User identity verification method and system for communication software

Abstract

The invention relates to the technical field of identity authentication, in particular to a user identity authentication method and system for communication software, which comprises the following steps of: acquiring an identity authentication request data packet in a communication protocol, decoding identity authentication field information, extracting a fixed field, a dynamic field and a variable field, and calculating a data bit offset value; and carrying out structure mapping and obtaining an identity verification field mapping result. According to the invention, through deep analysis of the identity verification request data packet, extraction and mapping of the identity verification field structure, improvement of the analysis accuracy and construction of the matching feature matrix, verification of the data format and content is more targeted, the possibility that abnormal data bypasses verification is reduced, the session continuity is evaluated in combination with historical session data, and the verification efficiency is improved. The adaptability of identity authentication to dynamic behaviors is improved, context consistency is calculated, keyword deviation degree judgment is performed, identity authentication strength is adjusted, identity authentication dynamically adapts to user behavior changes, interaction experience is improved, and safety is enhanced.

Description

Technical Field

[0001] The present invention relates to the technical field of identity authentication, and in particular to a user identity authentication method and system for communication software. Background Art

[0002] The field of identity authentication technology includes methods for confirming and managing user identities. The core content involves encryption and decryption technology based on cryptography, biometric identification methods, multi-factor identity authentication mechanisms, and secure communication verification methods based on network protocols. It systematically covers the collection, storage, comparison, and verification process of user identity data. In a computer network environment, identity authentication technology is widely used in many fields such as personal device unlocking, online payment, network service access control, and data security transmission. Common identity authentication methods include password-based authentication, token-based authentication, biometric authentication, and digital certificate authentication based on public key infrastructure. With the development of information technology, identity authentication technology continues to evolve to improve security and user experience.

[0003] Among them, the user identity verification method of communication software refers to the identity confirmation method for user access rights and data security of network communication software, which mainly covers identity verification based on user credentials, user identification based on device fingerprints, and secure communication mechanisms based on encryption protocols. Its specific implementation methods usually include using hash functions to encrypt and verify the identity information entered by the user, using key exchange protocols to establish a secure communication channel between the client and the server, and verifying user behavior based on specific identity verification protocols. In addition, it also involves the use of biometric information combined with a time synchronization mechanism to improve the reliability of identity verification, and verifying user identities step by step through protocols to ensure security in different communication environments.

[0004] In the identity authentication process of existing communication software, when parsing the identity authentication data, it mainly relies on a single field or a limited combination of fields for verification, and lacks the correlation analysis of the overall structure of the data packet, which leads to easy misjudgment when the field layout changes or some fields are forged. The legitimacy of the identity authentication request relies on static rule matching, and fails to effectively detect the order and consistency of the field arrangement, allowing attackers to interfere with the verification logic and circumvent security verification by adjusting the field structure. The identity authentication method is usually based on independent authentication of a single request, lacks the ability to analyze historical sessions, and is difficult to identify abnormal changes in user behavior patterns, allowing attackers to use low-frequency and multiple attempts to evade detection. The context analysis is relatively extensive, and the ability to identify changes in user input content is insufficient. It fails to effectively distinguish between normal user behavior and malicious tampering behavior, resulting in some fraudulent requests being difficult to accurately intercept, reducing overall security. Summary of the invention

[0005] The purpose of the present invention is to solve the shortcomings in the prior art and to propose a user identity authentication method for communication software.

[0006] In order to achieve the above object, the present invention adopts the following technical solution: a user identity verification method for communication software, comprising the following steps: S1: Obtain the authentication request data packet in the communication protocol, decode the authentication field information, extract the fixed field, dynamic field and variable field, calculate the data bit offset value, perform structure mapping and obtain the authentication field mapping result; S2: According to the identity authentication field mapping result, the matching features of the fixed fields are calculated, the data packet format is sequenced and verified, field matching rules are established, the dynamic field data range is parsed, the time span value of the timestamp field is calculated, whether the timestamp field meets the time matching reference value is determined, the correlation matching degree between the variable fields is calculated, and the identity authentication field matching feature matrix is ​​comprehensively established; S3: Based on the identity authentication field matching feature matrix, verify the field arrangement order of the identity authentication request data, calculate the field matching consistency value, compare the identity authentication field mapping result, calculate the legitimacy of the identity authentication request, and output the identity authentication request legitimacy data; S4: Read the identity authentication request legitimacy data, parse the current session data, calculate the correlation between the current session and the historical session data, determine whether there is a topic change, and obtain the session identity authentication continuity analysis result.

[0007] As a further solution of the present invention, the identity authentication field mapping result includes field offset value, field structure relationship, and field decoding information; the identity authentication field matching feature matrix includes fixed field matching features, dynamic field data range, variable field association matching degree, and timestamp matching benchmark; the identity authentication request legitimacy data includes field arrangement order consistency, field matching consistency value, storage offset matching status, and legitimacy evaluation result; the session identity authentication continuity analysis result includes message content correlation, message sequence matching degree, time feature consistency, and conversation topic changes.

[0008] As a further solution of the present invention, the specific steps of S1 are: S111: Obtain an identity authentication request data packet in the communication protocol, decode the identity authentication field information, extract the fixed fields, dynamic fields and variable fields associated with the identity authentication, calculate the data bit offset value, and obtain the identity authentication field position information; S112: Based on the identity authentication field location information, perform identity authentication field structure mapping, analyze the relative offset of each field in the data packet and the correlation between the fields, and use the formula: ; Calculate the offset error value for each authentication field , get the authentication field mapping error data, where represents the authentication field mapping error, Representative The calculated offset of the field, Representative The theoretical offset of the field, Representative The standard offset unit for each field. Representative The importance weight of each field, Represents the total number of authentication fields; S113: Based on the identity authentication field mapping error data, adjust the structural relationship of the identity authentication field, match the field mapping rule, and obtain the identity authentication field mapping result.

[0009] As a further solution of the present invention, the specific steps of S2 are: S211: Based on the identity authentication field mapping result, a matching feature is calculated for a fixed field, a field value of the fixed field is extracted, and matching patterns are counted to determine a fixed field matching rate, and a fixed field matching feature is obtained; S212: According to the fixed field matching feature, a field matching rule is established according to the protocol header information, the dynamic field data range is parsed, and the time span value of the timestamp field is counted, using the formula: ; Calculate the time matching deviation value , combined with the time interval of normal identity authentication requests, the time matching benchmark value is set, and whether the timestamp field meets the time matching benchmark value is determined to obtain the time matching deviation data, where, Representative The time value of the timestamp field, Represents the time value of the previous timestamp field, Represents the number of timestamp fields, The number of time points representing the calculation time span; S213: Based on the time matching deviation data, the correlation matching degree between the variable fields is calculated, and the matching features of the fixed fields and the dynamic fields are combined to comprehensively establish the identity authentication field matching feature matrix.

[0010] As a further solution of the present invention, the specific steps of S3 are: S311: Based on the identity authentication field matching feature matrix, verify the field arrangement order of the identity authentication request data, analyze the storage order of the fields, check the offset of the field arrangement, and obtain the field order offset record; S312: Record the offset according to the field sequence, and compare whether the identity verification field storage offset is consistent with the identity verification field mapping result, using the formula: ; Calculate field matching consistency metrics , and combined with the threshold to set the matching standard, the identity authentication field matching analysis results are obtained, where Representative The storage location of the fields, Representative The standard storage offset position of the field, Representative The storage step of the fields, Represents the total number of authentication fields; S313: Based on the identity authentication field matching analysis result, analyze the legitimacy of the identity authentication request and output the identity authentication request legitimacy data.

[0011] As a further solution of the present invention, the specific steps of S4 are: S411: Read the identity authentication request legitimacy data, parse the current session data, extract the message content, message sequence and time characteristics, calculate the time interval between messages, transmission delay and data consistency, and obtain session time characteristic parameters; S412: Based on the session time characteristic parameter, it is determined whether there is a change in the topic of the conversation content before and after the current identity authentication request, using the formula: ; Calculate the output conversation topic consistency coefficient , analyze the correlation matching value between the current session and the historical session, and judge whether the topic has changed based on the threshold, where, The feature vector representing the current session message, Representative The feature vector of the historical conversation message, Represents the total number of messages involved in the calculation; S413: Based on the session subject consistency coefficient and in combination with the session time characteristic parameter, the session identity authentication continuity of the identity authentication request is comprehensively calculated to obtain a session identity authentication continuity analysis result.

[0012] As a further solution of the present invention, the method further includes S5; S5: Based on the session identity authentication continuity analysis result, calculate the context consistency value of the identity authentication request, determine the user keyword usage deviation, calculate the credibility of the authentication request, adjust the authentication strength, and re-perform user identity authentication.

[0013] As a further solution of the present invention, the specific steps of S5 are: S511: Based on the session identity authentication continuity analysis result, calculate the context consistency value of the identity authentication request, analyze the keyword distribution, semantic features and contextual relationship in the current session, extract context feature parameters, and obtain the context consistency value; S512: judging the user keyword usage deviation according to the context consistency value, calculating the semantic change range, and analyzing the keyword stability in combination with the historical session data, evaluating the context matching degree of the identity authentication request, and obtaining the credibility of the identity authentication request; S513: Based on the credibility of the identity authentication request, adjust the authentication strength of the identity authentication and perform user identity re-authentication.

[0014] A user identity authentication system for communication software, comprising: The authentication field mapping module obtains the authentication request data packet, decodes the authentication field, extracts the fixed, dynamic and variable fields, calculates the data bit offset value, completes the structure mapping, and obtains the authentication field mapping result; The identity authentication feature matching module calculates fixed field matching features, verifies the data packet format arrangement order, parses the dynamic field range, calculates the time span value, sets the time matching reference value, determines whether the timestamp meets the reference value, calculates the variable field association matching degree, and establishes the identity authentication field matching matrix based on the identity authentication field mapping result; The identity authentication legitimacy analysis module verifies the field arrangement order, calculates the matching consistency value, compares the field storage offset, calculates the request legitimacy, and obtains the identity authentication request legitimacy data based on the identity authentication field matching matrix; The session continuity detection module parses the session data, calculates the data relevance, determines the change of the conversation topic, and obtains the session identity authentication continuity analysis result according to the identity authentication request legitimacy data; The identity authentication credibility assessment module calculates the context consistency value, determines the keyword deviation, calculates the request credibility, adjusts the verification strength and re-authenticates the identity according to the session identity authentication continuity analysis result.

[0015] Compared with the prior art, the advantages and positive effects of the present invention are: In the present invention, through in-depth analysis of the identity authentication request data packet, the identity authentication field structure is extracted and mapped, so that the data formatting processing accurately matches the preset field characteristics, the parsing accuracy is improved, and according to the mapping results, a matching feature matrix is ​​constructed to make the verification of the data format and content more targeted, enhance the field structure consistency judgment, and reduce the possibility of abnormal data bypassing the verification. In combination with historical session data, the message content, sequence and time characteristics are analyzed, the continuity of the session is evaluated, and the adaptability of identity authentication to dynamic behavior is improved. Based on the context consistency calculation and keyword deviation judgment, the identity authentication strength is adjusted, so that the identity authentication can dynamically adapt to changes in user behavior, improve the interactive experience and enhance security. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a main step flow chart of the present invention; Figure 2 This is a flow chart of step S1 of the present invention; Figure 3 This is a flow chart of step S2 of the present invention; Figure 4 This is a flow chart of step S3 of the present invention; Figure 5 This is a flow chart of step S4 of the present invention; Figure 6 This is a flow chart of step S5 of the present invention. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0018] In the description of the present invention, it should be understood that the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, in the description of the present invention, "multiple" means two or more, unless otherwise clearly and specifically defined.

[0019] See also Figure 1 , a user identity authentication method for communication software, comprising the following steps: S1: Obtain the authentication request data packet in the communication protocol, decode the authentication field information, extract the fixed fields, dynamic fields and variable fields associated with the authentication, calculate the data bit offset value, perform authentication field structure mapping, and obtain the authentication field mapping result; S2: According to the authentication field mapping results, the matching features of fixed fields are calculated, the data packet format is sequenced and verified, field matching rules are established based on the protocol header information, the dynamic field data range is parsed, the time span value of the timestamp field is calculated, the time matching benchmark value is set according to the time interval of the normal authentication request, and whether the timestamp field meets the time matching benchmark value is determined, the correlation matching degree between the variable fields is calculated, and the authentication field matching feature matrix is ​​comprehensively established; S3: Based on the authentication field matching feature matrix, verify the field arrangement order of the authentication request data, calculate the field matching consistency value, compare whether the authentication field storage offset is consistent with the authentication field mapping result, calculate the legitimacy of the authentication request, and output the authentication request legitimacy data; S4: Read the legitimacy data of the identity authentication request, parse the current session data, extract the message content, message sequence and time characteristics, calculate the data correlation between the current session and the historical session, determine whether there is a change in the topic of the conversation content before and after the current identity authentication request, and obtain the session identity authentication continuity analysis result; S5: Based on the session authentication continuity analysis results, calculate the context consistency value of the authentication request, determine the user keyword usage deviation, calculate the credibility of the authentication request, adjust the authentication strength, and re-authenticate the user.

[0020] The authentication field mapping results include field offset values, field structure relationships, and field decoding information. The authentication field matching feature matrix includes fixed field matching features, dynamic field data ranges, variable field association matching degrees, and timestamp matching benchmarks. The authentication request legitimacy data includes field arrangement order consistency, field matching consistency values, storage offset matching conditions, and legitimacy assessment results. The session authentication continuity analysis results include message content correlation, message sequence matching, time feature consistency, and conversation topic changes.

[0021] See also Figure 2 , the S1 step is: S111: Obtain an identity authentication request data packet in the communication protocol, decode the identity authentication field information, extract the fixed fields, dynamic fields and variable fields associated with the identity authentication, calculate the data bit offset value, and obtain the identity authentication field position information; To obtain the identity authentication request data packet in the communication protocol, it is necessary to parse the overall structure of the data packet, including the protocol header, the payload part, and the additional fields. Assume that in actual applications, the total length of the identity authentication request data packet is 1024 bytes, of which the protocol header occupies 64 bytes and the rest is the data payload. Call the data packet parsing module to decode it and obtain the identity authentication field information. Assume that after parsing, it is found that the data packet contains three key fields: a fixed field (F), a dynamic field (D), and a variable field (V), which are located at different offset addresses of the data packet. For example, the F field is located at offset address 128, the D field is located at offset address 256, and the V field is located at offset address 384. The corresponding field lengths are 16 bytes, 32 bytes, and 48 bytes, respectively. Calculate the data bit offset value, that is, the offset of each field relative to the starting address of the data packet, which can be expressed as , , , further obtain the offset relationship between fields, that is, calculate the interval distance between fields, for example , ,These offset values ​​are used for the structure mapping of subsequent authentication fields, and finally the authentication field location information is obtained.

[0022] S112: Based on the identity authentication field location information, perform identity authentication field structure mapping, analyze the relative offset of each field in the data packet and the correlation between the fields, and use the formula: ; Calculate the offset error value for each authentication field , get the authentication field mapping error data, where represents the authentication field mapping error, Representative The calculated offset of the field, Representative The theoretical offset of the field, Representative The standard offset unit for each field. Representative The importance weight of each field, Represents the total number of authentication fields; Based on the location information of the authentication field, the authentication field structure is mapped. First, the relative offset of each field in the data packet is determined. Taking the F field as the reference, the offset of the D field and the V field relative to the F field is calculated as shown above. , , further calculate the correlation between each field, by analyzing the numerical variation characteristics between fields, for example, setting the value of the fixed field F to always be a preset identifier (such as 0xA5A5), and the value of the dynamic field D to be variable and dependent on the user's identity information, such as the hash summary , the variable field V is transformed according to the value of D, such as , assuming that the V field is stored in a specific encryption method, such as (K is the key), calculate the offset error of each field, assuming that the theoretical offset value is , , .

[0023] Combine the formula, substitute the actual value, and set the standard offset unit , weight , , The weight setting is based on the importance weight distribution of the fields. As a fixed field, the F field plays a fundamental role in the identity authentication process and must be accurate. Therefore, the weight is set to the highest value of 0.4. The D field and the V field are both dynamic parts. They are slightly less stable than the F field, but they have the same impact on the overall identity authentication structure. Therefore, the weight of both is set to 0.3. The change of this value is affected by the adjustment of the overall structure of the data packet. If the number of dynamic fields in the data packet increases, the weight of the D field will be relatively reduced to maintain a proportional distribution of 1. If the fixed field F involves other auxiliary fields due to protocol adjustment, its weight may be further increased to 0.5 to ensure that the accuracy of the fixed field takes precedence over the dynamic field. The calculation is as follows: ; Get the offset error value , indicating that the current field structure mapping error is zero, that is, all fields conform to the theoretical offset values, as shown in Table 1: Table 1 Authentication field offset calculation table As shown in Table 1, all fields are within the theoretical offset range, and the authentication field mapping error data is obtained.

[0024] S113: Based on the identity authentication field mapping error data, adjusting the structural relationship of the identity authentication field, matching the field mapping rule, and obtaining the identity authentication field mapping result; Based on the authentication field mapping error, adjust the structural relationship of the authentication field. If the mapping error exceeds the acceptable range, adjust the data storage format so that the field offset conforms to the theoretical value. For example, if the D field offset value is detected to change to 272 (theoretically 256), the error is 16 bytes. It is necessary to adjust the data packet storage structure, set the D field to realign to 256 offset, and match the final field mapping rule. The specific adjustment method includes recalculating the storage order between fields or adding padding bytes. Assume that the number of padding bytes added satisfies: ; Since a negative value indicates that the D field is in advance, the offset can be adjusted by inserting 16 bytes of padding data after the F field, as shown in Table 2 below: Table 2 Comparison table before and after field storage adjustment As shown in Table 2, after adjustment, the D field is successfully aligned to the theoretical offset 256, and the V field is correspondingly moved forward by 16 bytes, and finally the authentication field mapping result is obtained.

[0025] See also Figure 3 , the S2 step is: S211: Based on the identity authentication field mapping result, a matching feature is calculated for the fixed field, the field value of the fixed field is extracted, and matching patterns are counted to determine a matching rate of the fixed field, and a matching feature of the fixed field is obtained; Based on the authentication field mapping results, obtain the fixed fields and calculate the matching features. Fixed fields usually include information such as the identifier, version number, source address, and destination address of the protocol header. The number and arrangement of fixed fields of different protocols are different, so these fields need to be extracted and their occurrence frequency in the data packet is counted. By analyzing the distribution of these fields in legitimate authentication requests, a matching feature matrix of fixed fields can be constructed. Assuming that the fixed fields of a data packet include (A, B, C), the probability of their occurrence in different data packets is counted. For example, data packet 1 contains A, B, and C, data packet 2 contains A and B, and data packet 3 only contains C. The statistical matching probability is as follows: Table 3: Matching probability table As shown in Table 3, the matching probability reflects the distribution law of fixed fields in the data packet. In order to set the fixed field matching threshold, the probability statistics method is used to calculate the minimum probability requirement for data packet matching. The setting formula is as follows: ; set up To reduce the impact of low matching data.

[0026] Calculate the fixed field matching probability for each packet: Packet 1: ; Packet 2: ; Packet 3: ; Substitute into the formula to calculate: ; ; The calculation results show that the matching threshold is set to 0.6167, which means that the fixed field matching probability of the data packet must be greater than 61.67% to meet the identity authentication matching requirements. The setting basis of this value is the stability of the fixed field of the data packet. Usually, the matching probability fluctuates with the change of protocol version and the adjustment of data packet format. When it is lower than 61.67%, it means that the fixed field matching is unstable, and there may be abnormal protocol format or attack behavior. The matching degree above 61.67% is usually the credible range of normal protocol matching, and then the fixed field matching characteristics are obtained.

[0027] S212: According to the fixed field matching characteristics, the field matching rules are established according to the protocol header information, the dynamic field data range is parsed, and the time span value of the timestamp field is counted, using the formula: ; Calculate the time matching deviation value , combined with the time interval of normal identity authentication requests, the time matching benchmark value is set, and whether the timestamp field meets the time matching benchmark value is determined to obtain the time matching deviation data, where, Representative The time value of the timestamp field, Represents the time value of the previous timestamp field, Represents the number of timestamp fields, The number of time points representing the calculation time span; Call the fixed field matching feature, establish field matching rules based on the protocol header information, parse the dynamic field data range, and calculate the time span value of the timestamp field. In the authentication protocol, the timestamp field is used to record the sending and receiving time of the data packet, usually in milliseconds or seconds. In order to analyze the time span of the timestamp field, set the timestamp sequence of the data packet (unit: seconds) as follows: ; Use the formula to calculate the packet time span value: ; ; ; The time matching benchmark value is set based on the calculation result. For example, if the time interval of a normal authentication request is 3.0 seconds ± 0.5 seconds, the time matching benchmark value is ,The currently calculated time matching deviation value is 3.16, which meets the matching benchmark.

[0028] S213: Based on the time matching deviation data, the correlation matching degree between the variable fields is calculated, and the matching characteristics of the fixed fields and the dynamic fields are combined to comprehensively establish the identity authentication field matching feature matrix; Based on the time matching deviation value, the correlation matching degree between variable fields is calculated. Variable fields refer to fields in data packets that change over time or under specific conditions. For example, fields such as session IDs and encryption signatures of certain authentication requests need to be matched according to dynamic rules. In practical applications, session IDs of different data packets may have certain correlations. For example, the change pattern of session IDs can be used to calculate the matching degree through sequence analysis. The variable field set of a data packet is set as follows: ; Calculate the change matching degree of each field with its previous field. For example, assuming that a certain matching rule calculates the matching degree as follows: Table 4: Matching data As shown in Table 4, the matching degree of variable fields between different data packets is above 80%, which can be considered to be a high matching degree. The matching degree threshold is derived from the stability measurement of protocol field matching. In a general network environment, a matching degree below 80% indicates a large field change, which may be an abnormal data packet or attack behavior. A matching degree above 80% can be regarded as the feature matching range of a normal authentication request. Combining the matching features of fixed fields and dynamic fields, a comprehensive authentication field matching feature matrix is ​​established.

[0029] See also Figure 4 , the S3 step is: S311: Based on the identity authentication field matching feature matrix, verify the field arrangement order of the identity authentication request data, analyze the storage order of the fields, check the offset of the field arrangement, and obtain the field order offset record; Based on the authentication field matching feature matrix, in actual scenarios, the field arrangement order of the authentication request data packet needs to be executed according to the protocol specification. First, the field set of the data packet is extracted and compared according to the predetermined storage order. For example, if the user authentication request in a system contains fields such as user name, user ID, timestamp, session key, etc., these fields are read and extracted according to the protocol storage order, and the storage location of the field is calculated. The actual storage offset of each field is extracted through the index value of the storage address, as shown in Table 5. The table lists the field storage addresses and corresponding offsets of different requests. The offset degree of each field relative to the protocol standard storage order is further calculated. The calculation formula is as follows: ; in, Representative The offset of the field, Representative The actual storage address of the field, Representative The standard storage address of each field is shown in Table 5. Assuming that the user name field of a data packet is stored at address 1000 and the standard address is 980, the offset is After all field offsets are calculated, the offset of each field is counted to obtain the field sequence offset record.

[0030] Table 5 Field storage address and offset table As shown in Table 5, the storage offsets of different fields are different. A storage offset that is too large may cause the verification request to be invalid or abnormal. Subsequent steps need to be further processed based on this result.

[0031] S312: offset the record according to the field order, and compare whether the authentication field storage offset is consistent with the authentication field mapping result, using the formula: ; Calculate field matching consistency metrics , and combined with the threshold to set the matching standard, the identity authentication field matching analysis results are obtained, where Representative The storage location of the fields, Representative The standard storage offset position of the field, Representative The storage step of the fields, Represents the total number of authentication fields; According to the field order offset data, the matching consistency value of the field is further calculated, and the storage offset of the authentication field is compared to see whether it conforms to the authentication field mapping result. In the authentication system, the storage order of different fields should conform to the protocol specification as much as possible, otherwise it may cause verification failure. Therefore, it is necessary to calculate the matching consistency of each field, analyze it through multiple data packet samples, and count the offset of each field in different data packets, as shown in Table 5. Substitute it into the formula to calculate the matching consistency value.

[0032] Assume that 4 data packets are received, as shown in Table 5, and the field storage address of each data packet is different, calculate the sum of the square errors of the storage locations of each field, and normalize them to obtain the matching value, such as: ; The calculated match degree can be used to determine whether the order of data packet fields complies with the protocol storage specifications. The setting basis of the match degree threshold of 200 is the offset tolerance range of different fields in the protocol. Usually, the storage position of the field is allowed to have a certain amount of slight fluctuation. For example, an offset within 10% will not affect the parsing of the data packet, while exceeding this range may cause the data packet parsing to fail. Therefore, the threshold is determined based on the maximum acceptable error range of the fields in the data storage structure and varies with the type of data packet. For example, for key security fields (such as encryption keys and session tokens), the allowed offset range is smaller and the threshold can be set lower. If the match degree value is lower than the set threshold (for example, 200), it means that the field arrangement of the data packet is more in line with the standard. A higher match degree indicates that there is a large deviation in the field order.

[0033] Table 6 Storage addresses of different data packet fields As shown in Table 6, the field storage address of the data packet is slightly deviated, but it conforms to the protocol standard as a whole. The matching consistency value calculated further is used to analyze the degree of storage order deviation of the data packet, and finally the authentication field matching analysis result is obtained.

[0034] S313: Analyze the legitimacy of the identity authentication request based on the identity authentication field matching analysis result, and output the identity authentication request legitimacy data; Based on the authentication field matching analysis results, the legitimacy of the authentication request is calculated, and the authentication request legitimacy data is output. During the authentication process, a field matching threshold needs to be set. The matching threshold of 150 is set based on the system's tolerance range for different request types. For example, for standard authentication requests, the field sequence offset usually does not exceed 5%. If the matching value exceeds the threshold, it means that the field storage offset has exceeded the normal range preset by the protocol, which may involve tampering or malicious attacks. When calculating specifically, the threshold can be adjusted according to different user levels. For example, for ordinary user requests, the threshold is set to 150, while for administrator-level authentication requests, the matching tolerance range is lower, and the threshold can be set to 120. If the calculated matching is lower than the threshold, the request can be considered a legitimate authentication request, otherwise there may be an exception. In actual scenarios, the server will perform matching calculations on a large number of request data packets and compare the calculation results with the legitimacy threshold, such as: ; Since the match degree does not exceed the set threshold, the authentication request is not marked as suspicious. , the corresponding authentication request is marked as suspicious, and it is necessary to combine other security policies, such as user behavior analysis, historical request records, etc., to determine whether the request is valid, and finally output the legitimacy data of the authentication request for subsequent security policy processing.

[0035] See also Figure 5 , step S4 is: S411: Read the authentication request legitimacy data, parse the current session data, extract the message content, message sequence and time characteristics, calculate the time interval between messages, transmission delay and data consistency, and obtain the session time characteristic parameters; To read the legitimacy data of the identity authentication request, it is necessary to first obtain the legitimacy detection result in the identity authentication request data packet. The result comes from the comprehensive judgment of the matching degree of the identity authentication field and related information in the previous step. In actual application scenarios, the identity authentication requests of different devices at different time nodes can be obtained through the network traffic monitoring system, and the legitimacy tags can be extracted. For example, a server receives three identity authentication requests at 10:05, 10:07 and 10:12 respectively, of which the matching degree of the first two requests exceeds the threshold setting of 90%, and the matching degree of the third request is as low as 65%. It can be determined that the first two requests have high legitimacy, while the third request may have the risk of abnormal or illegal requests. Subsequently, to parse the current session data, it is necessary to extract data from the session where the current identity authentication request is located. The main extracted content includes message content, message sequence and time characteristics. In actual operation, for a specific application scenario, such as the identity authentication log in the financial transaction system, the operation records of the user's continuous login can be extracted. Assuming that a user requests to access account information at 10:01, transfers funds at 10:03, and queries transaction records at 10:05, it can be determined that the time characteristic of the session is short time. High-frequency access: If a user suddenly tries to modify key account information at 10:20, this operation may not match the short-term high-frequency access pattern mentioned above. Further analysis of the relevance of sessions is required. The time interval between messages can be calculated by recording the timestamp of each message and calculating the time difference between adjacent messages. For example, if a user's three consecutive request times are 10:01:05, 10:01:10, and 10:01:25, the time interval between the first two requests is 5 seconds, while the time interval between the second and third requests is 15 seconds. By calculating the average time interval and standard deviation, it can be determined whether the current Whether the session maintains a certain interactive rhythm, the transmission delay can be calculated by comparing the server and client timestamps. For example, if the client sends a request at 10:01:30 and the server receives and processes it at 10:01:32, the transmission delay of the request is 2 seconds. Data consistency can be measured by verifying the degree of data association between different messages in the session. For example, in an e-commerce trading platform, if the order amount submitted by the user during the purchase process is consistent with the amount in the payment request, the data consistency is high. Otherwise, an abnormal judgment is required. Combining the above analysis, the session time characteristic parameters are obtained.

[0036] S412: Based on the session time characteristic parameters, it is determined whether there is a change in the topic of the conversation content before and after the current identity authentication request, using the formula: ; Calculate the output conversation topic consistency coefficient , analyze the correlation matching value between the current session and the historical session, and determine whether the topic has changed based on the threshold, where, Representative The feature vector of the current session message, Representative The feature vector of the historical conversation message, Represents the total number of messages involved in the calculation; Based on the session time feature parameters, the data correlation between the current session and the historical session is calculated, and it is determined whether there is a change in the topic of the conversation content before and after the current identity authentication request. In actual application scenarios, the user's continuous email interaction mode can be analyzed for the internal email system of the enterprise. For example, an employee sent 5 emails on a certain working day, of which the first 4 were related to market analysis, and the fifth email suddenly involved the modification of financial data. In this case, there may be a change in the topic, and its correlation needs to be further analyzed. The time series similarity calculation method can be used to calculate the correlation of session data, taking into account the time distribution, content vector and keyword matching of the message. In the specific calculation, the text content of the message in the current session is first vectorized. Assuming that a session contains 3 messages, its vector representation is as follows: , , , the corresponding message vector in the historical session is expressed as , , ,in, , substitute the numerical value to calculate: ; The final calculation is The setting of the preset threshold is based on the statistical analysis of historical conversation data. The value varies with the similarity of conversation message content, the degree of message keyword matching, and the fluctuation of historical conversation patterns. After statistics of a large number of normal conversation data, the mean of the calculated conversation topic consistency coefficient is about 0.73, and the standard deviation is 0.12. Therefore, the threshold is set to 0.7, so that normal conversations can be effectively distinguished from abnormal conversations within the 99% confidence interval. The value is higher than 0.7, so it can be judged that the topic of this conversation is highly consistent with the historical conversation, and the conversation topic consistency coefficient is obtained.

[0037] S413: Based on the session subject consistency coefficient and in combination with the session time characteristic parameter, the session identity authentication continuity of the identity authentication request is comprehensively calculated to obtain the session identity authentication continuity analysis result; Based on the session topic consistency coefficient and combined with the session time feature parameters, the session authentication continuity of the authentication request is comprehensively calculated. In practical applications, for example, in a banking system, if a user continuously performs account inquiries, fund transfers, and credit card repayments in a short period of time, these operations usually belong to high-continuity sessions. However, if a fund transfer is performed first and then an attempt is made to change the account password in a short period of time, it may indicate that there is an anomaly in the session continuity and further review is required. During the calculation of the authentication continuity, the time interval distribution is first calculated based on the session time feature, and the time interval threshold is set to 5 minutes. If a user performs multiple authentications within 1 minute, it can be determined as a high-continuity behavior. Next, the consistency of the message content is judged based on the session topic consistency coefficient. Assuming that the topic consistency coefficient of the aforementioned user operation is , which is higher than the threshold of 0.7, we can further determine that the session is a highly consistent session. Finally, we combine the two for weighted calculation: ; in, is the time matching degree, which is 0.9 through similarity calculation. ; The preset continuity judgment threshold is set based on the analysis and statistics of a large amount of normal session data. This value is mainly affected by the session time characteristics, session content similarity and abnormal session detection results. After classifying 50,000 normal sessions and 5,000 abnormal sessions, the calculated high-continuity session distribution mean is 0.82 and the standard deviation is 0.07. Therefore, 0.8 is set as the judgment threshold, so that abnormal sessions can be effectively excluded within the 98% confidence interval and the occurrence of misjudgment can be reduced. Since the calculated 0.88 is higher than the threshold of 0.8, it can be determined that the session belongs to high-continuity identity authentication behavior, and the session identity authentication continuity analysis result is obtained.

[0038] Table 7 Session time characteristic data As shown in Table 7, there are certain changes in the time characteristics of different sessions. Among them, the subject consistency coefficients of sessions 1001 and 1003 are both over 0.8, indicating that the identity authentication continuity of the sessions is high, while the subject consistency coefficient of session 1002 is low, and its legitimacy needs to be further analyzed.

[0039] See also Figure 6 , step S5 is: S511: Based on the session identity authentication continuity analysis result, calculate the context consistency value of the identity authentication request, analyze the keyword distribution, semantic features and contextual relationship in the current session, extract context feature parameters, and obtain the context consistency value; Based on the results of session identity authentication continuity analysis, we first extract key context features in the identity authentication request, including word frequency, syntactic structure, and the relationship between words, and calculate the usage of keywords involved in the current request. Then, we establish a set of context feature parameters, where keywords can be converted through a word vector model to obtain similarity scores between different words. For example, in an enterprise identity authentication scenario, if employees often use terms such as "remote login" and "work email" during normal authentication, and use deviating words such as "system management" and "privileged access" under abnormal circumstances, then calculate their context consistency values. In addition, we need to parse the context to determine the semantic relationship between the current identity authentication request and the historical requests. For example, if a user has been performing business-related identity authentication in a previous session, and a non-business-related request suddenly appears, such as access to sensitive system permissions, it may indicate an anomaly. Combined with historical session data, the cosine similarity of the keyword semantic vector is used to calculate the context matching degree, and the calculated similarities of each keyword are weighted and summed to finally obtain the context consistency value, which is used to determine whether the current identity authentication request conforms to the user's daily behavior pattern and obtain the context consistency value.

[0040] S512: judging the user keyword usage deviation based on the context consistency value, calculating the semantic change range, and analyzing the keyword stability in combination with the historical session data, evaluating the context matching degree of the identity authentication request, and obtaining the credibility of the identity authentication request; According to the context consistency value, we further analyze the usage deviation of user keywords, calculate the range of semantic changes, and evaluate the context matching degree of identity authentication requests. First, we extract the keyword sets used by users in different time periods, calculate the frequency of occurrence of these keywords in historical identity authentication requests, and count their deviations. For example, in a banking system, if users usually use keywords such as "transfer" and "balance inquiry" during the login process, and the keywords in this verification request are changed to "server access" and "remote management", it is necessary to calculate the keyword deviation and judge its abnormality based on the set reference value. The keyword deviation can be measured by calculating the Jaccard similarity between the keyword set of the current request and the keyword set of the historical request. The threshold is set based on the keyword stability analysis of actual business scenarios. The specific calculation method is to count the Jaccard similarities of all normal identity authentication requests within one month, and take the 5th percentile of the distribution as the abnormal threshold to ensure that more than 99% of the normal Frequent requests will not be misjudged as abnormal. After statistical analysis, in the enterprise identity authentication environment, the threshold is usually between 0.25 and 0.35, so it is set to 0.3 to ensure the effectiveness of anomaly detection. In addition, combined with the context change trend, the semantic transformation patterns of different identity authentication requests are analyzed. For example, when the time span is long, the semantic changes may be large, but the mutations in a short period of time are usually more abnormal. Therefore, it is necessary to dynamically set the context matching threshold under different time windows. Specifically, for a short time window within 1 hour, the normal range of keyword similarity is usually between 0.6 and 0.8, while for a one-day time window, the range can be reduced to 0.4 to 0.6. If the context matching degree of the current request is found to be lower than the set threshold (such as 0.3), it indicates that the current request may be abnormal and additional identity authentication measures need to be triggered. Finally, the credibility of the identity authentication request is obtained comprehensively. This value reflects the rationality of the current identity authentication request in terms of context matching, and the credibility of the identity authentication request is obtained.

[0041] S513: adjusting the authentication strength of the identity authentication based on the credibility of the identity authentication request, and performing user identity re-authentication; Based on the credibility of the identity authentication request, adjust the authentication strength and re-authenticate the user. First, divide the identity authentication level according to the credibility value. For example, when accessing the internal system of the enterprise, if the credibility value is higher than 0.8, single-factor authentication (such as password input) can be used. If the credibility value is between 0.5-0.8, it is necessary to add two-factor authentication (such as SMS verification code). If the credibility is lower than 0.5, it is necessary to use advanced verification mechanisms such as biometrics or security challenges. The credibility threshold is set based on the statistical analysis of the historical identity authentication success rate. The specific calculation method is to select the credibility distribution of all successful identity authentication requests in the past three months, and use the 10th percentile as the advanced authentication trigger point and the 30th percentile as the two-factor authentication trigger point. In an enterprise network environment, the threshold is usually set to 0.8, 0.5, and 0.3, and is dynamically adjusted based on data to reduce the false positive rate. In addition, in the process of adjusting the verification strength, the user's historical login behavior must also be considered. For example, if a user has been accessing the system from a fixed IP address, and this request comes from a different IP, the identity authentication process needs to be dynamically adjusted in combination with the credibility calculation. Specifically, if more than 90% of the user's logins in the past 30 days come from a fixed IP address, then when the IP changes, the credibility calculation should introduce an additional reduction factor, such as reducing the credibility score by 0.2-0.3 to reflect the sudden change in access behavior, and finally obtaining the user identity authentication adjustment parameter, which is used for subsequent identity authentication process optimization and obtaining the user identity authentication adjustment parameter.

[0042] Table 8 Example of calculation of keyword context deviation As shown in Table 8, the frequency of occurrence of keywords such as remote login and account management in historical sessions and current requests does not change much, while the frequency of use of "server access" suddenly increases, with a deviation of 0.80, indicating that there is a large deviation in the user's current identity authentication request.

[0043] Taking the calculation of identity authentication credibility as an example, assuming that the keyword set of a user in the historical identity authentication is {"login", "transfer", "balance query"}, and the keyword set in the current identity authentication request is {"remote management", "system access", "login"}, calculate the Jaccard similarity: ; in: X={"Login","Transfer","Balance Query"}; Y={"remote management","system access","login"}; intersection:{"login"},size=1; Union: {"Login", "Transfer", "Balance Query", "Remote Management", "System Access"}, size = 5; Calculation results: ; This value is lower than the set confidence threshold of 0.3 and is within the outlier range of the statistics for the past month (the normal range is usually 0.25-0.35), so additional authentication measures need to be triggered, such as two-factor authentication or biometrics, to prevent potential abnormal access.

[0044] A user identity authentication system for communication software, comprising: The authentication field mapping module obtains the authentication request data packet, decodes the authentication field, extracts the fixed, dynamic and variable fields, calculates the data bit offset value, completes the structure mapping, and obtains the authentication field mapping result; The identity authentication feature matching module calculates fixed field matching features based on the identity authentication field mapping results, verifies the data packet format arrangement order, parses the dynamic field range, calculates the time span value, sets the time matching benchmark value, determines whether the timestamp meets the benchmark value, calculates the variable field association matching degree, and establishes the identity authentication field matching matrix; The authentication legitimacy analysis module verifies the field arrangement order, calculates the matching consistency value, compares the field storage offset, calculates the request legitimacy, and obtains the authentication request legitimacy data based on the authentication field matching matrix; The session continuity detection module parses the session data, calculates the data relevance, determines the change of the conversation topic, and obtains the session identity authentication continuity analysis result according to the legitimacy data of the identity authentication request; The identity authentication credibility assessment module calculates the context consistency value, determines the keyword deviation, calculates the request credibility, adjusts the verification strength and re-authenticates based on the session identity authentication continuity analysis results.

[0045] The above are only preferred embodiments of the present invention and are not intended to limit the present invention in other forms. Any technician familiar with the profession may use the technical contents disclosed above to change or modify them into equivalent embodiments with equivalent changes and apply them to other fields. However, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention without departing from the technical solution of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A user identity authentication method for communication software, characterized in that: The following steps are involved: S1: Obtain the authentication request data packet in the communication protocol, decode the authentication field information, extract the fixed field, dynamic field and variable field, calculate the data bit offset value, perform structure mapping and obtain the authentication field mapping result; S2: According to the identity authentication field mapping result, the matching features of the fixed fields are calculated, the data packet format is sequenced and verified, field matching rules are established, the dynamic field data range is parsed, the time span value of the timestamp field is calculated, whether the timestamp field meets the time matching reference value is determined, the correlation matching degree between the variable fields is calculated, and the identity authentication field matching feature matrix is ​​comprehensively established; S3: Based on the identity authentication field matching feature matrix, verify the field arrangement order of the identity authentication request data, calculate the field matching consistency value, compare the identity authentication field mapping result, calculate the legitimacy of the identity authentication request, and output the identity authentication request legitimacy data; S4: Read the identity authentication request legitimacy data, parse the current session data, calculate the correlation between the current session and the historical session data, determine whether there is a topic change, and obtain the session identity authentication continuity analysis result.

2. The user identity authentication method of communication software according to claim 1, characterized in that: The identity authentication field mapping result includes field offset value, field structure relationship, and field decoding information; the identity authentication field matching feature matrix includes fixed field matching features, dynamic field data range, variable field association matching degree, and timestamp matching benchmark; the identity authentication request legitimacy data includes field arrangement order consistency, field matching consistency value, storage offset matching status, and legitimacy evaluation result; the session identity authentication continuity analysis result includes message content correlation, message sequence matching degree, time feature consistency, and conversation topic changes.

3. The user identity authentication method of communication software according to claim 1, characterized in that: The specific steps of S1 are: S111: Obtain an identity authentication request data packet in the communication protocol, decode the identity authentication field information, extract the fixed fields, dynamic fields and variable fields associated with the identity authentication, calculate the data bit offset value, and obtain the identity authentication field position information; S112: Based on the identity authentication field location information, perform identity authentication field structure mapping, analyze the relative offset of each field in the data packet and the correlation between the fields, and use the formula: ； Calculate the offset error value for each authentication field , get the authentication field mapping error data, where represents the authentication field mapping error, Representative The calculated offset of the field, Representative The theoretical offset of the field, Representative The standard offset unit for each field. Representative The importance weight of each field, Represents the total number of authentication fields; S113: Based on the identity authentication field mapping error data, adjust the structural relationship of the identity authentication field, match the field mapping rule, and obtain the identity authentication field mapping result.

4. The user identity authentication method of communication software according to claim 1, characterized in that: The specific steps of S2 are: S211: Based on the identity authentication field mapping result, a matching feature is calculated for a fixed field, a field value of the fixed field is extracted, and matching patterns are counted to determine a fixed field matching rate, and a fixed field matching feature is obtained; S212: According to the fixed field matching feature, a field matching rule is established according to the protocol header information, the dynamic field data range is parsed, and the time span value of the timestamp field is counted, using the formula: ； Calculate the time matching deviation value , combined with the time interval of normal identity authentication requests, the time matching benchmark value is set, and whether the timestamp field meets the time matching benchmark value is determined to obtain the time matching deviation data, where, Representative The time value of the timestamp field, Represents the time value of the previous timestamp field, Represents the number of timestamp fields, The number of time points representing the calculation time span; S213: Based on the time matching deviation data, the correlation matching degree between the variable fields is calculated, and the matching features of the fixed fields and the dynamic fields are combined to comprehensively establish the identity authentication field matching feature matrix.

5. The user identity authentication method of communication software according to claim 1, characterized in that: The specific steps of S3 are: S311: Based on the identity authentication field matching feature matrix, verify the field arrangement order of the identity authentication request data, analyze the storage order of the fields, check the offset of the field arrangement, and obtain the field order offset record; S312: Record the offset according to the field sequence, and compare whether the identity verification field storage offset is consistent with the identity verification field mapping result, using the formula: ； Calculate field matching consistency metrics , and combined with the threshold to set the matching standard, the identity authentication field matching analysis results are obtained, where Representative The storage location of the fields, Representative The standard storage offset position of the field, Representative The storage step of the fields, Represents the total number of authentication fields; S313: Based on the identity authentication field matching analysis result, analyze the legitimacy of the identity authentication request and output the identity authentication request legitimacy data.

6. The user identity verification method of communication software according to claim 1, characterized in that: The specific steps of S4 are: S411: Read the identity authentication request legitimacy data, parse the current session data, extract the message content, message sequence and time characteristics, calculate the time interval between messages, transmission delay and data consistency, and obtain session time characteristic parameters; S412: Based on the session time characteristic parameter, it is determined whether there is a change in the topic of the conversation content before and after the current identity authentication request, using the formula: ； Calculate the output conversation topic consistency coefficient , analyze the correlation matching value between the current session and the historical session, and judge whether the topic has changed based on the threshold, where, Representative The feature vector of the current session message, Representative The feature vector of the historical conversation message, Represents the total number of messages involved in the calculation; S413: Based on the session subject consistency coefficient and in combination with the session time characteristic parameter, the session identity authentication continuity of the identity authentication request is comprehensively calculated to obtain a session identity authentication continuity analysis result.

7. The user identity verification method of communication software according to claim 1, characterized in that: The method further comprises S5; S5: Based on the session identity authentication continuity analysis result, calculate the context consistency value of the identity authentication request, determine the user keyword usage deviation, calculate the credibility of the authentication request, adjust the authentication strength, and re-perform user identity authentication.

8. The user identity authentication method of communication software according to claim 1, characterized in that: The specific steps of S5 are: S511: Based on the session identity authentication continuity analysis result, calculate the context consistency value of the identity authentication request, analyze the keyword distribution, semantic features and contextual relationship in the current session, extract context feature parameters, and obtain the context consistency value; S512: judging the user keyword usage deviation according to the context consistency value, calculating the semantic change range, and analyzing the keyword stability in combination with the historical session data, evaluating the context matching degree of the identity authentication request, and obtaining the credibility of the identity authentication request; S513: Based on the credibility of the identity authentication request, adjust the authentication strength of the identity authentication and perform user identity re-authentication.

9. A user identity verification system for communication software, characterized in that: The system is used to execute the method according to any one of claims 1 to 8, comprising: The authentication field mapping module obtains the authentication request data packet, decodes the authentication field, extracts the fixed, dynamic and variable fields, calculates the data bit offset value, completes the structure mapping, and obtains the authentication field mapping result; The identity authentication feature matching module calculates fixed field matching features, verifies the data packet format arrangement order, parses the dynamic field range, calculates the time span value, sets the time matching reference value, determines whether the timestamp meets the reference value, calculates the variable field association matching degree, and establishes the identity authentication field matching matrix based on the identity authentication field mapping result; The identity authentication legitimacy analysis module verifies the field arrangement order, calculates the matching consistency value, compares the field storage offset, calculates the request legitimacy, and obtains the identity authentication request legitimacy data based on the identity authentication field matching matrix; The session continuity detection module parses the session data, calculates the data relevance, determines the change of the conversation topic, and obtains the session identity authentication continuity analysis result according to the identity authentication request legitimacy data; The identity authentication credibility assessment module calculates the context consistency value, determines the keyword deviation, calculates the request credibility, adjusts the verification strength and re-authenticates the identity according to the session identity authentication continuity analysis result.

Images