Enterprise-level network access control system based on dynamic authentication

Abstract

The invention relates to the technical field of network security, and discloses an enterprise-level network access control system based on dynamic authentication, which comprises an access request acquisition module, an identity risk assessment module, a dynamic authentication decision module, a multi-factor authentication module, an access control module and an access log storage module. The method comprises the steps of capturing a user access request and extracting feature data; calculating a risk score and generating a result; comparing a safety threshold value, and judging whether dynamic authentication is triggered or not; if yes, an optimal authentication strategy is calculated, and whether additional identity verification is executed or not is determined; if yes, authentication is completed, and a result is returned; determining an access right based on the authentication result, and storing an access record; and optimizing an authentication strategy and a risk scoring model by using historical data. By adopting a dynamic authentication technology based on risk scores, a flexible and efficient network access control effect is achieved, and the defect that a traditional method is difficult to cope with variable access situations is overcome.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and specifically to an enterprise-level network access control system based on dynamic authentication. Background Art

[0002] With the increasing complexity of enterprise network environments, traditional network access control methods are becoming increasingly difficult to cope with new security challenges. Most existing technologies rely on static rules and fixed authentication methods. However, this method has certain limitations, especially when dealing with complex and ever-changing network access requirements, it seems powerless.

[0003] First of all, existing technologies usually adopt fixed authentication strategies, such as single password verification or device-based authentication. These methods often cannot adapt to sudden security risks or changes in user access behaviors. For example, when a user suddenly logs in from an unfamiliar IP address or a high-risk area, the system is difficult to flexibly adjust the authentication strategy, resulting in security risks. Traditional solutions usually rely on preset authentication rules and are prone to vulnerabilities when facing new types of attacks and cannot respond quickly.

[0004] Secondly, the authentication process in existing technologies often relies on manually set thresholds or static risk assessment models, and these models are difficult to adapt to changes in the environment and user behaviors in a timely manner. For some high-risk access behaviors, the system is often difficult to accurately identify and is prone to false negatives or false positives. Moreover, traditional access control methods often do not consider the impact of historical access records on future authentication decisions, resulting in the need to start judgment from scratch every time an access occurs, lacking cumulative intelligence.

[0005] Furthermore, existing solutions usually simply rely on a certain authentication method, whether it is biometric identification or SMS verification code, lacking effective combination and optimization. In some cases, the user authentication process is too cumbersome, resulting in unnecessary loss of user experience, while in other cases, security may not be guaranteed enough. Existing technical solutions are difficult to balance the contradiction between the two, especially in the case of multiple authentication measures coexisting, it is difficult to achieve adaptive security control.

[0006] In summary, the deficiencies of existing technologies are mainly reflected in the lack of flexible adaptability, intelligent authentication strategies, and dynamic risk assessment mechanisms. This makes existing solutions appear too lagging when facing complex network security environments and cannot effectively guarantee the security of enterprise networks.

[0007] Therefore, the present invention proposes an enterprise-level network access control system based on dynamic authentication to solve the deficiencies of existing technologies. Summary of the Invention

[0008] In view of the deficiencies of the prior art, the present invention provides an enterprise-level network access control system based on dynamic authentication, which solves the problem that the existing identity authentication scheme lacks dynamic adaptability and is difficult to adjust the authentication strategy in real time according to the changes in access risks, resulting in insufficient security.

[0009] To achieve the above objectives, the present invention is realized through the following technical solutions: An enterprise-level network access control system based on dynamic authentication, including: An access request collection module, used to capture user access requests, extract access feature data, and transmit the collected access feature data to the identity risk assessment module; An identity risk assessment module, used to calculate the risk score of the user identity based on the access feature data to generate a risk score result, determine whether to trigger dynamic authentication according to the set security threshold, and at the same time transmit the risk score result to the dynamic authentication decision module; A dynamic authentication decision module, used to receive the access feature data provided by the access request collection module and the risk score result provided by the identity risk assessment module, calculate the optimal authentication strategy based on the partially observable Markov decision process, and select whether to trigger additional identity verification measures according to the risk score result. If triggered, send an authentication request to the multi-factor authentication module. If no additional authentication is required, send the access decision result to the access control module; A multi-factor authentication module, used to execute identity authentication measures when the dynamic authentication decision module selects to trigger identity verification, generate an authentication result, and return the authentication result to the access control module; An access control module, used to decide whether to allow access according to the authentication result of the multi-factor authentication module, and generate historical access record data from the records after access authorization to be stored in the access log storage module; An access log storage module, used to store historical access record data, optimize the dynamic authentication strategy of the system based on the historical access data to help optimize the authentication strategy, and at the same time provide historical access data to the identity risk assessment module to optimize the calculation of the user identity risk score.

[0010] Preferably, the access feature data includes device information, network environment, access time, user behavior, and authentication method.

[0011] Preferably, the identity authentication measures include but are not limited to SMS verification codes, device authentication, biometric identification, or manual approval.

[0012] Preferably, when the multi-factor authentication module executes the identity authentication measures, at least two or more of the identity authentication measures are used for verification.

[0013] Preferably, the risk score result includes the following content: The comprehensive risk score of the user identity is calculated based on access feature data such as device information, network environment, access time, user behavior, and authentication method; The risk score value, representing the risk level of the user identity, is quantified according to a preset scoring model; The authentication trigger flag, indicating whether additional identity verification measures are required, depends on the result of comparing the risk score value with a set security threshold.

[0014] Preferably, the calculation of the optimal authentication strategy based on the partially observable Markov decision process includes the following steps: Take the access feature data provided by the access request collection module and the risk score result provided by the identity risk assessment module as inputs; Construct a state space according to the partially observable Markov decision process model, and the state space includes the user's authentication status, access features, and risk score; Calculate the transition probabilities and reward values of different authentication decisions, and calculate the optimal authentication strategy in the current state based on the risk score and access feature data.

[0015] Preferably, the historical access record data includes the following: The user's historical access behavior data, including access time, access device, access location, access frequency, and behavior pattern; The user's authentication history, including authentication method, authentication result, and risk score during the authentication process; The user's historical access results, including whether the access is successful, the type of resources accessed, and their security levels; The user risk model generated based on the historical access record data, which is used to adjust the user's risk score and access permissions.

[0016] Preferably, the identity risk assessment module uses machine learning algorithms to train and optimize the risk scoring model for evaluating the user's identity risk.

[0017] The present invention also provides an enterprise-level network access control method based on dynamic authentication, including the following steps: Capture the user access request and extract the access feature data; Calculate the risk score of the user identity based on the access feature data and generate a risk score result; Compare the risk score result with a set security threshold to determine whether to trigger dynamic authentication; If dynamic authentication is triggered, calculate the optimal authentication strategy based on the risk score result and access feature data, and select whether to trigger additional identity verification measures; If additional identity verification is triggered, execute the identity authentication measures, generate an authentication result and return; Based on the authentication result, it is decided whether to allow access. If access is allowed, the relevant historical access record data is stored in the access log. Optimize the authentication strategy based on the stored historical access record data and adjust the risk scoring calculation model to improve the accuracy of future authentication.

[0018] The present invention provides an enterprise-level network access control system based on dynamic authentication, having the following beneficial effects: 1. The present invention adopts a dynamic authentication technology based on risk scoring, achieving a flexible and efficient network access control effect. Compared with the existing solutions that rely on fixed authentication methods, it solves the deficiency that traditional methods are difficult to cope with changing access scenarios. Dynamic authentication can automatically adjust the authentication method according to real-time risk assessment, improving security while reducing unnecessary user intervention.

[0019] 2. The present invention introduces a technical solution for optimizing the authentication strategy with historical access records, achieving the effect of continuously improving the authentication accuracy. Different from traditional technical solutions, the continuous feedback of historical data enables the authentication strategy to self-adjust with changes in the network environment and user behavior, avoiding the inefficiency and vulnerability of a single authentication method over a long period.

[0020] 3. The present invention adopts an intelligent multi-factor authentication method, achieving a more detailed access control effect. Different from the single authentication means in the existing technology, the strategy of the present invention determines whether to introduce additional identity verification based on risk scoring and access characteristics, truly realizing an authentication mechanism tailored to the actual situation.

[0021] 4. The present invention accurately determines whether to trigger dynamic authentication by calculating the user risk score in real time and comparing it with the security threshold. Compared with the traditional technology that relies too much on manually set rules, the intelligent judgment mechanism of the present invention can flexibly respond according to the risk characteristics of each access, thus avoiding misjudgment or missed judgment caused by overly rigid rules. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 is the system architecture diagram of the present invention; Figure 2 is the method flow chart of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0023] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of them. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0024] Please refer to the attached Figure 1 , an embodiment of the present invention provides an enterprise-level network access control system based on dynamic authentication, including: An access request collection module, configured to capture user access requests, extract access feature data, and transmit the collected access feature data to the identity risk assessment module; The access request collection module is mainly responsible for capturing user access requests and extracting access feature data. The access request collection module is the first link in the entire system, and its function is to obtain sufficient access feature data from user requests to provide necessary information for the subsequent identity risk assessment module and dynamic authentication decision module.

[0025] Generally, the access request collection module obtains data from multiple sources, including but not limited to user-initiated access requests, device information, network environment, authentication methods, etc. Specifically, in some embodiments, the access request collection module can collect the hardware information of the device, the operating system version, the IP address, the network access behavior, and the user behavior data, and further analyze the user's access pattern. These feature data will provide rich information for subsequent risk assessment and decision-making.

[0026] In a possible implementation manner, the access request collection module generates detailed feature vectors according to the access time, location, frequency, and the user's operation behavior, etc., and transmits these data to the subsequent identity risk assessment module. Through this series of steps, the access request collection module constructs an accurate access feature model for the system to ensure that subsequent operations can make reasonable decisions based on actual data.

[0027] As an option, the access request collection module can obtain device information through real-time analysis and synchronization. Especially at critical moments such as device changes and login behaviors, the dynamic information is processed as a real-time data stream to quickly respond to user access requests. This method helps to perceive potential risks in real time and reduce possible security vulnerabilities.

[0028] Specifically, this module can adopt a data collection method based on a distributed architecture, use a lightweight protocol to capture network access requests, and protect user privacy through encryption technology. To avoid information leakage, the collection module performs strict encryption processing on the transmitted data to ensure data security.

[0029] In some embodiments, the access request collection module can also have an adaptive feature. By analyzing historical access data, the collected feature data is continuously optimized. Through machine learning algorithms, this module can automatically adjust the collection rules in different user groups and network environments to more accurately capture access features related to security.

[0030] For example, in some embodiments, assuming that a user's access request comes from an uncommon geographical location, the system will identify this abnormal situation and mark the corresponding access feature data. This data will be transmitted to the identity risk assessment module as one of the input data for risk scoring. In this way, the access request collection module not only ensures the comprehensiveness of the system's data collection but also provides strong support for the dynamic authentication decision-making module.

[0031] In this embodiment, the functional implementation of the access request collection module not only depends on traditional user authentication means but also enhances the overall system's response efficiency and accuracy to access requests by integrating modern network environment and device information acquisition means. Through the work of this module, the system can capture the necessary access data in real time and efficiently, providing sufficient data support for subsequent identity risk assessment and dynamic authentication decision-making.

[0032] In addition, during the specific implementation process of the access request collection module, the scalability and flexibility of the system also need to be considered. For example, when new device types or new authentication methods are added, the collection module can adapt to new data sources or features by upgrading the configuration, thereby continuously optimizing its collection rules. Thus, this module can improve the system's adaptability while ensuring security, ensuring its long-term stable operation.

[0033] In summary, the access request collection module in this embodiment not only provides a reliable data source for the system but also has flexible configuration and self-adaptive capabilities. By accurately capturing and efficiently transmitting access features, this module plays a crucial role in the network access control system of the present invention.

[0034] An identity risk assessment module, used to calculate the risk score of the user identity based on the access feature data to generate a risk score result, determine whether to trigger dynamic authentication according to the set security threshold, and transmit the risk score result to the dynamic authentication decision-making module; After receiving the access feature data transmitted by the access request collection module, the system enters the identity risk assessment stage. The identity risk assessment module plays an important role in the entire dynamic authentication process. Its core task is to calculate the risk score of the user identity based on the access feature data and generate a risk score result. By comparing the risk score result with the set security threshold, it can be determined whether to trigger dynamic authentication, thereby providing a scientific basis for subsequent authentication decisions.

[0035] In general, the identity risk assessment module analyzes and processes the collected access feature data by combining multi-source data fusion and machine learning algorithms. Its ultimate goal is to establish an accurate and flexible risk scoring mechanism for determining the risk level for different access requests. As an option, the identity risk assessment module can achieve dynamic risk scoring adjustment by introducing a hybrid model of historical access data and real-time collected data, thereby improving the scoring accuracy and flexibility.

[0036] In this embodiment, the identity risk assessment module first preprocesses the access feature data, including data cleaning, feature extraction, and data normalization operations. By removing redundant and noisy data, the purity and usability of the feature data are improved. Then, a feature vectorization method is used to convert the multi-dimensional feature data into a unified format for input into the subsequent risk assessment model. Generally, the feature vector can be expressed as: ; where represents the th feature value, is the total number of features. Different feature values may have different data types and dimensions. To ensure the consistency of feature weights, the identity risk assessment module normalizes the feature data using the Min-Max normalization method, and the formula is as follows: ; where and respectively represent the minimum and maximum values of feature . Through the normalization process, all feature values can be made to be on the same scale, avoiding evaluation errors caused by dimensional differences.

[0037] In a possible implementation, the identity risk assessment module constructs a risk scoring model based on machine learning algorithms. Usually, a fusion algorithm based on supervised learning and unsupervised learning is adopted, such as ensemble learning methods, random forest algorithms, and deep neural networks. In the model training stage, historical access data is used to optimize the parameters so that the model can adapt to complex access scenarios. The output of the model is the risk score of the user identity, and its calculation formula is: ; where is the risk score value, is the input feature vector, is the model parameter. The score value usually fluctuates between 0 and 1, and the higher the value, the greater the risk. Through repeated iterations of the training samples and the validation set, the parameters of the model are optimized to make it still have high accuracy in complex access scenarios.

[0038] As an option, the identity risk assessment module can adopt a hybrid model fusion strategy, that is, dynamically switch the scoring model under different access environments. Specifically, a simple linear model is adopted in low-risk scenarios, while in high-risk or abnormal behavior scenarios, it automatically switches to a complex deep learning model, thus taking into account both real-time performance and accuracy.

[0039] In some embodiments, to further improve the accuracy and adaptability of risk scoring, the identity risk assessment module also introduces an online learning mechanism. By using the latest access data as incremental training samples, the model parameters are continuously updated to maintain a high evaluation accuracy when facing new security threats.

[0040] In addition, the calculation result of the risk score value needs to be compared with a set security threshold. Generally, the security threshold is configured by the system administrator according to the enterprise security policy, usually determined by methods based on empirical analysis and historical data statistics. When the risk score value is greater than the threshold the system will trigger dynamic authentication: ; As an extensible design, the identity risk assessment module also has a policy adaptive adjustment function. By continuously monitoring the authentication effect and the system operation status, the threshold and scoring rules are dynamically adjusted. Specifically, if it is found that the authentication accuracy rate decreases, the module will automatically optimize the feature weights or model hyperparameters to ensure the stability of the authentication effect.

[0041] Through the precise calculation and real-time response of the identity risk assessment module, the system can quickly judge the risk level and reasonably trigger the authentication policy when facing diverse access requests. Compared with traditional static authentication methods, the present invention has higher flexibility and accuracy and can effectively meet the complex enterprise-level network access control requirements.

[0042] The dynamic authentication decision module is used to receive the access feature data provided by the access request collection module and the risk scoring result provided by the identity risk assessment module, calculate the optimal authentication policy based on the partially observable Markov decision process, and select whether to trigger additional identity verification measures according to the risk scoring result. If triggered, it sends an authentication request to the multi-factor authentication module. If no additional authentication is required, it sends the access decision result to the access control module; After the Identity Risk Assessment Module completes the risk scoring of the user's identity, the system needs to make a decision based on the risk score results to determine whether to trigger additional identity authentication. This is where the Dynamic Authentication Decision Module plays a key role. Based on the risk score data provided by the Identity Risk Assessment Module and multiple factors such as historical access behavior, system security policies, and authentication costs, this module calculates the optimal authentication strategy. By optimizing the authentication path, this module ensures network access security while avoiding unnecessary authentication steps and improving access efficiency.

[0043] Typically, the dynamic authentication decision module uses a partially observable Markov decision process (POMDP) model to calculate authentication decisions. This model processes partially observable user state information and, based on historical access behavior and risk assessment results, infers the optimal authentication strategy. Optionally, the dynamic authentication decision module can also incorporate an optimization algorithm based on reinforcement learning to further enhance the adaptive capabilities of the authentication strategy.

[0044] In this embodiment, the dynamic authentication decision module first receives the risk score data output by the identity risk assessment module and compares it with the set authentication decision threshold. If the risk score is lower than the set security threshold, the user is allowed to directly access the target resource. If the risk score is higher than the threshold, the system will select an appropriate authentication method based on the authentication decision model and notify the multi-factor authentication module to execute the authentication process. The authentication decision calculation can be expressed as: ; in, For certification decision results; The risk score value calculated by the identity risk assessment module, The user's historical access behavior characteristics; It is the security policy parameter of the current system.

[0045] In one possible implementation, the dynamic authentication decision module constructs a state-action value function To evaluate the benefits of different authentication strategies. The value function is defined as follows: ; in, Indicates that the status Next action The expected benefits that can be obtained (i.e. the comprehensive evaluation value after adopting a certain certification strategy); Indicates that the status Next action The immediate benefits achieved, which reflect the direct security and user experience impact of the current authentication strategy; The Discount Factor is used to balance the current reward and the rewards that may be obtained in the future, and its value range is , if the value is larger, the system pays more attention to long-term benefits. If the value is smaller, it pays more attention to short-term benefits; represents the current system state, which is a set of multiple feature information including the user access environment, risk score, security policy, etc.; represents the authentication decision action taken by the system, such as whether to require the user to perform multi-factor authentication, adjust the authentication method, etc.; represents the next state that may be reached after executing the action , that is, the access state entered by the user after completing authentication, such as successful access, authentication failure, triggering higher-level authentication, etc.; represents the state by executing the action transfers to the state The probability is determined by factors such as historical access data and authentication success rate; represents the state value of the next state , that is, the security assessment and user experience score of the system in this state. It can be calculated iteratively to enable the system to achieve the optimal in the long-term authentication strategy.

[0046] As an option, the dynamic authentication decision module can adopt the DQN (DeepQ-Network) method based on deep reinforcement learning to approximate the value function through a neural network, so that the authentication strategy can be continuously optimized in a changing access environment.

[0047] Specifically, the dynamic authentication decision module will use a large amount of historical access data and real authentication feedback data for training during the training phase. During the training process, the model continuously adjusts the strategy according to the past authentication effects, so that the system can achieve the best balance between security and user experience.

[0048] In some embodiments, the dynamic authentication decision module can also combine a multi-layer policy framework. For example, the system can dynamically adjust the selection of authentication methods according to different access environments. For example, in a trusted intranet environment, the system can reduce the authentication intensity, while in a high-risk public network environment, it requires users to perform more stringent authentication.

[0049] In addition, the dynamic authentication decision module can also make personalized adjustments based on the user's behavior pattern. For example, for users who often access from the same device and the same location, the system can gradually reduce the authentication frequency to reduce the user's operation burden. For users with abnormal behaviors, the authentication intensity can be dynamically increased to enhance system security.

[0050] As an extension, the dynamic authentication decision module can also integrate with external threat intelligence systems to obtain the latest security threat information in real time and dynamically adjust authentication policies based on the threat level. For example, if the system detects a potential attack risk from a certain IP address, it can automatically increase the authentication requirements for access requests from that IP address, thereby enhancing defense against unknown threats.

[0051] Through this approach, the dynamic authentication decision module intelligently selects the optimal authentication strategy in complex and ever-changing access environments, ensuring security while minimizing the user's operational burden. Its core mechanism, based on mathematical optimization and reinforcement learning algorithms, enables the system to adapt to changing access patterns and dynamically adjust authentication strategies, thereby improving overall security and access efficiency.

[0052] The multi-factor authentication module is used to perform identity authentication measures when the dynamic authentication decision module selects to trigger identity authentication, generate authentication results, and return the authentication results to the access control module; After the dynamic authentication decision module completes its analysis of the user's identity risk score and makes its authentication decision, the system enters the final authentication execution phase. The core of this phase lies in the multi-factor authentication module, which is responsible for executing the corresponding identity verification operations based on the dynamic authentication decision module's output to ensure the authenticity of the user's identity and provide enhanced security verification measures where necessary. The multi-factor authentication module not only supports traditional password-based authentication but also incorporates multiple authentication methods, such as biometrics, device binding, and behavioral analysis, to adapt to different access environments and security requirements.

[0053] Typically, the multi-factor authentication module selects an appropriate authentication method based on the authentication decision and sends an authentication request to the user terminal via a secure communication protocol. The user then follows the system prompts to complete the identity verification process. The system then updates the user's trust score based on the authentication feedback and determines whether to grant access. Optionally, the multi-factor authentication module can adjust the authentication method based on the current device security level. For example, it can use a lower-intensity authentication method on trusted devices, while requiring multiple verifications on unfamiliar devices.

[0054] In this embodiment, the multi-factor authentication module first receives the authentication policy transmitted by the dynamic authentication decision module and parses the authentication requirements. The module then establishes a secure communication connection with the user terminal through the identity verification server and initiates an authentication request to the user. In various implementations, the module can support both single-factor and multi-factor authentication, and employ adaptive strategies to adjust the authentication process.

[0055] Specifically, single-factor authentication methods usually include password-based authentication (such as entering a password set by the user), device-based authentication (such as SMS verification codes or email verification), and biometric-based authentication (such as fingerprints, facial recognition, etc.). The security of single-factor authentication is relatively low, but it has high user experience advantages for low-risk access scenarios.

[0056] In a possible implementation, to enhance security, the multi-factor authentication module adopts a multi-factor combined authentication method, that is, combining two or more identity verification means in the same authentication process. Generally, based on different types of identity authentication factors, this module calculates the authentication credibility using the following weight model: ; Among them, represents the final authentication credibility score; represents the authentication result of the th authentication factor, and the value range is generally ; is the weight corresponding to the authentication factor, satisfying .

[0057] In some embodiments, to enhance the system's adaptability, the multi-factor authentication module can dynamically adjust the weights of each authentication factor. For example, if a certain user accesses the system on a fixed device for a long time, the system can reduce the weight of device authentication and increase the weight of behavior pattern matching to optimize the authentication process and reduce the user interaction cost.

[0058] In addition, the multi-factor authentication module supports an adaptive authentication strategy based on user behavior analysis. Specifically, this module models the user's access pattern and uses time series analysis algorithms to predict the user's typical access behavior. If the user's access behavior significantly deviates from the historical pattern, the system will automatically increase the authentication level. For example, assume that a user usually accesses the system using a fixed device during working hours, and the current request comes from a different region and at an abnormal time, then the system will trigger additional authentication measures, such as requiring the user to perform biometric identification or additional device verification.

[0059] In a possible implementation, the multi-factor authentication module can also combine machine learning models to score the security and user experience of different authentication methods to optimize the authentication strategy. Specifically, the system can adopt a reinforcement learning algorithm to optimize the authentication process with the following objective function: ; Among them, is the optimization target value; is the authentication security score; is the user experience cost; is the balance coefficient, which controls the trade-off between security and user experience.

[0060] Through this optimization model, the system can minimize the user authentication burden to the greatest extent while ensuring security, and improve the overall access experience.

[0061] In some embodiments, the multi-factor authentication module can also combine blockchain technology to achieve distributed identity authentication. Specifically, the user's identity information can be stored in a decentralized identity authentication system, and distributed ledger technology is used to improve data security and anti-tampering capabilities. In this way, even if the authentication server is attacked, the user's identity information is still secure and available, thereby enhancing the overall security of the system.

[0062] In summary, the multi-factor authentication module realizes precise control of access requests with different security levels by flexibly adjusting the authentication method and security policy. Combining the analysis results of the dynamic authentication decision module, this module can ensure the best authentication effect with the least user intervention, and continuously improve the security and user experience of the system through the adaptive optimization mechanism.

[0063] The access control module is used to decide whether to allow access according to the authentication result of the multi-factor authentication module, and generate historical access record data after access authorization to be stored in the access log storage module; After the multi-factor authentication module completes the verification of the user's identity, the system enters the final access control stage. The main task of the access control module is to decide whether to allow the user to access the target resource according to the authentication result, user permission information, and system security policy, and implement necessary permission management measures during the access process. This module not only ensures that legitimate users can access the required resources smoothly, but also effectively prevents unauthorized access behaviors, thereby enhancing the overall security and compliance of the system.

[0064] Generally, the access control module adopts a combination of role-based access control (RBAC) and attribute-based access control (ABAC) to achieve dynamic management of user access permissions. As an option, this module can also combine risk-based access control (RBAC+), that is, on the basis of the traditional access control mechanism, introduce the user's real-time risk score to adjust the access permissions.

[0065] In this embodiment, the access control module first receives the authentication result returned by the multi-factor authentication module and parses the user identity information. Then, this module queries the user's role, permission level, and historical access records through the access permission management server to calculate the final access decision. The calculation process can be expressed as: ; where Represents the final access decision result; Represents user identity information, including user unique identifier, device information, access location, etc.; Represents user role information, such as administrator, ordinary user, visitor, etc.; Represents the context information of the access request, such as access time, resource category, etc.; Represents the user's risk score, which is calculated by the identity risk assessment module.

[0066] In a possible implementation, the access control module adopts a policy-based access control model (PBAC) and dynamically adjusts user access permissions by defining access control policy rules. Generally, the policy rules can be expressed as: ; Among them, Represents the access control policy condition. Only when this condition is met can the user obtain access permissions. When the condition is met, the system returns an access authorization result =ALLOW, otherwise return =DENY.

[0067] Specifically, in some embodiments, the access control module can combine machine learning algorithms to detect anomalies in user access behaviors. For example, this module can build a time series model of user access patterns and calculate the normal behavior baseline of users based on historical access data. When a user's access request significantly deviates from this baseline, the system will automatically increase the strictness of access control. For example: ; Among them, Is the deviation value between the user's current access behavior and the historical access pattern; Is the access behavior feature of the user at time ; Is the predicted value of the user's historical access pattern; Is the length of the reference time window.

[0068] If Exceeds the set anomaly threshold D , the system will trigger enhanced access control measures, such as requiring the user to re-perform multi-factor authentication, or directly rejecting the access request.

[0069] In some embodiments, to improve the adaptability of the access control module, this module can incorporate blockchain technology to achieve distributed access rights management. Specifically, users' access rights can be stored in the smart contracts of the blockchain, and the consensus mechanism is used to ensure the security and immutability of the rights. For example, when an access request occurs, the system can verify the user's rights record in the blockchain and execute corresponding access decisions based on the smart contract logic.

[0070] In addition, the access control module supports dynamic permission adjustment based on session management. Generally, a user will obtain an access token after authentication, and the validity period of this token is dynamically adjusted by the system. For example, if the system detects an increase in the user's risk score, the access control module can shorten the validity period of the access token or force the user to re-authenticate. This token management process can be expressed as: ; where, is the effective duration of the access token; represents the user's real-time risk score; represents the user's historical access behavior characteristics.

[0071] As an extended solution, the access control module can also incorporate the zero-trust security architecture (ZTA) to achieve fine-grained dynamic access control. Specifically, this module can perform real-time authentication for each access request and dynamically adjust access rights in combination with factors such as the user's device and network environment. For example, in a trusted network environment, a user can directly access specific resources, while in an untrusted environment, additional authentication steps are required.

[0072] In summary, the access control module ensures the security and controllability of system resources through various access control policies and security mechanisms. In combination with the aforementioned identity authentication and risk assessment module, this module can achieve flexible and efficient access management while ensuring security, enabling the system to maintain a stable and reliable security policy execution ability in the face of a complex access environment.

[0073] The access log storage module is used to store historical access record data, optimize the system's dynamic authentication policy based on the historical access data to help optimize the authentication policy, and at the same time provide historical access data to the identity risk assessment module to optimize the calculation of the user's identity risk score; After the access control module decides whether to allow a user to access a resource, the system enters the stage of the access log storage module. The core function of this module is to record and store all access behaviors of users, including user authentication information, details of access requests, access decisions, and any exception events generated during the access process. This module ensures that all access behaviors can be comprehensively recorded and audited, providing support for subsequent security audits, troubleshooting, and compliance checks.

[0074] Generally, the access log storage module will determine the storage period, storage format, and the level of detail of the log content according to the security requirements and compliance requirements of the system. As an option, the access log storage module can also select different storage media or encryption methods according to the sensitivity of the access request to ensure the security and availability of the log data. Specifically, the log content should not only include user identity information, the path of the accessed resource, access time, etc., but also record key information such as the specific behavior of the user's operation, whether an exception occurred during the access process, and whether an alarm was triggered.

[0075] In this embodiment, the access log storage module first receives the access decision results from the access control module, including the user's identity information, access time, requested resources, etc. Then, the module stores these information in a structured manner in a unified format for subsequent retrieval and auditing. The storage format of the log usually includes fields such as timestamp, user identifier, resource identifier, access type, access result, etc. For example: ; Among them, represents the log record; is the timestamp, recording the specific time of the access request; is the user identifier, identifying the user who accesses the resource; is the resource identifier, indicating the accessed resource; is the access type, indicating the nature of the access request (such as read, write, etc.); is the access result, indicating whether the access request is successful (such as successful, rejected, etc.).

[0076] In a possible implementation, to improve the query efficiency and storage security of the log, the access log storage module can also optimize the log data by combining index technology. Generally, the log data can be classified and stored through an index structure to accelerate the subsequent log retrieval process. For example, the log can establish indexes according to the user identifier, resource identifier, and access time, enabling administrators to quickly retrieve the access history of a specific user or resource.

[0077] Specifically, the log data can be stored by dividing it according to time windows, forming a time series database. The log data within each time window can be partitioned and stored through a hashing algorithm. This method can effectively improve the storage efficiency of the data and reduce the computational overhead during querying. The storage structure of the access log can be expressed as: ; Among them, represents the log database; is the log partition within the th time window; and are the start and end times of this time window respectively.

[0078] In some embodiments, to ensure the integrity and anti-tampering property of the access log data, the access log storage module can combine blockchain technology and use a distributed ledger to record each log. This way can ensure that once the log data is written, it cannot be tampered with, and all log records can be verified through the consensus mechanism of the blockchain. Specifically, the writing of the access log can be verified through a smart contract and an immutable record is generated on the blockchain, thereby ensuring the authenticity of the data.

[0079] As an option, the access log storage module also supports the encrypted storage of log data. Generally, sensitive log data (such as containing user identity information, sensitive information on resource access, etc.) should be protected using an encryption algorithm. Specifically, the log data can be encrypted using a symmetric encryption or an asymmetric encryption algorithm to ensure that even if the log data is intercepted during transmission or storage, the data content still cannot be easily read or tampered with. The log encryption process can be expressed as: ; Among them, is the encrypted log record; is the original log record; is the encryption key.

[0080] Specifically, the system can select different encryption strengths and encryption methods according to the sensitivity grading of the logs to achieve an optimal balance between security and performance.

[0081] In some embodiments, to further enhance the security and reliability of the logs, the access log storage module also supports the backup function of log data. The log data can be regularly backed up to off-site storage media to ensure that the log data can still be restored in the event of a catastrophic event or system failure. The storage strategy of the backup data can be flexibly configured according to the type and importance of the logs, so as to balance the storage cost and the data protection requirements.

[0082] In summary, the access log storage module ensures the integrity, security, and efficiency of the system access logs through various security and optimization technologies. In combination with the aforementioned access control and authentication modules, the log storage module provides the system with detailed audit tracking and fault diagnosis support, while also meeting compliance requirements and data protection standards.

[0083] The present invention also provides an enterprise-level network access control method based on dynamic authentication, comprising the following steps: S1. Capture the user access request and extract the access feature data; S2. Calculate the risk score of the user identity based on the access feature data to generate a risk score result; S3. Compare the risk score result with a set security threshold to determine whether to trigger dynamic authentication; S4. If dynamic authentication is triggered, calculate the optimal authentication strategy based on the risk score result and the access feature data, and select whether to trigger additional identity verification measures; S5. If additional identity verification is triggered, execute the identity authentication measures, generate an authentication result and return it; S6. According to the authentication result, decide whether to allow access. If access is allowed, store the relevant historical access record data into the access log; S7. Optimize the authentication strategy based on the stored historical access record data and adjust the risk score calculation model to improve the accuracy of future authentication.

[0084] For step S1, in this process, the system needs to monitor and record the user access requests in real time. The access requests include the access time, location, device information, browsed resources, and request type, etc. These data can be obtained through different technical means, such as using a proxy server, a load balancer, or an access log collection tool. By extracting these access feature data, the system can better understand the user's access pattern, laying a foundation for subsequent risk assessment and authentication decision-making.

[0085] For step S2, this step involves analyzing the user access features and calculating the risk score of the user. The system will evaluate whether the access behavior conforms to the normal pattern and evaluate the risk level in combination with other factors (such as the user's historical behavior). For example, if the user's access pattern is inconsistent with the historical records, or the user logs in from a high-risk area, the system may determine it as a higher risk. The risk score helps the system decide whether to perform dynamic authentication on this user subsequently.

[0086] For step S3, once the risk score is calculated, the system compares it with a preset security threshold. If the risk score is lower than a certain predetermined value, the system can directly allow access; if the score is higher, the system will trigger a dynamic authentication process. This threshold can be adjusted according to different scenarios and requirements to ensure the flexibility and adaptability of dynamic authentication.

[0087] For step S4, if the system decides to trigger dynamic authentication, it will then determine the most appropriate authentication method based on the risk score and the user's access characteristics. This may include selecting different authentication methods such as SMS verification codes, fingerprint recognition, or two-factor authentication. Depending on the user's risk score, the system can choose more stringent authentication measures or provide some convenient options to balance security and user experience.

[0088] For step S5, if the system decides to perform additional authentication on the user, this process will initiate the corresponding authentication mechanism. For example, the system may require the user to enter a one-time password, verify fingerprints, or use a hardware token for verification. Based on the verification results, the system will generate an authentication decision and return whether the user has passed the authentication.

[0089] For step S6, based on the authentication result of the previous step, the system will decide whether to grant access rights. If the authentication is successful, the user will be able to access system resources. At the same time, the system will record the relevant data of this access (such as access time, resource type, risk score, etc.) in the access log. These log data are not only used for auditing and security analysis but also provide reference for future authentication and risk assessment.

[0090] For step S7, in this step, the system will regularly analyze historical access records to optimize the authentication strategy and adjust the risk scoring model. For example, the system can optimize the selection of the authentication strategy based on the past authentication success rate to ensure that the authentication measures are both secure and efficient in different risk scenarios. At the same time, the risk scoring model will also be continuously optimized to adapt to new security threats and user behavior patterns, improving the system's response ability and accuracy.

[0091] Although the embodiments of the present invention have been shown and described, it will be understood by those of ordinary skill in the art that various changes, modifications, substitutions, and variations can be made to these embodiments without departing from the principles and spirit of the present invention. The scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. An enterprise-level network access control system based on dynamic authentication, characterized in that, Including: An access request collection module, which is used to capture user access requests, extract access feature data, and transmit the collected access feature data to the identity risk assessment module; An identity risk assessment module, which is used to calculate the risk score of the user identity based on the access feature data to generate a risk score result, determine whether to trigger dynamic authentication according to the set security threshold, and at the same time transmit the risk score result to the dynamic authentication decision module; A dynamic authentication decision module, which is used to receive the access feature data provided by the access request collection module and the risk score result provided by the identity risk assessment module, calculate the optimal authentication strategy based on the partially observable Markov decision process, and select whether to trigger additional identity verification measures according to the risk score result. If triggered, it sends an authentication request to the multi-factor authentication module. If no additional authentication is required, it sends the access decision result to the access control module; A multi-factor authentication module, which is used to execute identity authentication measures when the dynamic authentication decision module selects to trigger identity verification, generate an authentication result, and return the authentication result to the access control module; An access control module, which is used to decide whether to allow access according to the authentication result of the multi-factor authentication module, and generate historical access record data from the access authorization record to be stored in the access log storage module; An access log storage module, which is used to store historical access record data, optimize the dynamic authentication strategy of the system based on the historical access data to help optimize the authentication strategy, and at the same time provide historical access data to the identity risk assessment module to optimize the calculation of the user identity risk score.

2. The enterprise-level network access control system based on dynamic authentication according to claim 1, characterized in that, The access feature data includes device information, network environment, access time, user behavior, and authentication method.

3. An enterprise-level network access control system based on dynamic authentication according to claim 1, characterized in that, The identity authentication measures include but are not limited to SMS verification codes, device authentication, biometric identification, or manual approval.

4. An enterprise-level network access control system based on dynamic authentication according to claim 1, characterized in that When the multi-factor authentication module executes the identity authentication measures, at least two or more authentication methods among the identity authentication measures are used for verification.

5. An enterprise-level network access control system based on dynamic authentication according to claim 1, characterized in that The risk score result includes the following contents: The comprehensive risk score of the user identity, which is calculated based on access feature data such as device information, network environment, access time, user behavior, and authentication method; The risk score value, which represents the risk level of the user identity and is quantified according to a preset scoring model; The authentication trigger flag, which indicates whether additional identity verification measures are required, depending on the result of comparing the risk score value with the set security threshold.

6. An enterprise-level network access control system based on dynamic authentication according to claim 1, characterized in that, The calculation of the optimal authentication strategy based on the partially observable Markov decision process includes the following steps: Taking the access feature data provided by the access request collection module and the risk score result provided by the identity risk assessment module as inputs; Constructing a state space according to the partially observable Markov decision process model, where the state space includes the user's authentication state, access features, and risk score; Calculating the transition probabilities and reward values of different authentication decisions, and calculating the optimal authentication strategy in the current state based on the risk score and access feature data.

7. An enterprise-level network access control system based on dynamic authentication according to claim 1, characterized in that, The historical access record data includes the following contents: The historical access behavior data of the user, including access time, access device, access location, access frequency, and behavior pattern; The authentication history of the user, including the authentication method, authentication result, and risk score during the authentication process; The historical access results of the user, including whether the access is successful, the type of resources accessed, and their security levels; A user risk model generated based on historical access record data, used to adjust the user's risk score and access permissions.

8. An enterprise-level network access control system based on dynamic authentication according to claim 1, characterized in that, The identity risk assessment module uses machine learning algorithms to train and optimize the risk score model for assessing the user's identity risk.

9. An enterprise-level network access control method based on dynamic authentication, which is applied to an enterprise-level network access control system based on dynamic authentication as described in any one of claims 1-8, and is characterized in that, Including the following steps: Capture the user access request and extract the access feature data; Calculate the risk score of the user identity based on the access feature data to generate a risk score result; Compare the risk score result with a set security threshold to determine whether to trigger dynamic authentication; If dynamic authentication is triggered, calculate the optimal authentication strategy based on the risk score result and access feature data, and select whether to trigger additional identity verification measures; If additional identity verification is triggered, execute the identity authentication measures, generate an authentication result and return it; Based on the authentication result, decide whether to allow access. If access is allowed, store the relevant historical access record data in the access log; Optimize the authentication strategy based on the stored historical access record data and adjust the risk score calculation model to improve the accuracy of future authentication.

Images