Quantitative risk and income self-adaptive dynamic multiple-factor authentication method

Abstract

The invention belongs to the technical fields of system safety and access control, and particularly relates to a quantitative risk and income self-adaptive dynamic multiple-factor authentication method. Through the method provided by the invention, an information system dynamically binds multiple authentication factors in different access scenes, thereby carrying out safety identification on a user logging in the system. Through the assessment of quantitative risk and income generated by access and the implementation of multiple-factor binding strategies, the information system determines the combination of authentication factors aiming at the corresponding access implementation so as to realize user identity authentication. The information system updates the assessed source historical data, thereby dynamically updating the assessment result of the quantitative risk and income so as to realize the self-adaptive characteristic of dynamic binding. By applying the method, the requirements for safety and usability of the information system can be balanced, and the response speed of the information system to an abnormal event can be improved.

Description

technical field [0001] The invention belongs to the technical field of system security and access control, and specifically relates to a dynamic multi-factor authentication method based on quantitative risk and self-adaptation of benefits, which dynamically selects an appropriate factor or multi-factor binding from an authentication factor library according to the context of an information system Perform user authentication. Background technique [0002] With the continuous popularization of personal computer and Internet technology, various information systems play an important role in people's daily life. With the increasing complexity of information systems, especially the emergence of various large-scale multi-user information systems, how to ensure the security of information systems has become a hot issue that enterprises, users and researchers are concerned about. [0003] Access control is a core technology that determines whether users can access sensitive informat...

AI Technical Summary

Problems solved by technology

[0008] 1. Due to the fixed strategy, it cannot adapt to the highly changing network environment

If the network environment changes and needs to change the security level requirements of the current information system, it cannot respond quickly

For example, in the first half of 2011, when the key system of Bank of China's online banking was breached, Bank of China could not change the authentication method in its own online banking system as soon as possible to improve the security level

This provides more attack time for malicious users to compromise system security

[0009] 2. Under the condition of normal network environment, if a more cumbersome authentication method is adopted for normal users, it will disrupt the normal transaction behavior of users, making users tend to choose other online banking services that are easier to use

Images