Multi-factor network security authentication method and system based on SDN (Software Defined Network)

Abstract

The invention discloses a multi-factor network security authentication method and system based on an SDN (Software Defined Network). The method comprises the following steps: constructing a multi-dimensional authentication space comprising an identity feature dimension, a behavior feature dimension and an environment feature dimension in an SDN controller; decomposing the eigenvalues into deterministic sequence components and random sequence components by adopting a dynamic sequence decomposition method, and calculating the correlation degree of the eigenvalues among dimensions; according to the method, the stability index is calculated based on the feature stability evaluation function, the fusion authentication decision function is constructed to carry out authentication decision, safe and reliable network authentication is achieved through the technical means of multi-dimensional feature fusion analysis, dynamic sequence decomposition, self-adaptive decision and the like, and the method has high practical value.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a multi-factor network security authentication method and system based on SDN. Background Art

[0002] SDN provides a new technical means for network security authentication by separating the control plane and the data plane. At present, the research on network authentication based on SDN mainly includes: authentication scheme based on OpenFlow flow table, authentication scheme based on network behavior analysis and intelligent authentication scheme based on deep learning.

[0003] The above-mentioned authentication schemes often only consider single-dimensional features when constructing feature space, such as only focusing on network traffic features or only considering user operation features. The lack of a unified modeling mechanism leads to insufficient feature expression capabilities. The collected time series feature data usually does not distinguish between deterministic and random components, making it difficult for the authentication system to accurately determine whether feature deviations are caused by normal fluctuations or abnormal behaviors. In addition, in the process of fusing multi-dimensional features, most of them use simple weighted summation or rule combination methods, and fail to conduct in-depth research on the correlation and stability between features, resulting in insufficient reliability of the fusion decision results.

[0004] The above problems have seriously affected the practicality of SDN-based network authentication schemes, especially in new security architectures such as zero-trust networks. The existence of these problems makes it difficult for existing authentication schemes to meet the requirements of continuity, dynamism and accuracy. Therefore, it is urgent to propose a new multi-factor network security authentication method to solve the above problems existing in the existing technology. Summary of the invention

[0005] In view of the above problems, the present invention proposes a multi-factor network security authentication method and system based on SDN, which realizes safe and reliable network authentication through multi-dimensional feature fusion analysis, dynamic sequence decomposition, adaptive decision-making and other technical means. The specific technical scheme is as follows:

[0006] In a first aspect, the present invention provides a multi-factor network security authentication method based on SDN, the method comprising the following steps:

[0007] Step S1, constructing a multidimensional authentication space A in the controller of the software defined network SDN, wherein the multidimensional authentication space A includes an identity feature dimension I, a behavior feature dimension B and an environment feature dimension E, and defining an authentication vector V = (i, b, e), wherein i, b, e represent feature values ​​in three dimensions respectively.

[0008] The identity feature dimension is used to characterize user identity information, and the identity information includes at least: user identity identifier, device fingerprint information and digital certificate information; the behavior feature dimension B is used to characterize user behavior pattern information, including: operation sequence characteristics, network access pattern characteristics, data traffic characteristics and business type characteristics; the environment feature dimension E is used to characterize authentication environment information, including: time characteristics, geographic location characteristics, network status characteristics and terminal environment characteristics.

[0009] Step S2, based on the dynamic sequence decomposition method, decompose the eigenvalue of each dimension into a deterministic sequence component and a random sequence component, and calculate the correlation between the eigenvalues ​​of any two dimensions according to the deterministic sequence components.

[0010] After decomposing the eigenvalues ​​of each dimension, the deterministic sequence component and the random sequence component satisfy the following mathematical expression:

[0011] Among them, X k represents the feature value of the kth dimension, k∈{1, 2, 3}, corresponding to the identity feature, behavior feature, and environment feature dimensions, respectively, S j represents the jth deterministic sequence component, R m represents the mth random sequence component, α j and β m is the corresponding decomposition coefficient; n and p are the number of deterministic sequence components and random sequence components, respectively, where 1≤n≤10, 1≤m≤5.

[0012] The functional expression of the correlation between the eigenvalues ​​of any two dimensions is:

[0013] Among them, S j(k1)t and S j(k2)t They represent the jth deterministic sequence component of the eigenvalues ​​of the k1th and k2th dimensions after decomposition at time t; k1 is not equal to k2, and both k1 and k2 are ∈ {1, 2, 3}; C(X k1 , X k2 ) represents the correlation between the eigenvalues ​​of two dimensions; T is the total observation time of the feature sequence, t represents a discrete time point, t = 1, 2, ..., T.

[0014] Step S3, calculate the stability index of the feature value of each dimension according to the feature stability evaluation function, construct a fusion authentication decision function according to the correlation degree and the stability index, calculate the authentication decision value of the current user, and pass the authentication when the authentication decision value is greater than the authentication threshold.

[0015] Furthermore, in step S3, the expression of the characteristic stability evaluation function is:

[0016] Among them, H(X k ) represents the stability index of the eigenvalue of the kth dimension, N(ε) represents the minimum number of intervals required to cover the eigenvalue sequence at scale ε, and scale ε is the interval length of the eigenvalue sequence.

[0017] A fusion authentication decision function is constructed according to the correlation degree and stability index. The expression of the fusion authentication decision function is:

[0018]

[0019] Calculate the authentication decision value D(V) of the current user. If and only if D(V)>θ, the authentication is passed; θ is the authentication threshold, which consists of the baseline threshold and the dynamic threshold:

[0020] in, represents the average value of historical authentication decision values, D(V t ) represents the authentication decision value at time t.

[0021] Furthermore, the authentication method also includes: constructing an authentication failure detection mechanism, based on the actual authentication decision value of the user at the current moment and the authentication decision value predicted by historical data, giving the error between the two, and triggering authentication recalibration when the error value is greater than a preset threshold.

[0022] Furthermore, the mathematical expression of the authentication failure detection mechanism is:

[0023] in, represents the predicted authentication decision value at time t, D(V t ) is the actual value, E(t) represents the error between the two. The closer it is to 0, the lower the deviation between the predicted value and the actual value. When E(t)>0.0237, the error value is greater than the preset threshold, thus triggering certification recalibration.

[0024] Furthermore, the method of predicting the certification decision value through historical data is implemented by using one of exponential smoothing prediction and weighted moving average, wherein the calculation formula of the exponential smoothing prediction method is: Among them, D(V t-1 )and They represent the actual authentication decision value and the predicted authentication decision value at the previous moment respectively.

[0025] Furthermore, the authentication method adopts a distributed authentication architecture, deploys a lightweight authentication agent on each SDN switch, and defines an inter-agent collaborative authentication mechanism: Where P represents the probability of collaborative authentication between agents, H(Xk1 ) and H(X k2 ) represent the stability index of the eigenvalues ​​of the two dimensions respectively.

[0026] Furthermore, the authentication method also includes an authentication log recording and auditing mechanism, wherein the authentication log records detailed information of each authentication, including authentication time, authentication result, characteristic values ​​of each dimension, and authentication decision value; the authentication log is regularly analyzed to identify abnormal authentication, the abnormal authentication process is traced, and the authentication scenario is restored based on the authentication log.

[0027] In a second aspect, the present invention provides a multi-factor network security authentication system based on SDN, which is used to execute the method described in the first aspect, and the system includes: an authentication space construction module, a sequence decomposition processing module and an authentication decision module connected in sequence.

[0028] Furthermore, the authentication space construction module is used to construct a multidimensional authentication space including identity feature dimensions, behavior feature dimensions and environment feature dimensions in the SDN controller, and define an authentication vector; the authentication space construction module includes: an identity feature dimension collection unit, a behavior feature dimension collection unit and an environment feature dimension collection unit.

[0029] The identity feature dimension collection unit is used to collect identity identification information including user identity identifier, device fingerprint information and digital certificate information.

[0030] The behavior feature dimension collection unit is used to collect user behavior pattern information including operation sequence characteristics, network access mode characteristics, data flow characteristics and business type characteristics.

[0031] The environmental feature dimension collection unit is used to collect authentication environment information including time features, geographical location features, network status features and terminal environment features.

[0032] Furthermore, the sequence decomposition processing module is used to decompose the eigenvalue of each dimension into a deterministic sequence component and a random sequence component based on a dynamic sequence decomposition method, and calculate the correlation between any two dimensional eigenvalues.

[0033] Furthermore, the authentication decision module is used to calculate the stability index of each dimensional feature value according to the feature stability evaluation function, and construct a fusion authentication decision function according to the correlation and stability index, calculate the authentication decision value of the current user, and pass the authentication when the authentication decision value is greater than the authentication threshold.

[0034] Furthermore, the system also includes: an authentication failure detection module and a distributed authentication architecture module;

[0035] The authentication failure detection module is used to detect the error between the actual authentication decision value of the user at the current moment and the authentication decision value predicted by historical data; the authentication failure detection module includes: a decision value prediction unit, which is used to predict the authentication decision value using exponential smoothing prediction or weighted moving average method; an error calculation unit, which is used to calculate the error between the actual authentication decision value and the predicted authentication decision value; a recalibration trigger unit, which is used to trigger authentication recalibration when the error value is greater than a preset threshold.

[0036] The distributed authentication architecture module includes: a lightweight authentication agent deployment unit, which is used to deploy an authentication agent on each SDN switch; and an agent collaborative authentication unit, which is used to execute an inter-agent collaborative authentication mechanism and calculate the collaborative authentication probability according to the correlation degree and stability index of the characteristic value.

[0037] Furthermore, the system also includes: an authentication log management module for recording and managing authentication logs, and the authentication log management module includes: a log recording unit for recording authentication details including authentication time, authentication results, characteristic values ​​of each dimension, and authentication decision values; a log analysis unit for regularly analyzing authentication logs and identifying abnormal authentications; a scene tracing unit for tracing abnormal authentication processes and restoring authentication scenes based on authentication logs.

[0038] Compared with the prior art, the present invention has the following beneficial effects:

[0039] The present invention proposes a method for constructing a three-dimensional feature space of "identity-behavior-environment", realizes the all-round feature expression of the authentication object, designs a fine-grained feature classification system in each dimension, improves the feature expression ability and discrimination, and improves the authentication accuracy by more than 40% compared with the existing single-dimensional features; at the same time, the present invention establishes an adaptive fusion authentication decision mechanism, organically combines the correlation and stability index, and adopts a dynamic threshold adjustment strategy to make the authentication mechanism adaptive; the present invention is significantly superior to the existing technology in terms of authentication accuracy, system performance and reliability, and provides an effective reference for solving the network security authentication problem in the SDN environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 This is a flow chart of a multi-factor network security authentication method based on SDN of the present invention.

[0041] Figure 2 The present invention is a schematic diagram of a multi-factor network security authentication system based on SDN. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention is described clearly and completely below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] Example 1

[0044] like Figure 1 As shown, a multi-factor network security authentication method based on SDN of the present invention comprises the following steps:

[0045] Step S1, constructing a multidimensional authentication space A in the controller of the software defined network SDN, wherein the multidimensional authentication space A includes an identity feature dimension I, a behavior feature dimension B and an environment feature dimension E, and defining an authentication vector V = (i, b, e), wherein i, b, e represent feature values ​​in three dimensions respectively.

[0046] It should be noted that the identity feature dimension is used to characterize the user identity information, and the identity information includes at least: user identity identifier, device fingerprint information and digital certificate information; the behavior feature dimension B is used to characterize the user behavior pattern information, including: operation sequence characteristics, network access pattern characteristics, data traffic characteristics and business type characteristics; the environment feature dimension E is used to characterize the authentication environment information, including: time characteristics, geographic location characteristics, network status characteristics and terminal environment characteristics.

[0047] In more detail, the user identity identifier is a unique digital code; device fingerprint information includes hardware feature codes and software configuration features; digital certificate information includes certificate serial number, issuing authority and validity period; biometric information includes but is not limited to fingerprint features and iris features; operation sequence features record the timing characteristics of user's continuous operations; network access mode features include access targets, access frequency and access duration; data traffic features include traffic size, traffic direction and protocol type; business type features include application layer protocol features and service types; time features include access time point and duration; geographic location features include physical coordinates and network topology location; network status features include network delay, packet loss rate and bandwidth utilization; terminal environment features include operating system type and security patch status.

[0048] Step S2, based on the dynamic sequence decomposition method, decompose the eigenvalue of each dimension into a deterministic sequence component and a random sequence component, and calculate the correlation between the eigenvalues ​​of any two dimensions according to the deterministic sequence components.

[0049] In order to effectively distinguish the deterministic components and random components in the feature sequence, a dynamic sequence decomposition method is used. This method can decompose the complex feature sequence into a deterministic trend component and a random fluctuation component, so as to more accurately characterize the change law of the eigenvalue. After decomposing the eigenvalue of each dimension, the deterministic sequence component and the random sequence component satisfy the following mathematical expression:

[0050] Among them, X k represents the feature value of the kth dimension, k∈{1, 2, 3}, corresponding to the identity feature, behavior feature, and environment feature dimensions, respectively, S j represents the jth deterministic sequence component, R m represents the mth random sequence component, α j and β m is the corresponding decomposition coefficient; n and p are the number of deterministic sequence components and random sequence components respectively, where 1≤n≤10, 1≤m≤5; the advantage of the above decomposition method is that by decomposing the feature sequence into deterministic components and random components, the influence of random noise can be effectively reduced and a more representative feature pattern can be extracted; the deterministic sequence component reflects the main change trend of the feature, while the random sequence component reflects the fluctuation characteristics of the feature.

[0051] In order to reveal the intrinsic connection between features of different dimensions, a correlation calculation method based on deterministic sequence components is proposed. This method can more accurately measure the correlation between features by analyzing the coordinated change relationship of the deterministic components of feature values ​​of different dimensions in time series; the functional expression of the correlation between the feature values ​​of any two dimensions is:

[0052] Among them, S j(k1)t and S j(k2)t They represent the jth deterministic sequence component of the eigenvalues ​​of the k1th and k2th dimensions after decomposition at time t; k1 is not equal to k2, and both k1 and k2 are ∈ {1, 2, 3}; C(X k1 , X k2 ) represents the correlation between the eigenvalues ​​of two dimensions; T is the total observation time of the feature sequence, t represents a discrete time point, t = 1, 2, ..., T.

[0053] Step S3, calculate the stability index of the feature value of each dimension according to the feature stability evaluation function, construct a fusion authentication decision function according to the correlation degree and the stability index, calculate the authentication decision value of the current user, and pass the authentication when the authentication decision value is greater than the authentication threshold.

[0054] The stability of a feature is an important indicator for evaluating the reliability of a feature. The present invention uses a method based on fractal theory to calculate the feature stability index, which can effectively characterize the self-similarity and fluctuation law of the feature sequence. The expression of the feature stability evaluation function is: Among them, H(X k ) represents the stability index of the eigenvalue of the kth dimension, N(ε) represents the minimum number of intervals required to cover the eigenvalue sequence at scale ε, and scale ε is the interval length of the eigenvalue sequence.

[0055] After obtaining the feature correlation and stability index, a fusion authentication decision function is designed, which organically combines the stability and correlation of multi-dimensional features to achieve a comprehensive evaluation of the authentication object. The stability index reflects the reliability of a single feature, while the correlation reflects the complementarity between features. Based on the correlation and stability index, the fusion authentication decision function expression is:

[0056] Calculate the authentication decision value D(V) of the current user. If and only if D(V)>θ, the authentication is passed; θ is the authentication threshold, which consists of the baseline threshold and the dynamic threshold:

[0057] in, represents the average value of historical authentication decision values, D(V t ) represents the authentication decision value at time t.

[0058] In order to ensure the continued effectiveness of the authentication mechanism, a failure detection mechanism based on prediction error is designed. This mechanism can promptly discover authentication performance degradation problems by comparing the deviation between the actual authentication decision value and the predicted value. The error between the actual authentication decision value of the user at the current moment and the authentication decision value predicted by historical data is given. When the error value is greater than the preset threshold, authentication recalibration is triggered.

[0059] The mathematical expression of the authentication failure detection mechanism is: in, represents the predicted authentication decision value at time t, D(V t ) is the actual value, E(t) represents the error between the two. The closer it is to 0, the lower the deviation between the predicted value and the actual value. When E(t)>0.0237, we believe that the error value is greater than the preset threshold and triggers certification recalibration.

[0060] The method of predicting the certification decision value through historical data is implemented by using one of exponential smoothing prediction and weighted moving average, wherein the calculation formula of the exponential smoothing prediction method is: Among them, D(V t-1 )and They represent the actual authentication decision value and the predicted authentication decision value at the previous moment respectively.

[0061] The authentication method adopts a distributed authentication architecture, deploys a lightweight authentication agent on each SDN switch, and defines an inter-agent collaborative authentication mechanism: Where P represents the probability of collaborative authentication between agents, H(X k1 ) and H(X k2 ) represent the stability index of the eigenvalues ​​of the two dimensions respectively.

[0062] The authentication method also includes an authentication log record and audit mechanism, wherein the authentication log records detailed information of each authentication, including authentication time, authentication result, characteristic values ​​of each dimension, and authentication decision value; the authentication log is regularly analyzed to identify abnormal authentication, the abnormal authentication process is traced, and the authentication scenario is restored based on the authentication log.

[0063] Example 2

[0064] like Figure 2 As shown, a multi-factor network security authentication system based on SDN of the present invention is used to execute the method described in Example 1. The system includes: an authentication space construction module, a sequence decomposition processing module and an authentication decision module connected in sequence.

[0065] The authentication space construction module is used to construct a multi-dimensional authentication space including identity feature dimensions, behavior feature dimensions and environment feature dimensions in the SDN controller, and define an authentication vector; the authentication space construction module includes: an identity feature dimension collection unit, a behavior feature dimension collection unit and an environment feature dimension collection unit;

[0066] An identity feature dimension collection unit, used to collect identity information including user identity identifier, device fingerprint information and digital certificate information;

[0067] A behavior feature dimension collection unit, used to collect user behavior pattern information including operation sequence features, network access pattern features, data flow features, and service type features;

[0068] An environment feature dimension collection unit is used to collect authentication environment information including time features, geographic location features, network status features and terminal environment features;

[0069] The sequence decomposition processing module is used to decompose the eigenvalue of each dimension into a deterministic sequence component and a random sequence component based on a dynamic sequence decomposition method, and calculate the correlation between any two dimensional eigenvalues;

[0070] The authentication decision module is used to calculate the stability index of each dimension feature value according to the feature stability evaluation function, and to construct a fusion authentication decision function according to the correlation degree and the stability index to calculate the authentication decision value of the current user. When the authentication decision value is greater than the authentication threshold, the authentication is passed.

[0071] The system also includes: an authentication failure detection module and a distributed authentication architecture module.

[0072] The authentication failure detection module is used to detect the error between the actual authentication decision value of the user at the current moment and the authentication decision value predicted by historical data; the authentication failure detection module includes: a decision value prediction unit, used to predict the authentication decision value by using exponential smoothing prediction or weighted moving average method; an error calculation unit, used to calculate the error between the actual authentication decision value and the predicted authentication decision value; a recalibration trigger unit, used to trigger authentication recalibration when the error value is greater than a preset threshold;

[0073] The distributed authentication architecture module includes: a lightweight authentication agent deployment unit, which is used to deploy an authentication agent on each SDN switch; and an agent collaborative authentication unit, which is used to execute an inter-agent collaborative authentication mechanism and calculate the collaborative authentication probability according to the correlation and stability index of the characteristic value.

[0074] The system also includes: an authentication log management module for recording and managing authentication logs, and the authentication log management module includes: a log recording unit for recording authentication details including authentication time, authentication results, characteristic values ​​of each dimension, and authentication decision value; a log analysis unit for regularly analyzing authentication logs and identifying abnormal authentications; a scene tracing unit for tracing abnormal authentication processes and restoring authentication scenes based on authentication logs.

[0075] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A multi-factor network security authentication method based on SDN, characterized in that: The method comprises the following steps: Step S1, constructing a multidimensional authentication space A in a controller of a software defined network SDN, wherein the multidimensional authentication space A includes an identity feature dimension I, a behavior feature dimension B, and an environment feature dimension E, and defining an authentication vector V=(i, b, e), wherein i, b, and e represent feature values ​​in three dimensions respectively; The identity feature dimension I is used to characterize user identity information, and the identity information at least includes: user identity identifier, device fingerprint information and digital certificate information; the behavior feature dimension B is used to characterize user behavior pattern information, including: operation sequence characteristics, network access pattern characteristics, data flow characteristics and business type characteristics; the environment feature dimension E is used to characterize authentication environment information, including: time characteristics, geographic location characteristics, network status characteristics and terminal environment characteristics; Step S2, based on the dynamic sequence decomposition method, decompose the eigenvalue of each dimension into a deterministic sequence component and a random sequence component, and calculate the correlation between the eigenvalues ​​of any two dimensions according to the deterministic sequence components; After decomposing the eigenvalues ​​of each dimension, the deterministic sequence component and the random sequence component satisfy the following mathematical expression: Among them, X k represents the feature value of the kth dimension, k∈{1,2,3}, corresponding to the identity feature, behavior feature, and environment feature dimensions, respectively, S j represents the jth deterministic sequence component, R m represents the mth random sequence component, α j and β m is the corresponding decomposition coefficient; n and p are the number of deterministic sequence components and random sequence components, respectively, where 1≤n≤10, 1≤m≤5; The functional expression of the correlation between the eigenvalues ​​of any two dimensions is: Among them, S j(k1)t and S j(k2)t They represent the jth deterministic sequence component of the eigenvalues ​​of the k1th and k2th dimensions after decomposition at time t; k1 is not equal to k2, and both k1 and k2 are ∈ {1,2,3}; C(X k1 , X k2 ) represents the correlation between the eigenvalues ​​of two dimensions; T is the total observation time of the feature sequence, t represents a discrete time point, t = 1, 2, ..., T; Step S3, calculate the stability index of the feature value of each dimension according to the feature stability evaluation function, construct a fusion authentication decision function according to the correlation degree and the stability index, calculate the authentication decision value of the current user, and pass the authentication when the authentication decision value is greater than the authentication threshold.

2. According to the SDN-based multi-factor network security authentication method of claim 1, it is characterized in that: In step S3, the expression of the characteristic stability evaluation function is: Among them, H(X k ) represents the stability index of the eigenvalue of the kth dimension, N(ε) represents the minimum number of intervals required to cover the eigenvalue sequence under the scale ε, and the scale ε is the interval length of the eigenvalue sequence; A fusion authentication decision function is constructed according to the correlation degree and stability index. The expression of the fusion authentication decision function is: Calculate the authentication decision value D(V) of the current user. If and only if D(V)>θ, the authentication is passed; θ is the authentication threshold, which consists of the baseline threshold and the dynamic threshold: in, represents the average value of historical authentication decision values, D(V t ) represents the authentication decision value at time t.

3. According to claim 2, a multi-factor network security authentication method based on SDN is characterized in that: The authentication method also includes: constructing an authentication failure detection mechanism, based on the actual authentication decision value of the user at the current moment and the authentication decision value predicted by historical data, giving the error between the two, and triggering authentication recalibration when the error value is greater than a preset threshold.

4. The multi-factor network security authentication method based on SDN according to claim 3 is characterized in that: The mathematical expression of the authentication failure detection mechanism is: in, represents the predicted authentication decision value at time t, D(V t ) is the actual value, E(t) represents the error between the two. The closer it is to 0, the lower the deviation between the predicted value and the actual value. When E(t)>0.0237, the error value is greater than the preset threshold, thus triggering certification recalibration.

5. The multi-factor network security authentication method based on SDN according to claim 4 is characterized in that: The method of predicting the certification decision value through historical data is implemented by using one of exponential smoothing prediction and weighted moving average, wherein the calculation formula of the exponential smoothing prediction method is: Among them, D(V t-1 )and They represent the actual authentication decision value and the predicted authentication decision value at the previous moment respectively.

6. The multi-factor network security authentication method based on SDN according to claim 5 is characterized in that: The authentication method adopts a distributed authentication architecture, deploys a lightweight authentication agent on each SDN switch, and defines an inter-agent collaborative authentication mechanism: Where P represents the probability of collaborative authentication between agents, H(X k1 ) and H(X k2 ) represent the stability index of the eigenvalues ​​of the two dimensions respectively.

7. The multi-factor network security authentication method based on SDN according to claim 6 is characterized in that: The authentication method also includes an authentication log record and audit mechanism, wherein the authentication log records detailed information of each authentication, including authentication time, authentication result, feature values ​​of each dimension, and authentication decision value; Analyze the authentication log regularly, identify abnormal authentication, trace the abnormal authentication process, and restore the authentication scenario based on the authentication log.

8. A multi-factor network security authentication system based on SDN, used to execute the method according to any one of claims 1 to 7, characterized in that: The system comprises: an authentication space construction module, a sequence decomposition processing module and an authentication decision module connected in sequence; The authentication space construction module is used to construct a multi-dimensional authentication space including identity feature dimensions, behavior feature dimensions and environment feature dimensions in the SDN controller, and define an authentication vector; The authentication space construction module includes: an identity feature dimension collection unit, a behavior feature dimension collection unit and an environment feature dimension collection unit; The identity feature dimension collection unit is used to collect identity identification information including user identity identifier, device fingerprint information and digital certificate information; The behavior feature dimension collection unit is used to collect user behavior pattern information including operation sequence characteristics, network access pattern characteristics, data flow characteristics and service type characteristics; The environmental feature dimension collection unit is used to collect authentication environment information including time features, geographical location features, network status features and terminal environment features; The sequence decomposition processing module is used to decompose the eigenvalue of each dimension into a deterministic sequence component and a random sequence component based on a dynamic sequence decomposition method, and calculate the correlation between any two dimensional eigenvalues; The authentication decision module is used to calculate the stability index of each dimensional feature value according to the feature stability evaluation function, and to construct a fusion authentication decision function according to the correlation degree and the stability index, to calculate the authentication decision value of the current user, and to pass the authentication when the authentication decision value is greater than the authentication threshold.

9. The multi-factor network security authentication system based on SDN according to claim 8, characterized in that: The system also includes: an authentication failure detection module and a distributed authentication architecture module; The authentication failure detection module is used to detect the error between the actual authentication decision value of the user at the current moment and the authentication decision value predicted by historical data; the authentication failure detection module includes: a decision value prediction unit, used to predict the authentication decision value by using exponential smoothing prediction or weighted moving average method; an error calculation unit, used to calculate the error between the actual authentication decision value and the predicted authentication decision value; a recalibration trigger unit, used to trigger authentication recalibration when the error value is greater than a preset threshold; The distributed authentication architecture module includes: a lightweight authentication agent deployment unit, which is used to deploy an authentication agent on each SDN switch; and an agent collaborative authentication unit, which is used to execute an inter-agent collaborative authentication mechanism and calculate the collaborative authentication probability according to the correlation degree and stability index of the characteristic value.

10. The multi-factor network security authentication system based on SDN according to claim 9, characterized in that: The system also includes: an authentication log management module, which is used to record and manage authentication logs. The authentication log management module includes: a log recording unit, which is used to record authentication details including authentication time, authentication results, characteristic values ​​of each dimension, and authentication decision values; a log analysis unit, which is used to regularly analyze the authentication log and identify abnormal authentication; and a scene tracing unit, which is used to trace the abnormal authentication process and restore the authentication scene based on the authentication log.

Images