Access permission control method and device, computer storage medium and electronic equipment

Abstract

The invention discloses an access permission control method and device, a computer storage medium and electronic equipment, and relates to the field of block chain technology and information security. The method comprises the following steps: acquiring biological characteristic information and access event information of a target object; the access event information is written into a public chain, and the public chain is used for recording data access information; performing Hash operation on the biological characteristic information to obtain a characteristic Hash value; the feature hash value is stored in a private chain, and the private chain is used for verifying the identity of the target object and performing authority management under the condition that the object information of the target object is not exposed; and adjusting the access authority of the target object according to the feature hash value on the private chain and the access event information on the public chain. According to the method and the device, the technical problem of poor information security caused by static management of authority in traditional data access control is solved.

Description

Technical Field

[0001] This application relates to the fields of blockchain technology and information security, and more specifically, to an access control method, device, computer storage medium, and electronic device. Background Technology

[0002] In the field of data access control, traditional permission management systems are often based on static role assignment, that is, each user role has a fixed set of permissions, and the permissions are usually not adjusted according to changes in user behavior or environment after assignment.

[0003] However, this static access control method cannot respond promptly to changes in user responsibilities, abnormal behavior, or changes in device security status. This may result in some users retaining relevant permissions when they no longer need to access specific resources, or failing to restrict users' ability to access sensitive data in high-risk environments, thereby increasing the risk of data leakage and misuse.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This application provides an access control method, apparatus, computer storage medium, and electronic device to at least solve the technical problem of poor information security caused by static access control in traditional data access control.

[0006] According to one aspect of the embodiments of this application, an access control method is provided, comprising: acquiring biometric information and access event information of a target object, wherein the biometric information is used to verify the identity of the target object, and the access event information is used to record access environment information, access time, and access behavior data when the target object performs an access action; writing the access event information into a public blockchain, wherein the public blockchain is used to record data access information; performing a hash operation on the biometric information to obtain a feature hash value; storing the feature hash value into a private blockchain, wherein the private blockchain is used to verify the identity of the target object and perform access control without exposing the object information of the target object; and adjusting the access permissions of the target object based on the feature hash value on the private blockchain and the access event information on the public blockchain.

[0007] Optionally, acquiring the biometric information and access event information of the target object includes: collecting the biometric information of the target object and performing a first authentication based on the biometric information and the result of the first liveness detection; if the first authentication is successful, fusing the biometric information to obtain fused feature information, and then calculating the weights based on the fused feature information to obtain a feature weight score; performing a second authentication based on the feature weight score and the result of the second liveness detection; if the second authentication is successful, determining the access permissions of the target object based on the fused feature information and context information, and generating access event information when the target object performs an access action, wherein the context information includes device trustworthiness, network location, and time sensitivity.

[0008] Optionally, upon successful initial authentication, the biometric information is fused to obtain fused feature information. Then, weights are calculated based on the fused feature information to obtain a feature weight score. This includes: obtaining target parameters by testing the fused feature information using a model, where the target parameters include the model's rejection rate, recognition rate, and acquisition time; determining the weight coefficients of the fused feature information based on the target parameters using an image segmentation algorithm; and calculating the feature weight score by combining the relevant parameters and weight coefficients.

[0009] Optionally, if the second authentication is successful, the access permissions of the target object are calculated based on the fused feature information and context information, and access event information is generated when the target object performs an access action. This includes: determining the initial access permission level based on the fused feature information, wherein the initial access permission level represents the access permissions that the target object has under normal behavior mode; obtaining a decay coefficient based on the time-sensitive quantification in the context information; determining a general risk score based on the context information, wherein the general risk score represents the degree of security risk faced by the current access request; and determining the access permissions of the target object based on the initial access permission level, the decay coefficient, and the general risk score.

[0010] Optionally, after storing the feature hash value in the private chain, the method further includes: verifying the feature hash value on the private chain using an anonymous verification strategy, wherein the anonymous verification strategy is used to perform the verification operation without revealing the real data pair.

[0011] Optionally, based on the feature hash value on the private blockchain and the access event information on the public blockchain, the access permissions of the target object are adjusted, including: generating a security status report based on the feature hash value and the access event information, wherein the security status report is used to characterize whether the current device's environment, geographical location, and access time meet preset conditions and whether the target object's access behavior meets preset behavioral characteristics; generating a current access risk score based on the security status report; and adjusting the access permissions of the target object based on the current access risk score.

[0012] Optionally, the access permissions of the target object are adjusted based on the current access risk score, including: when the current access risk score is greater than or equal to a preset threshold, a permission tightening strategy is executed, wherein the permission tightening strategy represents narrowing the access scope of the target object; when the current access risk score is less than the preset threshold, a permission expansion strategy is executed, wherein the permission expansion strategy represents expanding the access scope of the target object.

[0013] Optionally, after adjusting the access permissions of the target object based on the feature hash value on the private chain and the access event information on the public chain, the method further includes: interacting with the target system and collecting the behavioral profile of the target object; performing anomaly detection on the target object based on the behavioral profile and obtaining the detection results; and transmitting the detection results to the target system.

[0014] According to another aspect of the embodiments of this application, an access control device is also provided, comprising: an acquisition unit, configured to acquire biometric information and access event information of a target object, wherein the biometric information is used to verify the identity of the target object, and the access event information is used to record access environment information, access time, and access behavior data when the target object performs an access action; a first processing unit, configured to write the access event information into a public blockchain, wherein the public blockchain is used to record data access information; an encryption unit, configured to perform a hash operation on the biometric information to obtain a feature hash value; a second processing unit, configured to store the feature hash value into a private blockchain, wherein the private blockchain is used to verify the identity of the target object and perform access control without exposing the object information of the target object; and an adjustment unit, configured to adjust the access permissions of the target object based on the feature hash value on the private blockchain and the access event information on the public blockchain.

[0015] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, which stores a computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located performs the above-described access control method.

[0016] According to another aspect of the embodiments of this application, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when one or more programs are executed by one or more processors, the one or more processors cause the one or more processors to perform the access control method described above.

[0017] According to another aspect of the embodiments of this application, a computer program product is also provided, including a computer program or instructions, which implement the above-described access control method when executed by a processor.

[0018] In this application, the access control method first obtains the biometric information and access event information of the target object. The biometric information is used to verify the identity of the target object, and the access event information is used to record the access environment information, access time, and access behavior data when the target object performs an access action. The access event information is written to a public blockchain, which is used to record data access information. A hash operation is performed on the biometric information to obtain a feature hash value. The feature hash value is stored on a private blockchain, which is used to verify the identity of the target object and manage access permissions without exposing the target object's object information. Based on the feature hash value on the private blockchain and the access event information on the public blockchain, the access permissions of the target object are adjusted.

[0019] In this embodiment, a method is adopted in which a private chain stores the feature hash value and a public chain records access event information. By combining a dynamic permission adjustment mechanism with biometric verification, the goal of accurately controlling data access permissions and enhancing access event auditing capabilities is achieved. This results in improving data security and access control flexibility, thereby solving the technical problem of poor information security caused by static permission management in traditional data access control. Attached Figure Description

[0020] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0021] Figure 1 This is a flowchart of an optional access control method according to an embodiment of this application;

[0022] Figure 2 This is a schematic diagram of an optional access control system according to an embodiment of this application;

[0023] Figure 3 This is a schematic diagram of an optional liveness detection method according to an embodiment of this application;

[0024] Figure 4This is a schematic diagram of an optional access context-aware module according to an embodiment of this application;

[0025] Figure 5 This is a schematic diagram of an optional access control device according to an embodiment of this application. Detailed Implementation

[0026] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0027] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0028] According to an embodiment of this application, an access control method is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0029] According to the embodiments of this application, an access control system (hereinafter referred to as the system) can be used as the execution subject of the access control method of this application embodiment. The access control system can be a software system or an embedded system combining software and hardware. Of course, the method execution subject in the embodiments of this application can also be other forms of execution subject, such as devices or equipment. Those skilled in the art should know that this application does not particularly limit the specific form of the method execution subject.

[0030] Figure 1 This is a flowchart of an optional access control method according to an embodiment of this application, such as... Figure 1As shown, the method includes the following steps:

[0031] Step S101: Obtain the biometric information and access event information of the target object. The biometric information is used to verify the identity of the target object, and the access event information is used to record the access environment information, access time, and access behavior data when the target object performs an access action.

[0032] Optionally, biometric information includes, but is not limited to, optical fingerprints, facial micro-expression sequences, finger vein images, and voiceprints, used to verify the authenticity of the target's identity.

[0033] Optionally, the access event information includes access environment information (such as the security status of the device), access time, and access behavior data (such as keyboard input dynamics) when the target object performs the access action.

[0034] Optionally, the system collects the biometric information of the target object through integrated hardware devices, such as bank terminals, mobile banking, and counter equipment. Simultaneously, the system can record the specific environment in which the target object attempts to access data, such as whether the device is in a trusted execution environment, geographic location data determined through GPS, base station, and fingerprint triple positioning technology, as well as the access timestamp and user behavior data, such as transaction frequency and IP address, which together constitute access event information.

[0035] Step S102: Write the access event information into the public blockchain, whereby the public blockchain is used to record data access information.

[0036] Optionally, the public blockchain allows anyone to join and participate in verifying and recording transaction information, offering high transparency and immutability. In this application, the public blockchain is used to permanently record information for each access event, including the time, location, and behavioral data of the access.

[0037] Optionally, the system will de-identify the collected access event information, convert it into data entries in a standard format, and then use a smart contract to write the data entries into the corresponding positions in the public blockchain. This will record the access events in a decentralized and tamper-proof database, which will help ensure the transparency of auditing and the integrity of event records.

[0038] Step S103: Perform a hash operation on the biometric information to obtain the feature hash value.

[0039] Alternatively, hash operations can convert input data of arbitrary length into a fixed-length output, and the output length is usually small and consistent, called a hash value. Hash operations are one-way, meaning it is difficult to deduce the input from the output, but the same input will always produce the same output.

[0040] Optionally, the system performs a hash operation on the biometric information obtained from the target object, converting the biometric information into a feature hash value, which helps to protect the confidentiality of the original biometric information, since the feature hash value cannot directly reflect the details of the biometrics, thereby verifying the user's identity while protecting privacy.

[0041] Step S104: Store the feature hash value in a private chain. The private chain is used to verify the identity of the target object and manage permissions without exposing the object information of the target object.

[0042] Alternatively, private blockchains can be accessed and maintained only by members of a specific group or institution, offering greater privacy for their data and transactions.

[0043] Optionally, the feature hash value, along with the access permission data of the target object, is encrypted and stored on a private blockchain. This helps ensure that only authorized entities can access and verify the feature hash value, protecting the privacy of user identities and providing a data foundation for access control.

[0044] Step S105: Adjust the access permissions of the target object based on the feature hash value on the private chain and the access event information on the public chain.

[0045] Optionally, dynamic permission adjustment is a process of automatically updating the access permissions of the target object based on the real-time authentication results and the current access environment conditions.

[0046] Optionally, the system compares the characteristic hash value of the target object in a trusted execution environment to verify its identity. Simultaneously, it assesses the risk score of the target object's access requests using access event information on the public blockchain. Based on a dynamic permission decay model, it calculates a dynamic access level by comprehensively considering factors such as access time, geographical location, and device trustworthiness, and adjusts the target object's access permissions accordingly. For example, if the risk score is high, the dynamic access level will be lowered, meaning that access to more sensitive resources will be restricted for the target object.

[0047] In one optional embodiment, acquiring the biometric information and access event information of the target object includes: collecting the biometric information of the target object and performing a first authentication based on the biometric information and the result of a first liveness detection; if the first authentication is successful, fusing the biometric information to obtain fused feature information, and then calculating a weight score based on the fused feature information; performing a second authentication based on the feature weight score and the result of a second liveness detection; if the second authentication is successful, determining the access permissions of the target object based on the fused feature information and context information, and generating access event information when the target object performs an access action, wherein the context information includes device trustworthiness, network location, and time sensitivity.

[0048] Optionally, liveness detection verifies whether a target is a living individual by detecting the dynamic properties of biometrics, preventing the use of prosthetics or electronic deception. The initial liveness detection involves detecting blood flow fluctuations in fingerprints, detecting artificial material reflections on the face, and analyzing the electromagnetic interference characteristics of voiceprints.

[0049] Optionally, liveness detection helps reduce static forgery of biometric information and improves the security of identity verification. Meanwhile, collecting multiple types of biometrics facilitates subsequent feature fusion and weight calculation, laying the foundation for more comprehensive identity verification.

[0050] Optionally, the system performs feature-level fusion on the biometric information that has passed the first authentication, and performs weighted processing based on information fusion theory. Subsequently, according to the pre-set weight coefficients, combined with the rejection rate, recognition rate and acquisition time of each biometric feature, a feature weight score is calculated.

[0051] Optionally, through feature fusion and weight calculation, the system can more comprehensively and objectively evaluate the identity authentication level of the target object, thereby reducing the error rate of single feature recognition and improving the accuracy and efficiency of identity authentication.

[0052] Optionally, after feature fusion, additional liveness detection of the target object can help ensure that the fused feature information has not been tampered with or simulated.

[0053] Optionally, the system utilizes the target object's fused characteristic information and contextual information, such as device security status, network location, and access requirements within a specific time period, to determine the target object's access permissions. Once the target object performs an access action, the system immediately generates detailed access event information, recording the specific details of the access.

[0054] Optionally, a context-based dynamic permission determination mechanism can flexibly adjust the access permissions of target objects, helping to address security needs in different access environments. Simultaneously, the generation of access event information can strengthen auditing, facilitate subsequent review and monitoring, and contribute to the compliance and security of data access behavior.

[0055] In one optional embodiment, upon successful initial authentication, biometric information is fused to obtain fused feature information. Then, weight calculation is performed based on the fused feature information to obtain a feature weight score. This includes: obtaining target parameters by testing the fused feature information using a model, wherein the target parameters include the model's rejection rate, recognition rate, and acquisition time; determining the weight coefficients of the fused feature information based on the target parameters using an image segmentation algorithm; and calculating the feature weight score by combining the relevant parameters and weight coefficients.

[0056] Optionally, fusing feature information can combine biometric information from different modalities to form a comprehensive information set containing more feature details. The fusion process utilizes information fusion algorithms, which helps to provide more accurate fusion results.

[0057] Optionally, after the first successful authentication, the system performs feature-level fusion of the target object's biometric information using an information fusion algorithm to generate fused feature information, thereby forming a more comprehensive biometric image of the target object, reducing the error rate that may be caused by single-modal biometric recognition, and improving the accuracy and security of subsequent authentication.

[0058] Optionally, the target parameters include the model's rejection rate, recognition rate, and data acquisition time. The rejection rate refers to the probability that the system incorrectly rejects a legitimate user's identity, the recognition rate is the probability that the system incorrectly accepts an illegitimate user's identity, and the data acquisition time is the time required to acquire biometric information.

[0059] Optionally, obtaining the target parameters provides a quantitative basis for subsequent weight calculation, which helps the system to more objectively evaluate the effectiveness and real-time nature of different biometric information and prepares for the calculation of feature weight scores.

[0060] Optionally, the model architecture includes:

[0061] Input layer: Receives raw data from multimodal biometrics, including fingerprint images, facial images, voiceprint signals, and finger vein images.

[0062] Feature extraction layer: Design corresponding feature extraction networks for each biometric feature, such as using convolutional neural networks to process image data and long short-term memory networks to process voiceprint signals.

[0063] Fusion layer: Adopting an improved version of information fusion theory, it fuses features extracted from different biological characteristics to form a comprehensive feature vector.

[0064] Prediction layer: Contains multiple fully connected layers to predict rejection rate, recognition rate, and data acquisition time.

[0065] Optionally, specific network layer parameters include:

[0066] Convolutional layers: Use convolutional kernels of different sizes, such as 3x3, 5x5, and 7x7, to extract multi-scale features. The number of convolutional layers is adjusted according to the feature complexity, typically 3 to 5 layers.

[0067] Pooling layers: Use max pooling or average pooling to reduce the spatial size of the feature map, reduce computational cost, and avoid overfitting.

[0068] Time series layer: Used to process time series data of voiceprint signals, containing at least two time series units to capture long-term dependencies.

[0069] Fully connected layer: The fully connected layer in the prediction layer contains hundreds of neurons and is used for comprehensive analysis and prediction.

[0070] Activation function: ReLU is used as the activation function for the intermediate layer, and sigmoid is used as the activation function for the output layer to obtain prediction values ​​in the range [0,1].

[0071] Optionally, the model needs to predict the rejection rate, recognition rate, and data acquisition time simultaneously. Therefore, the loss function should include multiple components to reflect the prediction errors for these tasks. Furthermore, the model should give due consideration to the error of each prediction metric, which can be achieved by weighting the loss for each task.

[0072] Specifically, the rejection rate prediction loss uses mean squared error as the loss function to quantify the difference between the predicted and actual rejection rates. The recognition rate prediction loss also uses mean squared error to quantify the difference between the predicted and actual recognition rates. The acquisition time prediction loss uses a smoothed L1 loss to penalize larger prediction errors, as acquisition time may have high temporal resolution.

[0073] Optionally, the dataset is constructed by collecting a large number of biometric samples, including data collected under normal conditions as well as data collected under various environmental and device conditions. Each sample should be labeled with the actual rejection rate, acceptance rate, and collection time.

[0074] Optionally, the rejection rate label corresponds to the actual rejection rate of each biometric sample under specific environmental conditions; the recognition rate label corresponds to the actual recognition rate of each biometric sample under specific environmental conditions; and the acquisition time label reflects the actual time spent on the acquisition process for each biometric sample, which can be in milliseconds.

[0075] Optionally, for each target parameter, the system needs to determine a weight coefficient to reflect the importance of different parameters in the feature weight score calculation. The weight coefficient can be updated in real time during system operation through machine learning or a rule engine.

[0076] Optionally, the system first uses an image segmentation algorithm to analyze the fused feature information, identify the feature regions of each biometric feature, and then determines the weight coefficients of each feature region based on the rejection rate, recognition rate, and acquisition time obtained in the model test. Subsequently, the fused feature information is comprehensively scored using formula (1) to obtain the feature weight score. Wherein, formula (1) is:

[0077] W i =α×FRR i +β×FAR i +γ×T i (1)

[0078] Among them, W i For comprehensive weighted scoring, FRR i For rejection rate, FAR i For recognition rate, T i Let be the acquisition time at time i, and α, β, and γ be weighting coefficients, with α+β+γ=1.

[0079] Optionally, by quantifying the recognition accuracy and efficiency of fused feature information and dynamically adjusting the weight of different biometric information in identity verification, the system can focus on higher quality and more efficient feature information when processing identity verification, thereby improving the accuracy of identity verification and real-time response capability.

[0080] In an optional embodiment, upon successful second authentication, the access permissions of the target object are calculated based on the fused feature information and context information, and access event information is generated when the target object performs an access action. This includes: determining an initial access permission level based on the fused feature information, wherein the initial access permission level represents the access permissions that the target object possesses under normal behavior patterns; obtaining a decay coefficient based on time-sensitive quantification in the context information; determining a general risk score based on the context information, wherein the general risk score represents the degree of security risk faced by the current access request; and determining the access permissions of the target object based on the initial access permission level, the decay coefficient, and the general risk score.

[0081] Optionally, the system first determines the initial access permission level corresponding to the fused feature information in historical behavior patterns based on the fused feature information of the target object. For example, a system administrator who frequently accesses sensitive data may have a higher initial access permission level under normal behavior patterns.

[0082] Optionally, time sensitivity refers to the system's sensitivity adjustment to access permissions within a specific time period. For example, the permission requirements for accessing medical data at night may be more stringent, and the weight may increase by 30%.

[0083] Optionally, the system calculates a dynamic attenuation coefficient based on the current time sensitivity. For example, if it is late at night and a target attempts to access medical data, the attenuation coefficient will increase accordingly to reflect the system's high sensitivity to nighttime access. By introducing an attenuation coefficient, the system can adjust access permissions in real time according to changes in time, which helps to have a more stringent access control mechanism during high-risk periods or sensitive times, thereby reducing unintended access to sensitive data.

[0084] Optionally, the general risk score is a quantitative indicator for assessing the level of security risk faced by the current access request. The system calculates the general risk score related to the current access request by analyzing data such as device trustworthiness and network location in the context information, combined with historical risk models and behavioral anomalies.

[0085] Optionally, the determination of a general risk score provides a key risk assessment basis for the final adjustment of access permissions. The system can intelligently adjust access permissions based on the risk score, which helps to ensure that data security is not threatened.

[0086] Optionally, the system uses formula (2) to calculate the final access permissions of the target object. Through the calculation of permissions, the system can comprehensively consider the normal access permissions, time sensitivity, and risk of access requests of the target object to determine the real-time access permissions. Formula (2) is as follows:

[0087] AccessLevel = BaseLevel × ×(1-RiskScore)(2)

[0088] Where AccessLevel is the access level, BaseLevel is the base level, RiskScore is the general risk score, λ is the decay coefficient, t is the time interval from the current access request time to the last successful authentication time, and RiskScore∈[0,1] is calculated by the abnormality of behavior.

[0089] Optionally, the system's dynamic permission adjustment mechanism helps improve the flexibility and security of access permissions. It can respond to changes in risk in real time without affecting the normal working process of the target object, reducing the risks that may be caused by static permission settings.

[0090] In an alternative embodiment, after storing the feature hash value to the private chain, the method further includes: verifying the feature hash value on the private chain using an anonymous verification strategy, wherein the anonymous verification strategy is used to perform the verification operation without revealing the real data pair.

[0091] Optionally, after the target object is authenticated, the fused feature information is hashed to generate a feature hash value, which is then stored on a private blockchain as part of the target object's authentication record. Storing biometric information by hash helps protect the privacy of the original biometric data, while also contributing to data integrity and immutability, providing a foundation for subsequent anonymous verification.

[0092] Optionally, the anonymous verification strategy can employ technologies such as zero-knowledge proofs to verify the feature hash value on the private chain without revealing the real biometric data corresponding to the hash value, which helps ensure data compliance and security.

[0093] In one optional embodiment, adjusting the access permissions of the target object based on the feature hash value on the private blockchain and the access event information on the public blockchain includes: generating a security status report based on the feature hash value and the access event information, wherein the security status report is used to characterize whether the current device's environment, geographical location, and access time meet preset conditions and whether the target object's access behavior meets preset behavioral characteristics; generating a current access risk score based on the security status report; and adjusting the access permissions of the target object based on the current access risk score.

[0094] Optionally, the system will combine the characteristic hash value on the private blockchain to verify the authenticity of the target object's identity, and simultaneously utilize access event information on the public blockchain to analyze whether the target object's behavior patterns and environmental conditions are abnormal or pose potential risks. For example, if the target object attempts to access sensitive data from an unverified device at an unfamiliar location, the system will generate a security status report reflecting the anomaly. By generating security status reports, the system can monitor and assess the compliance and security of the target object's access behavior in real time, providing detailed data for the subsequent risk scoring calculation.

[0095] Optionally, based on the generated security status report, the system further calculates the overall risk score faced by the current access request. This score may involve multiple dimensions, such as device trustworthiness, geographical location trustworthiness, access time sensitivity, and the degree of anomalousness of behavioral characteristics. For example, attempting to access financial data from an unconventional geographical location at night may cause the risk score to rise sharply. The generation of the current access risk score provides a quantitative risk assessment indicator for the dynamic adjustment of access permissions, helping the system to react quickly based on real-time risks, thereby improving the effectiveness of data protection.

[0096] Optionally, the system can automatically or semi-automatically adjust the access permissions of target objects based on the current access risk score. If the risk score is high, the system may restrict the target object's access to specific types of data or require additional verification steps, such as two-factor authentication. Conversely, if the score is low, the system may maintain existing access permissions or moderately relax them under certain conditions. Dynamic permission adjustment helps the system cope with constantly evolving security threats while minimizing the impact on normal data access processes, achieving a balance between security and efficiency.

[0097] In one optional embodiment, adjusting the access permissions of the target object based on the current access risk score includes: when the current access risk score is greater than or equal to a preset threshold, executing a permission tightening strategy, wherein the permission tightening strategy represents narrowing the access scope of the target object; and when the current access risk score is less than the preset threshold, executing a permission expansion strategy, wherein the permission expansion strategy represents expanding the access scope of the target object.

[0098] Optionally, based on the biometric information and environmental context collected by the system, including device trustworthiness, geographical location, access time, and behavioral characteristics, a previously defined risk scoring algorithm is used to calculate the current access risk score of the target object. The higher the score, the greater the potential access risk.

[0099] Optionally, the calculated current access risk score can be compared with a preset access risk threshold set by the system. The preset threshold is a standard set during the system design phase based on security policies and risk management strategies, used to distinguish between low-risk and high-risk access behaviors.

[0100] Optionally, when a target's current access risk score is higher than or equal to a preset threshold, the system automatically executes a series of strategies designed to reduce the risk of data breaches by narrowing the target's access scope. The system automatically restricts the target's access to specific sensitive data, such as preventing access to financial records or patient health data. In some cases, the system may also require secondary verification, such as via finger vein recognition or iris scanning, to confirm the operator's identity. Changes to access permissions take effect immediately, helping to prevent immediate access to sensitive information even if a potential threat exists.

[0101] Optionally, when a target's current access risk score is below a preset threshold, the system can relax its access permissions as needed to improve work efficiency and user experience. Based on the target's role and historical access patterns, the system can appropriately expand its access scope, allowing access to more non-sensitive data or higher-level data processing operations. For certain routine or high-frequency access tasks, the system may no longer require complex multimodal biometric verification for each operation to improve access efficiency. It is important to note that decisions to expand permissions should be made in a way that contributes to overall security stability, reducing security vulnerabilities caused by over-trust.

[0102] In an optional embodiment, after adjusting the access permissions of the target object based on the feature hash value on the private chain and the access event information on the public chain, the method further includes: interacting with the target system and collecting the behavioral profile of the target object; performing anomaly detection on the target object based on the behavioral profile and obtaining the detection result; and transmitting the detection result to the target system.

[0103] Optionally, the target system refers to the application system or platform where the sensitive data is located, such as a bank's risk control system.

[0104] Optionally, after completing the access permission adjustment based on multimodal biometrics, the system proactively establishes a connection with the target system and begins to collect behavioral profiles of the target object in real time, including but not limited to a wide range of behavioral data points such as access frequency, access time, access location, device usage habits, and operation mode.

[0105] Optionally, the behavioral profile integrates various behavioral data of the target object in the target system to form a dynamic set of behavioral features, which is used to describe the target object's normal access patterns and behavioral habits.

[0106] Optionally, anomaly detection identifies behaviors that deviate from the normal range by comparing behavioral profiles with preset normal behavior patterns, thereby determining whether there is a security risk.

[0107] Optionally, the system uses deep learning and data analysis to perform behavioral profiling on the target object, employing advanced machine learning algorithms (such as clustering analysis and neural networks) to identify whether the target object's behavior deviates from its historical behavioral baseline. The purpose of anomaly detection is to promptly identify potential unauthorized access or operations, such as account theft or malicious internal operations. Through immediate intervention and response, it aims to minimize the impact of security incidents and protect sensitive data from harm.

[0108] Optionally, once the anomaly detection process has completed the behavioral analysis of the target object and generated detection results, the system will immediately feed back the detection results to the target system.

[0109] Optionally, the interaction with the target system supports a "zero trust" strategy, which means that biometrics must be re-verified for each sensitive operation, rather than a one-time authentication that is valid indefinitely.

[0110] Figure 2 This is a schematic diagram of an optional access control system according to an embodiment of this application. Figure 2 As shown, the access control system comprises a biometric acquisition layer, a multimodal fusion engine, a dynamic access control layer, and a blockchain audit layer. The biometric acquisition layer includes an optical fingerprint sensor with blood detection capabilities; a 3D structured light camera for capturing facial micro-expression sequences; a finger vein imaging module; and a voiceprint acquisition array for beamforming microphones. The multimodal fusion engine includes feature-level fusion and liveness detection. The dynamic access control layer includes a context-aware module for creating a visual dashboard and a permission calculation model. The blockchain audit layer includes storing biometric hash values ​​on a private blockchain, writing access records to the public blockchain via smart contracts, and zero-knowledge proof-based audit privacy protection.

[0111] Figure 3 This is a schematic diagram of an optional liveness detection method according to an embodiment of this application. Figure 3 As shown, liveness detection includes the detection of fingerprints, faces, and voiceprints. Fingerprint detection is based on blood flow fluctuation detection using photoplethysmography (PPG) pulse wave signals; face detection uses a residual network to identify the reflective properties of artificial materials; and voiceprint detection is used to detect electromagnetic interference features during audio recording and playback.

[0112] Figure 4 This is a schematic diagram of an optional context-aware module according to an embodiment of this application. For example... Figure 4 As shown, the context-aware module includes device trustworthiness, network location, and time sensitivity. Device trustworthiness is based on a security report from a trusted execution environment; network location is based on triple positioning using GPS, base station, and wireless fingerprinting; and time sensitivity is used to adjust access weights during specific time periods.

[0113] Figure 5 This is a schematic diagram of an optional access control device according to an embodiment of this application. According to another aspect of an embodiment of this application, an access control device is also provided, including: an acquisition unit 501, a first processing unit 502, an encryption unit 503, a second processing unit 504, and an adjustment unit 505.

[0114] The system includes: an acquisition unit 501 for acquiring biometric information and access event information of the target object, wherein the biometric information is used to verify the identity of the target object, and the access event information is used to record the access environment information, access time, and access behavior data when the target object performs an access action; a first processing unit 502 for writing the access event information into a public blockchain, wherein the public blockchain is used to record data access information; an encryption unit 503 for performing a hash operation on the biometric information to obtain a feature hash value; a second processing unit 504 for storing the feature hash value into a private blockchain, wherein the private blockchain is used to verify the identity of the target object and perform access control without exposing the object information of the target object; and an adjustment unit 505 for adjusting the access permissions of the target object based on the feature hash value on the private blockchain and the access event information on the public blockchain.

[0115] Optionally, the acquisition unit 501 includes: a first verification subunit, used to collect the biometric information of the target object and perform a first authentication based on the biometric information and the result of the first liveness detection; a weight score calculation subunit, used to perform feature fusion on the biometric information to obtain fused feature information if the first authentication is successful, and then perform weight calculation based on the fused feature information to obtain a feature weight score; a second verification unit, used to perform a second authentication on the biometric information based on the feature weight score and the result of the second liveness detection; and a generation subunit, used to determine the access permissions of the target object based on the fused feature information and context information if the second authentication is successful, and generate access event information when the target object performs an access action, wherein the context information includes device trustworthiness, network location, and time sensitivity.

[0116] Optionally, the weight scoring subunit includes: a parameter acquisition module, used to obtain target parameters by testing the fused feature information on the model, wherein the target parameters include the model's rejection rate, recognition rate, and acquisition time; a weight coefficient determination module, used to determine the weight coefficients of the fused feature information based on the target parameters using an image segmentation algorithm; and a calculation module, used to calculate the feature weight score by combining the relevant parameters and weight coefficients.

[0117] Optionally, the generation subunit includes: a first determining module, used to determine an initial access permission level based on fused feature information, wherein the initial access permission level characterizes the access permissions possessed by the target object under normal behavior mode; a second determining module, used to obtain an attenuation coefficient based on time-sensitive quantification in context information; a third determining module, used to determine a general risk score based on context information, wherein the general risk score characterizes the degree of security risk faced by the current access request; and a fourth determining module, used to determine the access permissions of the target object based on the initial access permission level, the attenuation coefficient, and the general risk score.

[0118] Optionally, the access control device further includes: a first generation unit, used to generate a security status report based on the feature hash value and access event information, wherein the security status report is used to characterize whether the current device's environment, geographical location, access time meet preset conditions and whether the target object's access behavior meets preset behavioral characteristics; a second generation unit, used to generate a current access risk score based on the security status report; and an adjustment unit, used to adjust the access permissions of the target object based on the current access risk score.

[0119] Optionally, the adjustment unit 505 includes: a first processing subunit, used to execute a permission tightening strategy when the current access risk score is greater than or equal to a preset threshold, wherein the permission tightening strategy represents narrowing the access scope of the target object; and a second processing subunit, used to execute a permission expansion strategy when the current access risk score is less than a preset threshold, wherein the permission expansion strategy represents expanding the access scope of the target object.

[0120] Optionally, the access control device further includes: an interaction unit for interacting with the target system and collecting a behavioral profile of the target object; a detection unit for performing anomaly detection on the target object based on the behavioral profile and obtaining detection results; and a transmission unit for transmitting the detection results to the target system.

[0121] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, which stores a computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located performs the above-described access control method.

[0122] According to another aspect of the embodiments of this application, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when one or more programs are executed by one or more processors, the one or more processors cause the one or more processors to perform the access control method described above.

[0123] According to another aspect of the embodiments of this application, a computer program product is also provided, including a computer program or instructions, which implement the above-described access control method when executed by a processor.

[0124] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0125] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0126] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0127] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0128] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0129] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0130] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. An access control method, characterized in that, include: The biometric information and access event information of the target object are obtained, wherein the biometric information is used to verify the identity of the target object, and the access event information is used to record the access environment information, access time, and access behavior data when the target object performs an access action; The access event information is written into the public blockchain, wherein the public blockchain is used to record data access information; Perform a hash operation on the biometric information to obtain the feature hash value; The feature hash value is stored in a private chain, wherein the private chain is used to verify the identity of the target object and perform access control without exposing the object information of the target object; Based on the characteristic hash value on the private chain and the access event information on the public chain, the access permissions of the target object are adjusted.

2. The access control method according to claim 1, characterized in that, Obtain the target object's biometric information and access event information, including: The biometric information of the target object is collected, and the first identity verification is performed based on the biometric information and the result of the first liveness detection. If the first identity verification is successful, the biometric information is fused to obtain fused feature information, and then a weight is calculated based on the fused feature information to obtain a feature weight score. Based on the feature weight score and the results of the second liveness detection, the biometric information is subjected to a second identity verification. If the second authentication is successful, the access permissions of the target object are determined based on the fused feature information and context information, and access event information is generated when the target object performs an access action. The context information includes device trustworthiness, network location, and time sensitivity.

3. The access control method according to claim 2, characterized in that, Upon successful initial authentication, the biometric information is fused to obtain fused feature information. Then, a weight calculation is performed based on the fused feature information to obtain a feature weight score, including: By testing the fused feature information on the model, target parameters are obtained, including the model's rejection rate, recognition rate, and data acquisition time. The weight coefficients of the fused feature information are determined based on the target parameters using an image segmentation algorithm. The feature weight score is calculated by combining the relevant parameters and the weight coefficients.

4. The access control method according to claim 2, characterized in that, If the second authentication is successful, the access permissions of the target object are calculated based on the fused feature information and context information, and access event information is generated when the target object performs an access action, including: An initial access permission level is determined based on the fused feature information, wherein the initial access permission level represents the access permissions that the target object has under normal behavior mode; The attenuation coefficient is obtained based on the time-sensitive quantification in the context information. A general risk score is determined based on the context information, wherein the general risk score characterizes the degree of security risk faced by the current access request; Access permissions for the target object are determined based on the initial access permission level, the attenuation coefficient, and the general risk score.

5. The access control method according to claim 1, characterized in that, After storing the feature hash value in the private chain, the method further includes: The feature hash value on the private chain is verified using an anonymous verification strategy, wherein the anonymous verification strategy is used to perform the verification operation without revealing the real data pair.

6. The access control method according to claim 1, characterized in that, Based on the characteristic hash value on the private blockchain and the access event information on the public blockchain, adjust the access permissions of the target object, including: Based on the feature hash value and the access event information, a security status report is generated, wherein the security status report is used to characterize whether the current device's environment, geographical location, and access time meet preset conditions, and whether the target object's access behavior meets preset behavior characteristics; Based on the security status report, a current access risk score is generated; Adjust the access permissions of the target object based on the current access risk score.

7. The access control method according to claim 6, characterized in that, Based on the current access risk score, adjust the access permissions of the target object, including: When the current access risk score is greater than or equal to a preset threshold, a permission tightening strategy is executed, wherein the permission tightening strategy represents narrowing the access scope of the target object; When the current access risk score is less than the preset threshold, a permission extension policy is executed, wherein the permission extension policy represents expanding the access scope of the target object.

8. The access control method according to claim 1, characterized in that, After adjusting the access permissions of the target object based on the characteristic hash value on the private blockchain and the access event information on the public blockchain, the method further includes: Interact with the target system and collect behavioral profiles of the target object; Based on the behavioral profile, anomaly detection is performed on the target object to obtain the detection results; The detection results are transmitted to the target system.

9. An access control device, characterized in that, include: The acquisition unit is used to acquire the biometric information and access event information of the target object, wherein the biometric information is used to verify the identity of the target object, and the access event information is used to record the access environment information, access time, and access behavior data when the target object performs an access action; The first processing unit is used to write the access event information into the public blockchain, wherein the public blockchain is used to record data access information; An encryption unit is used to perform a hash operation on the biometric information to obtain a feature hash value; The second processing unit is used to store the feature hash value in a private chain, wherein the private chain is used to verify the identity of the target object and perform access control without exposing the object information of the target object; An adjustment unit is used to adjust the access permissions of the target object based on the feature hash value on the private chain and the access event information on the public chain.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein when the computer program is executed, the device in which the computer-readable storage medium is located performs the access control method according to any one of claims 1 to 8.

11. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to perform the access control method according to any one of claims 1 to 8.

12. A computer program product, characterized in that, It includes a computer program or instructions that, when executed by a processor, implement the access control method according to any one of claims 1 to 8.

Images