CN111885597B

CN111885597B - Method and system for security authentication

Info

Publication number: CN111885597B
Application number: CN202011036522.9A
Authority: CN
Inventors: 卢国鸣
Original assignee: Shanghai Xingrong Information Technology Co ltd
Current assignee: Xingrong Shanghai Information Technology Co ltd
Priority date: 2020-09-28
Filing date: 2020-09-28
Publication date: 2021-01-01
Anticipated expiration: 2040-09-28
Also published as: WO2022063293A1; CN111885597A

Abstract

The embodiment of the specification provides a method and a system for security authentication, wherein the method comprises the following steps: acquiring use behavior characteristics of an object, position characteristics of M historical time points and network connection characteristics of N historical time points, wherein M and N are integers greater than 0; inputting the position characteristics of M historical time points, the network connection characteristics of N historical time points and the behavior characteristics of the object into a trained safety certification prediction model, predicting a target safety certification mode, and performing safety certification on the object by adopting the target safety certification mode, wherein the safety certification prediction model comprises a track prediction layer, a network connection prediction layer, a behavior prediction layer and a fusion layer. The method for acquiring the position characteristics of the M historical time points comprises the following steps: the method comprises the steps of determining graph data based on position information of at least one historical time point, and determining position characteristics of M historical time points through a characteristic representation model based on at least one first node in the graph data and at least one virtual edge connected with the first node.

Description

Method and system for security authentication

Technical Field

The present application relates to the field of computer data processing, and in particular, to a method and system for security authentication.

Background

With the development of computer technology, network connections are provided in various public places, office places and business places. When an object such as a user performs network connection in each place, security authentication is performed on the user. The objects for network connection are of various types, and when the security authentication is performed, the objects of different types are suitable for different security authentication modes, and the security authentication needs to be performed in a targeted manner.

Therefore, in order to meet the security authentication requirements of different types of objects and improve the efficiency of security authentication and user experience, a method and a system for security authentication are urgently needed.

Disclosure of Invention

One aspect of the present description provides a method of secure authentication. The method comprises the following steps: acquiring use behavior characteristics of an object, position characteristics of M historical time points and network connection characteristics of N historical time points, wherein M and N are integers greater than 0; the method for acquiring the position characteristics of the M historical time points comprises the following steps: the method comprises the steps of obtaining position information of at least one historical time point, and determining graph data based on the position information of the at least one historical time point, wherein the graph data comprises at least one first node and at least one virtual edge corresponding to the position information of the at least one historical time point, each virtual edge is connected with two of the at least one first node, the node attribute of the first node is determined based on the corresponding position information of the historical time point, and the edge attribute of the virtual edge is determined based on the time relation and the position relation of the position information of the two historical time points corresponding to the two connected first nodes; determining, by a feature representation model, location features of the M historical time points corresponding to the location information of the at least one historical time point based on the at least one first node in the graph data and the at least one virtual edge connected thereto; inputting the position features of the M historical time points, the network connection features of the N historical time points and the using behavior features of the object into a trained safety certification prediction model, predicting a target safety certification mode, and performing safety certification on the object by adopting the target safety certification mode, wherein the safety certification prediction model comprises a track prediction layer, a network connection prediction layer, a behavior prediction layer and a fusion layer; wherein: the track prediction layer determines the position track category characteristics of the object based on the position characteristics of the M historical time points; the network connection prediction layer determines the network connection category characteristics of the object based on the network connection characteristics of the N historical time points; the behavior prediction layer determines a behavior category characteristic of the object based on the usage behavior characteristic; the fusion layer determines the target security authentication mode of the object based on the location track category feature, the network connection category feature, and the behavior category feature.

Another aspect of the present specification provides a system for secure authentication. The system comprises: the characteristic acquisition module is used for acquiring position characteristics of M historical time points, network connection characteristics of N historical time points and use behavior characteristics of the object, wherein M and N are integers larger than 0; the method for acquiring the position characteristics of the M historical time points comprises the following steps: the method comprises the steps of obtaining position information of at least one historical time point, and determining graph data based on the position information of the at least one historical time point, wherein the graph data comprises at least one first node and at least one virtual edge corresponding to the position information of the at least one historical time point, each virtual edge is connected with two of the at least one first node, the node attribute of the first node is determined based on the corresponding position information of the historical time point, and the edge attribute of the virtual edge is determined based on the time relation and the position relation of the position information of the two historical time points corresponding to the two connected first nodes; determining, by a feature representation model, location features of the M historical time points corresponding to the location information of the at least one historical time point based on the at least one first node in the graph data and the at least one virtual edge connected thereto; a target security authentication mode prediction module, configured to input the location features of the M historical time points, the network connection features of the N historical time points, and the usage behavior features of the object into a trained security authentication prediction model, predict a target security authentication mode, and perform security authentication on the object by using the target security authentication mode, where the security authentication prediction model includes a trajectory prediction layer, a network connection prediction layer, a behavior prediction layer, and a fusion layer; wherein: the track prediction layer determines the position track category characteristics of the object based on the position characteristics of the M historical time points; the network connection prediction layer determines the network connection category characteristics of the object based on the network connection characteristics of the N historical time points; the behavior prediction layer determines a behavior category characteristic of the object based on the usage behavior characteristic; the fusion layer determines the target security authentication mode of the object based on the location track category feature, the network connection category feature, and the behavior category feature.

Another aspect of the present specification provides a device for secure authentication, comprising a processor for executing a method for secure authentication of any one of the objects.

Another aspect of the present specification provides a computer-readable storage medium storing computer instructions, wherein when the computer instructions in the storage medium are read by a computer, the computer performs any one of the methods for secure authentication of an object.

Drawings

The present description will be further explained by way of exemplary embodiments, which will be described in detail by way of the accompanying drawings. These embodiments are not intended to be limiting, and in these embodiments like numerals are used to indicate like structures, wherein:

FIG. 1 is a schematic diagram of an application scenario of a system for secure authentication according to some embodiments of the present description;

FIG. 2 is an exemplary flow diagram of a method of secure authentication, shown in accordance with some embodiments of the present description;

FIG. 3 is an exemplary flow diagram of a method for training a security certification predictive model in accordance with some embodiments described herein.

Detailed Description

In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings used in the description of the embodiments will be briefly described below. It is obvious that the drawings in the following description are only examples or embodiments of the present description, and that for a person skilled in the art, the present description can also be applied to other similar scenarios on the basis of these drawings without inventive effort. Unless otherwise apparent from the context, or otherwise indicated, like reference numbers in the figures refer to the same structure or operation.

It should be understood that "system", "device", "unit" and/or "module" as used in this specification is a method for distinguishing different components, elements, parts or assemblies at different levels. However, other words may be substituted by other expressions if they accomplish the same purpose.

As used in this specification and the appended claims, the terms "a," "an," "the," and/or "the" are not intended to be inclusive in the singular, but rather are intended to be inclusive in the plural, unless the context clearly dictates otherwise. In general, the terms "comprises" and "comprising" merely indicate that steps and elements are included which are explicitly identified, that the steps and elements do not form an exclusive list, and that a method or apparatus may include other steps or elements.

Flow charts are used in this description to illustrate operations performed by a system according to embodiments of the present description. It should be understood that the preceding or following operations are not necessarily performed in the exact order in which they are performed. Rather, the various steps may be processed in reverse order or simultaneously. Meanwhile, other operations may be added to the processes, or a certain step or several steps of operations may be removed from the processes.

Fig. 1 is a schematic diagram of an application scenario of an exemplary system for secure authentication, shown in accordance with some embodiments of the present description.

In some application scenarios, the system 100 for secure authentication may be used for various network-connected secure authentication platforms and systems for wired or wireless networks. The objects connected to the network have various types, for example, the objects may correspond to various security levels, such as a high security level, a medium security level, and a low security level, and for the objects with different security levels, different security authentication methods may be adopted. By the method, the security authentication can be performed on the object in a targeted manner, the simple authentication mode is selected for the object with high security level, so that the network can be connected through the security authentication more quickly, the user experience is better, and meanwhile, the relatively complex authentication mode is selected for the object with medium security level and low security level, so that the effectiveness and the security of the security authentication are ensured. Compared with the method for uniformly adopting a security authentication mode for various objects, the method has stronger pertinence, higher efficiency and better user experience when ensuring the effectiveness and the security of the security authentication.

As shown in FIG. 1, an application scenario to which this specification refers may include a first computing system 130 and/or a second computing system 160.

The first computing system 130 may be used to predict a target security authentication mode for the object. For example, the public network 170 may be applied to a place providing network connection, such as an airport, a station, a mall, etc., and the network may be a wireless network or a wired network, and may be any type of local area network, AP, etc. When an object requests to connect to the public network 170, the object needs to be securely authenticated. The first computing system 130 may predict a target secure authentication mode 140 for the object.

The first computing system 130 may obtain the feature data 120, the feature data 120 including usage behavior features, location features for M historical points in time, and network connection features for N historical points in time. The feature data 120 may be obtained through a secure authentication platform, system, and user terminal (mobile device 180-1, tablet computer 180-2, laptop computer 180-3, desktop computer 180-4, etc.). The feature data 120 may enter the first computing system 130 in a variety of common ways. Through the first model 132 in the first computing system 130, the target secure authentication mode 140 may be output. The object is networked through a target secure authentication means 140.

The parameters of the first model 132 may be obtained by training. The second computing system 160 may obtain multiple sets of sample data 150, where each set of sample data includes the behavior feature sample, the location feature sample, the network connection feature sample, and the corresponding label, and the second computing system 160 updates the parameters of the second model 162 through the multiple sets of sample data 150 to obtain a trained model. The parameters of the first model 132 are derived from the trained second model 162. Wherein the parameters may be communicated in any common manner.

The models (e.g., the first model 132 or/and the second model 162) may refer to a collection of several methods performed based on the processing device. These methods may include a number of parameters. When executing the model, the parameters used may be preset or may be dynamically adjusted. Some parameters may be obtained by a trained method, and some parameters may be obtained during execution. For a specific description of the model referred to in this specification, reference is made to the relevant part of the specification.

The first computing system 130 and the second computing system 160 may be the same or different. The first computing system 130 and the second computing system 160 refer to systems with computing capability, and may include various computers, such as a server and a personal computer, or may be computing platforms formed by connecting a plurality of computers in various structures.

Processing devices may be included in first computing system 130 and second computing system 160, and may execute program instructions. The Processing device may include various common general purpose Central Processing Units (CPUs), Graphics Processing Units (GPUs), microprocessors, application-specific integrated circuits (ASICs), or other types of integrated circuits.

First computing system 130 and second computing system 160 may include storage media that may store instructions and may also store data. The storage medium may include mass storage, removable storage, volatile read-write memory, read-only memory (ROM), and the like, or any combination thereof.

The first computing system 130 and the second computing system 160 may also include a network for internal connections and connections with the outside. Terminals for input or output may also be included. The network may be any one or more of a wired network or a wireless network.

For more details on the behavior feature, location feature, network connection feature and model, reference is made to fig. 2-3, which are not described in detail here.

The system 100 for security certification may include a feature acquisition module, a target security certification mode prediction module, a model training module, and a security certification determination module.

The characteristic acquisition module is used for acquiring the position characteristics of M historical time points, the network connection characteristics of N historical time points and the use behavior characteristics of the object, wherein M and N are integers larger than 0.

A target security authentication mode prediction module to predict the M of the object. Inputting the position characteristics of the historical time points, the network connection characteristics of the N historical time points and the using behavior characteristics into a trained safety certification prediction model, predicting a target safety certification mode, and performing safety certification on the object by adopting the target safety certification mode, wherein the safety certification prediction model comprises a track prediction layer, a network connection prediction layer, a behavior prediction layer and a fusion layer; wherein: the track prediction layer determines the position track category characteristics of the object based on the position characteristics of the M historical time points; the network connection prediction layer determines the network connection category characteristics of the object based on the network connection characteristics of the N historical time points; the behavior prediction layer determines a behavior category characteristic of the object based on the usage behavior characteristic; the fusion layer determines the target security authentication mode of the object based on the location track category feature, the network connection category feature, and the behavior category feature. In some embodiments, the network connection prediction layer and the trajectory prediction layer are recurrent neural networks. In some embodiments, the behavior prediction layer and the fusion layer are deep neural networks.

The model training module is used for obtaining at least one use behavior characteristic sample, at least one group of position characteristic samples and at least one group of network connection characteristic samples of the object, marking the at least one use behavior characteristic sample, the at least one group of position characteristic samples and the at least one group of network connection characteristic samples, wherein the group of position characteristic samples comprises M position characteristic samples, and the group of network connection characteristic samples comprises N network connection characteristic samples; and inputting the at least one using behavior characteristic sample with the mark, the at least one group of position characteristic samples and the at least one group of network connection characteristic samples into an initial security certification prediction model to obtain the trained security certification prediction model.

The safety certification determining module is used for acquiring real-time position information of the object; determining whether the object is in a target area based on the real-time location information of the object; if so, the target security authentication mode is adopted to perform security authentication on the object, otherwise, the object is not subjected to security authentication.

It should be understood that the system 100 of secure authentication and its modules may be implemented in a variety of ways. For example, in some embodiments, the system and its modules may be implemented in hardware, software, or a combination of software and hardware. Wherein the hardware portion may be implemented using dedicated logic; the software portions may be stored in a memory for execution by a suitable instruction execution system, such as a microprocessor or specially designed hardware. Those skilled in the art will appreciate that the methods and systems described above may be implemented using computer executable instructions and/or embodied in processor control code, such code being provided, for example, on a carrier medium such as a diskette, CD-or DVD-ROM, a programmable memory such as read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The system and its modules of the present application may be implemented not only by hardware circuits such as very large scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., but also by software executed by various types of processors, for example, or by a combination of the above hardware circuits and software (e.g., firmware).

It should be noted that the above descriptions of the object security authentication system and the modules thereof are only for convenience of description, and should not limit the present specification to the scope of the illustrated embodiments. It will be appreciated by those skilled in the art that, given the teachings of the present system, any combination of modules or sub-system configurations may be used to connect to other modules without departing from such teachings. For example, the feature obtaining module, the target security certification mode predicting module, the model training module, and the security certification determining module may be different modules in one system, or may be one module that implements the functions of two or more modules described above. For example, the feature acquisition module and the target security authentication method prediction module may be two modules, or one module may have both the function of problem acquisition and the function of problem determination. For example, each module may share one memory module, and each module may have its own memory module. Such variations are within the scope of the present application.

Fig. 2 is an exemplary flow diagram of a method of secure authentication shown in accordance with some embodiments of the present description.

As shown in fig. 2, the method 200 of secure authentication may include:

step 210, obtaining the use behavior characteristics of the object, the position characteristics of M historical time points and the network connection characteristics of N historical time points, wherein M and N are integers larger than 0.

In particular, this step 210 may be performed by the feature acquisition module.

An object may refer to any individual that may be described, such as a user, a merchant, a visitor, a robot for automatically initiating a network connection request, and so forth.

The use behavior characteristics of the object refer to behavior data characteristics of the object when browsing and operating the platform and the system, such as browsed pages, page use duration, clicked buttons, the number of clicking operations and the like. In some embodiments, the usage behavior feature of the object may be all usage behavior features of the current access and all historical accesses, or may be a usage behavior feature within a certain time, which may be customized.

The usage behavior characteristics of the object can be acquired by performing web page data acquisition on a web page or performing object data acquisition on a terminal (such as a client) of the object. Specifically, the crawler technology can be adopted to realize webpage data acquisition, and the point burying technology can be adopted to perform data point burying at the client of the object, so as to realize data acquisition of the client object. The collected usage behavior characteristics of the object can be stored in real time, for example, uploaded to a server of a platform or a system for storage.

Location features of an object refer to geographic location data of the objectInformationFeatures such as the type of area (e.g., cell, office building, park, etc.) of the geographic location where the object is located, or the latitude and longitude of the geographic location where the object is located. The position features of the M historical time points include geographic position data features of the object at the M historical time points. For example, M is 3, and the location characteristics of M historical time points include (historical time point 1, object geographic location is x cell, distance from the previous historical time point is 10KM, time from the previous historical time point to the historical time point is 1 h), (historical time point 2, object geographic location is x cell, distance from the previous historical time point is 1 h), (historical time point 2, object geographic location is x cell, and distance from the previous historical time point to the previous historical time point isThe distance is 5KM, and the time from the position of the last historical time point to the position of the historical time point is 0.5 h), (historical time point 3, the geographic position of the object is z subway station, the distance from the position of the last historical time point is 100KM, and the time from the position of the last historical time point to the position of the historical time point is 0.5 h). M is an integer larger than 0 and can be 1, 2, 3 … n and the like, and the value of M can be selected according to needs.

The position characteristics of the object can be obtained by acquiring the position information of the object recorded by the platform or the system when the object browses and operates the platform or the system, or by acquiring the position information of the object such as terminal satellite positioning information and terminal Bluetooth beacon.

In some embodiments, the obtaining of the location features of the M historical time points may be performed by: the method comprises the steps of obtaining position information of at least one historical time point, determining graph data based on the position information of the at least one historical time point, wherein the graph data comprise at least one first node and at least one virtual edge corresponding to the position information of the at least one historical time point, each virtual edge is connected with two of the at least one first node, the node attribute of each first node is determined based on the position information of the corresponding historical time point, and the edge attribute of each virtual edge is determined based on the time relation and the position relation of the position information of the two historical time points corresponding to the two connected first nodes; and determining the position characteristics of the M historical time points corresponding to the position information of at least one historical time point through the characteristic representation model based on at least one first node in the graph data and at least one virtual edge connected with the first node.

Graph data refers to data using a graph structure, including nodes, edges, and attributes to represent and store data.

The first node is a node representing the position information, i.e. the position of the historical time points in the graph data, one first node corresponds to each position of the historical time points, and the attribute of the first node can be determined based on the position information of the corresponding historical time points. The location information of the historical time point refers to the geographic location information characteristics of the historical time point, such as the area type (e.g., a cell, an office building, a park, etc.) of the geographic location where the object is located at a certain time point, or the longitude and latitude of the geographic location where the object is located.

The virtual edges refer to edges connecting nodes in the graph data, specifically, each virtual edge connects two of the plurality of first nodes, and the corresponding graph data may include at least one virtual edge. The attribute of the virtual edge may be determined based on the association relationship information between the two first nodes of the connection. The association relationship information between the two connected first nodes may include an association relationship between the location information of the historical time points corresponding to the two connected first nodes, for example, a time difference between 2 time points, a distance between 2 locations, a relationship of location areas where the 2 locations are located, and the like.

In some embodiments, node attribute information of the first node and edge attribute information of a virtual edge connected to the first node may be input to the feature representation model, and the feature representation model may output a location feature corresponding to the first node, that is, a location feature at a historical time point. In some embodiments, the feature representation model may employ a GCN model, CNN model, VGG model, or other convolutional neural network model. Specifically, the feature representation model may adopt a GCN model, and perform one or more layers of aggregation processing on the node attribute information of the plurality of first nodes and the edge attribute information of the plurality of virtual edges connected to the first nodes through a plurality of convolution layers in the GCN model to obtain the location features of the respective historical time points.

By determining the map data, the position distribution situation of each historical time point and the correlation situation among the positions can be more excellently and perfectly characterized, such as the relative distance situation among the positions, the time situation of the passing of the positions, the change situation of the located area among the positions, and the like. According to the relevant information of the first node and the relevant information of the virtual edge in the graph data, the corresponding position characteristics of each historical time point are obtained, the position characteristics can also comprise the position information characteristics of each historical time point and the incidence relation characteristics among the positions of each historical time point, and the position track can be predicted more effectively and accurately according to the position characteristics.

The network connection characteristics of the object refer to connection data characteristics when the object is networked, such as a security authentication method used when the object is networked, whether the object successfully passes security authentication, a location where the security authentication is performed, and the like. The network connection characteristics of the N historical time points comprise connection data characteristics of objects when networking is carried out at the N historical time points. For example, N is 3, and the connection data characteristics when N historical time points are networked include (historical time point a, the object accesses the network at the coffee shop in the Wi-Fi CERTIFIED platform manner and the security authentication is passed), (historical time point b, the object accesses the network at the bookstore in the Wi-Fi Easy Connect manner and the security authentication is passed), (historical time point c, the object accesses the network at the train station in the Wi-Fi Protected Setup manner and the security authentication is not passed). N is an integer greater than 0 and can be 1, 2, 3 … N and the like, and the value of N can be selected according to needs.

The network connection characteristics of the object may be obtained by obtaining a networking record of the object in the platform, system, or on the terminal of the object.

Step 220, inputting the usage behavior characteristics of the object, the position characteristics of the M historical time points, and the network connection characteristics of the N historical time points into a trained security authentication prediction model, predicting a target security authentication mode, and performing security authentication on the object by using the target security authentication mode.

Specifically, the step 220 may be performed by the target security authentication mode prediction module.

The security authentication means refers to a security authentication means used in network connection, for example, a Wi-Fi certificate platform, a Wi-Fi Easy Connect, and a Wi-Fi Protected Setup for wireless network connection, and a common network connection security authentication means such as PPPOE, WEB authentication, and 802.1X authentication for wired broadband network connection. When networking is carried out, if the network passes the security authentication, the network can be successfully connected.

In some embodiments, different security authentication approaches may be taken for different objects. Specifically, the object may correspond to multiple security levels, such as a high security level, a medium security level, and a low security level, and different security authentication methods may be adopted for objects with different security levels. Taking wireless network connection as an example, an object with a high security level may adopt a security authentication mode with low complexity, such as Wi-Fi certificate platform connected by a wireless network, and the Wi-Fi certificate platform is based on Hotspot 2.0 technology, so that network access between Wi-Fi hotspots can be simplified, and a user does not need to discover and verify a network during each connection. The medium security level can adopt a security authentication mode with a complexity which is slightly more complicated than that of the Wi-Fi CERTIFIED Passpoint, such as Wi-Fi Easy Connect which improves the network access standard relative to the Wi-Fi CERTIFIED Passpoint. The low security level may use a highly complex security authentication scheme such as Wi-Fi Protected Setup, which requires more object information or more operations to perform security authentication, a little more complex than Wi-Fi Easy Connect. By the method, the security authentication can be performed on the object in a targeted manner, the simple authentication mode is selected for the object with high security level, so that the network can be connected through the security authentication more quickly, the user experience is better, and meanwhile, the relatively complex authentication mode is selected for the object with medium security level and low security level, so that the effectiveness and the security of the security authentication are ensured. Compared with the method for uniformly adopting a security authentication mode for various objects, the method has stronger pertinence, higher efficiency and better user experience when ensuring the effectiveness and the security of the security authentication.

The target security authentication method is a security authentication method that is adopted for the specified object and matches the specified object. For example, for object a, which is a high security level user, the target security authentication method corresponding to object a is a low complexity security authentication method.

The input of the safety certification prediction model is the position characteristic, the network connection characteristic and the use behavior characteristic of the object, and the output is the corresponding target safety certification mode. In some embodiments, before the location features, network connection features, and usage behavior features are input into the model, their feature values may be processed, such as bucket-based, to represent the features in a vector manner.

In some embodiments, the security certification predictive model may be a neural network model. The neural network model may include a plurality of processing layers, each processing layer consisting of a plurality of neurons, each neuron matrixing data. The parameters used by the matrix may be obtained by training. The security certification predictive model may be any existing neural network model that enables processing of multiple features, e.g., CNN, DNN, etc. The security authentication prediction model can also be a model customized according to requirements.

In particular, the security certification prediction model may include a trajectory prediction layer, a network connection prediction layer, a behavior prediction layer, and a fusion layer.

In some embodiments, the trajectory prediction layer determines a location trajectory category feature of the object based on the location features of the M historical time points. The location track class feature is a vector that characterizes the location track class of the object. The location track category refers to a location track type obtained according to the position change of the object arranged in time sequence at the M historical time points, such as (cell-subway station-office building), (cell-subway station-mall), (square-mine field-lake), and the like. The position track category obtained in the foregoing may be directly used as the position track category feature.

From the location trajectory categories, the probability of the object being a normal object or an abnormal false object can be derived. For example, for a position track category conforming to a certain rule, the probability that the object is a normal object can be obtained according to the change rule of the position track. For example, the district-subway station-office building conforms to the track rule of office workers, the probability of being a normal object is 80% according to comparison with the track rule of office workers, the district-subway station-market conforms to the track rule of normal life trips, and the probability of being a normal object is 90% according to comparison with the track rule of normal life trips. For the position track categories with continuous position change and overlarge geographical span or without any rules, the probability that the object is an abnormal false object can be obtained according to the geographical change distance span of the position track. For example, the continuous position change geographical span of square-mine-lake is large, and does not conform to any rule, and the probability of being an abnormal false object is 70% according to the geographical change distance span. In some embodiments, the location trajectory category feature may be represented by a probability that the object is a normal object or an abnormal false object. For example (cell-subway station-office building), which is a normal object, the probability is 90%, and the location trajectory category feature can be expressed as (90%). (Square-mine-lake) which is an anomalous false object with a probability of 70%, the location track class feature can be expressed as (-70%).

Specifically, the trajectory prediction layer may map the input position features of the M historical time points to position trajectory category features. For example, when M is 3, the input of the trajectory prediction layer is position features at 3 historical time points (historical time point 1, object geographical position is x cell), (historical time point 2, object geographical position is x cell), (historical time point 3, object geographical position is z subway station), and the output is a vector representing position trajectory category features (cell-subway station) or (75%) obtained by mapping the 3 time point position features, and the output is position trajectory category features obtained by the probability that the object is a normal object or an abnormal false object (75%). If there are consecutive time point location features that are the same in the M time point location features arranged in the time sequence, in some embodiments, the consecutive same location features may be combined, for example, the historical time points 1 and 2 are consecutive time points arranged in the time sequence, and the location features thereof are the same, and the location track category of the 3 time point location features may be (cell-subway station).

In some embodiments, the trajectory prediction layer may be a Recurrent Neural Network (RNN). The recurrent neural network can process sequence data with any length, capture sequence information and output a result based on the correlation between the preceding data and the following data in the sequence. The position characteristics of the M historical time points are processed through the recurrent neural network, and the position track category characteristics considering the incidence relation among the position characteristics of the time points can be output, so that the position track category characteristic information is more accurate and comprehensive.

In some embodiments, the network connection prediction layer determines the network connection category characteristics of the object based on the network connection characteristics at the N historical points in time. The network connection class feature is a vector that characterizes the network connection class of the object. The network connection category refers to a network connection type obtained according to network connection characteristics of an object at N historical time points, such as (Wi-Fi CERTIFIED pass through, Wi-Fi Easy Connect pass through, Wi-Fi Protected Setup fail), (Wi-Fi CERTIFIED pass through, Wi-Fi Easy Connect pass through, Wi-Fi Protected Setup fail) and the like. The network connection type obtained in the foregoing can be directly used as the network connection type characteristic.

According to the network connection type, the situation that the object is the network connection passing rate can be obtained. In some embodiments, the network connection category characteristics may be represented by a network connection throughput rate. For example, for a network connection category (Wi-Fi CERTIFIED pass, Wi-Fi Easy Connect pass, Wi-Fi Protected Setup fail), the network connection passing rate is 66.7%, the network connection category characteristic thereof may be represented as (66.7%), for a network connection category (Wi-Fi CERTIFIED pass, Wi-Fi Easy Connect pass, Wi-Fi Protected Setup fail), the network connection passing rate is 33.3%, and the network connection category characteristic thereof may be represented as (33.3%).

Specifically, the network connection prediction layer may map the input network connection characteristics of the N historical time points into the network connection category characteristics. For example, when N is 3, the input of the network connection prediction layer is a network connection feature at 3 historical time points (historical time point a, an object accesses the network at a coffee shop in a Wi-Fi centralized communication manner and passes security authentication), (historical time point b, an object accesses the network at a bookstore in a Wi-Fi Easy Connect manner and passes security authentication), (historical time point c, an object accesses the network at a train station in a Wi-Fi Protected Setup manner and fails security authentication), and the output is a vector representing a network connection category (Wi-Fi centralized communication passed, Wi-Fi Easy Connect passed, Wi-Fi Protected Setup failed) or (66.7%) obtained by mapping the network connection feature at 3 time points.

In some embodiments, the network connectivity layer may be a Recurrent Neural Network (RNN). The recurrent neural network can process sequence data with any length, capture sequence information and output a result based on the correlation between the preceding data and the following data in the sequence. The network connection characteristics of the N historical time points are processed through the recurrent neural network, and the network connection type characteristics considering the incidence relation among the network connection characteristics of all the time points can be output, so that the network connection type characteristic information is more accurate and comprehensive.

In some embodiments, the behavior prediction layer determines a behavior category characteristic of the object based on the usage behavior characteristic. The behavior class features are vectors that characterize the behavior class of the object. The behavior category refers to a behavior type obtained according to the usage behavior category characteristics of the object, for example, the legal probability of the behavior is 80%, the legal probability of the behavior is 70%, the legal probability of the behavior is 30%, and the like. The obtained legal behavior probability may be used as the location track category characteristics, for example, the location track category characteristic with a legal behavior probability of 80% is represented as (80%), the location track category characteristic with a legal behavior probability of 70% is represented as (70%), and the location track category characteristic with a legal behavior probability of 30% is represented as (30%).

In some embodiments, the legality level of the object may also be obtained according to the behavior category, for example, if the behavior category is (behavior legal probability is 80%), that is, if the corresponding object is a high legality level, and if the behavior category is (behavior legal probability is 30%), that the corresponding object is a low legality level.

In particular, the behavior prediction layer may map the input usage behavior feature into a category feature. For example, the input usage behavior feature is a vector of behavior category features (80%) obtained by mapping the usage behavior feature, wherein the input usage behavior feature indicates that the time for browsing a web page is 3 minutes, 3 commodities on the web page are clicked, and one commodity is purchased, and the output indicates that the behavior legitimacy rate corresponding to the usage behavior feature is 80%.

Since the object that initiates the illegal request is generally a program or a robot, etc., the behavior is usually fixed by code, and the randomness is weak, for example, each web page only has access to a fixed time or times, or only has access to a certain type of web page, etc. Therefore, the mapping relationship between the usage behavior feature and the behavior category can be determined by the preset condition. The preset condition may refer to a limitation condition for accessing the trajectory data, for example, a limitation of a page to be browsed, a limitation of a page use time, a limitation of a button to be clicked, a limitation of a number of times of clicking operations, and the like. For example, the preset condition may be that the browsing time is different on different web pages; for another example, the preset condition may be that the time for browsing a web page exceeds 1 minute, at least 3 products on the web page are clicked, and one product is purchased, etc. The preset conditions may be custom. In some embodiments, the preset conditions may also be updated periodically or as needed.

In some embodiments, the network connectivity layer may be a Deep Neural Network (DNN).

In some embodiments, the fusion layer determines a target security authentication mode for the object based on the location trajectory category feature, the network connection category feature, and the behavior category feature.

Specifically, the fusion layer may fuse the input location trajectory category feature, the network connection feature, and the behavior category feature into one vector, and then map the vector into a security authentication mode category, that is, a predicted target security authentication mode. Further, a corresponding specific security authentication mode can be adopted for networking authentication according to the target security authentication mode. For example, the fusion layer fuses the location track class feature X = (cell-subway station), the network connection feature Y = (Wi-Fi center transit pass, Wi-Fi Easy Connect pass, Wi-Fi Protected Setup fail), and the behavior class feature Z = (80%) into a vector, and illustratively, splices the location track class feature, the network connection feature, and the behavior class feature into a vector (cell-subway station, Wi-Fi center transit, Wi-Fi Easy Connect pass, Wi-Fi Protected Setup pass, Wi-Fi Easy Connect pass, Wi-Fi Protected Setup fail, and behavior legal probability is 80%). In some embodiments, when the fusion layer fuses the location trajectory class feature, the network connection feature, and the behavior class feature into one vector, the fusion may be performed based on the weight of each feature, for example, the weighted sum of each feature is performed. For example, when the trace category feature X = (75%), the network connection feature Y = (66.7%), and the behavior category feature Z = (80%) are fused into one vector, the fusion layer performs weighted calculation and summation based on the trace category feature weight 0.3, the network connection feature 0.4, and the behavior category feature weight 0.3, to obtain 75% × 0.3+66.7% × 0.4+80% × 0.3=73.2%, and obtains a (73.2%) vector after fusion. Further, the fusion layer maps the vector into a predicted target security authentication mode, i.e., a security authentication mode with a general complexity. And finally, performing networking authentication by adopting a corresponding specific security authentication mode with general complexity, such as Wi-Fi Easy Connect.

As previously described, from the location trajectory category, the probability that an object is a normal object or an abnormal false object can be derived; according to the network connection type, the object is the network connection passing rate; and obtaining the behavior legal probability and the legal degree of the object according to the behavior category. Specifically, when the fusion layer predicts the target security authentication mode according to the position track category characteristics, the network connection characteristics and the behavior category characteristics, the security level of the object can be obtained according to the probability that the object is normal or false, the network connection passing rate of the object, the behavior legal probability and the legality level of the object. Specifically, the security authentication method may include a high security level, a medium security level, and a low security level, and for each security level object, a security authentication manner with each complexity (may correspond to a security authentication manner with a high complexity, a security authentication manner with a general complexity, and a security authentication manner with a low complexity) may be obtained, that is, a corresponding target security authentication manner.

In some embodiments, the fusion layer may be a Deep Neural Network (DNN). Preferably, the fusion layer is a two-layer neural network. Specifically, the calculation formula of the two-layer neural network can be expressed as g (W)⁽¹⁾*a⁽¹⁾)=a⁽²⁾，g(W⁽²⁾*a⁽²⁾)=z，a⁽¹⁾And a⁽²⁾Is the vector data of the first and second layers of the network, z is the vector data of the network output, W⁽¹⁾And W⁽²⁾Are the matrix parameters of the network. The neural networks of the two layers can better integrate the position track category characteristics, the network connection characteristics and the behavior category characteristics, so that under-fitting caused by a single-layer neural network and over-fitting caused by a multi-layer neural network are avoided; meanwhile, a complex calculation process can be avoided, so that the prediction efficiency of a target security authentication mode is improved, and efficient authentication is realized.

Various factors may affect the output during the target security authentication mode prediction process. In some embodiments of the present disclosure, the functions of multiple information (e.g., multiple features) are integrated, which is beneficial to improving the accuracy of the target security authentication mode prediction. Since these information are mixed, it is difficult to establish a clear rule to obtain a predicted result from each type of information. By means of machine learning, a predictable model can be formed through automatic data learning, and high accuracy is obtained. On the other hand, due to the fact that the related information features are more, the adoption of various standard machine learning models can cause the problems that the model parameter quantity is too much, the requirement on the training data quantity is high, overfitting is easy to happen and the like. In some embodiments of the present description, a custom model is used, that is, the security authentication prediction model includes a trajectory prediction layer, a network connection prediction layer, a behavior prediction layer, and a fusion layer. Features of a plurality of time points are integrated through a user-defined layer based on a neural network, and then prediction is carried out through a fusion layer and network features. Compared with the mode of applying various standard machine learning models, the scheme provided by the specification can better adapt to the characteristics of the used information and the problems to be solved, and the problems of low operation efficiency, overlarge training data requirement or overfitting caused by excessive model parameters are avoided.

In summary, for the target security authentication mode prediction problem of a multi-type object, the scheme provided by the specification can more fully collect data and obtain information helpful for prediction, and a customized machine learning model structure is adopted for the characteristics of the information to obtain better operation efficiency and prediction effect.

In some embodiments, real-time location information of an object may also be obtained, and whether the object is in a target area may be determined based on the real-time location information of the object; if so, the target security authentication mode is adopted to perform security authentication on the object, otherwise, the object is not subjected to security authentication. In particular, this step may be performed by the security authentication determination module.

The real-time position information can be obtained by acquiring the geographic position data of the object recorded by the platform or the system when the object browses and operates the platform or the system, or by acquiring the terminal satellite positioning information of the object, the terminal Bluetooth beacon and other positioning information.

Target area refers to an area that can be networked, e.g., a cafe, airport, bookstore, department store, gas station, etc. Whether an object enters a target area that can be networked can be determined based on whether the real-time location of the object belongs to the target area.

And carrying out safety authentication on the object in the target area, otherwise, not carrying out safety authentication networking. By the embodiment, the network of the area can not be connected without being in the target area, and the area effectiveness and the area safety of network connection are further ensured. The method of using security authentication may be a target security authentication method determined by the security authentication method of the subject in any of the present specifications.

Fig. 3 is an exemplary flow diagram of a method of training a security certification predictive model in accordance with some embodiments presented herein.

Specifically, the method 300 for training the security certification prediction model may be performed by a model training module.

As shown in fig. 3, the method 300 for training the security certification prediction model may include:

step 310, obtaining at least one usage behavior feature sample, at least one group of location feature samples and at least one group of network connection feature samples of the object, and marking the at least one usage behavior feature sample, the at least one group of location feature samples and the at least one group of network connection feature samples, where the group of location feature samples includes M location feature samples, and the group of network connection feature samples includes N network connection feature samples.

The usage behavior feature samples, location feature samples, and network connection feature samples may be feature data for a class of location trajectories, a class of network connections, and a class of behaviors known in advance. The location feature samples and the network connection feature samples may have n groups, where n is a positive integer greater than 1.

Marking the used behavior characteristic samples, the position characteristic samples and the network connection characteristic samples is to mark the behavior category of each behavior characteristic sample, mark the position track category of each group of position characteristic samples, mark the network connection category of each group of network connection characteristic samples, and mark the corresponding target security authentication mode (namely, the security authentication mode with high corresponding complexity, or the security authentication mode with general complexity, or the security authentication mode with low complexity) of the combination of each behavior category, position track category and network connection category.

Step 320, inputting the at least one usage behavior feature sample with the mark, the at least one group of position feature samples and the at least one group of network connection feature samples into an initial security certification prediction model for training, so as to obtain the trained security certification prediction model.

Specifically, at least one of the usage behavior characteristic samples, at least one group of position characteristic samples and at least one group of network connection characteristic samples with the marks are input into an initial security certification prediction model, and parameters of a track prediction layer, a network connection prediction layer, a behavior prediction layer and a fusion layer are trained and updated through a common method. For example, the training may be performed based on a gradient descent method, and the network parameter weight W and the bias b of the model may be updated. And finishing the training when the safety certification prediction model meets the conditions, thus obtaining the well-trained safety certification prediction model. The preset condition may be that the loss function result converges or is smaller than a preset threshold, etc.

The embodiment of the present specification further provides a device for security authentication, which at least includes a processor and a memory. The memory is to store instructions. The instructions, when executed by the processor, cause the apparatus to implement the aforementioned method of secure authentication of an object. The method may include: acquiring use behavior characteristics of an object, position characteristics of M historical time points and network connection characteristics of N historical time points, wherein M and N are integers greater than 0; inputting the position features of the M historical time points, the network connection features of the N historical time points and the use behavior features of the object into a trained safety certification prediction model, predicting a target safety certification mode, and performing safety certification on the object by adopting the target safety certification mode.

The embodiment of the specification also provides a computer readable storage medium. The storage medium stores computer instructions, and after the computer reads the computer instructions in the storage medium, the computer realizes the security authentication method of the object. The method may include: acquiring use behavior characteristics of an object, position characteristics of M historical time points and network connection characteristics of N historical time points, wherein M and N are integers greater than 0; inputting the position features of the M historical time points, the network connection features of the N historical time points and the use behavior features of the object into a trained safety certification prediction model, predicting a target safety certification mode, and performing safety certification on the object by adopting the target safety certification mode.

The beneficial effects that may be brought by the embodiments of the present description include, but are not limited to: (1) the target safety authentication mode of the object is predicted by combining various characteristic information, so that the object can be subjected to safety authentication in a targeted manner, the efficiency is higher when the effectiveness and the safety of the safety authentication are ensured, and the user experience is better; (2) data are collected more fully, information helpful for prediction is obtained, and a user-defined machine learning model structure is adopted according to the characteristics of the information so as to obtain better operation efficiency and prediction effect. It is to be noted that different embodiments may produce different advantages, and in different embodiments, any one or combination of the above advantages may be produced, or any other advantages may be obtained.

Having thus described the basic concept, it will be apparent to those skilled in the art that the foregoing detailed disclosure is to be regarded as illustrative only and not as limiting the present specification. Various modifications, improvements and adaptations to the present description may occur to those skilled in the art, although not explicitly described herein. Such modifications, improvements and adaptations are proposed in the present specification and thus fall within the spirit and scope of the exemplary embodiments of the present specification.

Also, the description uses specific words to describe embodiments of the description. Reference throughout this specification to "one embodiment," "an embodiment," and/or "some embodiments" means that a particular feature, structure, or characteristic described in connection with at least one embodiment of the specification is included. Therefore, it is emphasized and should be appreciated that two or more references to "an embodiment" or "one embodiment" or "an alternative embodiment" in various places throughout this specification are not necessarily all referring to the same embodiment. Furthermore, some features, structures, or characteristics of one or more embodiments of the specification may be combined as appropriate.

Moreover, those skilled in the art will appreciate that aspects of the present description may be illustrated and described in terms of several patentable species or situations, including any new and useful combination of processes, machines, manufacture, or materials, or any new and useful improvement thereof. Accordingly, aspects of this description may be performed entirely by hardware, entirely by software (including firmware, resident software, micro-code, etc.), or by a combination of hardware and software. The above hardware or software may be referred to as "data block," module, "" engine, "" unit, "" component, "or" system. Furthermore, aspects of the present description may be represented as a computer product, including computer readable program code, embodied in one or more computer readable media.

The computer storage medium may comprise a propagated data signal with the computer program code embodied therewith, for example, on baseband or as part of a carrier wave. The propagated signal may take any of a variety of forms, including electromagnetic, optical, etc., or any suitable combination. A computer storage medium may be any computer-readable medium that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code located on a computer storage medium may be propagated over any suitable medium, including radio, cable, fiber optic cable, RF, or the like, or any combination of the preceding.

Computer program code required for the operation of various portions of this specification may be written in any one or more programming languages, including an object oriented programming language such as Java, Scala, Smalltalk, Eiffel, JADE, Emerald, C + +, C #, VB.NET, Python, and the like, a conventional programming language such as C, Visual Basic, Fortran2003, Perl, COBOL2002, PHP, ABAP, a dynamic programming language such as Python, Ruby, and Groovy, or other programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or processing device. In the latter scenario, the remote computer may be connected to the user's computer through any network format, such as a Local Area Network (LAN) or a Wide Area Network (WAN), or the connection may be made to an external computer (for example, through the Internet), or in a cloud computing environment, or as a service, such as a software as a service (SaaS).

Additionally, the order in which the elements and sequences of the process are recited in the specification, the use of alphanumeric characters, or other designations, is not intended to limit the order in which the processes and methods of the specification occur, unless otherwise specified in the claims. While various presently contemplated embodiments of the invention have been discussed in the foregoing disclosure by way of example, it is to be understood that such detail is solely for that purpose and that the appended claims are not limited to the disclosed embodiments, but, on the contrary, are intended to cover all modifications and equivalent arrangements that are within the spirit and scope of the embodiments herein. For example, although the system components described above may be implemented by hardware devices, they may also be implemented by software-only solutions, such as installing the described system on an existing processing device or mobile device.

Similarly, it should be noted that in the preceding description of embodiments of the present specification, various features are sometimes grouped together in a single embodiment, figure, or description thereof for the purpose of streamlining the disclosure aiding in the understanding of one or more of the embodiments. This method of disclosure, however, is not intended to imply that more features than are expressly recited in a claim. Indeed, the embodiments may be characterized as having less than all of the features of a single embodiment disclosed above.

Numerals describing the number of components, attributes, etc. are used in some embodiments, it being understood that such numerals used in the description of the embodiments are modified in some instances by the use of the modifier "about", "approximately" or "substantially". Unless otherwise indicated, "about", "approximately" or "substantially" indicates that the number allows a variation of ± 20%. Accordingly, in some embodiments, the numerical parameters used in the specification and claims are approximations that may vary depending upon the desired properties of the individual embodiments. In some embodiments, the numerical parameter should take into account the specified significant digits and employ a general digit preserving approach. Notwithstanding that the numerical ranges and parameters setting forth the broad scope of the range are approximations, in the specific examples, such numerical values are set forth as precisely as possible within the scope of the application.

For each patent, patent application publication, and other material, such as articles, books, specifications, publications, documents, etc., cited in this specification, the entire contents of each are hereby incorporated by reference into this specification. Except where the application history document does not conform to or conflict with the contents of the present specification, it is to be understood that the application history document, as used herein in the present specification or appended claims, is intended to define the broadest scope of the present specification (whether presently or later in the specification) rather than the broadest scope of the present specification. It is to be understood that the descriptions, definitions and/or uses of terms in the accompanying materials of this specification shall control if they are inconsistent or contrary to the descriptions and/or uses of terms in this specification.

Finally, it should be understood that the embodiments described herein are merely illustrative of the principles of the embodiments of the present disclosure. Other variations are also possible within the scope of the present description. Thus, by way of example, and not limitation, alternative configurations of the embodiments of the specification can be considered consistent with the teachings of the specification. Accordingly, the embodiments of the present description are not limited to only those embodiments explicitly described and depicted herein.

Claims

1. A method of secure authentication, comprising:

acquiring use behavior characteristics of an object, position characteristics of M historical time points and network connection characteristics of N historical time points, wherein M and N are integers greater than 0;

inputting the use behavior characteristics of the object, the position characteristics of the M historical time points and the network connection characteristics of the N historical time points into a trained safety certification prediction model, predicting a target safety certification mode, and performing safety certification on the object by adopting the target safety certification mode, wherein the safety certification prediction model comprises a track prediction layer, a network connection prediction layer, a behavior prediction layer and a fusion layer; wherein:

the track prediction layer determines the position track category characteristics of the object based on the position characteristics of the M historical time points;

the network connection prediction layer determines the network connection category characteristics of the object based on the network connection characteristics of the N historical time points;

the behavior prediction layer determines a behavior category characteristic of the object based on the usage behavior characteristic;

the fusion layer determines the target security authentication mode of the object based on the position track category characteristics, the network connection category characteristics and the behavior category characteristics;

the method for acquiring the position characteristics of the M historical time points comprises the following steps:

the method comprises the steps of obtaining position information of at least one historical time point, and determining graph data based on the position information of the at least one historical time point, wherein the graph data comprises at least one first node and at least one virtual edge corresponding to the position information of the at least one historical time point, each virtual edge is connected with two of the at least one first node, the node attribute of the first node is determined based on the corresponding position information of the historical time point, and the edge attribute of the virtual edge is determined based on the time relation and the position relation of the position information of the two historical time points corresponding to the two connected first nodes;

and determining the position characteristics of the M historical time points corresponding to the position information of the at least one historical time point through a characteristic representation model based on the at least one first node in the graph data and the at least one virtual edge connected with the at least one first node.

2. The method of claim 1, the network connection prediction layer and the trajectory prediction layer being a recurrent neural network.

3. The method of claim 1, the behavior prediction layer and the fusion layer being deep neural networks.

4. The method of claim 1, the method of training the security certification predictive model comprising:

obtaining at least one use behavior feature sample, at least one group of position feature samples and at least one group of network connection feature samples of the object, and marking the at least one use behavior feature sample, the at least one group of position feature samples and the at least one group of network connection feature samples, wherein the group of position feature samples comprises M position feature samples, and the group of network connection feature samples comprises N network connection feature samples;

inputting the at least one usage behavior feature sample with the mark, the at least one group of position feature samples and the at least one group of network connection feature samples into an initial security certification prediction model for training to obtain the trained security certification prediction model.

5. The method of claim 1, the method further comprising:

acquiring real-time position information of the object;

determining whether the object is in a target area based on the real-time location information of the object;

if so, the target security authentication mode is adopted to perform security authentication on the object, otherwise, the object is not subjected to security authentication.

6. A system for secure authentication, comprising:

the characteristic acquisition module is used for acquiring position characteristics of M historical time points, network connection characteristics of N historical time points and use behavior characteristics of the object, wherein M and N are integers larger than 0;

a target security authentication mode prediction module, configured to input the usage behavior characteristics of the object, the location characteristics of the M historical time points, and the network connection characteristics of the N historical time points into a trained security authentication prediction model, predict a target security authentication mode, and perform security authentication on the object by using the target security authentication mode, where the security authentication prediction model includes a trajectory prediction layer, a network connection prediction layer, a behavior prediction layer, and a fusion layer; wherein:

7. The system of claim 6, the network connection prediction layer and the trajectory prediction layer being a recurrent neural network.

8. The system of claim 6, the behavior prediction layer and the fusion layer being deep neural networks.

9. The system of claim 6, further comprising a model training module to:

and inputting the at least one using behavior characteristic sample with the mark, the at least one group of position characteristic samples and the at least one group of network connection characteristic samples into an initial security certification prediction model to obtain the trained security certification prediction model.

10. The system of claim 6, the system further comprising a security authentication determination module to:

acquiring real-time position information of the object;

11. An apparatus for secure authentication, comprising a processor for performing a method of secure authentication of an object as claimed in any of claims 1 to 5.

12. A computer-readable storage medium storing computer instructions which, when read by a computer, cause the computer to perform a method of secure authentication of an object according to any one of claims 1 to 5.