A mobile terminal continuous identity authentication method based on sensor data quality perception

Abstract

This application discloses a continuous identity authentication method for mobile terminals based on sensor data quality perception, relating to the field of mobile terminal security authentication technology. The method includes: collecting data from multiple types of sensors based on the current user's operational behavior; dividing the collected records into multiple detection windows to obtain current detection window samples; calculating the reliability factor and overall reliability of each sensor based on the current detection window samples; inputting the current detection window samples into a trained reconstruction model to obtain input layer reconstruction error and hidden layer reconstruction error, and calculating a comprehensive anomaly score accordingly; determining a dynamic authentication threshold and the number of dynamic anomaly windows based on the overall reliability and the risk level of the target application; comparing the comprehensive anomaly score with the dynamic authentication threshold; and combining the cumulative count of anomaly windows to determine the current user's identity status. This application avoids directly misjudging data quality issues as identity anomalies by introducing a sensor data quality assessment mechanism.

Description

Technical Field

[0001] This application relates to the field of mobile terminal security authentication technology, specifically to a method for continuous identity authentication of mobile terminals based on sensor data quality perception. Background Technology

[0002] The statements in this section are merely to provide background information in relation to this application to aid in understanding it, and such background information does not necessarily constitute prior art.

[0003] Traditional mobile terminal authentication schemes primarily rely on one-time authentication methods such as passwords, fingerprint recognition, and facial recognition. This means that identity verification is performed only once when the device is unlocked or an application is logged in, and the current session's legitimate identity is maintained after successful authentication. However, such schemes have significant security blind spots: if the terminal is lost, borrowed, or subjected to a physical contact attack while unlocked, attackers can directly access sensitive applications and data without re-authentication, leading to the complete exposure of payment, office, and privacy data. To overcome the shortcomings of one-time authentication, continuous identity authentication technology based on behavioral biometrics has gradually become a research hotspot. This technology utilizes inertial sensors built into mobile terminals, such as accelerometers, gyroscopes, and magnetometers, to continuously collect behavioral pattern data (such as grip posture, swiping habits, and movement trajectories) during user interaction with the terminal. It calculates the reconstruction error of the sample to be detected using a classification reconstruction model (such as autoencoders, variational autoencoders, and their derivative models) and compares the reconstruction error with a preset fixed threshold, thereby continuously determining whether the current operator is still a legitimate user throughout the user session.

[0004] However, the quality of mobile terminal sensor data is susceptible to interference from various factors: data loss or timestamp jitter may occur during sampling; sensor amplitude may reach its range boundary and saturate due to violent movement or sudden environmental changes; sudden changes in device posture can cause short-term fluctuations in gyroscope data; and changes in the external magnetic field environment can cause continuous disturbances to the magnetometer. Existing solutions cannot effectively distinguish between abnormal sensor data quality and abnormal user identities. Specifically, when sensor data exhibits abnormal reconstruction errors due to quality degradation, fixed threshold schemes are prone to misclassifying it as an identity anomaly, leading to false rejection of legitimate users; conversely, when noise drowns out genuine abnormal signals, fixed thresholds may be too lenient, failing to detect attackers and creating security vulnerabilities. Summary of the Invention

[0005] This application aims to address the problem that existing technologies lack a reliability perception mechanism for sensor data quality, making it impossible to dynamically adjust the authentication threshold based on sensor data quality, resulting in a high false judgment rate in scenarios with abnormal data quality.

[0006] To achieve the above objectives, this application provides the following technical solution:

[0007] According to the first aspect of this application, a method for continuous identity authentication of a mobile terminal based on sensor data quality perception is provided, comprising: Step 1, while the mobile terminal is in an unlocked state and the target application is running, using multiple types of sensors built into the mobile terminal to collect data based on the current user's operation behavior, generating collection records, and dividing the collection records into multiple detection windows to obtain detection window samples; Step 2, calculating the reliability factor of each sensor based on the collection records in the current detection window, and fusing the reliability factors of each sensor to obtain the overall reliability; Step 3, inputting the current detection window samples into a trained reconstruction model to obtain the input layer reconstruction error and the hidden layer reconstruction error, and weighting and summing the input layer reconstruction error and the hidden layer reconstruction error to obtain a comprehensive anomaly score; Step 4, obtaining the risk level of the target application, determining a dynamic authentication threshold based on the overall reliability and the risk level of the target application, comparing the comprehensive anomaly score with the dynamic authentication threshold, and determining the legitimacy of the current user based on the comparison result.

[0008] Preferably, step 2 calculates the reliability factor of each sensor based on the acquisition records within the current detection window, including: the acquisition records include timestamps, sensor axial data, application scenario identifiers, and user identifiers; for each type of sensor, the following calculations are performed within the current detection window: the timestamp continuity index is calculated based on the deviation between the actual interval of adjacent sampling points and the preset sampling period; the data availability index is calculated based on the proportion of missing or invalid sampling points to the total number of expected sampling points; the amplitude unsaturation index is calculated based on the proportion of sampling points reaching or approaching the range boundary to the total number of expected sampling points; the short-time stability index is calculated based on the ratio of the variance of the triaxial amplitude sequence to the stability normalization parameter; the timestamp continuity index, data availability index, amplitude unsaturation index, and short-time stability index are weighted and fused to obtain the reliability factor of the sensor.

[0009] Preferably, step 2, which calculates the reliability factor of each sensor based on the acquisition records within the current detection window, further includes: for the magnetometer, the axial data of the sensor includes the magnetic field strength; calculating the environmental disturbance index based on the deviation between the magnetic field strength within the current detection window and the preset reference magnetic field strength, and the environmental disturbance index participating in weighted fusion to obtain the reliability factor.

[0010] Preferably, step 3, which involves inputting the current detection window sample into the trained reconstruction model to obtain the input layer reconstruction error and the hidden layer reconstruction error, includes: the reconstruction model is trained using only samples of legitimate user normal operation behavior, and it includes at least an encoder and a reconstructor; the current detection window sample is input into the encoder to obtain the first activation of each hidden layer of the encoder; the current detection window sample is input into the reconstructor to obtain the first reconstruction input, and the first reconstruction input is input into the encoder to obtain the second activation of each hidden layer of the encoder; the input layer reconstruction error is calculated based on the current detection window sample and the first reconstruction input, and the hidden layer reconstruction error is calculated based on the first activation and the second activation of each hidden layer.

[0011] Preferably, step 3, which involves weighted summation of the input layer reconstruction error and the hidden layer reconstruction error to obtain a comprehensive anomaly score, includes: weighting the input layer reconstruction error at the sensor channel level according to the reliability factor of each sensor to obtain a weighted input layer reconstruction error, wherein the higher the reliability factor of each sensor, the greater the weight of the corresponding sensor channel in the weighted input layer reconstruction error; obtaining the risk level of the target application, and determining the fusion weight of the weighted input layer reconstruction error and the fusion weight of the hidden layer reconstruction error based on the overall reliability and the risk level of the target application, wherein the higher the overall reliability and / or the higher the risk level of the target application, the higher the proportion of the hidden layer reconstruction error in calculating the comprehensive anomaly score; and calculating the comprehensive anomaly score based on the weighted input layer reconstruction error, the hidden layer reconstruction error, and their respective fusion weights.

[0012] Preferably, step 4 includes: obtaining the risk level of the target application; determining the dynamic authentication threshold and the number of dynamic abnormal windows based on the overall reliability and the risk level of the target application; comparing the comprehensive abnormal score with the dynamic authentication threshold; and calculating the cumulative count of abnormal windows based on the comparison result and preset rules; and triggering an identity abnormality warning and corresponding security response when the cumulative count of abnormal windows reaches the number of dynamic abnormal windows.

[0013] Preferably, the cumulative count of abnormal windows is calculated based on the comparison results and preset rules, including: increasing the cumulative count of abnormal windows when the overall abnormal score exceeds the dynamic authentication threshold; and decreasing the cumulative count of abnormal windows by a preset attenuation coefficient when the overall abnormal score does not exceed the dynamic authentication threshold.

[0014] Preferably, triggering the security response includes: when the risk level of the target application is low, performing authentication logging or increasing the subsequent collection frequency; when the risk level of the target application is medium, performing secondary authentication, suspending sensitive operations, or restricting data access; when the risk level of the target application is high, performing secondary authentication, freezing the page, locking the application, terminating the transaction, revoking the session token, or sending an abnormal authentication digest; wherein, the abnormal authentication digest includes detection time, application scenario identifier, comprehensive abnormal score, reliability factor, dynamic authentication threshold, number of dynamic abnormal windows, response type, and device identifier.

[0015] Preferably, the dynamic authentication threshold increases as the overall reliability decreases and decreases as the risk level increases; the number of dynamic anomaly windows increases as the overall reliability decreases and decreases as the risk level increases.

[0016] Preferably, the risk level of the target application is determined according to the application scenario using a preset mapping table, and is increased when a transaction confirmation, file export, permission change, or sensitive page access event occurs within the target application.

[0017] According to a second aspect of this application, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program that, when executed by a processor, implements the method of the first aspect of this application.

[0018] According to a third aspect of this application, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the method of the first aspect of this application.

[0019] Compared with the prior art, this application has the following advantages:

[0020] This application introduces a sensor data quality assessment mechanism into continuous identity authentication, incorporating multiple data quality indicators such as timestamp continuity, data availability, amplitude unsaturation, short-term stability, and magnetic field disturbance degree into the reliability factor calculation. This allows the quality status of sensor data to be identified before identity authentication is made, effectively distinguishing between abnormal sensor data and abnormal real user identities. It avoids directly misjudging data quality issues such as missing samples, timestamp jitter, amplitude saturation, sudden changes in device posture, or external magnetic field interference as identity anomalies, significantly reducing the false rejection rate of legitimate users and the probability of false triggering due to data quality fluctuations.

[0021] This application links the overall reliability obtained by fusing reliability factors from various sensors with the risk level of the target application to jointly determine the dynamic authentication threshold. When sensor data quality deteriorates and overall reliability decreases, the dynamic authentication threshold is automatically increased, making it more difficult for low-quality data to trigger anomaly judgments, thereby effectively avoiding false alarms caused by data quality anomalies. When the target application is in a high-risk scenario, the dynamic authentication threshold is automatically decreased, enabling a faster and more sensitive response to potential identity anomalies in high-risk scenarios. This application also introduces a continuous anomaly window as a judgment condition for triggering a security response to reduce false judgments caused by transient noise, and determines the number of dynamic anomaly windows based on the overall reliability obtained by fusing reliability factors from various sensors and the risk level of the target application. This linkage mechanism achieves an organic combination of data quality perception and scenario risk perception, ensuring timely response in high-risk scenarios while effectively avoiding false judgments in low-quality data scenarios, thus balancing the security and availability of continuous identity authentication.

[0022] In this application, the fusion weights of input layer reconstruction error and hidden layer reconstruction error can also be dynamically adjusted according to the overall reliability and risk level. In high-reliability data environments or high-risk application scenarios, the weight of hidden layer reconstruction error is increased accordingly, making the calculation of the comprehensive anomaly score focus more on the deep semantic deviation of behavioral patterns rather than the instantaneous fluctuations of surface data, thereby further improving the ability of the judgment to distinguish between real identity anomalies and data noise.

[0023] This application employs a sensor channel-level weighting method to apply reliability factors to the input layer reconstruction error of the reconstruction model. This method assigns greater error weights to sensor channels with higher reliability, while suppressing anomalous reconstruction errors from sensor channels with lower reliability. This channel-level weighting mechanism effectively reduces the negative impact of interfered or low-quality sensor channels on the overall anomaly score, preventing single sensor data anomalies from being amplified into global identity anomaly signals. This significantly improves the robustness of decision-making under complex noise environments and multi-source interference conditions.

[0024] This application implements a tiered security response based on the risk level of the target application. In low-risk scenarios, only logs are recorded or collection strategies are adjusted to avoid unnecessary interference with user experience. In medium-risk scenarios, secondary authentication is triggered or sensitive operations are restricted to maintain business continuity while ensuring security. In high-risk scenarios, strong protection measures such as locking the application, freezing pages, terminating transactions, or revoking session tokens are implemented, and abnormal authentication digests are reported to the server for security auditing. This tiered response mechanism ensures precise matching of security policies to scenario risks, preventing over-response in low-risk scenarios and ensuring timely protection in high-risk scenarios. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings:

[0026] Figure 1 This is a flowchart illustrating a mobile terminal continuous authentication method based on sensor data quality perception according to an embodiment of this application.

[0027] Figure 2 This is an overall flowchart of a continuous identity authentication method according to an embodiment of this application;

[0028] Figure 3 This is a flowchart illustrating the calculation of sensor reliability factor according to an embodiment of this application;

[0029] Figure 4 This is a schematic diagram illustrating the linkage between reliability, reconstruction error, dynamic threshold, and continuous window decision according to an embodiment of this application;

[0030] Figure 5 This is a schematic diagram of the architecture of a mobile terminal continuous identity authentication system based on sensor data quality perception according to an embodiment of this application. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application. Furthermore, the technical features involved in the various embodiments described below can be combined with each other as long as they do not conflict with each other.

[0032] As mentioned in the background section, fixed threshold schemes are prone to high false positive rates in scenarios with abnormal data quality. However, risk-based adaptive authentication schemes also suffer from this problem. These schemes adjust authentication strength or frequency based on the current application type, operational sensitivity, or environmental context—for example, increasing authentication requirements in payment or transaction scenarios and decreasing authentication frequency in ordinary browsing scenarios. However, this risk perception remains at the application and scenario level and does not assess the reliability of sensor data. When sensor data quality deteriorates due to environmental interference or hardware fluctuations, these schemes still execute judgments in the original manner, failing to dynamically adjust authentication parameters based on data quality. Therefore, they also face the problem of misjudging abnormal data quality as abnormal identity.

[0033] The inventors discovered in their research that existing mobile terminal continuous authentication technologies lack a reliability perception mechanism for sensor data quality. As a result, they cannot dynamically adjust sensor channel weights, authentication thresholds, and the number of abnormal windows based on sensor data quality. This leads to a high false positive rate in scenarios with abnormal data quality and makes it difficult to balance security and usability in high-risk application scenarios and low-quality data scenarios.

[0034] Figure 1 This is a flowchart illustrating a mobile terminal continuous authentication method based on sensor data quality perception according to an embodiment of this application. Figure 2 This is an overall flowchart of a continuous identity authentication method according to an embodiment of this application. Figure 1 and Figure 2 As shown, the method includes:

[0035] Step 1: While the mobile terminal is unlocked and the target application is running, multiple sensors built into the mobile terminal collect data based on the current user's actions, generating a collection record. This collection record is then divided into multiple detection windows to obtain detection window samples. In some embodiments, the collection record may include a timestamp, sensor axial data, application scenario identifier, and user identifier. Table 1 shows the seven types of fields included in the sampling record and their corresponding descriptions. In some embodiments, these field types can be adjusted or supplemented.

[0036] Table 1

[0037]

[0038] Step 2: Calculate the reliability factor of each sensor based on the acquisition records in the current detection window, and fuse the reliability factors of each sensor to obtain the overall reliability.

[0039] In some embodiments, for each type of sensor, the reliability factor of that sensor is calculated within the current detection window. For example... Figure 3 As shown, the first Taking sensors as an example, :

[0040] The timestamp continuity index is calculated based on the deviation between the actual interval between adjacent sampling points and the preset sampling period. :

[0041] ;

[0042] The data availability index is calculated based on the proportion of missing or invalid sampling points to the total number of expected sampling points. :

[0043] ;

[0044] The amplitude unsaturation index is calculated based on the proportion of sampling points that reach or approach the range boundary to the total number of expected sampling points. :

[0045] ;

[0046] The short-time stability index is calculated based on the ratio of the variance of the three-axis amplitude sequence to the stability normalization parameter. :

[0047] ;

[0048] Where M is the expected number of sampling points within the current detection window. For the preset sampling period, The interval between adjacent sampling points, The number of missing, invalid, or padded sampling points. The number of sampling points to reach or approach the range boundary. This is a three-axis amplitude sequence, where the amplitude at the k-th sampling point is... When the first The type of sensor is accelerometer timing. , , These are the X, Y, and Z axis accelerations corresponding to the accelerometers; when the... When the sensor is a gyroscope, , , These represent the X, Y, and Z axis angular velocities corresponding to the gyroscope; when the... The type of sensor is magnetic timing. , , These represent the X, Y, and Z axis magnetic field strengths corresponding to the magnetometer. For stability normalization parameters; Var( A function for calculating sample variance. This is used to characterize the short-time fluctuation of the sensor's triaxial amplitude sequence. This represents a function that calculates the average value; clip(X,0,1) restricts the intermediate variable X to between 0 and 1.

[0049] The reliability factor of the sensor is obtained by weighting and fusing the timestamp continuity index, data availability index, amplitude unsaturation index, and short-term stability index. .

[0050] ;

[0051] in, , , , This indicates the corresponding weight.

[0052] Overall reliability The following is obtained by weighting the reliability factors of each sensor:

[0053] ;

[0054] in, For the first Sensor reliability factor in overall reliability The fusion weights in It is a non-negative number, which can be preset according to the contribution of the sensor to the authentication performance of the classification reconstruction model, or determined by the validation set of normal samples of legitimate users, and satisfying that the sum of the weights of each sensor is 1.

[0055] In some embodiments, for a magnetometer, the sensor axial data includes magnetic field strength. In addition to calculating timestamp continuity, data availability, amplitude unsaturation, and short-time stability metrics, calculating the magnetometer's reliability factor also requires calculating environmental disturbance metrics. The environmental disturbance index is calculated based on the deviation between the current magnetic field strength within the detection window and the preset reference magnetic field strength.

[0056] ;

[0057] in, These represent the x, y, and z axis magnetic field strength components of the magnetometer at the k-th sampling point within the current detection window. This represents the magnetic field strength amplitude at the corresponding sampling point.

[0058] ;

[0059] in, The magnetic field strength benchmark value can be determined during the benchmark acquisition phase after a legitimate user has completed registration and authorized data collection, or during the parameter initialization phase after the initial deployment or retraining of a classification reconstruction model; specifically, it is used for data collection. A detection window that has been marked as a legitimate user interacting normally ( (Preset positive integers, preferably no less than 30), calculate the magnetic field strength amplitude within each window. The median of the first value is used, and then the median of the medians of the medians in each window is taken as the baseline value. During rolling updates, only the most recent value before the current detection window is used. The detection windows that have been determined to be normal by the continuous identity authentication results ( The preset positive integer is preferred, between 20 and 100, and the magnetometer reliability factor of this window (i.e., the magnetometer's corresponding...) Environmental disturbance index not less than 0.8 Not less than 0.8. This represents the preset magnetic field strength deviation threshold, used to normalize the maximum deviation of the magnetic field strength amplitude relative to the magnetic field strength reference value within the current detection window.

[0060] For magnetometers, the process of obtaining the reliability factor through weighted fusion of environmental disturbance indicators involves weighted fusion of timestamp continuity indicators, data availability indicators, amplitude unsaturation indicators, short-term stability indicators, and environmental disturbance indicators to obtain the reliability factor of the sensor. :

[0061] ;

[0062] in, This indicates the weight corresponding to the environmental disturbance index.

[0063] Step 3, as follows Figure 4 As shown, the input layer reconstruction error and the hidden layer reconstruction error are obtained by inputting the current detection window sample into the trained reconstruction model. The input layer reconstruction error and the hidden layer reconstruction error are then weighted and summed to obtain the comprehensive anomaly score. In some embodiments, the reconstruction model (a single-classification reconstruction model) is trained using only samples of legitimate user normal operation behavior, and can be an autoencoder, variational autoencoder, denoising autoencoder, convolutional autoencoder, or other reconstruction neural network.

[0064] In some embodiments, the reconstruction model includes at least an encoder and a reconstructor. Inputting the current detection window sample into the trained reconstruction model to obtain the input layer reconstruction error and the hidden layer reconstruction error may include: inputting the current detection window sample into the encoder to obtain the first activation of each hidden layer of the encoder; inputting the current detection window sample into the reconstructor to obtain the first reconstruction input, and inputting the first reconstruction input into the encoder to obtain the second activation of each hidden layer of the encoder; calculating the input layer reconstruction error based on the current detection window sample and the first reconstruction input, and calculating the hidden layer reconstruction error based on the first activation and the second activation of each hidden layer.

[0065] In some embodiments, hidden layer reconstruction error The calculation method is as follows:

[0066] Calculate the first Layer hidden representation in the original sample With reconstructed samples The deviation between them is the first Hidden layer reconstruction error :

[0067] ;

[0068] in, (·) represents the model number. Layered hidden representation.

[0069] In this embodiment of the application, the overall hidden layer reconstruction error Reconstruction error of each hidden layer Summing yields: ,in, This represents the number of hidden layers in the encoder.

[0070] Continue to refer to Figure 4 In some embodiments, the weighted summation of the input layer reconstruction error and the hidden layer reconstruction error to obtain a comprehensive anomaly score may include:

[0071] 1. The input layer reconstruction error is weighted at the sensor channel level based on the reliability factor of each sensor to obtain the weighted input layer reconstruction error. The higher the reliability factor of each sensor, the greater the weight of the corresponding sensor channel in the weighted input layer reconstruction error. Specifically:

[0072] No. Sensors of different types are typically not single-channel (referring to the input dimension in the model input matrix), but rather correspond to multiple axial or derived channels. For example, an accelerometer may correspond to the X-axis acceleration (AccValueX), Y-axis acceleration (AccValueY), and Z-axis acceleration (AccValueZ); a gyroscope may correspond to the X-axis angular velocity (GyrValueX), Y-axis angular velocity (GyrValueY), and Z-axis angular velocity (GyrValueZ); and a magnetometer may correspond to the X-axis magnetic field strength (MagValueX), Y-axis magnetic field strength (MagValueY), and Z-axis magnetic field strength (MagValueZ). If the input sample adopts a 12×50 structure, it can also be understood that each of the three types of sensors contains three-axis data and one amplitude channel.

[0073] After inputting the sample of the window to be detected into the reconstruction model to obtain the reconstructed sample, for the first... The set of channel indexes corresponding to the sensor class Calculate the first Average input layer reconstruction error of the corresponding channel of the sensor :

[0074] ;

[0075] in, This represents the input sample (original sample) of the current t-th detection window. Represents the reconstructed sample output by the model, r represents the channel index, | | Represents the set of channel indexes Number of central channels and Representing the original samples respectively and reconstructed samples The value taken in the r-th channel.

[0076] The sensor channel weights are calculated based on the reliability factor, and the input layer reconstruction error is weighted at the sensor channel level.

[0077] ;

[0078] ;

[0079] in, Indicates the first Fusion weights for reconstruction errors in sensor-like input layers. It is the first Reliability factor of sensor-like devices This involves summing the reliability factors of all participating sensors to achieve normalization. This represents the weighted input layer reconstruction error. More reliable sensors exhibit lower input layer reconstruction error. It has a higher weighting in China.

[0080] To illustrate the moderating effect of reliability factors on decision-making, consider the following example. Suppose a magnetometer within a detection window is affected by a magnetic field, and the reliability factors of the three types of sensors are respectively... =0.90、 =0.85、 =0.30, corresponding to an input layer channel reconstruction error of =0.20、 =0.25、 =0.80.

[0081] according to Calculate and weight the channels: If no reliability weighting (equal weighting for three channels) is applied, then It is evident that the reliability weighting reduces the impact of the disturbed magnetometer channel from 0.42 to 0.31, thereby preventing sensor data quality anomalies from being amplified as identity anomalies.

[0082] 2. Obtain the risk level of the target application, and determine the weighted input layer reconstruction error based on the overall reliability and the risk level of the target application. Fusion weights and hidden layer reconstruction error The higher the fusion weight, the higher the overall reliability and / or the risk level of the target application. The higher the value, the higher the proportion of hidden layer reconstruction error in calculating the overall anomaly score. Specifically:

[0083] The risk level of the target application is determined and quantified by the AppScenario field according to a preset mapping table. AppScenario is a field representing the current application or operation scenario collected by the mobile terminal. Based on the AppScenario or specific operation event, the current window is mapped to low risk, medium risk, or high risk, and then... Values ​​are assigned to 0, 0.5, 1, etc. When a transaction confirmation, file export, permission change, or sensitive page access event occurs within the target application, the risk level of the corresponding time window is increased. For example, if the current basic scenario is low risk, but an event such as file export, permission change, or sensitive page access occurs, the risk level can be increased by one level, i.e., low risk 0 is increased to medium risk 0.5; medium risk can be increased to high risk 1; if it is already high risk, it remains high risk. Alternatively, certain highly sensitive events can be directly mapped to high risk. In some embodiments, the risk level of the target application is determined according to the application scenario using a preset mapping table, and is increased when a transaction confirmation, file export, permission change, or sensitive page access event occurs within the target application.

[0084] In some embodiments, the mapping between the current window and the risk level of the target application can be as shown in Table 2:

[0085] Table 2

[0086]

[0087] The weights of input layer error and hidden layer error in the overall anomaly score are dynamically allocated according to the overall reliability and risk level:

[0088] ;

[0089] ;

[0090] in, This represents the hidden layer reconstruction error in the t-th detection window. The fusion weight; These are the basic weights; Indicates overall reliability The adjustment coefficient for the weights of the hidden layer; Indicates risk level The adjustment coefficient for the weights of the hidden layer; These represent the upper and lower limits of the weight, respectively. This indicates that the calculation result is restricted to a certain range ( )Inside; This represents the weighted input layer reconstruction error in the t-th detection window. The fusion weights, where, .

[0091] 3. Calculate the comprehensive anomaly score based on the weighted input layer reconstruction error, hidden layer reconstruction error, and their respective fusion weights. .

[0092] Step 4: Obtain the risk level of the target application, determine the dynamic authentication threshold based on the overall reliability and the risk level of the target application, compare the comprehensive anomaly score with the dynamic authentication threshold, and determine the legitimacy of the current user based on the comparison result.

[0093] Continue to refer to Figure 4 In some embodiments, step 4 may include:

[0094] 1. Obtain the risk level of the target application, and determine the dynamic authentication threshold and the number of dynamic anomaly windows based on the overall reliability and the risk level of the target application. Specifically:

[0095] The dynamic authentication threshold and the number of dynamic anomaly windows are determined by the base threshold, overall reliability, risk level, and historical authentication trends according to the following formula:

[0096] ;

[0097] ;

[0098] in, Indicates the first The dynamic authentication threshold for each detection window. Indicates the basic threshold; This represents the threshold for the cumulative count of abnormal windows (the number of dynamic abnormal windows) required to trigger an abnormal decision. Indicates the base number of windows. Indicates overall reliability Compensation coefficients for threshold and window size during descent. Indicates risk level The tightening factor for threshold and window number increases as the risk level increases. The threshold and window number decrease as the risk level increases (more sensitive response), while the threshold and window number increase as the overall reliability decreases (avoiding false triggers from low-quality data). These represent the upper and lower limits of the preset dynamic authentication threshold and the number of dynamic abnormal windows, respectively. This represents the floor function, used to ensure... It is an integer. This is a parameter for the stability of historical certifications, dynamically calculated based on historical certification results. This is the adjustment coefficient for the historical authentication stability parameter on the dynamic authentication threshold. L is the parameter used to calculate... The number of historical detection windows, where L is a positive integer.

[0099] 2. Compare the overall anomaly score with the dynamic authentication threshold, and calculate the cumulative count of anomaly windows based on the comparison result and preset rules. Specifically, this includes:

[0100] ;

[0101] in, This indicates the current detection window (the [number]th window). The cumulative count of abnormal windows when there are multiple detection windows. This indicates the cumulative count of abnormal windows up to the previous detection window. (·) indicates an indicator function. This represents the attenuation coefficient. If... The current detection window is abnormal; if The current detection window is normal.

[0102] In some embodiments, the cumulative count of the abnormal window is calculated based on the comparison result and preset rules, including: increasing the continuous abnormal count when the comprehensive abnormal score exceeds the dynamic authentication threshold; and decreasing the continuous abnormal count by a preset attenuation coefficient when the comprehensive abnormal score does not exceed the dynamic authentication threshold.

[0103] 3. When the cumulative count of abnormal windows reaches the dynamic number of abnormal windows, an identity abnormality warning and corresponding security response will be triggered.

[0104] when ≥ If the current user's identity status is deemed abnormal, a security response is triggered; otherwise, the authentication process continues in the next time window.

[0105] In some embodiments, triggering a security response includes: when the target application's risk level is low, performing authentication logging or increasing the frequency of subsequent data collection; when the target application's risk level is medium, performing secondary authentication, suspending sensitive operations, or restricting data access; when the target application's risk level is high, performing secondary authentication, freezing the page, locking the application, terminating the transaction, revoking the session token, or sending an abnormal authentication digest. The abnormal authentication digest includes the detection time, application scenario identifier, comprehensive anomaly score, reliability factor, dynamic authentication threshold, number of dynamic anomaly windows, response type, and device identifier.

[0106] In an instant messaging scenario, if the timestamp interval shows significant jitter within a detection window and the magnetometer is affected by magnetic field interference, the reliability factor of the corresponding sensor and its channel error weight are reduced, while the dynamic authentication threshold is increased to prevent data quality anomalies from being misjudged as identity anomalies. If the overall anomaly score of subsequent consecutive windows still exceeds the dynamic threshold, a security response is triggered according to the current scenario risk level.

[0107] In payment scenarios, AppScenario is mapped to a high-risk level ( =1), the dynamic authentication threshold and the number of dynamic anomaly windows decrease; when the comprehensive anomaly score exceeds the threshold and the anomaly count reaches... If secondary authentication is triggered, and the secondary authentication fails or the exception count continues to increase, the target application is locked, the transaction process is terminated, and an exception authentication summary is sent to the server.

[0108] It should be noted that although the steps are described in a specific order above, it does not mean that the steps must be executed in the above specific order. In fact, some of these steps can be executed concurrently, or even in a different order, as long as the required function can be achieved.

[0109] Figure 5 This is a schematic diagram of the architecture of a mobile terminal continuous identity authentication system based on sensor data quality awareness, according to an embodiment of this application. Figure 5 As shown in Table 3, the system architecture includes a mobile terminal (the local execution entity) and a server (optional). The mobile terminal includes a status monitoring module, a data acquisition module, a window generation module, a model inference module, a reliability assessment module, an application scenario identification module, a threshold management module, an anomaly score calculation module, an authentication decision module, a security response module, and an optional communication module. Specifically, the status monitoring module is configured to continuously monitor the terminal's operating status; the data acquisition module is configured to collect relevant data; the window generation module is configured to generate a detection window from the collected data; and the model inference module is configured to perform model inference and output the average input layer reconstruction error for each type of sensor channel. and hidden layer reconstruction error The reliability assessment module is configured to evaluate and output reliability factors. and overall reliability The application scenario identification module is configured to identify application scenarios and output risk levels. The threshold management module is configured based on overall reliability. and risk level Generate dynamic authentication thresholds and the number of dynamic exception windows The anomaly score calculation module is configured to be based on the reliability factor. Overall reliability Average input layer reconstruction error for each type of sensor channel Hidden layer reconstruction error and risk level Calculate the comprehensive abnormality score The authentication decision module is configured to... With dynamic authentication threshold Number of dynamic abnormal windows and cumulative count of abnormal windows The system compares data and makes authentication decisions. The security response module is configured to perform security operations such as secondary authentication, locking, terminating transactions, or generating anomaly summaries based on the decision results. The communication module is configured to upload anomaly authentication summaries and authentication logs to the server. In addition to log storage and security auditing, the server is also configured to update model parameters and risk mapping tables / threshold policies. It can remotely update and synchronize policies for the mobile terminal's model inference module and threshold management module by distributing model parameters and risk mapping tables / threshold policies, respectively.

[0110] Table 3

[0111]

[0112] In some embodiments, the system uses the parameters shown in Table 4 (all are exemplary settings and can be adjusted according to terminal capabilities and security requirements):

[0113] Table 4

[0114]

[0115] It should be noted that when the magnetometer is missing in Table 4 The "not participating" means that when the magnetometer is missing, the reliability factor corresponding to the magnetometer and its related channels do not participate in the overall reliability calculation and input layer reconstruction error fusion, and the weights of the remaining sensors participating in the fusion are renormalized.

[0116] Since the system implementation is basically similar to the method implementation, please refer to the corresponding description of the method implementation provided above for details of the relevant technical features and their effects. Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The above modules can be implemented in hardware or as software functions.

[0117] The embodiments provided in this application can also be computer program products. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of this application. A computer-readable storage medium may be a tangible device that holds and stores instructions used by an instruction execution device. Computer-readable storage media may include, for example, but not limited to, electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination thereof.

[0118] This application uses specific embodiments to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the solution and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for continuous identity authentication of mobile terminals based on sensor data quality perception, characterized in that, include: Step 1: While the mobile terminal is unlocked and the target application is running, use multiple sensors built into the mobile terminal to collect data based on the current user's operation behavior, generate collection records, and divide the collection records into multiple detection windows to obtain detection window samples; Step 2: Calculate the reliability factor of each sensor based on the acquisition records in the current detection window, and fuse the reliability factors of each sensor to obtain the overall reliability; Step 3: Input the current detection window sample into the trained reconstruction model to obtain the input layer reconstruction error and the hidden layer reconstruction error. Then, perform a weighted summation of the input layer reconstruction error and the hidden layer reconstruction error to obtain the comprehensive anomaly score. Step 4: Obtain the risk level of the target application, determine the dynamic authentication threshold based on the overall reliability and the risk level of the target application, compare the comprehensive anomaly score with the dynamic authentication threshold, and determine the legitimacy of the current user based on the comparison result.

2. The method according to claim 1, characterized in that, Step 2 calculates the reliability factor of each sensor based on the acquisition records within the current detection window, including: The data collection records include timestamps, sensor axial data, application scenario identifiers, and user identifiers. For each type of sensor, the calculation is performed within the current detection window as follows: The timestamp continuity index is calculated based on the deviation between the actual interval between adjacent sampling points and the preset sampling period. The data availability index is calculated based on the proportion of missing or invalid sampling points to the total number of expected sampling points; The amplitude unsaturation index is calculated based on the proportion of sampling points that reach or approach the range boundary to the total number of expected sampling points. The short-time stability index is calculated based on the ratio of the variance of the three-axis amplitude sequence to the stability normalization parameter. The reliability factor of the sensor is obtained by weighted and fused the timestamp continuity index, data availability index, amplitude unsaturation index, and short-term stability index.

3. The method according to claim 2, characterized in that, Step 2, which calculates the reliability factor of each sensor based on the data collected within the current detection window, also includes: For a magnetometer, the sensor's axial data includes the magnetic field strength; The environmental disturbance index is calculated based on the deviation between the magnetic field strength in the current detection window and the preset reference magnetic field strength. The environmental disturbance index is then used in a weighted fusion process to obtain the reliability factor.

4. The method according to claim 1, characterized in that, In step 3, the current detection window sample is input into the trained reconstruction model to obtain the input layer reconstruction error and the hidden layer reconstruction error, including: The reconstruction model is trained using only samples of normal user behavior and includes at least an encoder and a reconstructor. The current detection window sample is input into the encoder to obtain the first activation of each hidden layer of the encoder; The current detection window sample is input to the reconstructor to obtain the first reconstruction input, and the first reconstruction input is input to the encoder to obtain the second activation of each hidden layer of the encoder; The input layer reconstruction error is calculated based on the current detection window sample and the first reconstruction input, and the hidden layer reconstruction error is calculated based on the first activation and the second activation of each hidden layer.

5. The method according to claim 1, characterized in that, In step 3, the input layer reconstruction error and the hidden layer reconstruction error are weighted and summed to obtain a comprehensive anomaly score, including: The input layer reconstruction error is weighted at the sensor channel level based on the reliability factor of each sensor to obtain the weighted input layer reconstruction error. The higher the reliability factor of each sensor, the greater the weight of the corresponding sensor channel in the weighted input layer reconstruction error. Obtain the risk level of the target application, and determine the fusion weight of the weighted input layer reconstruction error and the fusion weight of the hidden layer reconstruction error based on the overall reliability and the risk level of the target application. The higher the overall reliability and / or the higher the risk level of the target application, the higher the proportion of the hidden layer reconstruction error in the calculation of the comprehensive anomaly score. The comprehensive anomaly score is calculated based on the weighted input layer reconstruction error, the hidden layer reconstruction error, and their respective fusion weights.

6. The method according to claim 1, characterized in that, Step 4 includes: Obtain the risk level of the target application, and determine the dynamic authentication threshold and the number of dynamic anomaly windows based on the overall reliability and the risk level of the target application. The comprehensive anomaly score is compared with the dynamic authentication threshold, and the cumulative count of anomaly windows is calculated based on the comparison result and preset rules. When the cumulative count of the abnormal windows reaches the number of dynamic abnormal windows, an identity abnormality warning and corresponding security response are triggered.

7. The method according to claim 6, characterized in that, The cumulative count of abnormal windows is calculated based on the comparison results and preset rules, including: When the overall anomaly score exceeds the dynamic authentication threshold, the cumulative count of the anomaly window is increased. When the overall anomaly score does not exceed the dynamic authentication threshold, the cumulative count of the anomaly window is reduced by a preset attenuation coefficient.

8. The method according to claim 6, characterized in that, The security response is triggered by: When the risk level of the target application is low, perform authentication log recording or increase the frequency of subsequent data collection. When the risk level of the target application is medium risk, perform secondary authentication, suspend sensitive operations, or restrict data access. When the risk level of the target application is high, perform secondary authentication, freeze the page, lock the application, terminate the transaction, revoke the session token, or send an abnormal authentication digest. The anomaly authentication summary includes detection time, application scenario identifier, comprehensive anomaly score, reliability factor, dynamic authentication threshold, number of dynamic anomaly windows, response type, and device identifier.

9. The method according to claim 6, characterized in that, The dynamic authentication threshold increases as the overall reliability decreases and decreases as the risk level increases. The number of dynamic anomaly windows increases as the overall reliability decreases and decreases as the risk level increases.

10. The method according to claim 1, characterized in that, The risk level of the target application is determined according to the application scenario using a preset mapping table, and is increased when a transaction confirmation, file export, permission change, or sensitive page access event occurs within the target application.

Images