Identity authentication method, identity authentication device, electronic device, program product

Abstract

The present disclosure provides a method, device, electronic equipment and computer program product, belonging to the technical field of identity authentication. The method comprises: acquiring multi-modal perception data of a to-be-authenticated object, and performing feature extraction on the multi-modal perception data to obtain a feature vector; the multi-modal perception data comprises at least perception data of two modalities; acquiring an identity parameter and a current timestamp of the to-be-authenticated object, and generating an authentication identifier according to the feature vector, the identity parameter and the current timestamp; generating proof data based on the authentication identifier; sending the authentication identifier and the proof data to a verification end for verification, and determining whether the to-be-authenticated object passes the identity authentication according to a verification result returned by the verification end. The present disclosure can improve the security and accuracy of identity authentication.

Description

Technical Field

[0001] This disclosure relates to the field of identity authentication technology, and in particular to an identity authentication method, an identity authentication device, an electronic device, and a computer program product. Background Technology

[0002] With the development of the Internet of Things (IoT) and communication networks, identity authentication has become a key technology in the field of information security. Existing identity authentication methods typically rely on the uploading and comparison of sensitive user information, posing a risk of privacy breaches. Furthermore, some methods are vulnerable to tracking or replay attacks during the authentication process. Therefore, how to achieve secure and reliable authentication while protecting user privacy is a problem that current technologies urgently need to solve.

[0003] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0004] This disclosure provides an identity authentication method, identity authentication device, electronic device, and computer program product, thereby at least partially solving the problem of user privacy leakage and identity tracking that easily occurs during the identity authentication process.

[0005] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part by practice of this disclosure.

[0006] According to one aspect of this disclosure, an identity authentication method is provided, comprising: acquiring multimodal perception data of an object to be authenticated, and extracting features from the multimodal perception data to obtain a feature vector; the multimodal perception data includes perception data of at least two modalities; acquiring identity parameters and a current timestamp of the object to be authenticated, and generating an authentication identifier based on the feature vector, the identity parameters, and the current timestamp; generating proof data based on the authentication identifier; sending the authentication identifier and the proof data to a verification terminal for verification, and determining whether the object to be authenticated has passed identity authentication based on the verification result returned by the verification terminal.

[0007] In an exemplary embodiment of this disclosure, the step of extracting features from the multimodal sensing data to obtain a feature vector includes: normalizing the sensing data of each modality in the multimodal sensing data to obtain normalized sensing data of each modality; inputting the normalized sensing data of each modality into an autoencoder; and compressing the sensing data into a vector of a preset dimension through the encoding layer of the autoencoder as the feature vector.

[0008] In one exemplary embodiment of this disclosure, obtaining the identity parameters of the object to be authenticated includes: obtaining a random number generated when the object to be authenticated first registers, and using it as the identity parameters of the object to be authenticated.

[0009] In one exemplary embodiment of this disclosure, generating an authentication identifier based on the feature vector, the identity parameter, and the current timestamp includes: concatenating the feature vector, the identity parameter, and the current timestamp to obtain a concatenated input sequence; performing a hash operation on the concatenated input sequence, and using the result of the hash operation as the authentication identifier.

[0010] In one exemplary embodiment of this disclosure, generating proof data based on the authentication identifier includes: decomposing each bit of the authentication identifier into Boolean variables and obtaining construction parameters based on multiple Boolean variables; determining elliptic curve commitment parameters based on the construction parameters and generating zero-knowledge proof parameters based on the construction parameters; and generating the proof data based on the elliptic curve commitment parameters and the zero-knowledge proof parameters.

[0011] In one exemplary embodiment of this disclosure, determining the elliptic curve commitment parameter based on the construction parameters includes: obtaining a first base point and a second base point on the elliptic curve, and a random factor; and determining the elliptic curve commitment parameter based on the construction parameters, the random factor, the first base point, and the second base point.

[0012] In one exemplary embodiment of this disclosure, generating zero-knowledge proof parameters based on the construction parameters includes: generating the zero-knowledge proof parameters based on the construction parameters and the random factor.

[0013] In one exemplary embodiment of this disclosure, determining whether the object to be authenticated has passed identity authentication based on the verification result returned by the verification terminal includes: if the verification result is successful, then determining that the object to be authenticated has passed identity authentication and granting access rights; if the verification result is unsuccessful, then determining that the object to be authenticated has failed identity authentication and denying access.

[0014] According to one aspect of this disclosure, an identity authentication device is provided, comprising: a feature vector acquisition module, configured to acquire multimodal perception data of an object to be authenticated, and perform feature extraction on the multimodal perception data to obtain a feature vector; wherein the multimodal perception data includes perception data of at least two modalities; an authentication identifier generation module, configured to acquire identity parameters and a current timestamp of the object to be authenticated, and generate an authentication identifier based on the feature vector, the identity parameters, and the current timestamp; a proof data generation module, configured to generate proof data based on the authentication identifier; and an object identity authentication module, configured to send the authentication identifier and the proof data to a verification terminal for verification, and determine whether the object to be authenticated has passed identity authentication based on the verification result returned by the verification terminal.

[0015] According to one aspect of this disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the method described in any of the preceding methods by executing the executable instructions.

[0016] According to one aspect of this disclosure, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the method described in any of the preceding descriptions.

[0017] The exemplary embodiments disclosed herein have the following beneficial effects: The process involves acquiring multimodal perception data of the object to be authenticated, extracting features from the multimodal perception data to obtain a feature vector, and ensuring that the multimodal perception data includes at least two modalities of perception data. The process also involves acquiring the identity parameters and current timestamp of the object to be authenticated, and generating an authentication identifier based on the feature vector, identity parameters, and current timestamp. Based on the authentication identifier, proof data is generated. The authentication identifier and proof data are then sent to the verification end for verification, and the verification result returned by the verification end determines whether the object to be authenticated has passed authentication. On one hand, the generation of the authentication identifier integrates identity parameters and timestamps, resulting in different authentication identifiers generated in different authentication sessions. Even if an attacker intercepts historical authentication data, they cannot associate it with the same object to be authenticated, achieving untraceable identity. Simultaneously, the binding of timestamps prevents intercepted historical data from being resent to pass verification, effectively preventing replay attacks. On the other hand, sending the authentication identifier and proof data to the verification end for verification determines whether the object to be authenticated has passed authentication. Throughout the entire process, the original perception data remains locally on the authentication initiator, ensuring the privacy and security of the object to be authenticated. This method is particularly suitable for security authentication scenarios of UAV platforms in 5G enhanced mobile communication network environments.

[0018] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0019] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0020] Figure 1 This schematically illustrates a flowchart of an identity authentication method in this exemplary embodiment; Figure 2 This schematic diagram illustrates a structural block diagram of an identity authentication device in this exemplary embodiment; Figure 3 An electronic device for implementing the above method is illustrated in this exemplary embodiment. Detailed Implementation

[0021] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that this disclosure will be more comprehensive and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0022] An exemplary embodiment of this disclosure first provides an identity authentication method.

[0023] The following is in conjunction with the appendix Figure 1 The exemplary embodiments will be further described as follows: Figure 1 As shown, the identity authentication method may include the following steps S110~S140: Step S110: Obtain multimodal perception data of the object to be authenticated, and extract features from the multimodal perception data to obtain feature vectors; the multimodal perception data includes perception data of at least two modalities.

[0024] The object to be authenticated refers to an entity that needs identity verification to obtain specific permissions or services. This can be a human user, an unmanned mobile platform such as a drone, or an IoT device mounted on a drone platform. Multimodal perception data refers to perception information from at least two different types of sensors, reflecting different attribute dimensions of the object to be authenticated. Multimodal perception data includes at least two modalities of perception data, for example, it can include modal data reflecting physiological characteristics and modal data reflecting behavioral characteristics, or it can include two different types of physiological characteristic modal data, or it can include two different types of behavioral characteristic modal data. In one specific implementation, multimodal perception data can include user motion trajectory and respiratory signal data detected by millimeter-wave radar, heart rate signal data detected by a PPG (Photoplethysmography) sensor, and environmental temperature and humidity information data detected by a temperature and humidity sensor. Millimeter-wave radar can capture the user's motion trajectory and micro-motion signals in three-dimensional space, the photoplethysmography sensor can acquire the user's heart rate signal, and the temperature and humidity sensor can sense the current environmental temperature and relative humidity. Multimodal perception data can be collected by various sensors mounted on a drone platform, by ground sensor nodes distributed around the object to be authenticated, or by wearable devices in conjunction with external sensors. For example, the user's radar echo signal and photoplethysmography signal can be collected by millimeter-wave radar and PPG sensor mounted on a drone platform, and ambient temperature and humidity data can be collected by temperature and humidity sensors.

[0025] After acquiring multimodal sensing data, feature extraction is performed to obtain feature vectors that characterize the essential attributes of the object to be authenticated. Feature extraction refers to extracting representative, discriminative, and stable information from the original multimodal sensing data and transforming it into a numerical form that can be processed by a computer. Feature extraction can be achieved through neural network models such as autoencoders, where the encoder compresses the input data into a low-dimensional hidden layer representation as the feature vector. Feature extraction can also be achieved through traditional dimensionality reduction methods such as principal component analysis, which projects the original high-dimensional data into a low-dimensional principal component space through linear transformation. Feature extraction can also be achieved through manually designed feature extraction algorithms, such as extracting time-domain and frequency-domain statistical features from radar data, and extracting mean, variance, and spectral features from heart rate signals.

[0026] Step S120: Obtain the identity parameters and current timestamp of the object to be authenticated, and generate an authentication identifier based on the feature vector, identity parameters and current timestamp.

[0027] The identity parameter refers to the secret information associated with the object to be authenticated and used for cryptographic operations. It can be a random number pre-stored in a trusted execution environment, such as a user seed generated and stored in the trusted execution environment when the object is first registered; it can also be the private key information in the digital certificate held by the object to be authenticated, such as the private key stored in a general-purpose integrated circuit card or embedded secure element; or it can be a fixed-length hash value derived from the biometric template of the object to be authenticated, such as the hash value obtained after hashing a fingerprint template. The current timestamp refers to the time information representing the current moment. It can be obtained from a time server via a network time protocol, through a global navigation satellite system, or through the high-precision time synchronization service provided by the fifth-generation mobile communication enhancement network (5G+), for example, using the precise time protocol service in the 5G+ to obtain a timestamp with millisecond-level precision.

[0028] After obtaining the feature vector, identity parameters, and current timestamp, an authentication identifier is generated based on these parameters. The authentication identifier is an identifier used to identify the object to be authenticated in the current authentication session and changes as the authentication session changes, such as a dynamic AID (Anonymous Identifier). The authentication identifier can be generated in several ways. First, the feature vector, identity parameter, and current timestamp can be concatenated and hashed to obtain a hash value, which serves as the authentication identifier. For example, the components of the feature vector, the value of the identity parameter, and the value of the timestamp can be concatenated in a predetermined order as an input sequence, and then hashed using the SHA256 algorithm. The resulting hash value is then used as the authentication identifier. Second, the feature vector and identity parameter can be XORed together, and then encrypted with the timestamp to obtain the authentication identifier. For example, the feature vector and identity parameter can be XORed bitwise to obtain an intermediate value, and then an encryption algorithm can be used to encrypt the intermediate value with the timestamp as an encryption factor to obtain the authentication identifier. Third, the three components can be combined according to predetermined rules and then an authentication code algorithm can be applied to generate the authentication identifier. For example, the feature vector and identity parameter can be combined, and a hash-based authentication code algorithm can be used with the timestamp as a key to generate a message authentication code, which serves as the authentication identifier.

[0029] Step S130: Generate proof data based on the authentication identifier.

[0030] In this context, proof data refers to cryptographic evidence used by the verification end to verify the legitimacy of the identity of the object to be authenticated. Without revealing the authentication identifier itself, it enables the verification end to be certain that the authentication identifier meets preset constraints. Preset constraints refer to pre-defined mathematical or logical conditions that the authentication identifier must satisfy. For example, the value of the authentication identifier may be within a preset range, or the authentication identifier may have preset data structure characteristics, or the authentication identifier may belong to a preset legitimate identifier space. In one implementation, proof data may include elliptic curve commitment parameters and zero-knowledge proof parameters. Elliptic curve commitment parameters are cryptographic parameters constructed based on elliptic curve cryptography, used to hide the secret to be proved while binding the secret to the commitment value. Zero-knowledge proof parameters are cryptographic evidence generated through a zero-knowledge proof protocol, used to prove that the secret to be proved meets the preset constraints. The generation of proof data can be implemented using zero-knowledge proof protocols, such as using the Bulletproofs protocol to generate zero-knowledge proof parameters; it can also be implemented using concise non-interactive zero-knowledge proof protocols, such as using the zk-SNARKs protocol to generate proof parameters; or it can be implemented by combining a commitment-based scheme with a zero-knowledge proof protocol, such as first generating elliptic curve commitment parameters, then generating zero-knowledge proof parameters based on the commitment parameters and the secret to be proved, and combining the two as proof data.

[0031] In one specific implementation, generating proof data based on the authentication identifier can be achieved as follows: First, each bit of the authentication identifier is decomposed into a Boolean variable. The authentication identifier is binary data composed of multiple bits, each bit being 0 or 1. Decomposing each bit into a Boolean variable means extracting the bit value of each bit as an independent Boolean type variable. For example, if the authentication identifier is a 256-bit binary string, it is decomposed into 256 Boolean variables, each corresponding to a single bit value in the authentication identifier. Then, construction parameters are obtained from the multiple Boolean variables. Construction parameters refer to intermediate values ​​used for subsequently constructing elliptic curve commitment parameters and generating zero-knowledge proof parameters. For example, the Boolean variables can be combined into a bit vector according to their position order in the authentication identifier as construction parameters, or the Boolean variables can be expanded according to their binary bit weights and summed to obtain a large integer as construction parameters.

[0032] After obtaining the construction parameters, the elliptic curve commitment parameters are determined based on them. For example, the construction parameters are multiplied by a first base point on the elliptic curve to obtain a first intermediate value, and a randomly generated random factor is multiplied by a second base point on the elliptic curve to obtain a second intermediate value. The first and second intermediate values ​​are then added using elliptic curve point addition to obtain the elliptic curve commitment parameters. Simultaneously, zero-knowledge proof parameters are generated based on these construction parameters. For example, the construction parameters and the random factor are used as input to a proof generation algorithm, the proof generation process in the zero-knowledge proof protocol is executed, and the zero-knowledge proof parameters are output. Then, proof data is generated based on the elliptic curve commitment parameters and the zero-knowledge proof parameters. For example, the elliptic curve commitment parameters and the zero-knowledge proof parameters are serialized according to a predetermined format and concatenated into unified proof data, or they are encapsulated as different fields in the same data structure.

[0033] Step S140: Send the authentication identifier and proof data to the verification end for verification, and determine whether the object to be authenticated has passed the identity authentication based on the verification result returned by the verification end.

[0034] In this context, the verification terminal refers to the terminal responsible for verifying authentication requests and making authorization decisions. It can be a cloud server, a ground station, or an authentication server deployed at the network edge. Transmission can be via wired networks, wireless networks, or the ultra-reliable low-latency (ULL) communication link of a fifth-generation (5G) enhanced network. For example, the authentication identifier and proof data can be sent to a ground station or cloud server using a transport layer security (TLS) encryption protocol via an ULS-enhanced 5G network ULS-enhanced 5G network. Upon receiving the authentication identifier and proof data, the verification terminal performs cryptographic verification on the proof data and returns a verification result of success or failure.

[0035] The authentication initiator determines whether the object to be authenticated has passed the authentication process based on the verification result returned by the verification provider. If the verification result is successful, the object to be authenticated is deemed to have passed the authentication process and is allowed to access protected resources or perform authorized operations. If the verification result is unsuccessful, the object to be authenticated is deemed to have failed the authentication process and its access request is denied.

[0036] Based on the above description, in this exemplary embodiment, multimodal perception data of the object to be authenticated is obtained, and feature extraction is performed on the multimodal perception data to obtain a feature vector; the multimodal perception data includes perception data of at least two modalities; the identity parameters and current timestamp of the object to be authenticated are obtained, and an authentication identifier is generated based on the feature vector, identity parameters, and current timestamp; proof data is generated based on the authentication identifier; the authentication identifier and proof data are sent to the verification end for verification, and the object to be authenticated is determined to have passed the authentication based on the verification result returned by the verification end. On the one hand, the generation of the authentication identifier integrates the identity parameters and the timestamp, and the authentication identifiers generated in different authentication sessions are different. Even if an attacker intercepts historical authentication data, they cannot associate it with the same object to be authenticated, thus achieving untraceable identity. At the same time, the binding of the timestamp prevents the intercepted historical data from being resent to pass the verification, effectively preventing replay attacks. On the other hand, the authentication identifier and proof data are sent to the verification end for verification. Based on the verification result, it can be determined whether the object to be authenticated has passed the identity authentication. Throughout the process, the original perception data is always kept locally at the authentication initiator, which protects the privacy and security of the object to be authenticated. The above method is particularly suitable for the security authentication scenario of the drone platform in the 5G mobile communication enhanced network environment.

[0037] In one implementation, the above-described feature extraction from multimodal sensing data to obtain a feature vector may include: The sensing data of each modality in the multimodal sensing data are normalized to obtain the normalized sensing data of each modality. The normalized sensing data of each modality is input into the autoencoder; The autoencoder's encoding layer compresses the perceived data into a vector of a preset dimension, which serves as the feature vector.

[0038] Normalization involves linearly transforming the sensory data from each modality according to their respective statistical characteristics. This transforms the data to have a uniform scale range, eliminating the adverse effects of different modalities' data on subsequent feature extraction due to differences in units or numerical ranges. For example, the numerical range of three-dimensional spatial coordinate data acquired by millimeter-wave radar may be on the order of meters, while the heart rate sequence acquired by a photoplethysmography sensor is on the order of tens to hundreds. Without normalization, the larger-scale modal data will dominate the subsequent processing and weaken the contribution of other modalities. Normalization can be achieved using the standard deviation normalization method, which involves subtracting the mean of the modal data from each data value and then dividing by the standard deviation of the modal data. Normalization can also be achieved using the min-max normalization method, which linearly maps the data values ​​to the interval between zero and one. Another method is mean normalization, which involves subtracting the mean from each data value and then dividing by the difference between the maximum and minimum values. After normalization, the normalized sensory data from each modality is input into the autoencoder.

[0039] An autoencoder is an unsupervised neural network model that compresses input data into a low-dimensional representation through an encoding layer, and then reconstructs this low-dimensional representation back into the original input space through a decoding layer. The training objective is to minimize the reconstruction error, ensuring that the low-dimensional representation output by the encoding layer retains the most essential feature information of the input data. Autoencoders can be ordinary fully connected autoencoders, where the layers are connected via fully connected connections. They can also be convolutional autoencoders, where the encoding layer uses convolutional layers for feature extraction. Furthermore, they can be variational autoencoders, where the encoding layer outputs the distribution parameters of latent variables rather than a deterministic encoding result. The structure of an autoencoder can be chosen based on the type and characteristics of the input data.

[0040] After normalized perceptual data for each modality is input into an autoencoder, the encoding layer of the autoencoder compresses the input perceptual data into a vector of a preset dimension, which becomes the feature vector. The preset dimension refers to the pre-defined size of the output vector of the encoding layer, which determines the length of the feature vector after feature extraction. The preset dimension can be set according to the actual application scenario and computational resource constraints. A larger dimension retains more information but also increases computational overhead, while a smaller dimension results in more compact features but may lose some discriminative information. For example, in edge computing scenarios involving drones with limited computational resources, the preset dimension can be set to a smaller value, such as 128, to reduce the computational load of subsequent authentication processes. Compression through the encoding layer of the autoencoder maps multimodal data, which originally had different physical meanings and scales, into a unified feature space, facilitating subsequent authentication processing.

[0041] In one implementation, the multimodal sensing data includes millimeter-wave radar data, object physiological characteristic data, and environmental parameter data; The above-mentioned normalization processing of the sensing data of each modality in the multimodal sensing data may include: For each coordinate value in the millimeter-wave radar data, subtract the mean of the millimeter-wave radar mode data from the coordinate value, and then divide by the standard deviation of the millimeter-wave radar mode data to obtain the normalized coordinate value. For each heart rate value in the photoplethysmography data, the mean of the heart rate modal data is subtracted from the heart rate value, and then divided by the standard deviation of the heart rate modal data to obtain the normalized heart rate value. Environmental parameter data is input into the autoencoder as an independent environmental parameter vector.

[0042] Millimeter-wave radar data refers to data collected by millimeter-wave radar sensors that reflects the spatial position and motion state of the object to be authenticated. For example, it may include the coordinate sequence of the object in three-dimensional space. Millimeter-wave radar refers to radar sensors operating in the millimeter-wave frequency band. It features strong penetration, high resolution, and strong anti-interference capabilities, enabling non-contact detection of the object's motion trajectory and micro-motion signals. In one specific implementation, millimeter-wave radar can collect the three-dimensional spatial coordinate sequence of the object to be authenticated at a sampling frequency of once per second, with each collection containing 10 three-dimensional coordinate points. The object's physiological characteristic data refers to signal data reflecting the physiological state of the object to be authenticated, such as a heart rate value sequence collected by a photoplethysmography (PPG) sensor. PPG is an optical measurement technique that uses photoplethysmography to detect changes in blood volume. By emitting light of a specific wavelength onto the skin surface and detecting changes in the intensity of reflected or transmitted light, heart rate signals can be non-invasively acquired. In one specific implementation, the PPG sensor can collect the heart rate value sequence at a sampling frequency of 60 times per second. The physiological characteristic data of the object can be an electrocardiogram (ECG) signal sequence collected by an ECG sensor, or an electroencephalogram (EEG) signal sequence collected by an EEG sensor. Environmental parameter data refers to physical quantities characterizing the environmental state of the object to be authenticated, such as ambient temperature and relative humidity, or ambient air pressure and ambient light intensity. In one specific implementation, the environmental parameter data can be acquired at an update frequency of once per minute.

[0043] The mean and standard deviation of millimeter-wave radar modal data are pre-calculated statistics reflecting the overall distribution characteristics of the millimeter-wave radar data. These can be obtained by calculating from a large amount of historical millimeter-wave radar data. For each heart rate value in the photoplethysmography (PPG) data, the mean of the heart rate modal data is subtracted from the heart rate value, and then divided by the standard deviation of the heart rate modal data to obtain the normalized heart rate value. The mean and standard deviation of the heart rate modal data are also obtained through statistical calculation from a large amount of historical heart rate data. For environmental parameter data, since their values ​​already have clear physical meaning and low dimensionality, no normalization is required; instead, they are directly input into the autoencoder as independent environmental parameter vectors.

[0044] The above implementation method fully utilizes the complementarity of different sensors in detection dimensions and detection principles by introducing three modalities of perception data: millimeter-wave radar data, physiological feature data, and environmental parameter data. This effectively improves the detection capability of spoofing attacks. At the same time, it adopts differentiated normalization strategies for the characteristics of different modalities of data to ensure the effectiveness of subsequent feature extraction.

[0045] In one exemplary embodiment of this disclosure, data acquisition and feature extraction can be implemented in the following specific manner.

[0046] During the data acquisition phase, multimodal sensing data of the object to be authenticated is collected using millimeter-wave radar, photoplethysmography (PPG) sensors, and temperature and humidity sensors mounted on the UAV platform. Specifically, the millimeter-wave radar is used to capture the motion trajectory and breathing signals of the object to be authenticated, acquiring a three-dimensional spatial coordinate sequence R∈ at a sampling frequency of once per second. Assuming each acquisition includes 10 three-dimensional coordinate points, the dimension of the millimeter-wave radar data R is 3 × 10, where 3 represents the dimension of the spatial coordinates and 10 represents the number of sampling points. The photoplethysmography sensor is used to detect the heartbeat signal H∈ of the object to be authenticated. Where m is the number of heart rate sampling points, and the heart rate value sequence is collected at a sampling frequency of 60 times per second, so the length of the photoplethysmography data H is 60. The temperature and humidity sensor is used to acquire ambient temperature and humidity information, updating the data once per minute. Therefore, the environmental parameter E remains constant during each authentication process. E includes temperature T and relative humidity RH, where the temperature T ranges from T∈[-40, 85] and the relative humidity RH ranges from RH∈[0, 100]%. The final acquired multimodal sensing data can be represented as D=(R, H, E).

[0047] In the feature extraction stage, the data for each modality in the acquired multimodal sensing data are first normalized to eliminate scale differences between different modalities. Normalization can be calculated using the following formula: = =

[0048] in, These represent the mean and standard deviation of the millimeter-wave radar data, respectively. These represent the mean and standard deviation of the heartbeat signal data, respectively.

[0049] After normalization, the normalized millimeter-wave radar data, normalized photoplethysmography data, and unnormalized environmental parameter data are input into the autoencoder. The autoencoder consists of a three-layer neural network: an input layer, a hidden layer, and an output layer. The autoencoder's encoding layer compresses the input sensor data into a low-dimensional vector z, which is the feature vector. For example, the normalized data... , E-input automatic encoder In the process, it is compressed into a low-dimensional vector z through an encoding layer: z= ( , E) The hidden layer has 128 nodes, i.e., z∈ .

[0050] The above implementation method acquires the motion trajectory, heartbeat signal and environmental parameters of the object to be authenticated by millimeter-wave radar, photoplethysmography sensor and temperature and humidity sensor respectively, realizing the comprehensive acquisition of multimodal sensing data. By normalizing the data of each modality, the difference in dimensions and scale between different sensor data is eliminated. The encoding layer of the autoencoder is used to compress the multidimensional sensing data into a compact 128-dimensional feature vector, which effectively reduces the computational burden of the subsequent authentication process, while retaining the most essential feature information of the original data.

[0051] In one implementation, obtaining the identity parameters of the object to be authenticated may include: Obtain the random number generated when the object to be authenticated first registers, and use it as the identity parameter of the object to be authenticated.

[0052] Initial registration refers to the initial registration process performed when an object to be authenticated first accesses the authentication system. During this process, the system creates a unique identity file for the object and generates a associated secret credential. A random number is a numerical value generated by a random number generation algorithm that possesses unpredictability and sufficient entropy. For example, it can be a 128-bit random number, a 256-bit random number, or any other random number of any length that meets security requirements. This random number should be generated locally by the authentication initiator during the initial registration to ensure it cannot be intercepted during network transmission. Random number generation can be implemented using a cryptographically secure pseudo-random number generator, with its seed derived from system entropy sources such as hardware noise, mouse movement, or keyboard input timing. Alternatively, it can be generated using a counter mode of an encryption algorithm, where a counter value is used as input, encrypted with an encryption algorithm, and the output random number is generated. The counter increments after each generation to ensure the unpredictability of the output sequence; for example, a counter mode of an Advanced Encryption Standard (AES) can be used to generate random numbers. Random number generators based on physical random sources can also be used, such as hardware random number generators based on thermal noise or quantum effects.

[0053] In one implementation, a random number is generated as a user seed when a user registers for the first time. And it is stored in a Trusted Execution Environment (TEE). To ensure security, It should have sufficient entropy to generate random numbers using the CTR (Counter) mode of the AES (Advanced Encryption Standard) encryption algorithm: = (IV, key) Where IV is the initialization vector and key is the key.

[0054] After generating the random number, it is securely stored as an identity parameter locally on the authentication initiator, for example, in a trusted execution environment, and read and used during each authentication. This implementation uses the random number generated during initial registration as the identity parameter. This identity parameter is known only to the object to be authenticated and the authentication initiator, and has sufficient uncertainty, providing a solid secret foundation for the generation of subsequent authentication identifiers. Even if an attacker intercepts the authentication identifier, they cannot deduce the identity parameter in reverse.

[0055] In one implementation, generating the authentication identifier based on the feature vector, identity parameters, and current timestamp may include: The feature vector, identity parameters, and current timestamp are concatenated to obtain the concatenated input sequence; Perform a hash operation on the concatenated input sequence and use the result of the hash operation as the authentication identifier.

[0056] In this exemplary embodiment, the current timestamp can be obtained using the high-precision time synchronization service IEEE 1588 protocol provided by the 5G-A network. T s The timestamp precision is set to milliseconds, and the current timestamp can be identified as... T s =GetTimeFrom5G(precision=ms).

[0057] Concatenating feature vectors, identity parameters, and the current timestamp refers to linking three different types and formats of data together in a predetermined order to form a continuous input sequence. The concatenation order can be flexibly set according to the actual application scenario. For example, the identity parameters can be arranged first, followed by the feature vector, and finally the timestamp; alternatively, the feature vector can be arranged first, followed by the identity parameters, and finally the timestamp; or the timestamp can be arranged first, followed by the identity parameters, and finally the feature vector. The concatenation order does not affect the security of the final result, as long as the authentication initiator and the verification end use the same concatenation order in subsequent verification processes. In one specific implementation, the concatenation can be performed in the order of identity parameters, feature vector, and timestamp. In another implementation, the concatenation can also be performed in the order of timestamp, identity parameters, and feature vector.

[0058] After concatenating the three elements into a continuous input sequence, a hash operation is performed on this concatenated input sequence, and the result of the hash operation is used as the authentication identifier. A hash operation is the process of mapping input data of arbitrary length to a fixed-length output value through a hash function. It possesses cryptographic properties such as one-wayness, collision resistance, and avalanche effect. Hash operations can be implemented using the SHA256 algorithm, a third-generation secure hash algorithm, whose output is a 256-bit binary string. Hash operations can also be implemented using the SHA3 algorithm, such as the SHA3-256 algorithm. Furthermore, hash operations can be implemented using the BLAKE2 algorithm, such as the BLAKE2b or BLAKE2s algorithms.

[0059] For example, the low-dimensional feature vector z and the current timestamp can be used as input. Ts and user seeds (Identity parameters) are concatenated and then the anonymous identifier AID is generated using the SHA256 hash function: AID = SHA256(z|| Ts || ), where z is a 128-dimensional vector, T sIt is an integer. If it is a large integer, then the concatenated input is: Input=[ ... Ts ] Then, its SHA256 hash value is calculated using the following formula, yielding the authentication identifier AID = SHA256(Input). The authentication identifier generated through hashing has several advantages. First, due to the one-way nature of hashing, the original feature vector or identity parameters cannot be derived from the authentication identifier, ensuring that the biometrics and secret information of the object to be authenticated are not leaked. Second, due to the avalanche effect of hashing, any small change in the input data will cause a significant change in the authentication identifier, making the authentication identifier highly sensitive to input changes. Third, because the current timestamp is appended, even if the feature vectors generated for the same object to be authenticated are exactly the same in two adjacent authentications, the generated authentication identifiers will be completely different due to the different timestamps.

[0060] The above implementation binds the feature vector, identity parameters, and timestamp by concatenation and hashing, which not only ensures the correlation between the authentication identifier and the object to be authenticated, but also realizes the unpredictability of the authentication identifier changing with the authentication session, effectively preventing identity tracking and replay attacks.

[0061] In one implementation, generating proof data based on the authentication identifier may include: Each bit of the authentication identifier is decomposed into a Boolean variable, and the construction parameters are obtained based on multiple Boolean variables; The elliptic curve commitment parameters are determined based on the construction parameters, and the zero-knowledge proof parameters are generated based on the construction parameters. Proof data is generated based on the elliptic curve commitment parameters and the zero-knowledge proof parameters.

[0062] The authentication identifier is binary data composed of multiple bits, each bit taking the value of 0 or 1. Decomposing each bit of the authentication identifier into a Boolean variable means extracting the bit value of each bit and treating it as an independent Boolean variable. A Boolean variable is a variable whose value is only logically true or logically false, corresponding numerically to 1 or 0. For example, a Boolean variable is true and corresponds to the value 1, and a Boolean variable is false and corresponds to the value 0.

[0063] In one specific implementation, if the authentication identifier is a 256-bit binary string, it can be decomposed into 256 Boolean variables, each corresponding to a single bit value in the authentication identifier. After decomposing each bit of the authentication identifier into Boolean variables, construction parameters can be obtained from these multiple Boolean variables. Construction parameters refer to intermediate values ​​used for subsequently constructing elliptic curve commitment parameters and generating zero-knowledge proof parameters. The construction parameters can be obtained by combining the Boolean variables into a bit vector according to their position in the authentication identifier; alternatively, they can be obtained by expanding the Boolean variables according to their binary bit weights and summing the sums to obtain a large integer, i.e., multiplying the first Boolean variable by 2. 255 The second Boolean variable is multiplied by 2. 224 This continues until the last Boolean variable is multiplied by 2. 0 Then, add all the products together to get the construction parameters; you can also map each Boolean variable to a specific mathematical object and combine them as construction parameters, for example, use each Boolean variable as polynomial coefficients to construct a polynomial function.

[0064] In this embodiment, the authentication identifier AID is a 256-bit binary string, which is decomposed into multiple Boolean variables. The construction parameters can be obtained by calculating these multiple Boolean variables using the following formula. w :

[0065] in, k =256, Indicates the first i The nth boolean variable, corresponding to the nth AID. i Bit.

[0066] After obtaining the construction parameters, the elliptic curve commitment parameters can be determined based on them. Elliptic curve commitment parameters are commitment values ​​constructed using elliptic curve cryptography to hide and bind the construction parameters. They enable the verifier to believe, without revealing the construction parameters, that the prover indeed possesses construction parameters that satisfy the conditions.

[0067] Next, zero-knowledge proof parameters can be generated based on the construction parameters. Zero-knowledge proof parameters are cryptographic evidence generated through a zero-knowledge proof protocol to prove that the construction parameters satisfy preset constraints. They are used in conjunction with elliptic curve commitment parameters to enable the verifier to verify the authenticity of the prover's claim. In one implementation, the zero-knowledge proof parameters can be determined based on the construction parameters and a random factor.

[0068] Finally, proof data can be generated based on the elliptic curve commitment parameters and the zero-knowledge proof parameters. The proof data is a combination of the elliptic curve commitment parameters and the zero-knowledge proof parameters, and it can be sent as a whole to the verification end.

[0069] The above implementation constructs construction parameters by decomposing the authentication identifier into Boolean variables, and then derives elliptic curve commitment parameters and zero-knowledge proof parameters from the construction parameters. This ensures that the secret information of the authentication identifier is always kept locally at the authentication initiator, while the proof data sent to the verification end is sufficient to complete the identity verification without revealing the authentication identifier. This avoids the risk of identity leakage caused by the authentication identifier being intercepted during network transmission. At the same time, since different random factors are used for each authentication, the elliptic curve commitment parameters generated by multiple authentications of the same object to be authenticated are different, further enhancing untraceability.

[0070] In one implementation, determining the elliptic curve commitment parameters based on the construction parameters may include: Obtain the first and second base points on the elliptic curve, as well as the random factor; The elliptic curve commitment parameters are determined based on the construction parameters, random factors, first base point, and second base point.

[0071] In this context, an elliptic curve is an algebraic curve consisting of a set of points satisfying a specific cubic equation, where points can be used for addition and scalar multiplication. The first and second base points are two publicly generated points on the elliptic curve, belonging to the same subgroup of large prime numbers. The first and second base points must be public and unpredictable to ensure the security of the commitment scheme. The first and second base points can be selected using a "nothing-up-my-sleeve" approach, meaning points with a clear mathematical origin and that cannot be maliciously constructed are chosen as base points. For example, the coordinates of the base points can be obtained by mapping the hash value of a specific constant such as pi or a natural constant. There should be no known discrete logarithmic relationship between the first and second base points; that is, no one knows how many times the second base point equals the first base point, otherwise the binding force of the commitment scheme will be compromised. In one implementation, two publicly generated points on the elliptic curve can be used as the first and second base points, respectively.

[0072] random factor rThis refers to a high-entropy random number temporarily generated by the authentication initiator during the current authentication session. The random factor must meet high entropy requirements and must be kept confidential to ensure the indistinguishability of the committed value. A different random factor should be used for each authentication. The random factor can be generated using a cryptographically secure random number generator, and its entropy value should be high enough to resist exhaustive guessing attacks; for example, the length of the random factor can be 256 bits. After obtaining the first base point, the second base point, the construction parameters, and the random factor, the elliptic curve commitment parameters are determined based on the construction parameters, the random factor, the first base point, and the second base point. Specifically, the construction parameters are multiplied by the first base point using an elliptic curve scalar operation to obtain the first intermediate value; the random factor is multiplied by the second base point using an elliptic curve scalar operation to obtain the second intermediate value; and the first and second intermediate values ​​are then added using an elliptic curve point addition operation to obtain the elliptic curve commitment parameters.

[0073] In one implementation, the first base point on the elliptic curve can be obtained. G Second base point K and randomly generated random factors r The first intermediate value is obtained by performing a scalar multiplication of the construction parameters with the first base point. wG The second intermediate value is obtained by performing a scalar multiplication of the random factor and the second base point. rK The elliptic curve commitment parameter is obtained by adding the first and second intermediate values ​​using elliptic curve point addition, and can be expressed as: C w = wG + rK ,in, G , K It is the first base point and the second point on the elliptic curve. w These are the eigenvalues ​​of the Boolean circuit form obtained above, i.e., the construction parameters. r It is a random blinding factor.

[0074] The elliptic curve commitment parameters obtained through the above method have two important characteristics. First, they possess concealment: due to the presence of random factors, even if the construction parameters remain unchanged, each generated commitment parameter appears completely random and uncorrelated to the verifier, preventing attackers from obtaining any information about the construction parameters from the commitment parameters. Second, they possess binding: once the commitment parameters are generated, the construction parameters are bound to them. The authentication initiator cannot subsequently deny or change its construction parameters because changing the construction parameters would require finding different combinations of construction parameters and random factors that satisfy the same commitment value, which is impossible under the difficult assumption of the elliptic curve discrete logarithm problem.

[0075] The above implementation method hides and binds the construction parameters through the elliptic curve commitment mechanism, which enables the verification end to perform verification based on the commitment parameters without knowing the construction parameters themselves, thus protecting the privacy of the object to be authenticated. At the same time, since different random factors are used for each authentication, the commitment parameters generated by multiple authentications of the same object to be authenticated are different, further enhancing untraceability.

[0076] In one implementation, the above-mentioned generation of zero-knowledge proof parameters based on construction parameters may include: Generate zero-knowledge proof parameters based on the construction parameters and random factors.

[0077] In this zero-knowledge proof, the constructed parameters serve as secret witness information, the random factor as a blinding factor, and the preset constraints as the proposition to be proven. All three are input into the proof generation algorithm to generate the zero-knowledge proof parameters. The zero-knowledge proof protocol can be implemented using the Bulletproofs protocol, a non-interactive zero-knowledge proof protocol that does not require trusted setup, making it particularly suitable for deployment on edge devices and in resource-constrained scenarios. Within the Bulletproofs protocol framework, the proof generation algorithm receives the constructed parameters as secret witness information, the random factor as a blinding factor, and the preset constraints as the proposition to be proven, and outputs the zero-knowledge proof parameters. The preset constraints can be that the value of the constructed parameters is within a preset numerical range, that the constructed parameters belong to a preset space of valid identifiers, or that the constructed parameters satisfy a preset algebraic relationship, such as the hash value of the constructed parameters equaling a predetermined value.

[0078] In the process of generating zero-knowledge proof parameters, due to the nature of zero-knowledge proof protocols, the proving end needs to know the specific values ​​of the construction parameters and random factors to generate valid proof parameters. If the construction parameters or random factors are unknown, it is impossible to generate proof parameters that can pass verification. The verifying end, without possessing this secret information, can confirm the validity of the proof parameters solely through the verification algorithm, i.e., confirm that the proving end does indeed possess a construction parameter that satisfies the preset constraints. Taking the Bulletproofs protocol as an example, the proof generation algorithm first generates a random blinding factor, then constructs an elliptic curve commitment using the construction parameters and random factors, and then generates a series of proof data based on this commitment and construction parameters, finally outputting the zero-knowledge proof parameters. The size of these parameters is much smaller than the original secret information; for example, the zero-knowledge proof parameter π can be expressed as: π = Prove( w , r The proof parameter satisfies the preset constraint: 0 ≤ w < .

[0079] The above implementation uses the Bulletproofs protocol to generate zero-knowledge proof parameters, which requires no trusted setup and has low computational overhead. It can run efficiently on resource-constrained platforms such as drones and edge devices, while ensuring the privacy and security of the object to be authenticated.

[0080] In one implementation, sending the authentication identifier and proof data to the verification end may include: The authentication identifier and proof data are sent to the verification end using the ultra-reliable low-latency communication link of the fifth-generation mobile communication enhanced network.

[0081] This implementation can use the ultra-reliable low-latency communication link of a fifth-generation mobile communication enhanced network to send the authentication identifier and proof data to the verification end using a transport layer security encryption protocol. For example, it can use a 5G-A network to send the anonymous identifier AID and elliptic curve commitment. C w and zero-knowledge proofs π Uploaded to a ground station or cloud server. TLS encryption is used during transmission to ensure data security.

[0082] Ultra-reliable low-latency communication links refer to the highly reliable, low-latency communication services provided in fifth-generation enhanced mobile networks (5G networks). These links ensure that authentication data is transmitted within milliseconds, making them particularly suitable for the real-time authentication needs of high-speed mobile platforms such as drones in dynamic environments. Transport layer security (TLS) encryption protocols are security protocols that encrypt and protect the integrity of data at the transport layer. They negotiate encryption algorithms and session keys through a handshake to encrypt and protect transmitted data from eavesdropping and tampering. TLS protocols can be Transport Layer Security (TLS), Secure Sockets Layer (SSL), or other encryption protocols that provide transport layer security protection. The above implementation uses the ultra-reliable low-latency communication link of the 5G network to transmit authentication identifiers and proof data. The authentication data is encrypted during transmission, making it unreadable even if intercepted by a third party. Furthermore, the ultra-reliable low-latency communication link of the 5G network ensures rapid response to authentication requests, meeting the real-time authentication needs of drones in high-speed motion.

[0083] In one embodiment, the above method may further include: The verification end verifies the validity of the proof data to determine the verification result and return it.

[0084] In this embodiment, the authentication identifier and proof data are sent to the verification end. After receiving the authentication identifier and proof data, the verification end verifies the validity of the proof data. For example, the device where the object to be authenticated resides can use (AID, Cw , π The authentication data is sent to the ground station or cloud server. The verification end can then parse the G and K values, execute the verification algorithm, and obtain a result indicating successful or failed verification. For example, the ground station or cloud server receives the authentication identifier and proof data, and uses a Bulletproofs verifier to verify the validity of the proof, such as Verify. C w , π , G , K The verification process determines the result based on the returned value: "True" or "False". If verification is successful, it returns "True"; otherwise, it returns "False". During verification, the verification end receives the authentication identifier (AID). After obtaining the verification result, it associates the result with the AID. Specifically, the verification end uses the AID as an index to bind the successful or failed verification result to the AID received in this authentication session, thereby determining which object to be authenticated corresponds to the conclusion of this authentication session.

[0085] The above implementation allows the verification end to complete cryptographic verification without using the authentication identifier as input to the verification algorithm. The authentication identifier is bound to the verification result as a session identifier to realize authorization decisions and log traceability. The verification end can confirm whether the proof data is valid without obtaining the secret information of the object to be authenticated, thereby confirming the legitimacy of the object to be authenticated and realizing privacy-preserving authentication verification.

[0086] In one implementation, determining whether the object to be authenticated has passed identity authentication based on the verification result returned by the verification terminal may include: If the verification result is successful, it is determined that the object to be authenticated has passed the identity authentication and access permissions are granted. If the verification result is "verification failed", it is determined that the object to be authenticated has not passed the identity authentication and access is denied.

[0087] In this context, successful verification means that the verification end confirms that the object to be authenticated has passed identity authentication after verifying the supporting data. In the case of successful verification, the authentication initiator determines that the object to be authenticated has passed identity authentication and grants it the corresponding access permissions. Access permissions refer to the permission granted to the object to be authenticated after passing identity authentication to perform operations on specific resources or services. For example, access permissions can be granted to a drone control platform, read permissions for protected data, or access permissions to a specific physical space such as a hangar. Verification failure means that the verification end cannot confirm that the object to be authenticated has failed identity authentication after verifying the supporting data. In the case of verification failure, the authentication initiator determines that the object to be authenticated has failed identity authentication and rejects the object's access request. Rejection can be achieved by returning an authentication failure message, not responding and allowing the access request to time out, or triggering a security alert and recording the failed attempt.

[0088] The above implementation method makes explicit authorization decisions based on the verification results, ensuring that only legitimate users can obtain access permissions, while rejecting unauthorized access requests and maintaining system security.

[0089] In one embodiment, the above method may further include: The authentication identifier and current timestamp are recorded as audit logs at the verification end, but multimodal perception data, feature vectors, and proof data are not recorded.

[0090] Audit logs refer to log data used to record authentication event-related information for subsequent traceability and review. After each authentication request is processed, the verification end writes the authentication identifier used for that authentication and the current timestamp as a log record to the log storage system. The current timestamp can be the timestamp obtained during the authentication process, ensuring that the timestamp in the log is consistent with the timestamp bound to the authentication identifier. The verification end does not record multimodal perception data to avoid privacy risks caused by the leakage of raw biometric or behavioral data. The verification end does not record feature vectors to prevent the theft or misuse of the feature information of the object to be authenticated after long-term storage. The verification end does not record proof data, including elliptic curve commitment parameters and zero-knowledge proof parameters, to prevent attackers from analyzing historical proof data to associate multiple authentication behaviors of the same object to be authenticated. In one implementation, when generating audit logs, the verification end only extracts the authentication identifier (AID) and the current timestamp from the received authentication data. T sThe data is written to the log storage. After verification, the multimodal sensing data, feature vectors, and proof data are cleared from memory and not written to any persistent storage medium. The verification end only records the authentication identifier and the current timestamp. The authentication identifier itself has been hashed and bound to the timestamp, so it is impossible to deduce the identity information or biometric information of the object to be authenticated from it, nor can authentication identifiers under different timestamps be associated with the same object to be authenticated.

[0091] The above implementation method, by logging only the authentication identifier and timestamp, meets the protection requirements of data protection regulations such as the General Data Protection Regulation (GDPR) and the Health Insurance Portability and Accountability Act (HIPAA). When auditors need to trace authentication events, they can locate the specific authentication session through the authentication identifier without obtaining the sensitive information of the object to be authenticated, thus achieving a balance between auditability and privacy protection.

[0092] An exemplary embodiment of this disclosure also provides an identity authentication device. (Refer to...) Figure 2 The device 200 may include: a feature vector acquisition module 210, used to acquire multimodal perception data of the object to be authenticated, and extract features from the multimodal perception data to obtain a feature vector; the multimodal perception data includes perception data of at least two modalities; an authentication identifier generation module 220, used to acquire the identity parameters and current timestamp of the object to be authenticated, and generate an authentication identifier based on the feature vector, identity parameters, and current timestamp; a proof data generation module 230, used to generate proof data based on the authentication identifier; and an object identity authentication module 240, used to send the authentication identifier and proof data to the verification end for verification, and determine whether the object to be authenticated has passed identity authentication based on the verification result returned by the verification end.

[0093] In one embodiment, the feature vector acquisition module 210 includes: The sensing data of each modality in the multimodal sensing data are normalized to obtain the normalized sensing data of each modality. The normalized sensing data of each modality is input into the autoencoder; The autoencoder's encoding layer compresses the perceived data into a vector of a preset dimension, which serves as the feature vector.

[0094] In one embodiment, the authentication identifier generation module 220 includes: Obtain the random number generated when the object to be authenticated first registers, and use it as the identity parameter of the object to be authenticated.

[0095] In one embodiment, the authentication identifier generation module 220 includes: The feature vector, identity parameters, and current timestamp are concatenated to obtain the concatenated input sequence; Perform a hash operation on the concatenated input sequence and use the result of the hash operation as the authentication identifier.

[0096] In one implementation, the proof data generation module 230 includes: Each bit of the authentication identifier is decomposed into a Boolean variable, and the construction parameters are obtained based on multiple Boolean variables; The elliptic curve commitment parameters are determined based on the construction parameters, and the zero-knowledge proof parameters are generated based on the construction parameters. Proof data is generated based on the elliptic curve commitment parameters and the zero-knowledge proof parameters.

[0097] In one implementation, determining the elliptic curve commitment parameters based on the construction parameters includes: Obtain the first and second base points on the elliptic curve, as well as the random factor; The elliptic curve commitment parameters are determined based on the construction parameters, random factors, first base point, and second base point.

[0098] In one implementation, generating zero-knowledge proof parameters based on construction parameters includes: Generate zero-knowledge proof parameters based on the construction parameters and random factors.

[0099] In one implementation, the object authentication module 240 includes: If the verification result is successful, it is determined that the object to be authenticated has passed the identity authentication and access permissions are granted. If the verification result is "verification failed", it is determined that the object to be authenticated has not passed the identity authentication and access is denied.

[0100] The specific details of each part of the above-mentioned device have been described in detail in the method section of the implementation plan. For any undisclosed details, please refer to the implementation plan of the method section, and therefore will not be repeated here.

[0101] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to exemplary embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0102] Exemplary embodiments of this disclosure also provide a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the above-described authentication method.

[0103] In one implementation, the computer program product can be a tangible product containing a computer program, such as a computer-readable storage medium storing the computer program. The readable storage medium can be a storage medium based on electrical, magnetic, optical, electromagnetic, infrared, or other signals, including but not limited to: random access memory (RAM), read-only memory (ROM), magnetic tape, floppy disk, flash memory, hard disk drive (HDD), solid-state drive (SSD), etc. For example, the computer program product can be implemented as a non-volatile storage medium storing a computer program, such as read-only memory, NAND flash memory, etc.

[0104] In one implementation, the computer program product can be an intangible product containing a computer program. For example, the computer program product can be implemented as a virtual digital product, such as an executable file, installation package, or other digital file storing the computer program.

[0105] Computer program code can be written in one or more programming languages. Examples of programming languages ​​include C, Java, and C++. Program code can execute entirely on the user's computing device, partially on the user's computing device, or as a standalone software package. It can also execute partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, such as a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via an internet connection provided by a mobile network operator).

[0106] Computer programs can be carried or transmitted via signals such as electrical, magnetic, optical, electromagnetic, and infrared rays. Electronic devices can convert the signals carrying computer programs into digital signals, thereby running the computer programs. When a computer program runs on an electronic device, its code is used to cause the electronic device to execute (more specifically, the processor of the electronic device to execute) the method steps of various exemplary embodiments of this disclosure, such as the aforementioned authentication method.

[0107] Exemplary embodiments of this disclosure also provide an electronic device. The electronic device may include a processor and a memory. The memory stores executable instructions of the processor, such as program code. The processor executes the executable instructions to perform the methods of this exemplary embodiment. Furthermore, the electronic device may also include a display for displaying a graphical user interface.

[0108] The following is for reference. Figure 3 The electronic device is illustrated by way of a general-purpose computing device. It should be understood that... Figure 3The electronic device 300 shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments disclosed herein.

[0109] like Figure 3 As shown, the electronic device 300 may include: a processor 310, a memory 320, a bus 330, an I / O (input / output) interface 340, a network adapter 350, and a display 360.

[0110] Memory 320 may include volatile memory, such as RAM 321 and cache unit 322, and may also include non-volatile memory, such as ROM 323. Memory 320 may also include one or more program modules 324, including but not limited to: operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include an implementation of a network environment. For example, program module 324 may include the modules in the above-described device.

[0111] The processor 310 may include one or more processing units, such as an AP (Application Processor), a modem processor, a GPU (Graphics Processing Unit), an ISP (Image Signal Processor), a controller, an encoder, a decoder, a DSP (Digital Signal Processor), a baseband processor, and / or an NPU (Neural-Network Processing Unit).

[0112] The processor 310 can be used to execute executable instructions stored in the memory 320, such as the aforementioned authentication method.

[0113] Bus 330 is used to connect different components of electronic device 300 and may include data bus, address bus and control bus.

[0114] Electronic device 300 can communicate with one or more external devices 400 (such as keyboard, mouse, external controller, etc.) through I / O interface 340.

[0115] Electronic device 300 can communicate with one or more networks via network adapter 350. For example, network adapter 350 can provide mobile communication solutions such as 3G / 4G / 5G, or wireless communication solutions such as wireless LAN, Bluetooth, and near-field communication. Network adapter 350 can communicate with other modules of electronic device 300 via bus 330.

[0116] Electronic device 300 can display a graphical user interface via monitor 360.

[0117] although Figure 3 Other hardware and / or software modules, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, may also be configured in the electronic device 300.

[0118] As can be seen from the above, the technical solutions disclosed herein can be implemented as methods, apparatus, systems, computer program products, storage media, electronic devices, etc. Those skilled in the art will understand that various aspects of this disclosure can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or an implementation combining hardware and software aspects, which may be referred to as "circuit," "module," or "system," respectively.

[0119] It should be understood that this disclosure is not limited to the specific methods, steps, or structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. Those skilled in the art will readily conceive of other embodiments based on the specific implementations provided in this disclosure. Therefore, the specific implementations provided in this disclosure are merely exemplary, and the scope and spirit of this disclosure are indicated by the claims, and should cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary technical means in the art not disclosed in this disclosure.

[0120] Those skilled in the art will understand that various aspects of this disclosure can be implemented as systems, methods, or program products. Therefore, various aspects of this disclosure can be embodied in entirely hardware implementations, entirely software implementations (including firmware, microcode, etc.), or implementations combining hardware and software aspects, collectively referred to herein as “circuit,” “module,” or “system.” Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and embodiments are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the claims.

[0121] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is defined only by the appended claims.

Claims

1. An identity authentication method, characterized in that, include: Acquire multimodal sensing data of the object to be authenticated, and extract features from the multimodal sensing data to obtain a feature vector; The multimodal sensing data includes sensing data from at least two modalities; Obtain the identity parameters and current timestamp of the object to be authenticated, and generate an authentication identifier based on the feature vector, the identity parameters, and the current timestamp; Based on the authentication identifier, proof data is generated; The authentication identifier and the proof data are sent to the verification terminal for verification, and the object to be authenticated is determined to have passed the identity authentication based on the verification result returned by the verification terminal.

2. The method according to claim 1, characterized in that, The step of extracting features from the multimodal sensing data to obtain feature vectors includes: The sensing data of each mode in the multimodal sensing data are normalized to obtain the normalized sensing data of each mode. The normalized sensing data of each mode is input into the autoencoder; The autoencoder's encoding layer compresses the perceived data into a vector of a preset dimension, which serves as the feature vector.

3. The method according to claim 1, characterized in that, The step of obtaining the identity parameters of the object to be authenticated includes: Obtain the random number generated when the object to be authenticated first registers, and use it as the identity parameter of the object to be authenticated.

4. The method according to claim 1, characterized in that, The step of generating an authentication identifier based on the feature vector, the identity parameter, and the current timestamp includes: The feature vector, the identity parameter, and the current timestamp are concatenated to obtain the concatenated input sequence; A hash operation is performed on the concatenated input sequence, and the result of the hash operation is used as the authentication identifier.

5. The method according to claim 1, characterized in that, The step of generating proof data based on the authentication identifier includes: Each bit of the authentication identifier is decomposed into a Boolean variable, and construction parameters are obtained based on multiple Boolean variables; The elliptic curve commitment parameters are determined based on the construction parameters, and the zero-knowledge proof parameters are generated based on the construction parameters. The proof data is generated based on the elliptic curve commitment parameters and the zero-knowledge proof parameters.

6. The method according to claim 5, characterized in that, Determining the elliptic curve commitment parameters based on the construction parameters includes: Obtain the first and second base points on the elliptic curve, as well as the random factor; The elliptic curve commitment parameters are determined based on the construction parameters, the random factor, the first base point, and the second base point.

7. The method according to claim 6, characterized in that, The step of generating zero-knowledge proof parameters based on the construction parameters includes: The zero-knowledge proof parameters are generated based on the construction parameters and the random factor.

8. The method according to claim 1, characterized in that, The step of determining whether the object to be authenticated has passed identity authentication based on the verification result returned by the verification terminal includes: If the verification result is successful, then the object to be authenticated is determined to have passed the identity authentication and is granted access rights. If the verification result is a verification failure, it is determined that the object to be authenticated has not passed the identity authentication and access is denied.

9. An identity authentication device, characterized in that, include: The feature vector acquisition module is used to acquire multimodal perception data of the object to be authenticated, and to extract features from the multimodal perception data to obtain feature vectors; The multimodal sensing data includes sensing data from at least two modalities; The authentication identifier generation module is used to obtain the identity parameters and current timestamp of the object to be authenticated, and generate an authentication identifier based on the feature vector, the identity parameters and the current timestamp; The proof data generation module is used to generate proof data based on the authentication identifier; The object identity authentication module is used to send the authentication identifier and the proof data to the verification terminal for verification, and determine whether the object to be authenticated has passed the identity authentication based on the verification result returned by the verification terminal.

10. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the method of any one of claims 1-8 by executing the executable instructions.

11. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1-8.

Images