A dynamic trusted permission authentication method and system based on multi-modal fusion

Abstract

The application provides a kind of dynamic trusted authority authentication method and system based on multi-modal fusion, it is related to trusted authentication technical field, method includes: the spatial position information of target user, biological characteristic information and behavior characteristic information are collected;Determine the security level quantization value of authentication scene, and match the predetermined score level fusion rule;Fusion calculation is carried out, and trusted score is obtained;Determine access permission level, and control system resource access;Periodically update trusted score in access process, and dynamically adjust access permission level according to the updated trusted score.The application solves the technical problem that the prior art is based on static threshold for permission division, which causes the authentication result to be disconnected with the actual security risk, and further causes the permission control to lack adaptive ability, which is difficult to cope with complex and changeable access environment.

Description

Technical Field

[0001] This invention relates to the field of trusted authentication technology, specifically to a dynamic trusted authorization authentication method and system based on multimodal fusion. Background Technology

[0002] As information systems evolve towards cloud computing, mobile terminals, and multi-service convergence, user access scenarios are becoming increasingly complex. Traditional authentication methods, often based on single identity credentials such as passwords, tokens, or single biometrics, are no longer sufficient to meet the access control requirements of high-security scenarios. To enhance security, existing technologies are gradually introducing multimodal authentication and static access control mechanisms, but significant shortcomings still exist.

[0003] Traditional authentication systems often rely on static thresholds for permission allocation, leading to a disconnect between authentication results and actual security risks. This results in a lack of adaptive access control, making it difficult to cope with complex and ever-changing access environments. Furthermore, existing technologies typically perform only one-time identity verification during the authentication process, failing to reflect the dynamic characteristics of user behavior over time. This leaves them vulnerable to identity drift or session hijacking risks during long sessions, hindering timely responses. Summary of the Invention

[0004] This application provides a dynamic trusted permission authentication method and system based on multimodal fusion, aiming to solve the technical problem that existing technologies mostly rely on static thresholds for permission division, resulting in authentication results being out of sync with actual security risks, and consequently, permission control lacking adaptability and struggling to cope with complex and ever-changing access environments.

[0005] The first aspect disclosed in this application provides a dynamic trusted access authentication method based on multimodal fusion. The method includes: collecting spatial location information, biometric information, and behavioral feature information of a target user; determining a security level quantification value for the authentication scenario based on context information, and matching the security level quantification value with a predetermined score-level fusion rule; performing fusion calculation on the spatial location information, biometric information, and behavioral feature information according to the predetermined score-level fusion rule to obtain a trusted score for the target user; determining the access permission level of the target user based on the trusted score, and controlling access to system resources according to the access permission level; periodically updating the trusted score during the access process, and dynamically adjusting the access permission level based on the updated trusted score.

[0006] The second aspect of this application discloses a dynamic trusted access authentication system based on multimodal fusion. The system is used in the aforementioned dynamic trusted access authentication method based on multimodal fusion. The system includes: an information acquisition module for acquiring spatial location information, biometric information, and behavioral characteristic information of a target user; a rule matching module for determining a security level quantification value for the authentication scenario based on context information and matching the security level quantification value with a predetermined score-level fusion rule; a fusion calculation module for performing fusion calculation on the spatial location information, biometric information, and behavioral characteristic information according to the predetermined score-level fusion rule to obtain a trusted score for the target user; an access control module for determining the access permission level of the target user based on the trusted score and controlling access to system resources according to the access permission level; and a level adjustment module for periodically updating the trusted score during the access process and dynamically adjusting the access permission level based on the updated trusted score.

[0007] One or more technical solutions provided in this application have at least the following beneficial effects: By integrating spatial location, biometric, and behavioral information, a multi-dimensional identity profile of target users is achieved, significantly improving the accuracy of identity recognition and resistance to impersonation. By introducing a context-driven security level quantification mechanism, authentication strategies can be dynamically adjusted according to scenario risks. Furthermore, by matching score-level fusion rules, adaptive fusion parameter configuration under different security levels is achieved, improving the system's adaptability and security strategy flexibility in high-risk and low-risk environments. By rule-based fusion of single-modal authentication results and introducing a risk correction mechanism, multi-source authentication information can form a unified and reliable score output, not only improving the utilization efficiency of multi-modal information but also achieving normalization. The system enhances the stability and interpretability of risk-adjusted scores, thereby improving the detection capabilities against deception attacks, forgery features, and abnormal behavior. It maps continuous trust scores to discrete permission levels and associates resource sets and operation sets through permission levels, achieving fine-grained access control. This mechanism effectively prevents unauthorized access while improving system resource utilization efficiency while ensuring security, achieving a balance between security and availability. Furthermore, it introduces continuous authentication and dynamic update mechanisms, enabling real-time adjustments to trust scores and permission levels based on user behavior and environmental changes. This enhances the system's defense against long-term session attacks, session hijacking, and behavior drift, thereby strengthening the continuous and dynamic security control capabilities of the authentication process.

[0008] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0009] Figure 1 This is a schematic diagram of a dynamic trusted authorization authentication method based on multimodal fusion, provided for an embodiment of this application.

[0010] Figure 2 This is a trend chart of instance data in a dynamic trusted authorization authentication method based on multimodal fusion provided in an embodiment of this application.

[0011] Figure 3 This is a schematic diagram of a dynamic trusted authorization authentication system based on multimodal fusion, provided as an embodiment of this application.

[0012] Explanation of reference numerals in the attached diagram: Information collection module 10, rule matching module 20, fusion calculation module 30, access control module 40, and level adjustment module 50. Detailed Implementation

[0013] To further illustrate the technical means and effects of the present invention in achieving its intended purpose, the following detailed description of the specific implementation methods, structures, features, and effects of the present invention, in conjunction with the accompanying drawings and preferred embodiments, is provided below.

[0014] Example 1, as Figure 1 As shown in the figure, this application provides a dynamic trusted authorization authentication method based on multimodal fusion, the method comprising: Collect spatial location information, biometric information, and behavioral information of target users.

[0015] The system acquires basic authentication input data from the target user, including spatial location information, biometric information, and behavioral characteristic information. Spatial location information is obtained through a UWB (Ultra-Wideband) ranging module, acquiring the real-time distance and relative orientation between the target user and the terminal device to characterize spatial proximity. Biometric information is collected through a face recognition or liveness detection module, collecting the user's facial or physiological features for identity verification. Behavioral characteristic information is obtained through terminal operation logs and sensor records, including click trajectories, input rhythm, and interaction sequences, to characterize user behavior patterns. These three types of data undergo time synchronization and basic preprocessing after collection to ensure that multimodal data can be compared and fused within the same authentication time sequence.

[0016] The security level quantification value of the authentication scenario is determined based on the context information, and the predetermined score-level fusion rule corresponding to the security level quantification value is matched.

[0017] The system dynamically assesses the security requirements of the current authentication scenario based on the authentication context. First, it acquires contextual information, including the user's geographical location, the terminal's usage environment, and the security attribute level of the target application. It then constructs costs for mistakenly accepting unauthorized users and for mistakenly rejecting legitimate users to measure the consequences of different security risks. Finally, it uses a weighted mapping function to comprehensively calculate the two types of costs, obtaining a quantified security level value. This quantified security level value reflects the risk sensitivity of the current scenario and is matched with a pre-defined score-level fusion rule base. This allows for the selection of corresponding fusion parameters and decision threshold combinations, enabling dynamic adaptation of authentication strategies under different security scenarios.

[0018] The spatial location information, biometric information, and behavioral feature information are fused and calculated according to the predetermined score-level fusion rules to obtain the trust score of the target user.

[0019] Based on predetermined score-level fusion rules, multimodal features are fused and calculated. First, spatial location information, biometric information, and behavioral feature information are input into the corresponding single-modal authentication models. Each single-modal authentication model outputs its own confidence score based on a support vector machine (SVM). According to the matching score-level fusion rules, the scores of each modality are weighted and fused to obtain a comprehensive authentication score. The comprehensive authentication score is then normalized to map it to a unified scoring range. Risk factors are then incorporated to correct the score. These risk factors are calculated jointly by device status, environmental status, and behavioral deviation, resulting in a final credibility score that characterizes the target user's current overall credibility.

[0020] In one specific implementation, this invention is applied to login authentication scenarios in high-security enterprise systems, such as financial data management platforms or industrial control platforms. The target user initiates a login request via a terminal device, and their UWB location information, biometric features, and behavioral data are collected in real time, with dynamic trust scores calculated. In this scenario, three typical authentication environments are set up: a general office environment (low security level), a remote access environment (medium security level), and a highly sensitive data access environment (high security level). The effectiveness of this method in terms of trust score stability and dynamic access control is verified through comparisons across different scenarios. Table 1 shows typical test data collected under different security level scenarios, with trust scores ranging from 0 to 1.

[0021] Table 1: Example Data Table

[0022] Based on the above data, the following line trend chart is drawn: Figure 2The reliability score is used to illustrate the dynamic characteristics of the reliability score as risk changes. The trend relationship is described as follows: when the risk factor is low (<0.2), the reliability score remains in the high range above 0.9; as the risk factor rises to around 0.5, the reliability score drops significantly to 0.75~0.8; when the risk factor exceeds 0.7, the reliability score drops rapidly to the range of 0.5~0.7; in abnormal behavior scenarios, the rate of score decline is greater, reflecting a dynamic penalty mechanism.

[0023] The access permission level of the target user is determined based on the trust score, and access to system resources is controlled according to the access permission level.

[0024] The trust score is mapped to system access permission levels. Specifically, the trust score range is divided into multiple preset level ranges, each corresponding to a different permission level and resource access set. The current trust score range is determined in real time, and the corresponding permission level is used as the target user's current access permission. Access control is applied to system resources based on the permission level, including allowing, restricting, or prohibiting access. A circuit breaker mechanism is executed for sensitive resources with permission levels below the current level, thereby achieving fine-grained access control and ensuring a balance between security and availability under different trust states.

[0025] The trust score is periodically updated during the access process, and the access permission level is dynamically adjusted based on the updated trust score.

[0026] During user access to the system, multimodal feature data is periodically re-collected or updated according to preset time intervals or event-triggered mechanisms, and the trust score is recalculated. A time decay function is introduced to reduce historical authentication results, reflecting the natural decay of user trust status over time. After obtaining a new trust score, the permission level mapping process is re-executed, and the current access permission level is dynamically adjusted to achieve real-time permission upgrade and downgrade control. When abnormal behavior or a rapid drop in the score is detected, a permission downgrade or re-authentication mechanism is triggered, thereby achieving continuous trusted authentication and dynamic security control.

[0027] Furthermore, the collection of target users' spatial location information, biometric information, and behavioral characteristic information includes: Based on UWB, the real-time distance and spatial orientation relationship between the target user and the terminal device are perceived to obtain the spatial location information; the biometric information of the target user is collected through biometric recognition technology; and the behavioral operation trajectory and interaction sequence of the target user are recorded as the behavioral feature information.

[0028] The spatial location information of the target user is acquired through a UWB (Ultra-Wideband) positioning module. High-frequency pulse signals are transmitted between the terminal device and the UWB tag worn or carried by the target user. The real-time distance between the two is calculated by measuring the signal's time of flight or time difference of arrival. Combined with angle measurements from multiple base stations or multi-antenna arrays, the spatial orientation relationship of the target user relative to the terminal device is determined, thus forming spatial location information data containing distance and orientation information. This data reflects whether the user is within a trusted operating area, provides spatial constraints for subsequent authorization assessments, and can effectively identify remote attacks or unauthorized approach behavior.

[0029] The system collects biometric information of target users and uses biometric recognition technology to verify their uniqueness. Specifically, a face recognition module collects user facial images, and a feature extraction algorithm obtains key facial feature vectors. Combined with liveness detection technology, blink detection, micro-expression analysis, or infrared depth information is used to determine whether the user is a genuine, live user, preventing photo or video spoofing attacks. In some implementations, fingerprint recognition, iris recognition, and other biometric features can be added as supplementary inputs. The collected biometric data is then normalized and standardized before being output as the input basis for subsequent single-modal authentication models.

[0030] The system records the behavioral characteristics of target users to characterize their operating habits and behavioral patterns. The terminal-side log collection module records the user's operational trajectory during authentication and use, including mouse movement paths, click frequency, keyboard input rhythm, and pause times—a sequence of interactive behaviors. This data, combined with touch trajectories or sensor data, forms a continuous behavioral stream. After time sorting and serialization, this behavioral data is used to construct a behavioral feature sequence model, reflecting the consistency and degree of abnormal deviation in user operations. This behavioral feature information is used for subsequent risk assessment and credibility score calculation, improving the ability to identify spoofed users or abnormal operations.

[0031] Furthermore, the security level quantification value of the authentication scenario is determined based on contextual information, including: Based on the context information, obtain the geographic location information of the authentication scenario; based on the context information, obtain the security attribute information of the target application requested by the target user; based on the geographic location information and the security attribute information, determine the first cost coefficient for incorrectly accepting an illegal user and the second cost coefficient for incorrectly rejecting a legitimate user; perform a weighted mapping calculation on the first cost coefficient and the second cost coefficient to obtain the quantified value of the security level.

[0032] Extract the geographic location information of the current authentication request from the context information, including but not limited to GPS positioning results, network base station location, or terminal system positioning information, to characterize the spatial environment in which the authentication occurs. Parse the target application currently requested by the target user from the context and obtain the corresponding security attribute information of the application, such as the system level to which the application belongs, data sensitivity, and access control level, to characterize the business risk level.

[0033] Two types of error cost coefficients are calculated for authentication decisions based on geographic location information and application security attribute information. The first cost coefficient, which measures the security risk of mistakenly allowing unauthorized users in the current scenario, measures the business interruption or efficiency loss caused by mistakenly rejecting legitimate users. Based on the risk level of geographic location (e.g., high-risk areas, abnormal login locations) and the application security attribute level (e.g., highly sensitive business systems), these two types of costs are mapped and modeled to obtain dynamic cost parameters that change with the scenario, enabling the authentication policy to adaptively balance security and availability.

[0034] The first cost coefficient and the second cost coefficient are normalized to ensure they are within a unified dimension. They are then weighted and combined according to preset weight coefficients, where the weights reflect the system's preference for two types of risks: false acceptance and false rejection. The weighted result is converted into a standardized security level quantification value through a mapping function, such as a linear mapping or a nonlinear sigmoid mapping. This quantification value is used to characterize the overall security risk level of the current authentication scenario and serves as the basis for selecting the score-level fusion rule.

[0035] Furthermore, the process of pre-determining the predetermined score-level fusion rule includes: The fusion parameters and decision thresholds in the score-level fusion rule are used as variables to be optimized; the global error rate in the authentication scenario is used as the optimization objective; the variables to be optimized are retrieved and optimized with the optimization objective as a constraint, and the value of the variables to be optimized is obtained when the optimization objective is minimized, thus forming the predetermined score-level fusion rule.

[0036] In the score-level fusion rule, the fusion parameters are used to control the weight distribution ratio of each modality's score, and the decision threshold is used to divide the boundary between trustworthy and untrustworthy. These are used as variables to be optimized to construct a parameter search space to describe different combinations of fusion strategies.

[0037] The global error rate of the authentication system in the current scenario is used as the optimization objective function. The global error rate takes into account both the false acceptance rate and the false rejection rate, and is used to measure the accuracy and stability of the fusion rule in the overall authentication decision, thereby reflecting the quality of the current parameter configuration.

[0038] By minimizing the global error rate as a constraint, the variables to be optimized are retrieved and optimized. Specifically, iterative search or candidate solution update is adopted. Within the preset parameter range, the combination of fusion parameters and decision thresholds is continuously adjusted until the parameter solution that makes the global error rate optimal is obtained. Finally, the optimal parameter combination is solidified into the predetermined score level fusion rule corresponding to the current authentication scenario, so as to realize the automatic generation and dynamic adaptation of fusion strategies under different security scenarios.

[0039] Furthermore, the variable to be optimized is retrieved and optimized under the constraint of the optimization objective to obtain the value of the variable to be optimized when the optimization objective is minimized, forming the predetermined score-level fusion rule, including: Multiple candidate solutions are generated by introducing a predetermined range of variable values. Each candidate solution includes a set of fusion parameter values ​​and a decision threshold value. The multiple candidate solutions are iteratively updated. In each iteration, the current optimal solution is determined based on the global error rate corresponding to each candidate solution, and the update magnitude of each candidate solution is adjusted according to the dispersion of the distribution of the multiple candidate solutions. When it is determined that the global error rate corresponding to the multiple candidate solutions has not changed in multiple consecutive iterations, a random change is applied to the current optimal solution and iteration continues. When a preset termination condition is met, iteration stops, and the current optimal solution is used as the value of the retrieved variable to be optimized.

[0040] Based on a preset range of variable values, discretization sampling is performed within the fusion parameter space and threshold space to generate multiple candidate solutions. Each candidate solution includes a set of fusion parameter values ​​to determine the weighting of each modality's score, and a decision threshold to delineate the boundary between credible and uncredible decisions. This set of candidate solutions covers different combinations of fusion strategies, thus providing diverse initial solutions for subsequent optimization, improving the global coverage of the search, and avoiding getting trapped in local optima.

[0041] In each iteration, the global error rate corresponding to each candidate solution is calculated, and the candidate solution with the smallest error rate is selected as the current optimal solution. At the same time, the update step size is dynamically adjusted according to the dispersion of all candidate solutions in the parameter space. When the candidate solutions are relatively dispersed, the update step size is increased to improve the global search capability; when the distribution tends to be concentrated, the update step size is decreased to enhance the local convergence capability, thereby achieving an adaptive balance between exploration and convergence, and improving optimization efficiency and stability.

[0042] When the global error rate corresponding to multiple candidate solutions remains unchanged in consecutive iterations, it is determined that the current optimization process may be trapped in a local optimum or stagnant state. At this time, a random change is introduced to the current optimal solution to perturb it, that is, a small-range random offset is applied to the fusion parameters or decision threshold, thereby breaking the stable structure of the current solution space, reactivating the search process, and prompting the algorithm to jump out of the local optimum and continue to evolve towards the global optimum.

[0043] When preset termination conditions are met, such as reaching the maximum number of iterations, the error convergence threshold, or the change in candidate solutions falling below a set threshold, the iterative update process stops, and the current optimal solution is selected as the final result. The combination of the fusion parameters corresponding to this optimal solution and the decision threshold constitutes the score-level fusion rule for the current authentication scenario, realizing the adaptive generation and solidification of multimodal authentication strategies, thereby completing the retrieval and optimization process of the fusion rule.

[0044] Furthermore, the spatial location information, biometric information, and behavioral feature information are fused and calculated according to the predetermined score-level fusion rules to obtain the target user's credibility score, including: The spatial location information, biometric information, and behavioral feature information are respectively input into the corresponding single-modal authentication model to obtain a first authentication score, a second authentication score, and a third authentication score. The first authentication score, the second authentication score, and the third authentication score are fused according to the predetermined score-level fusion rule to obtain a comprehensive authentication score. The comprehensive authentication score is normalized and corrected in conjunction with the risk factors of the authentication scenario to obtain the credibility score. The single-modal authentication model is a binary classification model based on support vector machines. The support vector machine constructs a classification hyperplane using historical feature samples as training data. The authentication score of each modality is the confidence value output by the classification hyperplane after classifying the current input features. The risk factors are calculated based on at least one of the following: device safety status, environmental safety status, behavioral deviation, and historical authentication deviation rate.

[0045] Spatial location information, biometric information, and behavioral feature information are input into corresponding unimodal authentication models for independent discrimination. The spatial model assesses UWB spatial consistency, the biometric model assesses identity matching degree, and the behavioral model assesses consistency of operational habits. Each unimodal authentication model is built based on support vector machines, trained using historical sample data to obtain a classification hyperplane. After the current input features are classified and determined by the model, the confidence value of the distance from the hyperplane is output. This confidence value serves as the first authentication score, second authentication score, and third authentication score, reflecting the independent judgment results of each modality on the authenticity of the target user's identity.

[0046] The first, second, and third authentication scores are input into the fusion rule model, which is optimized from the previous steps and is used to define the weight allocation and combination of different modal scores. Based on the fusion parameters, each modal score is weighted or nonlinearly combined to obtain a comprehensive authentication score, which characterizes the overall credibility level after multimodal information fusion, thereby improving the ability to identify complex attacks or single-modal deception.

[0047] The comprehensive certification score is normalized to map it to a unified standard range, eliminating differences in output scale between different models. A certification scenario risk factor is introduced to correct the normalization result. This risk factor comprehensively considers factors such as equipment safety status, environmental safety status, behavioral deviation degree, and historical certification deviation rate, dynamically reflecting the uncertainty and risk level of the current certification environment. Finally, a credibility score is output, which serves as a quantitative result of the target user's current comprehensive credibility.

[0048] Each single-modal authentication model is constructed using a support vector machine binary classification structure. The optimal classification hyperplane is formed by training with historical authentication feature samples to distinguish between legitimate and illegitimate users. In the actual authentication process, after the current input features are mapped to a high-dimensional feature space, the classification hyperplane performs distance discrimination. This distance or boundary confidence is output as the authentication score, thereby realizing a quantitative evaluation of the credibility of single-modal features.

[0049] Risk factors are calculated by comprehensively considering at least one or more of the following: device security status, environmental security status, behavioral deviation, and historical authentication deviation rate. Specifically, device security status reflects whether the terminal is abnormal or at risk of being attacked; environmental security status characterizes the current network or physical environment security level; behavioral deviation measures the difference between the user's current behavior and historical behavior models; and the historical authentication deviation rate statistically analyzes historical authentication errors. These indicators are weighted and fused or calculated using a mapping function to obtain risk factors, which are then used for dynamic security correction of the comprehensive authentication results.

[0050] Furthermore, the first authentication score, the second authentication score, and the third authentication score are fused according to the predetermined score-level fusion rules to obtain a comprehensive authentication score. This process also includes: The signal-to-noise ratio of the UWB signal used to acquire the spatial location information in real time is used as the first signal quality index; the sharpness score of the biometric image acquired when acquiring the biometric information is used as the second signal quality index; the integrity score of the sensor data used to acquire the behavioral feature information is used as the third signal quality index; and the values ​​of the fusion parameters in the predetermined fractional fusion rule are corrected based on the first, second, and third signal quality indices.

[0051] The signal-to-noise ratio (SNR) of the received signal during UWB positioning is monitored in real time. This metric reflects the degree of noise interference affecting the UWB signal during propagation and the stability of ranging. A higher SNR indicates more reliable spatial positioning results; a lower SNR may indicate the presence of obstruction, multipath effects, or interference in the environment. The current UWB signal SNR is used as the primary signal quality indicator and is used as the basis for subsequent fusion parameter adjustments, thereby improving the adaptive reliability of spatial information weights in multimodal fusion.

[0052] Image data acquired during biometric data collection undergoes sharpness analysis. A sharpness score is generated based on image contrast, edge sharpness, or blurriness indicators to characterize the quality level of face or liveness detection images. Higher image sharpness indicates stronger reliability in biometric recognition; conversely, a lower score is applied to blurry or poorly lit images. This sharpness score serves as a secondary signal quality indicator, reflecting the effectiveness of biometric data in the current environment.

[0053] Continuity and integrity analysis is performed on user action data, including whether there are missing action trajectories, whether the interaction sequence is continuous, and whether there are interruptions in sensor data, and a data integrity score is calculated accordingly. A higher score is awarded when the action data is continuous and without significant gaps; a lower score is awarded when packet loss, sampling discontinuities, or abnormal interruptions occur. This integrity score serves as a third signal quality indicator, characterizing the reliability of behavioral feature information during the authentication process.

[0054] By comprehensively analyzing the first, second, and third signal quality indicators, and adjusting the weight allocation of the fusion parameters according to the relative merits of each indicator, higher-quality modes are given greater weight in the fusion calculation, while lower-quality modes have correspondingly reduced weights. This approach enables the fusion rules to adaptively respond to real-time data quality, thereby improving the stability and anti-interference capability of the overall reliable score calculation.

[0055] Furthermore, the comprehensive authentication score is normalized and corrected by incorporating risk factors from the authentication scenario to obtain the credibility score, which includes the following steps: The first security level corresponding to the equipment security status, the second security level corresponding to the environmental security status, the first deviation value corresponding to the behavioral deviation, and the second deviation value corresponding to the historical authentication deviation rate are obtained respectively. The first security level, the second security level, the first deviation value, and the second deviation value are standardized and weighted according to a preset initial weight to obtain an initial risk value. An amplification coefficient is determined based on the security level quantification value, and the initial risk value is amplified using the amplification coefficient to obtain the risk factor. 4 Wherein, the amplification coefficient is positively correlated with the security level quantification value.

[0056] The system obtains the first security level corresponding to the device's security status, used to characterize whether the terminal device is abnormal, attacked, or unstable in operation; it obtains the second security level corresponding to the environmental security status, used to characterize the security risks of the current network or physical environment; it calculates the first deviation value corresponding to the behavioral deviation degree, used to reflect the degree of difference between the current user behavior and the historical normal behavior model; and it obtains the second deviation value corresponding to the historical authentication deviation rate, used to reflect misjudgments or abnormal fluctuations in the historical authentication process. These four types of indicators together constitute the basic feature inputs for risk assessment.

[0057] The first security level, second security level, first deviation value, and second deviation value are standardized according to preset initial weights to ensure that all indicators are within a unified dimension. A weighted summation is then performed based on the weighting coefficients to obtain an initial risk value. This initial risk value is used to comprehensively characterize the basic risk level in the current certification scenario, integrating information from equipment, environment, behavior, and historical dimensions, thereby achieving a unified measurement of multi-source risk factors.

[0058] An amplification factor is determined based on the aforementioned security level quantification value. A higher security level quantification value indicates more stringent security requirements or stronger risk sensitivity in the scenario. This amplification factor is used to amplify the initial risk value, thereby obtaining the final risk factor. In this way, the risk assessment results can be dynamically adjusted according to changes in the security level of the certification scenario, achieving scenario-adaptive enhancement of risk perception.

[0059] The amplification factor is positively correlated with the security level quantification value; that is, when the security level quantification value increases, the amplification factor increases accordingly, thereby increasing the amplification of risk factors; conversely, the amplification effect decreases. This design makes the system more sensitive to risks in high-security-level scenarios, strengthening its risk punishment capabilities, while relatively relaxing the impact of risks in low-security-level scenarios, thus achieving adaptive adjustment of the authentication strategy.

[0060] Furthermore, determining the access permission level of the target user based on the trusted score, and controlling access to system resources according to the access permission level, includes: The trusted score range is divided into multiple permission level ranges according to multiple preset thresholds. Each permission level range is associated with a corresponding set of accessible resources and a set of executable operations. The permission level range into which the trusted score falls is determined, and the corresponding permission level range is determined as the access permission level. The corresponding system resources and operations are opened according to the access permission level, and permission circuit breaker control is performed on system resources and operations below the access permission level.

[0061] Multiple pre-defined scoring threshold ranges are used to divide the trust scoring range into several non-overlapping permission level ranges, such as high trust, medium trust, and low trust. Each permission level range is bound to a specific set of system resources and executable operations to define the scope of functions and operation permissions that users can access at that level, thus forming a hierarchical access control model based on trust scoring and realizing a structured mapping from scoring to permissions.

[0062] After obtaining the latest trust score of the target user, it is matched against a preset threshold range to determine the permission level range to which the score belongs, and the permission level corresponding to this range is output as the current access permission level. This process is a deterministic mapping mechanism, meaning that the same trust score corresponds to a unique permission level under the same threshold system, thereby ensuring the consistency and stability of permission determination.

[0063] Based on the current access permission level, the system automatically grants the system resources and operation permissions allowed at that level, enabling users to perform functions within their authorized scope. For sensitive resources or high-risk operations below the authorized permission level, a circuit breaker mechanism is implemented, prohibiting access or interrupting request responses to prevent unauthorized access. This mechanism achieves fine-grained dynamic access control based on trusted scoring, improving the overall security and controllability of the system.

[0064] Example 2 is based on the same inventive concept as the dynamic trusted authorization method based on multimodal fusion in the previous examples, such as... Figure 3 As shown in the figure, this application provides a dynamic trusted authorization authentication system based on multimodal fusion, the system comprising: The information collection module 10 is used to collect the spatial location information, biometric information, and behavioral feature information of the target user; the rule matching module 20 is used to determine the security level quantification value of the authentication scenario based on the context information, and match the predetermined score-level fusion rule corresponding to the security level quantification value; the fusion calculation module 30 is used to perform fusion calculation on the spatial location information, the biometric information, and the behavioral feature information according to the predetermined score-level fusion rule to obtain the trust score of the target user; the access control module 40 is used to determine the access permission level of the target user based on the trust score, and control the access to system resources according to the access permission level; the level adjustment module 50 is used to periodically update the trust score during the access process, and dynamically adjust the access permission level according to the updated trust score.

[0065] Furthermore, the information acquisition module 10 is used to perform the following operation steps: Based on UWB, the real-time distance and spatial orientation relationship between the target user and the terminal device are perceived to obtain the spatial location information; the biometric information of the target user is collected through biometric recognition technology; and the behavioral operation trajectory and interaction sequence of the target user are recorded as the behavioral feature information.

[0066] Furthermore, the rule matching module 20 is used to perform the following operation steps: Based on the context information, obtain the geographic location information of the authentication scenario; based on the context information, obtain the security attribute information of the target application requested by the target user; based on the geographic location information and the security attribute information, determine the first cost coefficient for incorrectly accepting an illegal user and the second cost coefficient for incorrectly rejecting a legitimate user; perform a weighted mapping calculation on the first cost coefficient and the second cost coefficient to obtain the quantified value of the security level.

[0067] Furthermore, the rule matching module 20 is used to perform the following operation steps: The fusion parameters and decision thresholds in the score-level fusion rule are used as variables to be optimized; the global error rate in the authentication scenario is used as the optimization objective; the variables to be optimized are retrieved and optimized with the optimization objective as a constraint, and the value of the variables to be optimized is obtained when the optimization objective is minimized, thus forming the predetermined score-level fusion rule.

[0068] Furthermore, the rule matching module 20 is used to perform the following operation steps: Multiple candidate solutions are generated by introducing a predetermined range of variable values. Each candidate solution includes a set of fusion parameter values ​​and a decision threshold value. The multiple candidate solutions are iteratively updated. In each iteration, the current optimal solution is determined based on the global error rate corresponding to each candidate solution, and the update magnitude of each candidate solution is adjusted according to the dispersion of the distribution of the multiple candidate solutions. When it is determined that the global error rate corresponding to the multiple candidate solutions has not changed in multiple consecutive iterations, a random change is applied to the current optimal solution and iteration continues. When a preset termination condition is met, iteration stops, and the current optimal solution is used as the value of the retrieved variable to be optimized.

[0069] Furthermore, the fusion computing module 30 is used to perform the following operation steps: The spatial location information, biometric information, and behavioral feature information are respectively input into the corresponding single-modal authentication model to obtain a first authentication score, a second authentication score, and a third authentication score. The first authentication score, the second authentication score, and the third authentication score are fused according to the predetermined score-level fusion rule to obtain a comprehensive authentication score. The comprehensive authentication score is normalized and corrected in conjunction with the risk factors of the authentication scenario to obtain the credibility score. The single-modal authentication model is a binary classification model based on support vector machines. The support vector machine constructs a classification hyperplane using historical feature samples as training data. The authentication score of each modality is the confidence value output by the classification hyperplane after classifying the current input features. The risk factors are calculated based on at least one of the following: device safety status, environmental safety status, behavioral deviation, and historical authentication deviation rate.

[0070] Furthermore, the fusion computing module 30 is used to perform the following operation steps: The signal-to-noise ratio of the UWB signal used to acquire the spatial location information in real time is used as the first signal quality index; the sharpness score of the biometric image acquired when acquiring the biometric information is used as the second signal quality index; the integrity score of the sensor data used to acquire the behavioral feature information is used as the third signal quality index; and the values ​​of the fusion parameters in the predetermined fractional fusion rule are corrected based on the first, second, and third signal quality indices.

[0071] Furthermore, the fusion computing module 30 is used to perform the following operation steps: The system obtains the first security level corresponding to the device security status, the second security level corresponding to the environmental security status, the first deviation value corresponding to the behavioral deviation, and the second deviation value corresponding to the historical authentication deviation rate. It then performs a standardized weighted summation of the first security level, the second security level, the first deviation value, and the second deviation value according to preset initial weights to obtain an initial risk value. Based on the security level quantification value, it determines an amplification coefficient and uses this coefficient to amplify the initial risk value to obtain the risk factor. The amplification coefficient is positively correlated with the security level quantification value.

[0072] Furthermore, the access control module 40 is used to perform the following operational steps: The trusted score range is divided into multiple permission level ranges according to multiple preset thresholds. Each permission level range is associated with a corresponding set of accessible resources and a set of executable operations. The permission level range into which the trusted score falls is determined, and the corresponding permission level range is determined as the access permission level. The corresponding system resources and operations are opened according to the access permission level, and permission circuit breaker control is performed on system resources and operations below the access permission level.

[0073] Through the foregoing detailed description of a dynamic trusted authorization authentication method based on multimodal fusion, those skilled in the art can clearly understand the dynamic trusted authorization authentication system based on multimodal fusion in this embodiment. Since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and relevant parts can be referred to the method section.

[0074] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any modifications, equivalent changes, and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A dynamic trusted authorization authentication method based on multimodal fusion, characterized in that, The method includes: Collect spatial location information, biometric information, and behavioral characteristic information of the target user; The security level quantification value of the authentication scenario is determined based on the context information, and the predetermined score level fusion rule corresponding to the security level quantification value is matched. The spatial location information, biometric information and behavioral feature information are fused and calculated according to the predetermined score-level fusion rules to obtain the credibility score of the target user. The access permission level of the target user is determined based on the credibility score, and access to system resources is controlled according to the access permission level. The trust score is periodically updated during the access process, and the access permission level is dynamically adjusted based on the updated trust score.

2. The dynamic trusted authorization authentication method based on multimodal fusion according to claim 1, characterized in that, Collect the target user's spatial location information, biometric information, and behavioral characteristic information, including: Based on UWB, the real-time distance and spatial orientation relationship between the target user and the terminal device are perceived to obtain the spatial location information; The biometric information of the target user is collected using biometric identification technology; The behavioral operation trajectory and interaction sequence of the target user are recorded as behavioral feature information.

3. The dynamic trusted authorization authentication method based on multimodal fusion according to claim 1, characterized in that, The security level quantification value of the authentication scenario is determined based on contextual information, including: The geographical location information of the authentication scenario is obtained based on the context information; Based on the context information, obtain the security attribute information of the target application requested by the target user; Based on the geographic location information and the security attribute information, a first cost coefficient for incorrectly accepting an illegal user and a second cost coefficient for incorrectly rejecting a legitimate user are determined respectively. The first cost coefficient and the second cost coefficient are weighted and mapped to obtain the quantified value of the security level.

4. The dynamic trusted authorization authentication method based on multimodal fusion according to claim 1, characterized in that, The process of pre-determining the predetermined score-level fusion rule includes: The fusion parameters and decision thresholds in the score-level fusion rules are used as variables to be optimized. The optimization objective is to achieve a global error rate under the aforementioned authentication scenario. The variable to be optimized is retrieved and optimized under the constraint of the optimization objective, and the value of the variable to be optimized is obtained when the optimization objective is minimized, thus forming the predetermined score-level fusion rule.

5. The dynamic trusted authorization authentication method based on multimodal fusion according to claim 4, characterized in that, Using the optimization objective as a constraint, the variable to be optimized is retrieved and optimized to obtain the value of the variable to be optimized when the optimization objective is minimized, thus forming the predetermined score-level fusion rule, including: Multiple candidate solutions are generated by introducing a predetermined range of variable values. Each candidate solution in the multiple candidate solutions includes a set of values ​​for a fusion parameter and a value for a decision threshold. The multiple sets of candidate solutions are iteratively updated. In each iteration, the current optimal solution is determined based on the global error rate corresponding to each candidate solution, and the update magnitude of each candidate solution is adjusted based on the dispersion of the multiple sets of candidate solutions. When it is determined that the global error rate corresponding to the multiple sets of candidate solutions has not changed in multiple consecutive iterations, a random change is applied to the current optimal solution and the iteration continues. The iteration stops when the preset termination condition is met, and the current optimal solution is used as the value of the retrieved variable to be optimized.

6. The dynamic trusted authorization authentication method based on multimodal fusion according to claim 1, characterized in that, The spatial location information, biometric information, and behavioral feature information are fused and calculated according to the predetermined score-level fusion rules to obtain the trust score of the target user, including: The spatial location information, the biometric information, and the behavioral feature information are respectively input into the corresponding single-modal authentication model to obtain a first authentication score, a second authentication score, and a third authentication score. The first certification score, the second certification score, and the third certification score are merged according to the predetermined score level fusion rule to obtain a comprehensive certification score. The comprehensive certification score is normalized and then corrected by incorporating the risk factors of the certification scenario to obtain the credibility score. The single-modal authentication model is a binary classification model based on support vector machines. The support vector machine constructs a classification hyperplane using historical feature samples as training data. The authentication score of each modality is the confidence value output by the classification hyperplane after classifying the current input feature. The risk factor is calculated based on at least one of the following: equipment safety status, environmental safety status, behavioral deviation, and historical certification deviation rate.

7. The dynamic trusted authorization authentication method based on multimodal fusion according to claim 6, characterized in that, The first certification score, the second certification score, and the third certification score are fused according to the predetermined score-level fusion rules to obtain a comprehensive certification score. This process also includes: The signal-to-noise ratio of the UWB signal used to collect the spatial location information in real time is used as the first signal quality indicator. The clarity score of the biometric image used to collect the biometric information is used as a second signal quality index. The integrity score of the sensor data on which the behavioral feature information is collected is used as a third signal quality indicator. The values ​​of the fusion parameters in the predetermined fractional fusion rule are corrected based on the first signal quality index, the second signal quality index, and the third signal quality index.

8. The dynamic trusted authorization authentication method based on multimodal fusion according to claim 6, characterized in that, The comprehensive authentication score is normalized and then corrected based on the risk factors of the authentication scenario to obtain the credibility score, which includes the following steps: The first security level corresponding to the device security status, the second security level corresponding to the environmental security status, the first deviation value corresponding to the behavior deviation degree, and the second deviation value corresponding to the historical authentication deviation rate are obtained respectively. The first security level, the second security level, the first deviation value, and the second deviation value are standardized and weighted according to preset initial weights to obtain the initial risk value; The amplification factor is determined based on the quantified value of the safety level, and the initial risk value is amplified using the amplification factor to obtain the risk factor. The amplification factor is positively correlated with the quantified value of the security level.

9. The dynamic trusted authorization authentication method based on multimodal fusion according to claim 1, characterized in that, Determining the access permission level of the target user based on the trusted score, and controlling access to system resources according to the access permission level, including: The trust score interval is divided into multiple permission level intervals according to multiple preset thresholds, and each permission level interval is associated with a corresponding set of accessible resources and a set of executable operations. Determine the permission level range into which the trusted score falls, and define the corresponding permission level range as the access permission level; System resources and operations are opened according to the access permission level, and access control is applied to system resources and operations below the access permission level.

10. A dynamic trusted authentication system based on multimodal fusion, characterized in that, The system is used to implement the dynamic trusted authentication method based on multimodal fusion as described in any one of claims 1-9, the system comprising: The information collection module is used to collect the target user's spatial location information, biometric information, and behavioral characteristic information; The rule matching module is used to determine the security level quantification value of the authentication scenario based on the context information, and match the predetermined score level fusion rule corresponding to the security level quantification value; The fusion calculation module is used to perform fusion calculation on the spatial location information, the biometric information and the behavioral feature information according to the predetermined score-level fusion rules to obtain the credibility score of the target user. An access control module is used to determine the access permission level of the target user based on the trust score, and to control access to system resources according to the access permission level; The level adjustment module is used to periodically update the trust score during the access process and dynamically adjust the access permission level based on the updated trust score.

Images