Account-free user unification method and system of construction and management system based on multimode authentication

Abstract

The invention relates to the technical field of login management, in particular to an account-free user unification method and system of a construction and management system based on multimode authentication, and the method comprises the following steps: collecting historical login time, login frequency, login place and equipment type data of a user based on multi-terminal user activity data, and obtaining a historical behavior record of the user; according to the method, the behavior deviation can be identified by comparing and analyzing the current and historical behaviors of the user, then the risk score is calculated, the authentication factor is dynamically adjusted according to the risk score, the flexibility and adaptability of security verification are improved, and the security verification efficiency is improved by binding the real person information of the user to the dynamically adjusted token and adjusting the validity period of the token. The security and effectiveness of token management are effectively improved, close token checking and authority analysis can be performed when a user accesses a downstream system, and the accuracy and security of authorized access are ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of login management, and in particular to a method and system for unifying users without an account in a construction management system based on multi-mode authentication. Background Art

[0002] The field of login management technology mainly involves methods and systems for identifying and verifying user identities. Login management technology mainly focuses on verifying and managing user identity information to ensure the security of system or network resources. This field covers various authentication methods from traditional username and password verification to multi-factor authentication technology. The core purpose of login management is to ensure the authenticity of user identity and the authorization of operations, while reducing security risks.

[0003] Among them, the unified method of building a management system without account users focuses on providing a technical solution that can access the system without traditional login credentials. This method uses an authentication agent or a one-time identification mechanism, such as a link or token, to allow users to temporarily access the system through methods such as email or mobile phone verification. The purpose of this method is mainly to simplify the user's login process and improve access convenience while maintaining the security of the system. The account-free login method is particularly suitable for systems or applications that require quick access rights but are not frequently used, such as customer support systems or temporary project management tools. It aims to reduce the burden of account management, prevent the risk of account leakage, and improve user experience.

[0004] Traditional management methods rely on static authentication methods, which show their limitations in the face of increasingly complex security threats. The management and maintenance of static credentials not only increases the burden on users, but also easily leads to security vulnerabilities due to credential leakage or theft. In addition, traditional methods lack flexibility and cannot dynamically adjust security policies based on real-time data or behavioral analysis, which is particularly evident when dealing with large-scale or complex user environments. For example, once a user's login behavior is abnormal, such as frequent login attempts or access at unconventional times, traditional methods cannot respond immediately, resulting in unauthorized access or data leakage. Traditional methods usually fail to effectively solve the burden of account management. For temporary or infrequently used systems, users need to remember multiple credentials, which is not only inconvenient, but also leads to additional security risks due to forgotten credentials. Summary of the invention

[0005] The purpose of the present invention is to solve the shortcomings of the prior art and to propose a unified method and system for accountless users of a construction and management system based on multi-mode authentication.

[0006] In order to achieve the above object, the present invention adopts the following technical solution: a unified method for users without accounts based on a construction and management system with multi-mode authentication, comprising the following steps:

[0007] S1: Based on multi-terminal user activity data, collect the user's historical login time, login frequency, login location and device type data to obtain the user's historical behavior record;

[0008] S2: Based on the user's historical behavior records, the risk score is calculated according to the user's current login time, login frequency, login location and device type, and the historical behavior records are compared to obtain a behavior risk score result;

[0009] S3: Based on the behavior risk scoring result, dynamically adjust the user's authentication factors according to the risk score, adjust the required authentication measures according to the set security threshold, and generate a dynamic authentication configuration;

[0010] S4: Based on the dynamic authentication configuration, receiving the face image, verification sound and fingerprint authentication information submitted by the user through the camera, authenticating the user identity, and obtaining the authentication result;

[0011] S5: Based on the behavior risk scoring result and the authentication verification result, the user's real-person registration information is bound to the user token, and the validity period of the user token is adjusted according to the risk score to obtain token validity period adjustment information;

[0012] S6: Based on the token validity period adjustment information, when a user accesses a downstream system, the user identity and permission data in the token is parsed, the user is uniformly authorized to access the downstream system, and data is recorded to obtain access management information.

[0013] As a further solution of the present invention, the user's historical behavior record includes login time information, device usage type information and login location information, the behavior risk scoring result includes risk score, behavior abnormality rate and device abnormality rate, the dynamic authentication configuration includes the number of authentication steps, authentication type information and authentication process priority, the authentication verification result includes the matching success rate of face and voice recognition, the user's verification status information and user identity information, the token validity period adjustment information includes the encryption level of the token, the validity period and the user identity binding information, and the question management information includes the user's authority level, authorized systems and services, and the timestamp and access record of authority verification.

[0014] As a further solution of the present invention, based on multi-terminal user activity data, the user's historical login time, login frequency, login location and device type data are collected to obtain the user's historical behavior record in the following steps:

[0015] S101: Based on the multi-terminal user activity data, extract the user's login time, login frequency, login location and device type record data, summarize the data, and obtain a user behavior data set;

[0016] S102: Based on the user behavior data set, clean the data, remove outliers and duplicate records, optimize the consistency and accuracy of the data, and obtain a cleaned user data set;

[0017] S103: Based on the cleaned user data set, format the data, convert the data into a unified format, and integrate the data to obtain user historical behavior records.

[0018] As a further solution of the present invention, based on the user's historical behavior records, the risk score is calculated according to the user's current login time, login frequency, login location and device type, and the steps of obtaining the behavior risk score result are specifically as follows:

[0019] S201: extracting the user's current login behavior data based on the user's historical behavior records, including login time, frequency, location and device type, to obtain the user's real-time login information;

[0020] S202: Based on the real-time login information of the user, compare it with the historical behavior data, analyze the differences in login behaviors, evaluate the deviation of each behavior, and obtain behavior deviation information;

[0021] S203: Based on the behavior deviation information, a corresponding risk weight is set for each deviation, and the risk score of the user is calculated to obtain a behavior risk score result.

[0022] As a further solution of the present invention, the formula for calculating the risk score of the user is:

[0023]

[0024] Among them, R represents the user's total risk score, d1, d2 and d3 represent the quantitative scores of login time deviation, login frequency deviation and login location deviation respectively, w1, w2 and w3 are weight coefficients, k is the adjustment parameter, and N is the normalization constant.

[0025] As a further solution of the present invention, based on the behavior risk scoring result, according to the risk score, the user's authentication factors are dynamically adjusted, and according to the set security threshold, the required authentication measures are adjusted. The steps of generating a dynamic authentication configuration are specifically as follows:

[0026] S301: Based on the behavior risk score result, the risk score is compared with a set security threshold. If the risk score exceeds the security threshold, an additional biometric identification step is added to obtain dynamic authentication quantity information;

[0027] S302: Based on the dynamic authentication quantity information, set additional biometric measures, select biometric methods, including fingerprint, face and voice authentication, and set corresponding parameters for each method, including recognition sensitivity and maximum number of attempts, to obtain authentication measure parameter information;

[0028] S303: Based on the authentication measure parameter information, adjust the execution process of the authentication measure, including setting the application order and conditions of each biometric technology to obtain a dynamic authentication configuration.

[0029] As a further solution of the present invention, based on the dynamic authentication configuration, receiving the face image, verification sound and fingerprint authentication information submitted by the user through the camera, authenticating the user identity, and obtaining the authentication verification result are specifically as follows:

[0030] S401: Based on the dynamic authentication configuration, receiving biometric authentication information submitted by the user through the current device, including face image, voice sample and fingerprint data, to obtain a biometric authentication data set;

[0031] S402: Based on the biometric authentication data set, perform face image recognition and voice verification, compare the matching degree of fingerprints with pre-stored data, record the results of the verification method, and obtain a single authentication result;

[0032] S403: Based on the single authentication result, the verification information of the authentication steps is summarized. If each authentication is verified to be successful, the authentication status is verified to be successful, the user's security status record is updated, and the authentication result is obtained.

[0033] As a further solution of the present invention, based on the behavior risk scoring result and the authentication verification result, the user's real-person registration information is bound to the user token, and the validity period of the user token is adjusted according to the risk score. The steps of obtaining the token validity period adjustment information are specifically as follows:

[0034] S501: Based on the behavior risk scoring result and the authentication verification result, the authentication information is compared with the pre-stored user data. After the verification information matches, the user's personal identity information, including name and ID number, is bound to the token of the current session to create bound user real-person registration information;

[0035] S502: Based on the bound user real person registration information and the risk score, the validity period of the user token is adjusted to obtain a token validity period configuration;

[0036] S503: Based on the token validity period configuration, the token validity period configuration is integrated with the user token information, the user's token status is updated, the risk score is matched, and token validity period adjustment information is obtained.

[0037] As a further solution of the present invention, based on the token validity period adjustment information, when a user accesses a downstream system, the user identity and permission data in the token are parsed, the user is uniformly authorized to access the downstream system, and data is recorded. The steps of obtaining the access management information are specifically as follows:

[0038] S601: Based on the token validity period adjustment information, when the user accesses the downstream system, the token encryption signature is verified to check the validity and integrity of the token, verify that the token has not expired and has not been tampered with, and obtain the token verification status;

[0039] S602: Based on the token verification status, if the token is valid, parse the user identity and permission data embedded in the token, and grant the user permission to access the downstream system, including resource access and data query permission, according to the user identity and permission data, to obtain a user permission parsing result;

[0040] S603: Based on the user authority parsing result, record the information of each time the user accesses the downstream system through the verified token, including the time of access, the name of the accessed system and the result of the access, to obtain access management information.

[0041] A unified system for non-account users of a construction and management system based on multi-mode authentication, the unified system for non-account users of a construction and management system based on multi-mode authentication is used to execute the above-mentioned unified method for non-account users of a construction and management system based on multi-mode authentication, the system includes:

[0042] The login risk assessment module collects the user's historical login time, login frequency, login location and device type data based on multi-terminal user activity data, compares the user's current login time, login frequency, login location and device type with historical behavior records, analyzes behavioral deviations, calculates risk scores, and obtains behavioral risk score results;

[0043] The authentication measure dynamic adjustment module dynamically adjusts the user's authentication factors based on the behavior risk scoring result, adjusts the required authentication measures according to the set security threshold, and generates a dynamic authentication configuration;

[0044] The identity authentication module receives the face image, verification sound and fingerprint authentication information submitted by the user through the camera based on the dynamic authentication configuration, authenticates the user's identity, and obtains the authentication result;

[0045] The token validity period adjustment module binds the user's real-person registration information to the user token based on the behavior risk score result and the authentication verification result, and adjusts the validity period of the user token according to the risk score to obtain token validity period adjustment information;

[0046] Based on the token validity period adjustment information, the access management module verifies the encrypted signature and status of the user token when the user accesses the downstream system. After verification, it parses the user identity and permission data in the token, uniformly authorizes the user to access the downstream system, and records the data to obtain access management information.

[0047] Compared with the prior art, the advantages and positive effects of the present invention are:

[0048] In the present invention, by comparing and analyzing the current and historical behaviors of users, behavioral deviations can be identified, and then a risk score can be calculated. Authentication factors can be dynamically adjusted according to the risk score, such as adding a biometric identification step, thereby improving the flexibility and adaptability of security verification. The generated dynamic authentication configuration and real-time biometric identification verification enhance the security protection capability of the system. By binding the user's real-person information to a dynamically adjusted token and adjusting the validity period of the token, the security and effectiveness of token management are effectively improved. Close token verification and permission analysis can be performed when the user accesses the downstream system, ensuring the accuracy and security of authorized access, improving the convenience of access, and significantly reducing security risks and enhancing user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 It is a schematic diagram of the workflow of the present invention;

[0050] Figure 2 This is a detailed flow chart of S1 of the present invention;

[0051] Figure 3 This is a detailed flow chart of S2 of the present invention;

[0052] Figure 4 This is a detailed flow chart of S3 of the present invention;

[0053] Figure 5 This is a detailed flow chart of S4 of the present invention;

[0054] Figure 6 This is a detailed flow chart of S5 of the present invention;

[0055] Figure 7 This is a detailed flow chart of S6 of the present invention;

[0056] Figure 8 It is a system flow chart of the present invention. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0058] In the description of the present invention, it should be understood that the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, in the description of the present invention, "multiple" means two or more, unless otherwise clearly and specifically defined.

[0059] See also Figure 1 The present invention provides a technical solution: a unified method for building a management system without an account based on multi-mode authentication, comprising the following steps:

[0060] S1: Based on multi-terminal user activity data, collect the user's historical login time, login frequency, login location and device type data, integrate the data, clean and format the data, and obtain the user's historical behavior record;

[0061] S2: Based on the user's historical behavior records, the user's current login time, login frequency, login location and device type are compared with the historical behavior records, the behavior deviation is analyzed, the risk score is calculated, and the behavior risk score result is obtained;

[0062] S3: Based on the behavior risk score results, dynamically adjust the user's authentication factors according to the risk score, and adjust the required authentication measures according to the set security threshold, including adding biometric steps and types, and generating dynamic authentication configuration;

[0063] S4: Based on the dynamic authentication configuration, the user's face image, voice verification and fingerprint authentication information are received through the camera, and the user's identity is authenticated through image, voice recognition and fingerprint authentication to obtain the authentication result;

[0064] S5: Based on the behavior risk score result and the authentication verification result, the user's real-person registration information is bound to the user token, and the validity period of the user token is adjusted according to the risk score to obtain token validity period adjustment information;

[0065] S6: Based on the token validity period adjustment information, when the user accesses the downstream system, the encrypted signature and status of the user token are checked. After the verification is passed, the user identity and permission data in the token are parsed, the user is uniformly authorized to access the downstream system, and the data is recorded to obtain the access management information;

[0066] User historical behavior records include login time information, device usage type information and login location information. Behavioral risk scoring results include risk score, behavior abnormality rate and device abnormality rate. Dynamic authentication configuration includes the number of authentication steps, authentication type information and authentication process priority. Authentication verification results include the matching success rate of face and voice recognition, user's verification status information and user identity information. Token validity period adjustment information includes token encryption level, validity period and user identity binding information. Question management information includes user's authority level, authorized systems and services, and timestamp and access records of authority verification.

[0067] See also Figure 2 Based on multi-terminal user activity data, the user's historical login time, login frequency, login location and device type data are collected, the data is integrated, and the data is cleaned and formatted. The specific steps for obtaining the user's historical behavior record are as follows:

[0068] S101: Based on the multi-terminal user activity data, extract the user's login time, login frequency, login location and device type record data, summarize the data, and obtain a user behavior data set;

[0069] Based on multi-terminal user activity data, the collected data includes the user's login time, login frequency, login location and device type. This process involves the docking of multiple data sources and data standardization. The format of each data is unified and the time is synchronized to ensure the consistency of the data in subsequent processing. The login frequency data is normalized to eliminate the differences in data recording methods between different devices. The login location data is geocoded to convert the location information into standardized geographic coordinates for subsequent geographic analysis. Through these steps, the collected data is uniformly recorded and standardized to obtain a user behavior data set.

[0070] S102: Based on the user behavior data set, clean the data, remove outliers and duplicate records, optimize the consistency and accuracy of the data, and obtain a cleaned user data set;

[0071] Based on the user behavior data set, a data cleaning process is performed, including using an outlier detection algorithm to identify and exclude abnormal data points in the data set, such as determining abnormal login frequencies through the IQR method, and identifying and eliminating duplicate records through data hashing technology to ensure the independence and integrity of the data set. At the same time, missing values ​​in the data set are interpolated or deleted, and the recovery method is determined based on the importance and degree of missing data. These steps are implemented through program automation to ensure data consistency and accuracy, and ultimately a cleaned user data set is obtained.

[0072] S103: Based on the cleaned user data set, format the data, convert the data into a unified format, and integrate the data to obtain the user's historical behavior record.

[0073] Based on the cleaned user data set, the data is formatted, including unifying multi-source data into a common format, such as converting date and time data into ISO standard format. At the same time, the description of user device types is unified and standard device classification codes are used. During the integration process, a database management system is used to merge and query data, and SQL statements are used to effectively index and integrate data to reduce data processing time and improve efficiency. After these operations, the data is effectively integrated and ultimately the user's historical behavior records are obtained.

[0074] See also Figure 3 Based on the user's historical behavior records, the user's current login time, login frequency, login location and device type are compared with the historical behavior records, the behavior deviation is analyzed, and the risk score is calculated. The specific steps for obtaining the behavior risk score result are as follows:

[0075] S201: extracting the user's current login behavior data based on the user's historical behavior records, including login time, frequency, location, and device type, to obtain the user's real-time login information;

[0076] Based on the user's historical behavior records, the current user login data is extracted, including timestamp, login frequency statistics, geographic location information and device identification code. The data is realized through database query. Specifically, by constructing SQL query statements, user activity records within the corresponding time period are extracted from the database. The geographic location information is converted into specific coordinate data through location coding, and the device type is matched with the specific device model and category through the device library to ensure the accuracy and real-time nature of the extracted information. The data set obtained through process integration forms the user's real-time login information.

[0077] S202: Based on the user's real-time login information, compare it with the historical behavior data, analyze the differences in login behaviors, evaluate the deviation of each behavior, and obtain behavior deviation information;

[0078] Based on the user's real-time login information, it is compared with historical behavior data to analyze the differences in login behavior, evaluate the deviation of each behavior, extract the login pattern of the same user from the historical data set, including the average login frequency, common login location and device type, and compare it with the current login attempt. Difference analysis relies on calculating the deviation value of each data (time, location, frequency, device) using mathematical formulas such as mean absolute deviation or standard deviation. The deviation information obtained from these calculations is used to evaluate the abnormality of user behavior and provide data support for subsequent risk assessment.

[0079] S203: Based on the behavior deviation information, a corresponding risk weight is set for each deviation, and the risk score of the user is calculated to obtain a behavior risk score result.

[0080] The formula for calculating a user's risk score is:

[0081]

[0082] Among them, R represents the user's total risk score, d1, d2 and d3 represent the quantitative scores of login time deviation, login frequency deviation and login location deviation respectively, w1, w2 and w3 are weight coefficients, k is the adjustment parameter, and N is the normalization constant.

[0083] formula:

[0084]

[0085] The meaning and acquisition method of parameters:

[0086] d1 Login Time Deviation Score: Calculated based on the deviation of the user's login time from the predetermined standard login time. The deviation is obtained by measuring the difference between the actual login time and the average login time.

[0087] d2 Login frequency deviation score: This is calculated based on the difference between the number of user logins and their historical average login frequency. This parameter is obtained by counting the number of user logins in a certain period and comparing it with the average number of logins in that period.

[0088] d3 Login location deviation score: If the user logs in from a non-resident location, the score is calculated based on the distance between the login location and the permanent location. The distance is calculated by measuring the GPS coordinates, and the straight-line distance between the actual login location and the permanent location is used as the deviation score.

[0089] w1, w2, and w3: Weight coefficients are set based on historical security event data by analyzing the correlation between various types of deviations and security events. For example, if the time deviation is more relevant to the security event, a higher weight is given.

[0090] k: Location deviation adjustment parameter, which is a baseline adjustment parameter used to adjust the benchmark of the location deviation score to make the location deviation score more reasonable. The setting of k is based on the average geographical location of the statistical permanent location.

[0091] N: A normalization constant used to ensure that the risk score is within a standard range, usually taken as the sum of the reciprocals of the weights.

[0092] Calculation example:

[0093] Set the values ​​as follows:

[0094] d1=2, indicating that the user login time is 2 hours later than the standard time.

[0095] d2=16, indicating that the user's login attempts are 16 times more than the average.

[0096] d3=20, indicating that the user logs in from a location 20 kilometers away.

[0097] w1=0.5, w2=0.3, w3=0.2, indicating the weight of each deviation.

[0098] k=15, location deviation adjustment value.

[0099] N=3, normalization constant.

[0100] Calculate R using the natural logarithm:

[0101]

[0102]

[0103] The risk score R = 1.283 represents the user's overall risk level, taking into account different types of behavioral deviations and their weights. The higher the score, the greater the deviation of the user's behavior from normal behavior, and the higher the security risk. This result can be used to determine whether the user needs additional security measures or monitoring.

[0104] See also Figure 4 Based on the behavior risk score results, the user's authentication factors are dynamically adjusted according to the risk score. According to the set security threshold, the required authentication measures are adjusted, including adding biometric steps and types. The steps to generate dynamic authentication configuration are as follows:

[0105] S301: Based on the behavior risk score result, the risk score is compared with the set security threshold. If the risk score exceeds the security threshold, an additional biometric identification step is added to obtain dynamic authentication quantity information;

[0106] Based on the behavioral risk score results, the calculated risk score of each user is compared with the security threshold set by the system. The comparison is implemented through programming logic, including the use of conditional judgment statements to check whether the score of each user exceeds the threshold. If it exceeds the threshold, the security response mechanism is triggered, which includes the introduction of additional biometric verification steps to ensure that the system only adds an additional security verification layer when the user behavior shows potential risks. This operation is completed through software automation to ensure the immediacy of the response and generate dynamic authentication quantity information containing the necessary number of biometric steps.

[0107] S302: Based on the dynamic authentication quantity information, set additional biometric measures, select biometric methods, including fingerprint, face and voice authentication, and set corresponding parameters for each method, including recognition sensitivity and maximum number of attempts, to obtain authentication measure parameter information;

[0108] Based on the dynamic authentication quantity information, the additional biometric measures are determined according to the risk level, and appropriate biometric technologies are selected, including fingerprint recognition, facial recognition and voice recognition. Specific operating parameters are set for each technology. The parameters include the sensitivity setting during the recognition process and the maximum number of attempts after the user fails the authentication. The parameter setting process takes into account the security needs of different risk levels, and adjusts the parameters through programming logic to meet the needs of different security scenarios, thereby forming authentication measure parameter information.

[0109] S303: Based on the authentication measure parameter information, adjusting the execution process of the authentication measure, including setting the application order and conditions of each biometric recognition technology, and obtaining a dynamic authentication configuration;

[0110] Based on the authentication measure parameter information, the authentication process is adjusted, including determining the application order of different biometric technologies and their activation under specific conditions, including setting conditional judgment logic, such as selecting appropriate identification technology based on the user's risk score and authentication scenario. In addition, it also includes adjustments to biometric devices to ensure that each technology meets the set parameter standards when implemented, and to build a dynamic authentication configuration that adapts to different security needs.

[0111] See also Figure 5 Based on the dynamic authentication configuration, the user's face image, voice verification and fingerprint authentication information are received through the camera, and the user's identity is authenticated through image, voice recognition and fingerprint authentication. The specific steps to obtain the authentication result are as follows:

[0112] S401: Based on the dynamic authentication configuration, receiving the biometric authentication information submitted by the user through the current device, including the face image, the voice sample and the fingerprint data, and obtaining the biometric authentication data set;

[0113] Based on the dynamic authentication configuration, the system receives and processes the biometric authentication information submitted by the user through the device he / she is currently using, including but not limited to face images, voice samples and fingerprint data. The data is collected through the device's biometric sensor and sent to the server through a secure communication protocol, and formatted into a unified data format to form a biometric authentication data set.

[0114] S402: Based on the biometric authentication data set, perform face image recognition and voice verification, compare the matching degree of fingerprints with pre-stored data, record the results of the verification method, and obtain a single authentication result;

[0115] Based on the biometric authentication data set, face image recognition and voice verification are performed, and the matching degree of fingerprints and pre-stored data is compared. Identity verification uses image processing algorithms for face recognition, voice verification is implemented through voiceprint recognition technology, and fingerprint data is compared with pre-stored fingerprint data in the database through a biometric matching algorithm. Each authentication technology is executed independently, and the three types of data are processed in parallel to reduce the total verification time. For each authentication method, an authentication result is generated, including a sign of success or failure, the time required for authentication, and possible error codes.

[0116] S403: Based on the single authentication result, the verification information of the authentication steps is summarized. If each authentication is verified to be passed, the authentication status is verified to be passed, the user's security status record is updated, and the authentication verification result is obtained;

[0117] Based on the single authentication results, the verification information of the authentication steps is summarized. By checking all the single results, the user's authentication status is marked as passed only when all items show that the authentication is passed. If any item fails, the user will be guided to retry the authentication. After successful authentication, the user's security status will be updated, including marking the current login attempt as authorized login in the user's personal record, and recording the authentication time and device information to obtain the authentication verification result.

[0118] See also Figure 6 Based on the behavior risk score result and the authentication verification result, the user's real-person registration information is bound to the user token, and the validity period of the user token is adjusted according to the risk score. The specific steps for obtaining the token validity period adjustment information are as follows:

[0119] S501: Based on the behavior risk scoring result and the authentication verification result, the authentication information is compared with the pre-stored user data. After the verification information matches, the user's personal identity information, including name and ID number, is bound to the token of the current session to create the bound user real-person registration information;

[0120] Based on the behavior risk score results and authentication verification results, the user's pre-stored data, including name, ID number, and historical authentication records, is extracted from the security database, and the data is checked with the authentication information submitted by the user from the current session to ensure that the name and ID number match exactly. Once the verification is passed, the personal identity information is bound to the generated session token. The binding process ensures data security through encryption methods and creates a new real-person registration record, which includes the user's identity information, token and its binding time to ensure identity consistency in subsequent sessions.

[0121] S502: Based on the bound user real person registration information and the risk score, the validity period of the user token is adjusted to obtain the token validity period configuration;

[0122] Based on the bound user's real-person registration information, the system adjusts the validity period of the token according to the user's behavioral risk score. This adjustment process uses conditional logic to determine the new validity period of the token. A high risk score may result in a shortened token validity period, while a low risk score allows a longer validity period. This adjustment is to balance user convenience and system security requirements. The specific settings of the validity period are automatically updated through a programmatic method to ensure that the validity of each user's token matches its behavioral risk and obtain the token validity period configuration.

[0123] S503: Based on the token validity period configuration, the token validity period configuration is integrated with the user token information, the user's token status is updated, the risk score is matched, and the token validity period adjustment information is obtained.

[0124] Based on the token validity period configuration, the system integrates the new token validity period information with the user's token data, which includes updating the token record in the database and modifying the validity period field in the record. The integration process is completed through automated database operations to ensure that all token information is updated in a timely manner. At the same time, the system adjusts the token status according to the user's risk score to ensure that the token status of each user is consistent with their risk level, forming token validity period adjustment information and updating the user's token status to match their behavioral risk.

[0125] See also Figure 7 , based on the token validity period adjustment information, when the user accesses the downstream system, the encrypted signature and status of the user token are checked. After the verification is passed, the user identity and permission data in the token are parsed, the user is uniformly authorized to access the downstream system, and the data is recorded. The specific steps to obtain the access management information are as follows:

[0126] S601: Based on the token validity period adjustment information, when the user accesses the downstream system, the token encryption signature is verified to check the validity and integrity of the token, verify that the token has not expired and has not been tampered with, and obtain the token verification status;

[0127] Based on the token validity period adjustment information, when a user attempts to access a downstream system, the system performs an encrypted signature verification process for the token, including decrypting the token using a security protocol and verifying its signature to confirm the validity and integrity of the token. The operation ensures that the token has not expired within the validity period and the content has not been tampered with. It is checked through encryption technology and signature algorithms, and implemented through an automated security verification procedure to ensure that all passed tokens meet security requirements and obtain a token verification status.

[0128] S602: Based on the token verification status, if the token is valid, parse the user identity and permission data embedded in the token, and grant the user permission to access the downstream system, including resource access and data query permissions, based on the user identity and permission data, to obtain the user permission parsing result;

[0129] Based on the token verification status, if the token is verified to be valid, the user identity information and permission settings contained in the token will be parsed. The parsing process uses a security token service (such as OAuth2.0 or JWT) to identify the user's permission level and determine the scope of resources that the user can access. The user's access rights are dynamically configured based on the parsed permission data, which includes file reading, data modification, or permissions to use specific applications. Depending on the user's role and security level, additional access control may be performed on sensitive data. After completing the permission configuration, the parsing results are recorded and the status of the access rights is updated in the user's session log to ensure the correct execution of permissions and audit tracking.

[0130] S603: Based on the user authority parsing result, record the information of each time the user accesses the downstream system through the verified token, including the time of access, the name of the accessed system and the result of the access, to obtain access management information.

[0131] Based on the results of user permission analysis, the access details of each user are recorded, including the time of each user's access, the name of the downstream system accessed, and the result of the access (such as success, failure, or access denied). The information is stored in a secure audit database for future security analysis, user behavior analysis, and compliance checks. It can provide a detailed access history to help identify potential security threats and optimize user access policies, while ensuring that all user activities are monitored to prevent unauthorized access or data leakage.

[0132] See also Figure 8 The unified system for accountless users of a construction management system based on multiple authentication methods is used to execute the unified method for accountless users of a construction management system based on multiple authentication methods. The system includes:

[0133] The login risk assessment module collects the user's historical login time, login frequency, login location and device type data based on multi-terminal user activity data, compares the user's current login time, login frequency, login location and device type with historical behavior records, analyzes behavioral deviations, calculates risk scores, and obtains behavioral risk score results;

[0134] The authentication measure dynamic adjustment module dynamically adjusts the user's authentication factors based on the behavior risk score results and the risk score size, adjusts the required authentication measures based on the set security threshold, and generates a dynamic authentication configuration;

[0135] The identity authentication module is based on dynamic authentication configuration, receives the face image, verification voice and fingerprint authentication information submitted by the user through the camera, authenticates the user's identity, and obtains the authentication verification result;

[0136] The token validity period adjustment module binds the user's real-person registration information to the user token based on the behavior risk score result and the authentication verification result, and adjusts the validity period of the user token according to the risk score to obtain the token validity period adjustment information;

[0137] The access management module adjusts the token validity period information based on the information. When the user accesses the downstream system, it verifies the encrypted signature and status of the user token. After the verification is passed, it parses the user identity and permission data in the token, uniformly authorizes the user to access the downstream system, and records the data to obtain access management information.

[0138] The above are only preferred embodiments of the present invention and are not intended to limit the present invention in other forms. Any technician familiar with the profession may use the technical contents disclosed above to change or modify them into equivalent embodiments with equivalent changes and apply them to other fields. However, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention without departing from the technical solution of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A unified method for building a management system without an account based on multi-mode authentication, characterized in that: The following steps are involved: Based on multi-terminal user activity data, the user's historical login time, login frequency, login location and device type data are collected to obtain the user's historical behavior records; Based on the user's historical behavior records, the risk score is calculated according to the user's current login time, login frequency, login location and device type, and compared with the historical behavior records to obtain a behavior risk score result; Based on the behavior risk scoring result, dynamically adjust the user's authentication factors according to the risk score, adjust the required authentication measures according to the set security threshold, and generate a dynamic authentication configuration; Based on the dynamic authentication configuration, receiving the face image, verification sound and fingerprint authentication information submitted by the user through the camera, authenticating the user identity, and obtaining the authentication verification result; Based on the behavior risk scoring result and the authentication verification result, the user's real-person registration information is bound to the user token, and the validity period of the user token is adjusted according to the risk score to obtain token validity period adjustment information; Based on the token validity period adjustment information, when a user accesses a downstream system, the user identity and permission data in the token are parsed, the user is uniformly authorized to access the downstream system, and data is recorded to obtain access management information.

2. According to claim 1, the unified method for building and managing a system without an account based on multi-mode authentication is characterized in that: The user's historical behavior record includes login time information, device usage type information and login location information; the behavior risk scoring result includes risk score, behavior abnormality rate and device abnormality rate; the dynamic authentication configuration includes the number of authentication steps, authentication type information and authentication process priority; the authentication verification result includes the matching success rate of face and voice recognition, the user's verification status information and user identity information; the token validity period adjustment information includes the token's encryption level, validity period and user identity binding information; the question management information includes the user's authority level, authorized systems and services, and the timestamp and access record of authority verification.

3. According to claim 1, the method for unifying users without accounts in a construction and management system based on multi-mode authentication is characterized in that: Based on multi-terminal user activity data, the user's historical login time, login frequency, login location and device type data are collected to obtain the user's historical behavior records in the following steps: Based on multi-terminal user activity data, extract the user's login time, login frequency, login location and device type record data, summarize the data, and obtain the user behavior data set; Based on the user behavior data set, data cleaning is performed on the data to remove outliers and duplicate records, optimize the consistency and accuracy of the data, and obtain a cleaned user data set; Based on the cleaned user data set, the data is formatted, converted into a unified format, and integrated to obtain the user's historical behavior records.

4. According to claim 1, the method for unifying users without accounts in a construction and management system based on multi-mode authentication is characterized in that: Based on the user's historical behavior records, the risk score is calculated according to the user's current login time, login frequency, login location and device type, and compared with the historical behavior records. The steps of obtaining the behavior risk score result are as follows: Based on the user's historical behavior records, extract the user's current login behavior data, including login time, frequency, location and device type, to obtain the user's real-time login information; Based on the real-time login information of the user, the user is compared with the historical behavior data to analyze the differences in login behaviors, evaluate the deviation of each behavior, and obtain behavior deviation information; Based on the behavioral deviation information, a corresponding risk weight is set for each deviation, and the user's risk score is calculated to obtain a behavioral risk score result.

5. According to claim 4, the method for unifying users without accounts in a construction and management system based on multi-mode authentication is characterized in that: The formula for calculating the user's risk score is: Among them, R represents the user's total risk score, d1, d2 and d3 represent the quantitative scores of login time deviation, login frequency deviation and login location deviation respectively, w1, w2 and w3 are weight coefficients, k is the adjustment parameter, and N is the normalization constant.

6. The method for unifying users without accounts in a construction and management system based on multi-mode authentication according to claim 1 is characterized in that: Based on the behavior risk scoring result, the user's authentication factors are dynamically adjusted according to the risk score, and the required authentication measures are adjusted according to the set security threshold. The steps for generating a dynamic authentication configuration are specifically as follows: Based on the behavior risk score result, the risk score is compared with a set security threshold, and if the risk score exceeds the security threshold, an additional biometric identification step is added to obtain dynamic authentication quantity information; Based on the dynamic authentication quantity information, setting additional biometric measures, selecting biometric methods, including fingerprint, face and voice authentication, and setting corresponding parameters for each method, including recognition sensitivity and maximum number of attempts, to obtain authentication measure parameter information; Based on the authentication measure parameter information, the execution process of the authentication measure is adjusted, including setting the application order and conditions of each biometric technology, to obtain a dynamic authentication configuration.

7. The method for unifying users without accounts in a construction and management system based on multi-mode authentication according to claim 1 is characterized in that: Based on the dynamic authentication configuration, the steps of receiving the face image, verification sound and fingerprint authentication information submitted by the user through the camera, authenticating the user identity and obtaining the authentication result are as follows: Based on the dynamic authentication configuration, receiving biometric authentication information submitted by the user through the current device, including face image, voice sample and fingerprint data, to obtain a biometric authentication data set; Based on the biometric authentication data set, face image recognition and voice verification are performed, and the matching degree of fingerprints and pre-stored data is compared, and the results of the verification method are recorded to obtain a single authentication result; Based on the single authentication results, the verification information of the authentication steps is summarized. If each authentication is verified to be successful, the authentication status is verified to be successful, the user's security status record is updated, and the authentication result is obtained.

8. The method for unifying users without accounts in a construction and management system based on multi-mode authentication according to claim 1 is characterized in that: Based on the behavior risk score result and the authentication verification result, the user's real-person registration information is bound to the user token, and the validity period of the user token is adjusted according to the risk score. The steps of obtaining the token validity period adjustment information are specifically as follows: Based on the behavior risk scoring result and the authentication verification result, the authentication information is compared with the pre-stored user data. After the verification information matches, the user's personal identity information, including name and ID number, is bound to the token of the current session to create bound user real-person registration information; Based on the bound user real person registration information, according to the risk score, the validity period of the user token is adjusted to obtain the token validity period configuration; Based on the token validity period configuration, the token validity period configuration is integrated with the user token information, the user's token status is updated, the risk score is matched, and the token validity period adjustment information is obtained.

9. The method for unifying users without accounts in a construction and management system based on multi-mode authentication according to claim 1, characterized in that: Based on the token validity period adjustment information, when a user accesses a downstream system, the user identity and permission data in the token are parsed, the user is uniformly authorized to access the downstream system, and data is recorded. The specific steps of obtaining access management information are as follows: Based on the token validity period adjustment information, when a user accesses a downstream system, the token encryption signature is verified to check the validity and integrity of the token, verify that the token has not expired and has not been tampered with, and obtain the token verification status; Based on the token verification status, if the token is valid, parse the user identity and permission data embedded in the token, and grant the user permission to access the downstream system, including resource access and data query permissions, based on the user identity and permission data, to obtain a user permission parsing result; Based on the user authority parsing result, the information of each time the user accesses the downstream system through the verified token is recorded, including the time of access, the name of the accessed system and the result of the access, to obtain the access management information.

10. A unified system for users without accounts based on a multi-mode authentication management system, characterized in that: According to any one of claims 1 to 9, the unified method for building a management system without an account based on multi-mode authentication, the system comprises: The login risk assessment module collects the user's historical login time, login frequency, login location and device type data based on multi-terminal user activity data, compares the user's current login time, login frequency, login location and device type with historical behavior records, analyzes behavioral deviations, calculates risk scores, and obtains behavioral risk score results; The authentication measure dynamic adjustment module dynamically adjusts the user's authentication factors based on the behavior risk scoring result, adjusts the required authentication measures according to the set security threshold, and generates a dynamic authentication configuration; The identity authentication module receives the face image, verification sound and fingerprint authentication information submitted by the user through the camera based on the dynamic authentication configuration, authenticates the user's identity, and obtains the authentication result; The token validity period adjustment module binds the user's real-person registration information to the user token based on the behavior risk score result and the authentication verification result, and adjusts the validity period of the user token according to the risk score to obtain token validity period adjustment information; Based on the token validity period adjustment information, the access management module verifies the encrypted signature and status of the user token when the user accesses the downstream system. After verification, it parses the user identity and permission data in the token, uniformly authorizes the user to access the downstream system, and records the data to obtain access management information.

Images