CN111444489A

CN111444489A - Double-factor authentication method based on photoplethysmography sensor

Info

Publication number: CN111444489A
Application number: CN202010211605.0A
Authority: CN
Inventors: 李凡; 曹烨彤
Original assignee: Beijing Institute of Technology BIT
Current assignee: Beijing Institute of Technology BIT
Priority date: 2020-01-06
Filing date: 2020-03-24
Publication date: 2020-07-24
Anticipated expiration: 2040-03-24
Also published as: CN111444489B

Abstract

The invention relates to a double-factor authentication method based on a photoplethysmography sensor, and belongs to the technical field of mobile computing application. The invention uses the photoelectric volume pulse wave sensor to collect the heartbeat signal of the user. And (3) carrying out noise removal processing on the heartbeat signals subjected to the motion artifact interference by utilizing a semi-blind source separation technology and a self-adaptive filtering technology, and extracting pure heartbeat signals. And carrying out time domain and angle domain coordinate conversion on the extracted heartbeat signals. Extracting the geometric features from the converted heartbeat signals, and obtaining a series of features capable of uniquely identifying the user after conversion and encryption algorithm processing. Therefore, the heartbeat signal is collected by the photoelectric volume pulse wave sensor of the intelligent wrist strap device, and the double-factor authentication of the user is realized. The present invention supports highly secure authentication and allows users to re-register substitute credentials to resist replay attacks and man-in-the-middle attacks. The user is not required to remain stationary and the usual authentication methods can be used at the same time.

Description

Double-factor authentication method based on photoplethysmography sensor

Technical Field

The invention relates to a double-factor identity authentication method, in particular to an identity authentication method based on heartbeat signals and utilizing a photoelectric volume pulse wave sensor of intelligent wrist strap equipment, and belongs to the technical field of mobile computing application.

Background

With the wide popularization and application of mobile devices in daily behaviors of people, such as short message sending and receiving, health care, mobile payment and the like, the connection with personal and financial sensitive information is increasingly close, and the two-factor authentication is widely applied to the mobile devices. The double-factor authentication is a method for authenticating the user by combining two methods, further improves the safety of the system, enhances the privacy protection of the user, and provides an additional security line in addition to a common identity authentication method.

The existing two-factor authentication method mainly relies on combining common mobile authentication technologies. Commonly used mobile authentication techniques are mainly classified into a method based on user knowledge and a method based on biometrics. Methods based on user knowledge mainly include password unlocking, sliding gesture unlocking and the like, and are easily attacked by shoulder surfing and smudge. Some business systems have applied the above approach to two-factor authentication, but existing systems all have problems of requiring additional user involvement, poor use experience, and the like. The biometric-based methods can be classified into physiological signal feature-based methods and biological behavior-based methods. The technology based on physiological signal characteristics mainly comprises iris authentication, voice authentication, face recognition and fingerprint recognition. They can achieve higher recognition accuracy.

However, the above techniques have problems that frequent and continuous authentication by the user is not supported, and additional user participation and replay attacks are required. Biometric behavior-based techniques also require additional user involvement, such as handwritten signatures, lip movement patterns, and the like. Screen manipulation habits can non-invasively verify user identity, but it has proven to be ineffective against statistical attacks.

In summary, there are various deficiencies in the existing methods and new methods are needed to overcome the limitations.

Disclosure of Invention

The invention aims to overcome the technical defect that an existing double-factor authentication method needs extra participation of a user, and provides a double-factor combined authentication method which uses a common authentication mode of collecting heartbeat signal characteristics of the user as a factor, such as handwriting signature, password input, gesture unlocking and the like as a factor by using a photoelectric volume pulse wave sensor of an intelligent wrist strap type device.

The main principle of the invention is as follows: different light sources (such as an infrared light source and a green light source) of the photoplethysmography sensor are used for acquiring heartbeat signals of a user. And (3) carrying out noise removal processing on the heartbeat signals subjected to the motion artifact interference by utilizing a semi-blind source separation technology and a self-adaptive filtering technology, and extracting pure heartbeat signals. And carrying out time domain and angle domain coordinate conversion on the extracted heartbeat signals. Extracting the geometric features from the converted heartbeat signals, and obtaining a series of features capable of uniquely identifying the user after conversion and encryption algorithm processing. Therefore, the heartbeat signal is collected by the photoelectric volume pulse wave sensor of the intelligent wrist strap device, and the double-factor authentication of the user is realized.

The purpose of the invention is realized by the following technical scheme:

a double-factor authentication method based on a photoplethysmography sensor comprises the following steps:

the method comprises the following steps: different light sources (such as an infrared light source and a green light source) of the photoplethysmography sensor are used for acquiring heartbeat signals of a user and preprocessing the heartbeat signals. The purpose of this step is in order to get rid of the motion artifact in the heartbeat signal that intelligent wrist strap equipment photoelectricity volume pulse wave sensor gathered, extracts pure user's heartbeat.

The pretreatment method comprises the following specific steps:

step 1.1: and (3) processing the acquired heartbeat signals of the user by using a band-pass filter, and removing noise irrelevant to heartbeat.

Step 1.2: and further denoising the signal by utilizing a semi-blind source separation technology and an adaptive filtering technology to obtain a clean heartbeat signal which is used for subsequent processing and does not contain noise such as motion artifacts.

And step two, extracting the geometric characteristics of the heartbeat signals of the user.

Step 2.1: and (3) converting the clean heartbeat signals obtained in the step (1.2) from a time domain to an angle domain, and cutting the angle domain heartbeat signals into single heartbeat signals according to the trough positions.

Step 2.2: from the single and multiple heartbeat signals, geometric features are extracted that can remain stable and uniquely identify the user.

Step three: a re-registrable user profile template is generated.

And (3) converting the geometric features of the heartbeat signals of the user extracted in the step (2.2) to generate a characteristic template capable of being registered again, and disordering the arrangement sequence of the characteristics in the template.

And the processed heartbeat geometric characteristics are used for being registered as the characteristic template as the identity document again.

Step four: and verifying the user identity information.

And training the random forest classifier by using the user characteristic template.

And when the user identity is verified, acquiring heartbeat signals of the user, obtaining a user characteristic template of the signals by using the method from the first step to the third step, and verifying the identity by using a pre-trained random forest classifier. Conventional authentication methods (such as handwritten signatures, password entry, gesture unlocking, etc.) are used as one factor, and heartbeat signals are used as another factor.

And when the two factors pass the verification, the user identity verification is successful. If a certain factor fails to pass the identity authentication, the authentication fails, and finally whether the user is an authorized user is judged.

So far, from the step one to the step four, a double-factor authentication method based on a photoplethysmography sensor is realized.

Advantageous effects

Compared with the prior authentication technology, the method of the invention has the following advantages:

1. the invention can realize continuous, non-invasive and safe mobile two-factor identity authentication only by relying on a common photoelectric volume pulse wave sensor in the intelligent wrist strap equipment. The invention provides a universal double-factor identity authentication method which can be transparently combined with identity authentication methods such as hand-written signature, password input, sliding gesture unlocking and the like, and can re-register a new characteristic template as a new identity authentication certificate after the characteristic template of a heartbeat signal of a user is stolen;

2. the method accurately separates clean heartbeat signals from original heartbeat signals with strong noise by utilizing a semi-blind source separation technology and an adaptive filtering technology. Common authentication methods can be simultaneously authenticated without the user remaining stationary, such as: signature handwriting, password input and gesture unlocking are carried out, and double-factor authentication is achieved;

3. the invention converts the heartbeat signal of the user by utilizing the geometric characteristic of the heartbeat signal in the angle domain to generate the characteristic template which can be registered again, supports high-safety identity authentication, and allows the user to register the substitute certificate again to resist replay attack and man-in-the-middle attack.

4. The identity authentication of the invention has robustness and effectiveness, and an average F1 value of 95.3 percent is obtained in identity verification tests involving 7 volunteers.

Drawings

FIG. 1 is a schematic diagram of a dual-factor authentication method based on a photoplethysmography sensor according to the present invention;

FIG. 2 is a diagram of a feature transformation strategy proposed by the present invention;

wherein (a) the transitions are performed on the same feature for different functions; (b) performing a transformation on different features for different functions;

FIG. 3 is a schematic diagram of an embodiment of the present invention;

FIG. 4 shows the performance of the heartbeat signal collected during the handwritten signature for authentication according to an embodiment of the present invention;

FIG. 5 shows the performance of the heartbeat signal collected during password entry for authentication according to an embodiment of the present invention;

FIG. 6 shows the performance of the heartbeat signal collected during gesture unlocking for authentication according to an embodiment of the present invention;

FIG. 7 shows the performance of the embodiment of the present invention at different time durations of the acquired heartbeat signals.

Detailed Description

The method of the present invention will be described in detail with reference to the accompanying drawings and examples.

As shown in fig. 1, a two-factor authentication method based on a photoplethysmography sensor includes the following steps:

step one, collecting heartbeat signals of a user by using an infrared light source and a green light source of a photoplethysmography sensor, and preprocessing the heartbeat signals.

The pretreatment method comprises the following specific steps:

Because the heartbeat signal that intelligence wrist strap equipment gathered inevitably receives external environment change and the influence of hand motion, band pass filter is through the signal of shielding other frequency channels, and the heartbeat signal of gathering makes an uproar falls tentatively. Since the human heart rate is typically 50-100 beats per minute, the frequency range of the remaining heartbeat signal is 0.2Hz to 10 Hz.

Step 1.2: and further denoising the signal by utilizing a semi-blind source separation technology and an adaptive filtering technology to obtain a clean heartbeat signal which is used for subsequent processing and does not contain noise such as motion artifacts. The method comprises the following specific steps:

firstly, regarding the heartbeat signals of the green and infrared channels collected in step 1.1 as the superposition result of the pure heartbeat signal and the motion artifact, respectively recording the result as X_green，X_infrared. The pure heartbeat signal and the motion artifact are respectively S_herat、S_maAnd (4) showing. As known from the semi-blind source separation technique, the separation of pure heartbeat signal and motion artifact is performed by defining and maximizing the function J (W)The method comprises the following steps:

J(W)＝E{S(k)S(k+τ)}＝WE{X(k)X(k+τ)}W^T(1)

wherein E { } denotes expectation, k is a time series, and S (k) denotes the separated signal S ═ S_heart,S_ma]^TThe amplitude at time k. X (k) denotes an acquired signal X ═ X_green,X_infrared]^TThe amplitude at time k. W is a coefficient matrix satisfying S ═ W · X, and | 1, T represents transpose, W is a coefficient matrix satisfying S | -, X, and^Trepresenting the transpose of the matrix W. The solution makes J (W) reach the maximum coefficient matrix W equivalent to the calculation:

here, EIG { } represents a singular value decomposition operation, p is a positive integer, and in this embodiment, p is 4.

Then, the obtained motion artifact signal is used as a reference signal, the heartbeat signal containing noise obtained in step 1.1 is used as an input signal, and a self-adaptive filtering technology is used to further filter out the motion artifact.

First, the first and second derivatives of the clean heartbeat signal obtained in step 1.2 are calculated.

And then, positioning an extreme point of the heartbeat signal according to the zero crossing points of the first derivative and the second derivative, and segmenting the heartbeat by taking a trough of the heartbeat signal as a starting point and an end point.

Then, performing form adjustment on the segmented single heartbeat signal, and converting the time domain coordinates (x, y) into angle domain coordinates

Wherein z is the amplitude of each extreme point of the heartbeat signal, and z₀For baseline amplitude, it is negligible in this method. Instantaneous angular position θ satisfies θ ═ tan^-1(y/x)，Δθ_i＝(θ-θ_i)mod2π，θ_iThe angular domain position of each extreme point of the heartbeat signal; rho is the instantaneous heart rate, omega is the angular velocity, and satisfies

a_iAnd b_iIs a constant parameter; exp (×) represents an exponential function with e as the base.

Step 2.2: according to the extreme point position, from single and multiple heartbeat signals, the geometric characteristics which can keep stable and can uniquely mark the user are extracted.

The geometric features are divided into features for inspecting a single heartbeat cycle and features for inspecting continuous multiple heartbeat cycles, and specifically include 10 single cycle features related to a point position, 4 multiple cycle features related to the point position, 4 single cycle features related to an area, 10 single cycle features related to statistical performance, and 12 multiple cycle features related to statistical performance.

Step three: a re-registrable user profile template is generated.

Step 3.1: the geometric features are mapped to a new feature template using a feature transfer function. The feature conversion function converts a plurality of heartbeat signal features of the same user into similar feature templates, and converts heartbeat signals of different users into feature templates with large differences. The specific method comprises the following steps:

and (4) performing feature transformation on the geometric feature vector extracted in the step 2.3 by using a feature transformation function F (—) to generate a new feature vector. The feature transformation function F (x) meets the condition that the feature vectors of different users have larger difference after feature transformation; the feature vectors of the same user have larger difference after being mapped by different feature transfer functions; multiple feature vectors of the same user are mapped by the same feature transfer function with still small difference. Figure 2 illustrates a feature transformation strategy.

First, the feature vector p is set to { p }₁,p₂,…,p_N}，q＝{q₁,q₂,…,q_NNormalized, and recorded as

Where N is the total number of extracted features. Then, a complete bipartite graph G ═ (V, E) is constructed, where V denotes nodes, divided into two parts corresponding to the nodes respectively

Are not collected. E represents the edge, the weight of each edge is the Euclidean norm of the connecting vertex, and is recorded as

In order to ensure the similarity of the two feature vectors, the method defines the similarity of the two feature vectors through a Hungarian algorithm:

Distance(p_i,q_j)＝∑_(i,j)d(p_i,q_j) (6)

wherein i and j are positive integers from 1 to N. An available feature transformation function should satisfy the condition that the distance between feature vectors of the same user is minimized and the distance between feature vectors of different users is maximized.

Then, the internal feature elements of the feature vector are sequentially rearranged so as to avoid an attacker from reversely deducing the heartbeat privacy information of the user.

Step four: and verifying the user identity information.

Step 4.1: and training a random forest classifier.

Firstly, the user provides the heartbeat signal of the user to the system, and establishes a characteristic template of the individual as an identity document. In order to avoid interfering with the normal authentication mode of the user, the heartbeat data acquisition is carried out while the user carries out handwritten signature or inputs a password or carries out gesture unlocking. And after the collected heartbeat signals are processed in the first step to the third step, outputting a characteristic template which can uniquely mark the identity of the user.

And then, taking the user identity characteristic template as the input of a random forest classifier, and training the random forest classifier to be used for subsequent authentication.

Step 4.2: and performing identity authentication.

And when the user identity is verified, acquiring heartbeat signals of the user, obtaining a user characteristic template of the signals by using the method from the first step to the third step, and sending the user characteristic template into a trained random forest classifier to perform identity verification based on the heartbeat signals. Conventional authentication methods (such as handwritten signatures, password entry, gesture unlocking, etc.) are used as one factor, and heartbeat signals are used as another factor.

And when the two factors pass the verification, the user identity verification is successful. If a certain factor fails to pass the identity authentication, the authentication fails.

Example verification

To verify the performance of the method, the method was developed as a wrist-worn prototype, as shown in fig. 3. The prototype included an integrated photoplethysmography sensor (which emitted green and infrared light) and an adjustable wrist band. The prototype is harmless to human body and does not affect other actions of the user.

A total of 7 volunteers (4 males and then 3 females between the ages of 21 and 27) were recruited to participate in the experiment. All volunteers were healthy without a history of heart disease. In the data acquisition process, each volunteer sits on a chair in a natural and comfortable manner, wears the prototype on the dominant hand, and performs three actions: handwriting signature, inputting password and gesture unlocking. A total of 3780 samples were collected for analysis and training.

Recall, precision and F1 values were used for system performance evaluation. Wherein, Recall (Recall) is defined as: for a certain user, the method is used for correctly verifying the ratio of the number of samples of the identity to the number of samples actually belonging to the user; precision (Precision) is defined as: for a certain user, the sample number for correctly verifying the identity accounts for the proportion of the sample number of the user;

wherein the F1 value is defined as:

first, the overall performance of the method was tested. Fig. 4, 5 and 6 show the performance of identity verification by using heartbeat signals collected when 7 volunteers perform handwriting signature, input password and gesture unlocking respectively. When the user performs a common authentication action, the overall performance is related to the step 2.3 of extracting the quality of features. This experiment sets up that geometric characteristics gather from different continuous a plurality of cycles, include: 1 heartbeat cycle, 2 heartbeat cycles, 4 heartbeat cycles, 6 heartbeat cycles, 8 heartbeat cycles, 10 heartbeat cycles. When the volunteer performed a handwritten signature, the F1 values were 91.5%, 93.7%, 93.9%, 93.2%, 93.0%, 92.3%, respectively. When the user performs the password entry and gesture unlocking actions, F1 values are 95.5%, 97.2%, 97.6%, 98.2%, 97.0%, and 89.6%, 93.3%, 94.5%, 95.5%, 94.8%, respectively, since the features are extracted from different length heartbeat cycles. There is a similar trend in recall and precision for performing three authentication actions at different heartbeat cycles. When 4 heartbeat cycle signals are used for feature extraction, the overall accuracy of the method is optimal, and the average F1 score, recall rate and precision rate of the three actions are all over 95%. The result shows that the method can accurately verify the user.

The response time required for the method was then tested. The two-factor authentication method based on the photoplethysmography sensor includes the following common verification methods: handwritten signature, input password, gesture unlocking, etc. are used as one factor, and heartbeat signal is another factor. The difference of the execution time of the common verification method is large, the acquisition time of the heartbeat signal should be adapted to the execution time, and the response time of the method is influenced finally. In the experiment, 5 heartbeat signal acquisition duration conditions are set, including 4s, 6s, 8s, 10s and 12 s. FIG. 7 shows that the F1 values for the method were 92.1%, 99.1%, 98.1%, 97.2%, 87.4% for 5 duration conditions, respectively. Recall and precision have similar performance with corresponding values of 91.8%, 99.1%, 98.0%, 97.0%, 86.8% and 92.4%, 99.1%, 98.2%, 97.4%, 87.9%, respectively. When the heartbeat signal acquisition time is 4s, the accuracy rate of the system reaches over 90 percent, and the average system response time is 1.8 s. The heartbeat signal acquisition time of 2 to 6 seconds is needed in three conditions of hand-written signature, password input and gesture unlocking. Therefore, the sensing time and the condition completion time can be approximately synchronized to achieve high accuracy. The result shows that the method can effectively carry out identity authentication on the user.

Finally, the user characteristic template used in the testing method is re-registrable, which proves that the re-registered characteristic template is different from the original characteristic template, and the re-registered characteristic template can still reach higher precision. When three actions of handwriting signature, password input and gesture unlocking are executed, the average F1 value of the identity authentication based on the original characteristics is 94.6%, the recall rate is 94.7% and the precision rate is 94.6%. And when evaluating the performance of the re-registration characteristic template in identity verification, taking the original characteristic template as an attacker. The average F1 value of the characteristic templates which are re-registered when the three actions of hand-written signature, password input and gesture unlocking are executed is 96.1%, the recall rate is 93.7% and the precision rate is 98.6%. The results show that the process of generating the re-enrolled characteristic template does not reduce the efficiency of the present invention.

The above detailed description is intended to illustrate the objects, aspects and advantages of the present invention, and it should be understood that the above detailed description is only exemplary of the present invention, and is not intended to limit the scope of the present invention, and any modifications, equivalents, improvements, etc. made within the spirit and principle of the present invention should be included in the scope of the present invention.

Claims

1. A double-factor authentication method based on a photoplethysmography sensor is characterized by comprising the following steps:

the method comprises the following steps: different light sources of the photoplethysmography sensor are used for acquiring heartbeat signals of a user and preprocessing the heartbeat signals;

secondly, extracting geometric features of heartbeat signals of the user;

step 2.1: converting the clean heartbeat signals obtained in the step 1.2 from a time domain to an angle domain, and dividing the angle domain heartbeat signals into single heartbeat signals according to the positions of wave troughs;

step 2.2: extracting geometric features which can keep stable and uniquely mark a user from single and multiple heartbeat signals;

step three: generating a re-registrable user characteristic template;

converting the geometric features of the heartbeat signals of the user extracted in the step 2.2 to generate a characteristic template capable of being re-registered, and disturbing the arrangement sequence of the characteristics in the template;

the processed heartbeat geometric characteristics are used for being registered as a characteristic template again to serve as an identity document;

step four: verifying user identity information;

training a random forest classifier by using a user characteristic template;

when the user identity is verified, acquiring heartbeat signals of the user, obtaining a user characteristic template of the signals by using the method from the first step to the third step, and verifying the identity by using a pre-trained random forest classifier; taking a conventional verification method as one factor and taking a heartbeat signal as another factor;

when the two factors pass the verification, the user identity verification is successful; if a certain factor fails to pass the identity authentication, the authentication fails, and finally whether the user is an authorized user is judged.

2. The method as claimed in claim 1, wherein the preprocessing comprises the following steps:

step 1.1: processing the acquired heartbeat signals of the user by using a band-pass filter, and removing noise irrelevant to heartbeat;

3. The two-factor authentication method based on the photoplethysmography sensor as claimed in claim 2, wherein in step 1.2, the semi-blind source separation technique and the adaptive filtering technique are used to further denoise the signal as follows:

firstly, regarding the heartbeat signal processed in the step 1.1 as the superposition result of the pure heartbeat signal and the motion artifact, respectively recording the superposition result as X_green，X_infrared(ii) a The pure heartbeat signal and the motion artifact are respectively S_heart、S_maRepresents; separating the clean heartbeat signal and the motion artifact is achieved by defining and maximizing a function j (w):

J(W)＝E{S(k)S(k+τ)}＝WE{X(k)X(k+τ)}W^T(1)

wherein E { } denotes expectation, k is a time series, and S (k) denotes the separated signal S ═ S_heart,S_ma]^TThe amplitude at time k; x (k) denotes an acquired signal X ═ X_green,X_infrared]^TThe amplitude at time k; w is a coefficient matrix satisfying S ═ W · X, and | 1, T represents transpose, W is a coefficient matrix satisfying S | -, X, and^Ta transposed matrix representing the matrix W; tau represents a heartbeat period and is obtained by calculating autocorrelation of heartbeat signals; solving the coefficient matrix W that maximizes j (W) is equivalent to calculating:

wherein EIG (×) represents singular value decomposition operation, and p is a positive integer;

4. The method for two-factor authentication based on photoplethysmography sensor according to claim 1, wherein the step 2.1 is implemented as follows:

firstly, calculating a first derivative and a second derivative of a clean heartbeat signal;

then, positioning an extreme point of the heartbeat signal according to the zero crossing point of the first-order derivative and the second-order derivative, and segmenting the heartbeat by taking a trough of the heartbeat signal as a starting point and a trough of the heartbeat signal as an end point;

Wherein z is the amplitude of each extreme point of the heartbeat signal, and z₀The baseline amplitude is negligible in the present method; instantaneous angular position θ satisfies θ ═ tan^-1(y/x)，Δθ_i＝(θ-θ_i)mod2π，θ_iThe angular domain position of each extreme point of the heartbeat signal; rho is the instantaneous heart rate, omega is the angular velocity, and satisfies

a_iiAnd b_iIs a constant parameter; exp (×) represents an exponential function with e as the base.

5. The method for two-factor authentication based on photoplethysmography sensor according to claim 1, wherein the step 3 is implemented as follows:

performing feature transformation on the geometric feature vector extracted in the step 2 by using a feature transformation function F (—) to generate a new feature vector; the feature transformation function F (x) satisfies that the feature vectors of different users have larger difference after feature transformation, the feature vectors of the same user have larger difference after different feature transformation function mappings, and a plurality of feature vectors of the same user still have smaller difference after the same feature transformation function mapping;

Where N is the total number of extracted features; then, a complete bipartite graph G ═ (V, E) is constructed, where V denotes nodes, divided into two parts corresponding to the nodes respectively

A disjoint set of; e represents the edge, the weight of each edge is the Euclidean norm of the connecting vertex, and is recorded as

Distance(p_i,q_j)＝∑_(i,j)d(p_i,q_j) (6)

wherein i and j are positive integers from 1 to N; an available feature conversion function should satisfy the minimization of the distance between the feature vectors of the same user and the maximization of the distance between the feature vectors of different users;

then, the internal feature elements of the feature vector are sequentially rearranged, so that an attacker is prevented from reversely deducing the heartbeat privacy information of the user.