing the mapping indices; wherein the second mapping index is concatenated after the first mapping index.

[0015] The above scheme collects two-dimensional dynamic primitives of the access subject, providing more accurate and sufficient data support for identity authentication by collecting features from identity and behavior. Then, the collected features are stratified according to their stability. Features with high stability are classified as core layer features, serving as the core basis for authentication and having the highest priority; features with lower stability are classified as auxiliary layer features, serving as auxiliary verification basis and having a lower priority. This provides a foundation for subsequent layered verification, effectively reducing the computational load of identity authentication and improving authentication efficiency.

[0016] In one possible implementation of the first aspect, dynamic features are dynamically collected from the identity feature dimension and behavioral feature dimension of the accessing subject according to the type of the accessing subject, resulting in a two-dimensional dynamic primitive, specifically:

[0017] If the accessing entity is a human, then from the identity feature dimension, the fingerprint texture feature and iris tremor feature of the accessing entity are collected, and from the behavioral feature dimension, the keyboard operation feature and mouse movement feature of the accessing entity are collected.

[0018] If the accessing entity is a microservice entity or a container entity, then the identity identifier of the accessing entity is collected from the identity feature dimension, and the communication timing features of the accessing entity are collected from the behavioral feature dimension.

[0019] Specifically, the keyboard operation features are constructed by recording the timestamps of consecutive keystrokes when the user operates the keyboard and calculating the time difference between two adjacent keystrokes; the mouse movement features are constructed by calculating the mouse movement acceleration based on the change in the mouse position coordinates when the user operates the mouse.

[0020] The above solution uses different feature collection methods depending on the access subject, making it applicable to various application scenarios. Furthermore, the collected features better match the characteristics of each subject, effectively resisting attacks and ensuring high accuracy and reliability of identity authentication.

[0021] In one possible implementation of the first aspect, the generated associated feature pairs are layered according to preset filtering conditions to obtain core layer features and auxiliary layer features, specifically:

[0022] The identity features are matched one by one with the behavioral features to obtain several feature pairs;

[0023] The associated feature pairs are obtained by filtering the feature pairs based on their cosine similarity.

[0024] The fluctuation coefficient of the associated feature pair is calculated based on the acquisition frames and character index data during the feature acquisition process.

[0025] The associated feature pairs with a volatility coefficient less than or equal to a first threshold are used as core layer features, and the associated feature pairs with a volatility coefficient greater than the first threshold are used as auxiliary layer features.

[0026] In one possible implementation of the first aspect, the associated feature set is subjected to layered encryption and ciphertext concatenation using a preset key encryption method to obtain a composite authentication packet, specifically:

[0027] Extract core layer features containing the first mapping index and auxiliary layer features containing the second mapping index from the associated feature set;

[0028] According to the preset index order, the core layer features and the auxiliary layer features are concatenated to obtain the core layer plaintext and the auxiliary layer plaintext.

[0029] Based on a preset key, the plaintext of the core layer and the plaintext of the auxiliary layer are encrypted respectively to obtain the ciphertext of the core layer and the ciphertext of the auxiliary layer; wherein, the key includes a public key and a private key, the public key is stored in the cloud-native authentication server, and the private key is stored in the local module of the access subject;

[0030] The core layer ciphertext is concatenated first, followed by the auxiliary layer ciphertext, to generate a composite authentication package.

[0031] The above scheme stores the public and private keys separately, ensuring that the private key never leaves the local security boundary, thus avoiding the risk of key leakage that may occur when the public and private keys are stored on the server at the storage architecture level.

[0032] In one possible implementation of the first aspect, the core layer features and the auxiliary layer features are concatenated according to a preset index order to obtain the core layer plaintext and the auxiliary layer plaintext, specifically as follows:

[0033] Based on the same mapping index, calculate the relative rate of change of features between the core layer features and the auxiliary layer features and the preset feature pre-stored template;

[0034] Based on the relative rate of change of the features, the core layer features and the auxiliary layer features are filtered;

[0035] According to the index order of the first mapping index, the filtered core layer features and the first mapping index are concatenated byte-level to obtain the core layer plaintext;

[0036] Following the index order of the second mapping index, the filtered auxiliary layer features and the second mapping index are concatenated byte-level to obtain the auxiliary layer plaintext.

[0037] The above scheme concatenates the mapping index with the features to obtain the corresponding plaintext, providing data support for subsequent calculation of the similarity between the features and the pre-stored feature templates based on the index. Furthermore, by filtering before encryption, features with low variability are ignored, and features with high variability are selected for verification. This eliminates the need for repeated encryption, saving computational resources and further reducing the computational resources required for authentication.

[0038] In one possible implementation of the first aspect, auxiliary layer ciphertext and core layer ciphertext are extracted from the composite authentication packet, auxiliary layer verification is performed first using the auxiliary layer ciphertext, and core layer verification is performed using the core layer ciphertext, and the verification result is output, specifically as follows:

[0039] The auxiliary layer ciphertext is extracted from the composite authentication packet, and the auxiliary layer ciphertext is decrypted to obtain the first decryption result;

[0040] Based on the preset feature pre-stored template, auxiliary layer verification is performed by calculating the auxiliary layer similarity of the first decryption result. If the auxiliary layer verification result is passed, the core layer ciphertext is extracted from the composite authentication package.

[0041] The core layer ciphertext is decrypted to obtain the second decryption result;

[0042] Based on the pre-stored feature template, core layer verification is performed by calculating the core layer similarity of the second decryption result, and the verification result is output.

[0043] The above scheme first verifies the auxiliary layer, intercepting requests that do not meet the authentication conditions directly at the auxiliary layer. This reduces the computational load on the core layer and improves authentication efficiency. Furthermore, the two-layer verification method effectively enhances the security of identity authentication.

[0044] In one possible implementation of the first aspect, the similarity between the auxiliary layer and the core layer is specifically as follows:

[0045] The auxiliary layer features and the corresponding second mapping index are parsed from the first decryption result, and the core layer features and the corresponding first mapping index are parsed from the second decryption result.

[0046] Extract the first feature corresponding to the first mapping index and the second feature corresponding to the second mapping index from the feature pre-stored template;

[0047] Calculate the average similarity between the core layer features and the first feature to obtain the core layer similarity;

[0048] Calculate the average similarity between the auxiliary layer feature and the second feature to obtain the auxiliary layer similarity; wherein, when the auxiliary layer similarity is greater than or equal to the second threshold, the auxiliary layer verification result is passed.

[0049] In one possible implementation of the first aspect, the feature pre-stored template is specifically as follows:

[0050] When the access subject performs identity authentication for the first time, the core layer features and auxiliary layer features extracted from the access subject are stored in a preset template to obtain the feature pre-stored template;

[0051] The pre-stored feature template is bound to the identity identifier of the access subject and stored in a cloud-native authentication server;

[0052] When the accessing entity is not performing identity authentication for the first time, the aforementioned feature-pre-stored template is used for identity authentication.

[0053] The above scheme records the information of the access subject during the first authentication by pre-storing the feature template, providing reliable data support for subsequent multiple authentications.

[0054] In one possible implementation of the first aspect, based on the verification result, a corresponding operation instruction is sent to the access control component, and the final authentication result is output, specifically as follows:

[0055] If the verification result is successful, an access authorization instruction is sent to the access control component, and the preset feature pre-stored template is dynamically updated according to the verification result;

[0056] If the verification result is unsuccessful, an access denial command is sent to the access control component, and the failure timestamp corresponding to the access denial command is recorded in the management log. Attached Figure Description

[0057] To more clearly illustrate the technical solution of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0058] Figure 1 This is a schematic diagram illustrating the specific process of a quantum-resistant identity authentication method based on two-dimensional dynamic primitives provided in an embodiment of this application. Detailed Implementation

[0059] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0060] It should be understood that the step numbers used in the text are for ease of description only and are not intended to limit the order in which the steps are performed.

[0061] First Embodiment

[0062] Compared to traditional authentication methods, quantum-resistant authentication algorithms primarily achieve quantum security through algorithms based on complex mathematical problems. While improving authentication security, this also introduces challenges such as excessive computational load and increased consumption of computational resources. To reduce authentication latency while ensuring accuracy, this application employs a two-dimensional dynamic primitive for two-layer authentication, distributing the data required for authentication to achieve lightweight encryption and authentication, effectively improving authentication efficiency.

[0063] like Figure 1 As shown, to address the problem that existing quantum-resistant authentication technologies consume significant computational resources during identity authentication, leading to high authentication latency and thus affecting the normal operation of the system, the first embodiment of this application provides a detailed flowchart of a quantum-resistant identity authentication method based on two-dimensional dynamic primitives. This embodiment's quantum-resistant identity authentication method based on two-dimensional dynamic primitives includes steps S1 to S4, detailed below:

[0064] Step S1 involves dynamically collecting features from the identity and behavioral characteristics of the accessing entity, and then performing hierarchical processing and mapping index allocation on the collected data to obtain a set of associated features.

[0065] Compared to existing technologies that only perform single identity authentication on the access subject, this application implements dynamic feature collection from the access subject's identity feature dimension and behavioral feature dimension to obtain dual-dimensional dynamic primitives for subsequent identity authentication, making the authentication data more difficult to forge.

[0066] Furthermore, access subjects are generally divided into human subjects, microservice subjects, and container subjects. In order to more accurately adapt to these three types of subjects, this application embodiment selects data collection that fits the characteristics of each subject, so as to effectively resist attacks and ensure high accuracy and high reliability of identity authentication.

[0067] For the human subject, from the perspective of identity characteristics, fingerprint texture features and iris tremor features are collected; from the perspective of behavioral characteristics, keyboard operation features and mouse movement features are collected. Specifically, an optical fingerprint sensor is used to collect fingerprint images during the fingerprint pressing process of the subject, with a frame rate of 30 frames / second and a collection time of 1 second, forming a fingerprint image sequence of length 30. Then, the deformation rate of the ridges and the time-varying value of the ridge spacing are extracted from each frame of the fingerprint image sequence to construct the fingerprint texture features. The formula for calculating the ridge deformation rate is:

[0068]

[0069] Δd=d k+1 -d k ;

[0070] In the formula, δ is the ridge deformation rate, and L cur L is the length of the target ridge in the current frame. init Let d be the initial length of the same target ridge in the first frame, and Δd be the inter-frame difference in distance between adjacent ridges. k The distance between the same pair of adjacent ridges in the k-th frame.

[0071] Simultaneously, a near-infrared iris camera is used to capture the micro-tremor trajectory of the iris edge (obtained based on selected feature points) during the subject's gaze at a fixed target. The acquisition time is 1 second, forming a micro-tremor trajectory sequence of length 100. Then, the tremor frequency and amplitude variation sequence is extracted from the micro-tremor trajectory sequence to construct the iris tremor feature.

[0072] The formula for calculating the flutter frequency is:

[0073]

[0074] In the formula, ω is the angular frequency of the micro-vibration trajectory.

[0075] The amplitude change sequence records the amplitude value A every 10ms. k Its expression is:

[0076]

[0077] In the formula, A k The feature point (x) selected for the kth record k ,y k Deviation from the mean of the trajectory ( and The maximum distance is given by the sequence length of 100.

[0078] The keyboard driver records the timestamps of consecutive keystrokes when the user operates the keyboard, and calculates the time difference between two adjacent keystrokes to construct the keyboard operation features. The mouse sensor collects the position coordinates (x, y) of the user when operating the mouse at a frequency of 50 times per second for a duration of 1 second, forming a position coordinate sequence of length 50. The coordinates of the k-th frame are denoted as (x, y). k ,y k ), k = 1, 2, ..., 50.

[0079] Then, based on the position coordinate sequence, the displacement change between adjacent frames is calculated, specifically expressed as:

[0080] Δx k =x k+1 -x k ;

[0081] Δy k =y k+1 -y k ;

[0082] In the formula, k = 1, 2, ..., 49, Δx k Let Δy be the displacement change in the x-direction. k This represents the change in displacement in the y-direction.

[0083] Then the movement speed of adjacent frames is calculated:

[0084]

[0085] In the formula, k = 1, 2, ..., 49, v x,k Let v be the velocity in the x-direction. y,k The moving speed is y, and Δt is the sampling time interval (Δt = 0.02s).

[0086] Calculate the mouse movement acceleration based on the mouse movement speed in adjacent frames:

[0087]

[0088] In the formula, k = 2, 3, ..., 49, a x,k Let a be the acceleration in the x-direction. y,k The acceleration in the y-direction is used to form a mouse movement acceleration sequence of length 48.

[0089] Finally, the mouse movement features are constructed based on the mouse movement acceleration sequence.

[0090] For microservice entities and container entities, the identity identifier of the accessing entity is collected from the identity feature dimension, and the communication timing characteristics of the accessing entity are collected from the behavioral feature dimension.

[0091] Optionally, in this embodiment, the identity identifier of the microservice entity is the microservice account ID and the microservice image ID, both of which are mapped to the [0,1] range using a standardized method. The identity identifier of the container entity adds a unique container identifier as a supplementary feature to the identity feature dimension.

[0092] When collecting the communication timing features of the microservice entity, the time interval and API request packet length of the API calls between microservices are collected through the cloud-native service mesh. The original timing features are aligned using linear interpolation, and then the aligned features are mapped to the [0,1] interval through 255 levels of quantization to obtain the communication timing features.

[0093] The logic for collecting communication timing characteristics of the container body is consistent with that of the microservice body.

[0094] Then, the collected two-dimensional dynamic primitives are preprocessed to obtain core layer features and auxiliary layer features with mapping indexes.

[0095] Specifically, the identity features in the two-dimensional dynamic primitives are preprocessed. First, denoising is performed by applying a 3×3 two-dimensional Gaussian filter to the original feature value matrix of the identity features to fill in missing values ​​and ensure the integrity of the filtering operation. Then, standardization is performed to map the denoised identity features to the [0,1] interval to obtain standardized identity features, thus avoiding the influence of differences in feature magnitude on the correlation calculation.

[0096] The behavioral features in the two-dimensional dynamic primitives are preprocessed. First, temporal alignment is performed, and the behavioral features are completed using linear interpolation. The interpolation reference is the timestamp interval of the behavioral feature sequence. Finally, it is ensured that the length of the completed sequence is consistent with that of the identity feature sequence, resulting in temporally aligned behavioral features. Then, quantization is performed to map the temporally aligned behavioral feature values ​​to the [0,1] interval.

[0097] The preprocessed identity features and behavioral features are then matched one by one to obtain several feature pairs.

[0098] Optionally, in this embodiment of the application, when performing feature matching, fingerprint texture features are associated with keyboard input interval, iris tremor features are associated with mouse movement acceleration, microservice identity features are associated with microservice API call time interval, and container ID features are associated with microservice request packet length. The matching basis is that the collection time window / index dimension of the two types of features completely overlap.

[0099] Calculate the cosine similarity of each feature pair, and select feature pairs with a cosine similarity greater than or equal to 0.6 as associated feature pairs. Here, the cosine similarity is the cosine similarity between the identity feature and the behavioral feature within the feature pair.

[0100] The associated feature pairs are then processed in a hierarchical manner, with key features divided into core layer features and secondary features divided into auxiliary layer features.

[0101] Specifically, the fluctuation coefficient of the associated feature pair is calculated based on the number of acquisition frames and character index data during the feature acquisition process. In this embodiment, the number of acquisition frames is set to 10.

[0102] Therefore, the formula for calculating the volatility coefficient is:

[0103]

[0104] In the formula, σ f The standard deviation of the feature values ​​from 10 acquisitions, μ f This is the mean of the feature values ​​collected over 10 trials. Both the standard deviation and the mean are calculated based on all frame / character index data within the same feature dimension.

[0105] The associated feature pairs with a fluctuation coefficient less than or equal to 0.05 are selected as core layer features. Core layer features exhibit high stability and can serve as the core basis for authentication.

[0106] The associated feature pairs with a fluctuation coefficient greater than 0.05 are used as auxiliary layer features. Auxiliary layer features have low stability and are used to assist in verification to reduce the computational load of the core layer.

[0107] For example, in some embodiments, the core layer features include ridge deformation rate, time-varying ridge spacing, iris main tremor frequency, iris amplitude variation sequence, microservice image ID, and container ID. The auxiliary layer features include keyboard input interval, mouse movement acceleration, microservice API call time interval, and microservice request packet length.

[0108] Next, generate corresponding mapping indices for the core layer features and auxiliary layer features respectively. Unique mapping indices are assigned to the core layer and auxiliary layer features using consecutive integers, with the index storage format being a 1-byte unsigned integer (supporting index assignment for up to 255 features). The mapping index for the core layer features starts from 1 and is denoted as idx. c =1,2,…,p; p is the number of core layer features (where p=6, and each index uniquely corresponds to a core layer feature dimension). The mapping indices of auxiliary layer features are concatenated after the mapping indices of the core layers, denoted as idx. a = p+1,…,p+q. Where q is the number of auxiliary layer features (where q=4, and each index uniquely corresponds to an auxiliary layer feature dimension).

[0109] Finally, the core layer features and auxiliary layer features with mapping indices are combined into an associated feature set, specifically expressed as:

[0110] (F c idx c ,F a idx a );

[0111] In the formula, F c This is an array of core layer feature values ​​(array elements are the frame / character index sequence values ​​of each core layer feature), idx c F is a mapping index array of core layer features (array elements are integer indices of the corresponding core layer features). a idx is an array of auxiliary layer feature values ​​(the array elements are the frame sequence values ​​of each auxiliary layer feature). a This is a mapping index array for auxiliary layer features (array elements are integer indices of the corresponding auxiliary layer features).

[0112] As an improvement to the above solution, this embodiment of the application also constructs a corresponding feature pre-stored template for the access subject undergoing initial authentication. When the access subject performs identity authentication for the first time, the core layer features and auxiliary layer features extracted from the access subject are stored in a preset template to obtain the corresponding feature pre-stored template. The feature pre-stored template is then bound to the access subject's identity identifier and stored in the secure storage component of the cloud-native authentication server. In this embodiment, the feature pre-stored template is constructed using an associated feature set with a mapping index; therefore, the mapping index is also stored. After successful template storage, the authentication server records the access subject's initialization completion status, the protocol enters a ready state, and the protocol initialization of the subject is complete. Subsequently, the feature pre-stored template will be used for all subsequent non-initial authentication processes of the subject to trace the corresponding features.

[0113] Step S2: The associated feature set is encrypted in layers and the ciphertext is concatenated using a preset key encryption method to obtain a composite authentication package.

[0114] First, a lightweight pre-screening operation is performed on the associated feature set to filter out features that differ significantly from the pre-stored feature template, providing data support for subsequent authentication. The remaining features, due to their minimal changes, have negligible differences from the pre-stored feature template and are therefore not subject to further encryption, saving computational resources for subsequent authentication.

[0115] If the accessing entity is authenticating for the first time, its features are not lightly pre-screened. Instead, the data in the associated feature set is directly arranged in the order of core layer and auxiliary layer to ensure that the subsequent encryption steps can fully process all features.

[0116] If the accessing entity is not authenticating for the first time, then for a single feature in the associated feature set, calculate the relative rate of change between the current value of that feature and the feature value with the same mapping index in the feature pre-stored template. The calculation formula is as follows:

[0117]

[0118] In the formula, f cur f represents the current value of the feature in the associated feature set. tmp The feature value with the same index as the feature in the feature pre-stored template (extracted by index from the feature pre-stored template feature array of the cloud-native distributed secure storage component); ε = 10 -6 This is a local minimum value, used to avoid f tmp The division-by-zero error when the value is 0, the value of ε is much smaller than the order of magnitude of the eigenvalue.

[0119] Then, features with a relative change rate ≥ 0.1 are selected from the associated feature set for subsequent feature concatenation. Because these features change significantly, they need to be re-encrypted and verified to ensure security; therefore, in this embodiment, they can also be referred to as the feature set to be authenticated.

[0120] Extract the core layer features and auxiliary layer features after filtering from the feature set to be certified.

[0121] For the selected core layer features, a key is generated for them. Then, the obtained core layer plaintext is concatenated and finally encrypted using the key.

[0122] When generating the key, the polynomial ring R is used. q =Z q [X] / (X 256 +1)(where q = 3329 is the modulus of the polynomial ring, X 256 +1 is the reduced polynomial of the polynomial ring. A private key seed s (where s is a 256-bit binary set of 0, 1) is randomly generated using a cryptographically secure random number generator conforming to the NIST SP800-134A standard. 256 The randomness of the seed ensures the security of the private key. Then, two operations are performed on the private key seed to generate the private key sk: the private key seed s is hashed using a preset hash function H(·) (using the SHA-256 hash algorithm) to enhance its collision resistance; then, a small-noise polynomial e (with a discrete Gaussian distribution D) is generated based on the randomness of the private key seed s. Z,σ＝2.4 (used to resist grid base attacks), and finally, by combining the above operations, the final private key sk = (s, e) is obtained.

[0123] Then, a public key pk is generated based on the private key sk, starting from the polynomial ring R. q A polynomial 'a' is randomly selected from the polynomials, and the public key is calculated using polynomial ring operations. The specific calculation formula is as follows:

[0124] pk = a·s + e;

[0125] Finally, the public key is publicly stored on a cloud-native authentication server, while the private key is encrypted and stored in the access subject's local security chip (for human subjects) or container security sandbox (for microservices / container subjects). This ensures that the private key never leaves the local security boundary, thus avoiding the risk of key leakage that may occur when the public and private keys are stored on the same server from the storage architecture level.

[0126] Then, based on the index order of the mapping index of the core layer features, the core layer features retained after lightweight pre-screening are concatenated with the corresponding mapping index at the byte level to form the core layer plaintext.

[0127] The formula for calculating the plaintext in the core layer is as follows:

[0128] M c =F c′ ||idx c ;

[0129] In the formula, M c For the core layer plaintext, F c′ For the core layer features retained after lightweight pre-screening, idx c The mapping index is for the core layer features; || is for byte-level concatenation. The length of the concatenated plaintext is dynamically adjusted according to the number of core layer features. Each feature value is stored as a 4-byte floating-point number, and each index is stored as a 1-byte integer number.

[0130] Then, use the generated public key to encrypt the core layer plaintext to obtain the core layer ciphertext. The specific steps are as follows:

[0131] (1) Generate a random polynomial u (for subsequent randomization operations) and two noise polynomials e1 and e2 (both following a discrete Gaussian distribution, used to enhance encryption security and resist lattice attacks) using a cryptographically secure random number generator.

[0132] (2) Calculate the intermediate components of the ciphertext, including calculating the first component c1 and the second component c2. When calculating the first component c1, a polynomial ring R is selected. q A pre-defined polynomial a (in matrix form, whose transpose is denoted as a) is randomly determined in the matrix. T The transpose operation adapts to the dimensionality requirements of multiplication within a polynomial ring, transforming a T Perform an in-ring multiplication operation with the random polynomial u, and then superimpose it with the noise polynomial e1 (the noise distribution is a discrete Gaussian distribution D). Z,σ＝2.4 (This is consistent with the noise distribution during the private key generation phase, used to resist lattice attacks), resulting in the first component c1. When calculating the second component c2, the transpose of the public key pk is taken as pk. T , will PK T Perform an in-ring multiplication operation with the random polynomial u, and then superimpose it with the noise polynomial e2 (the noise distribution is the same as e1, i.e., a discrete Gaussian distribution D). Z,σ＝2.4 ); then add the core layer plaintext M c The polynomial after transformation by the encoding function Δ(·) yields the second component c2;

[0133] (3) Combine the two intermediate components c1 and c2 to obtain the core layer ciphertext C. c = (c1, c2); where both c1 and c2 belong to the polynomial ring R. q The final ciphertext is stored in binary stream format.

[0134] For the selected auxiliary layer features, lightweight optimization is first performed, then auxiliary layer plaintext is generated, and finally the plaintext is encrypted to obtain auxiliary layer ciphertext.

[0135] Specifically, based on the NIST quantum-resistant candidate symmetric algorithm ASCON-Lite, its standard 12 rounds of iteration are optimized to 8 rounds. Then, the optimized 8-round round function is used to perform operations in a fixed order to optimize the key lightweight, generating 8 round keys k1, k2, ..., k8, with each round key being 320 bits long.

[0136] Then, based on the index order of the mapping indices of the auxiliary layer features, the filtered auxiliary layer features and their corresponding mapping indices are concatenated byte-level to obtain the auxiliary layer plaintext. In the auxiliary layer plaintext, each feature value is stored as a 4-byte floating-point number, and each index is stored as a 1-byte integer number, with the same logic as the specific calculation formula for the core layer plaintext.

[0137] The 8 round keys obtained above are used to perform 8 round function calculations on the plaintext of the auxiliary layer. The elements in the plaintext of the auxiliary layer are XORed using the round keys to encrypt the plaintext of the auxiliary layer and obtain the ciphertext of the auxiliary layer.

[0138] Finally, the two types of ciphertext are concatenated in the order of core layer ciphertext first, followed by auxiliary layer ciphertext, to form a composite authentication packet. This composite authentication packet includes a ciphertext type identifier, used to distinguish between the auxiliary layer ciphertext and the core layer ciphertext during subsequent decryption.

[0139] Step S3: Extract the auxiliary layer ciphertext and the core layer ciphertext from the composite authentication packet. First, perform auxiliary layer verification using the auxiliary layer ciphertext, and then perform core layer verification using the core layer ciphertext, and output the verification result.

[0140] First, the auxiliary layer ciphertext is extracted from the composite authentication packet using the ciphertext type identifier. The auxiliary layer ciphertext is then decrypted to obtain the first decryption result. Next, the first decryption result is verified using the auxiliary layer based on the pre-stored feature template. If the verification passes, the core layer ciphertext is extracted from the composite authentication packet and verified using the core layer. The final verification result is then output.

[0141] The decryption of the auxiliary layer ciphertext is essentially the inverse operation of the encryption round function. It involves executing eight rounds of round function iterations (using the same round keys k1, k2, ..., k8 as in the encryption phase), followed by XORing the first 128 bits of the iterated data to obtain the first decryption result. The entire decryption process uses the same 128-bit master key k0 and eight round keys as in the encryption phase to ensure correctness. Decryption of the core layer ciphertext is also the inverse operation of the previous encryption phase, but it uses the private key paired with the encryption key to ensure correctness.

[0142] During auxiliary layer verification, the current auxiliary layer feature and its second mapping index are extracted from the first decryption result. Based on the second mapping index, the corresponding second feature is extracted from the feature pre-stored template. Then, the average similarity between the current auxiliary layer feature and the second feature is calculated to obtain the auxiliary layer similarity. If the auxiliary layer similarity is ≥0.7, the auxiliary layer verification is successful, and the process can proceed to the next core layer verification step; otherwise, a verification failure result is output, and the verification failure process is triggered.

[0143] After the auxiliary layer verification passes, the core layer ciphertext is extracted from the composite authentication package and parsed to obtain the second decryption result. The current core layer feature and its first mapping index are then extracted from the second decryption result. Based on the first mapping index, the corresponding first feature is extracted from the feature pre-stored template. The average similarity between the current core layer feature and the first feature is then calculated to obtain the core layer similarity. If the core layer similarity is ≥0.8, the verification passes, and an authorization command is sent to the cloud-native access control component; otherwise, the verification fails, and the verification failure process is triggered.

[0144] Among them, because the core layer features have high stability, its threshold is set higher than that of the auxiliary layer to ensure authentication security.

[0145] The formula for calculating the similarity of the auxiliary layer is as follows:

[0146]

[0147] In the formula, q represents the number of auxiliary layer features (q = 4, i.e., keyboard input interval, mouse movement acceleration, microservice API call interval, and microservice request packet length), F a,j′ The value of the j-th feature in the current auxiliary layer (from the current auxiliary layer feature F) a′ Extracted from T a,j The feature value corresponding to the j-th auxiliary layer feature in the feature pre-stored template (from the feature pre-stored template T of the cloud-native distributed secure storage component). a Extracted from the array by index), λ is the similarity decay rate adjustment parameter, λ = 5 (λ value is optimized to ensure that the similarity decays to below 0.37 when the change is 0.2), exp(·) is the natural exponential function.

[0148] The formula for calculating the similarity of the core layer is as follows:

[0149]

[0150] In the formula, p represents the number of core layer features (p = 6, which are fingerprint ridge deformation rate, fingerprint ridge spacing time-varying value, iris main flutter frequency, iris amplitude change sequence, microservice image ID feature, and container ID feature, respectively), F c,i′Let T be the value of the i-th feature in the current core layer. c,i The feature value corresponding to the i-th core layer feature in the pre-stored template.

[0151] The above scheme improves authentication efficiency and reduces the computational load of the core layer by directly intercepting some invalid requests at the auxiliary layer through layered verification.

[0152] Step S4: Based on the verification result, send the corresponding operation instruction to the access control component and output the final authentication result.

[0153] If the final verification result is successful, an access authorization instruction is sent to the access control component, and the preset feature pre-stored template is dynamically updated based on the verification result. Dynamic updates overwrite the original template storage with the updated feature pre-stored template, synchronously triggering cross-container template synchronization.

[0154] If the verification result is unsuccessful, an access denial command is sent to the access control component, and the failure timestamp corresponding to the access denial command is recorded in the management log.

[0155] Specifically, upon successful verification, an authorization command containing the access subject identifier, resource identifier, and decryption signature is sent to the access control component to grant access to the target resource. Simultaneously, the overall difference rate of the associated feature set is calculated. When the overall difference rate is less than a set threshold, the feature prediction template is updated according to a set method, the expression of which is:

[0156] T new,i =0.8T i +0.2F i ;

[0157] In the formula, T new,i For the i-th feature value of the pre-stored template after the feature update, T i To store the i-th feature value of the template before updating, F i For the currently collected i-th feature value, 80% of the historical weights remain stable, and 20% of the current weights are used to adapt to feature drift.

[0158] As an improvement to the above solution, when the number of consecutive verification failures reaches 3, a local alarm is triggered and permissions are locked for 5 minutes; when it reaches 4, permissions are locked for 10 minutes; and when the number of consecutive verification failures exceeds 5, permissions are locked for 30 minutes. After the locking period ends, the number of consecutive verification failures is reset to zero.

[0159] Finally, the output of the verification success or failure result is synchronized to the management log.

[0160] Implementing the embodiments of this application has the following beneficial effects:

[0161] This application embodiment collects dual features of the access subject's identity and behavioral actions to obtain a two-dimensional dynamic primitive, which is more difficult to forge than traditional single-identity authentication, ensuring high accuracy and reliability of identity authentication. Then, by performing layered encryption on the features in the associated feature set, feature classification is achieved, and different encryption algorithms are implemented according to different classification results to achieve lightweight encryption and reduce encryption complexity. A hierarchical permission locking method is adopted, first verifying the auxiliary layer ciphertext and then verifying the core layer ciphertext, directly intercepting some invalid requests at the auxiliary layer, thus reducing the computational load on the core layer. Therefore, layered verification reduces the amount of data computation, effectively reducing verification latency and improving authentication efficiency, and achieving accurate identity authentication with less computing resources. Finally, the identity authentication result is output based on the verification result, achieving accurate identity authentication.

[0162] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of this application. It should be understood that the above descriptions are merely specific embodiments of this application and are not intended to limit the scope of protection of this application. In particular, it should be noted that any modifications, equivalent substitutions, or improvements made by those skilled in the art within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A two-dimension dynamic cell based anti-quantum identity authentication method, characterized in that, The method comprises the following steps: Collecting dynamic features from the identity feature dimension and the behavior feature dimension of the access subject, and performing hierarchical processing and mapping index allocation on the data collection results to obtain an associated feature set; Performing hierarchical encryption and ciphertext splicing on the associated feature set through a preset key encryption method to obtain a composite authentication package; Extracting auxiliary layer ciphertext and core layer ciphertext from the composite authentication package, performing auxiliary layer verification through the auxiliary layer ciphertext, performing core layer verification through the core layer ciphertext, and outputting a verification result; According to the verification result, sending corresponding operation instructions to the access control component to output a final authentication result.

2. The dual-dimension dynamic cell based anti-quantum identity authentication method according to claim 1, wherein, The method of collecting dynamic features from the identity feature dimension and the behavior feature dimension of the access subject, and performing hierarchical processing and mapping index allocation on the data collection results to obtain an associated feature set, specifically comprises the following steps: According to the type of the access subject, dynamic features are collected from the identity feature dimension and the behavior feature dimension of the access subject to obtain a two-dimensional dynamic element; wherein the two-dimensional dynamic element includes identity features and behavior features; According to a preset filtering condition, the generated associated feature pairs are layered to obtain core layer features and auxiliary layer features; wherein the associated feature pairs are obtained by one-to-one matching of the identity features and the behavior features; A corresponding first mapping index is generated for the core layer features, and a corresponding second mapping index is generated for the auxiliary layer features to construct the associated feature set containing the mapping index; wherein the second mapping index is connected after the first mapping index.

3. The dual-dimension dynamic cell based anti-quantum identity authentication method according to claim 2, wherein, The method of collecting dynamic features from the identity feature dimension and the behavior feature dimension of the access subject according to the type of the access subject to obtain a two-dimensional dynamic element, specifically comprises the following steps: If the access subject is a human subject, the fingerprint texture features and iris tremor features of the access subject are collected from the identity feature dimension, and the keyboard operation features and mouse movement features of the access subject are collected from the behavior feature dimension; If the access subject is a microservice subject or a container subject, the identity of the access subject is collected from the identity feature dimension, and the communication timing features of the access subject are collected from the behavior feature dimension; Wherein, the keyboard operation features are constructed by recording the timestamps of consecutive keystrokes when the access subject operates the keyboard, calculating the time difference between adjacent two keystrokes; the mouse movement features are constructed by calculating the mouse movement acceleration according to the position coordinate change amount when the access subject operates the mouse.

4. The dual-dimension dynamic cell based anti-quantum identity authentication method of claim 2, wherein, The method of layering the generated associated feature pairs according to a preset filtering condition to obtain core layer features and auxiliary layer features, specifically comprises the following steps: The identity features and behavior features are matched one-to-one to obtain a plurality of feature pairs; The feature pairs are filtered through the cosine similarity of the feature pairs to obtain the associated feature pairs; According to the collection frame number and character index data in the feature collection process, the fluctuation coefficient of the associated feature pairs is calculated; The associated feature pairs with a fluctuation coefficient less than or equal to a first threshold value are taken as core layer features, and the associated feature pairs with a fluctuation coefficient greater than the first threshold value are taken as auxiliary layer features.

5. The dual-dimension dynamic cell based anti-quantum identity authentication method according to claim 1, wherein, The associated feature set is hierarchically encrypted and ciphertext spliced by a preset key encryption method to obtain a composite authentication package, specifically: Core layer features containing a first mapping index and auxiliary layer features containing a second mapping index are extracted from the associated feature set; The core layer features and the auxiliary layer features are spliced in a preset index order to obtain core layer plaintext and auxiliary layer plaintext; Based on a preset key, the core layer plaintext and the auxiliary layer plaintext are encrypted to obtain core layer ciphertext and auxiliary layer ciphertext; wherein the key includes a public key and a private key, the public key is stored in a cloud native authentication server, and the private key is stored in a local module of an access subject; The ciphertexts are spliced in the order of core layer ciphertext first and auxiliary layer ciphertext last to generate a composite authentication package.

6. The dual-dimension dynamic cell based anti-quantum identity authentication method according to claim 5, wherein, The core layer features and the auxiliary layer features are spliced in a preset index order to obtain core layer plaintext and auxiliary layer plaintext, specifically: Based on the same mapping index, the feature relative change rate between the core layer features and the auxiliary layer features and a preset feature prestorage template is calculated; The core layer features and the auxiliary layer features are filtered according to the feature relative change rate; The filtered core layer features and the first mapping index are byte-level spliced in the index order of the first mapping index to obtain core layer plaintext; The filtered auxiliary layer features and the second mapping index are byte-level spliced in the index order of the second mapping index to obtain auxiliary layer plaintext.

7. The dual-dimension dynamic cell based anti-quantum identity authentication method of claim 1, wherein, The auxiliary layer ciphertext and the core layer ciphertext are extracted from the composite authentication package, the auxiliary layer is verified through the auxiliary layer ciphertext first, and then the core layer is verified through the core layer ciphertext to output a verification result, specifically: The auxiliary layer ciphertext is extracted from the composite authentication package, and the auxiliary layer ciphertext is decrypted to obtain a first decryption result; The auxiliary layer is verified by calculating the auxiliary layer similarity of the first decryption result according to a preset feature prestorage template, and if the auxiliary layer verification result is passed, the core layer ciphertext is extracted from the composite authentication package; The core layer ciphertext is decrypted to obtain a second decryption result; The core layer is verified by calculating the core layer similarity of the second decryption result according to the feature prestorage template, and a verification result is output.

8. The dual-dimension dynamic cell based anti-quantum identity authentication method of claim 7, wherein, The auxiliary layer similarity and the core layer similarity are specifically: The auxiliary layer features and the corresponding second mapping index are parsed from the first decryption result, and the core layer features and the corresponding first mapping index are parsed from the second decryption result; The first feature corresponding to the first mapping index and the second feature corresponding to the second mapping index are extracted from the feature prestorage template; The average similarity between the core layer features and the first feature is calculated to obtain the core layer similarity; The average similarity between the auxiliary layer features and the second feature is calculated to obtain the auxiliary layer similarity; wherein when the auxiliary layer similarity is greater than or equal to a second threshold value, the auxiliary layer verification result is passed.

9. The anti-quantum identity authentication method based on two-dimensional dynamic primitives according to any one of claims 1 to 8, characterized in that, The feature prestorage template is specifically: When the access subject performs identity authentication for the first time, the core layer features and the auxiliary layer features extracted from the access subject are stored in a preset template to obtain a feature pre-storage template; The feature pre-storage template is bound with the identity of the access subject and stored in a cloud-native authentication server; When the access subject performs identity authentication for the second time, the feature pre-storage template is used for identity authentication.

10. The dual-dimension dynamic cell based anti-quantum identity authentication method of claim 1, wherein, According to the verification result, the corresponding operation instruction is sent to the access control component, and the final authentication result is output, specifically: If the verification result is passed, an access authorization instruction is sent to the access control component, and the preset feature pre-storage template is dynamically updated according to the verification result; If the verification result is not passed, an access denial instruction is sent to the access control component, and the failure timestamp corresponding to the access denial instruction is recorded in the management log.

Images