Multi-level dynamic authorization and access control method and system based on identity token

Abstract

The invention provides a multilevel dynamic authorization and access control method and system based on an identity token, and relates to the technical field of network security, and the method comprises the steps: generating a user main token of a binding terminal, constructing a resource access domain knowledge graph, carrying out the feature coding, predicting an access intention based on knowledge enhancement features and user historical behaviors, and achieving the dynamic grouping of resources. A permission certificate is generated through homomorphic encryption, verifiability is ensured through zero-knowledge proof, a verification program is deployed in a distributed network, and collaborative detection and certificate revocation of abnormal access are achieved. According to the invention, the security and flexibility of access control are improved, and the dynamic adaptive capacity of authority management is enhanced.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a multi-level dynamic authorization and access control method and system based on identity tokens. Background Art

[0002] With the widespread application of information systems and the continuous expansion of network scale, identity authentication and access control technologies have become core components of ensuring information security. Traditional identity authentication mainly relies on static credentials such as usernames and passwords, while modern information systems have gradually developed token-based authentication mechanisms, which reliably confirm user identities by issuing, verifying, and managing identity tokens. At the same time, access control technology has also evolved from the initial simple permission table to more sophisticated role-based, attribute-based, and other models to meet the permission management needs in complex scenarios. In recent years, with the development of artificial intelligence and distributed systems, dynamic authorization models based on knowledge graphs and machine learning, as well as secure verification mechanisms implemented using cryptographic techniques, have gradually become research hotspots, providing new ideas and methods for addressing the challenges faced by traditional access control mechanisms. Summary of the Invention

[0003] The embodiments of the present invention provide a multi-level dynamic authorization and access control method and system based on identity tokens, which can solve the problems in the prior art.

[0004] A first aspect of an embodiment of the present invention provides a multi-level dynamic authorization and access control method based on an identity token, comprising:

[0005] Receive user identity token requests, generate user master tokens and bind them to the terminal device; verify the legitimacy of the user master token and the device binding relationship; after verification, receive and resolve the user's resource access request;

[0006] Based on the user's resource access request, a resource access domain knowledge graph containing user, resource, and operation entity nodes is constructed; feature encoding is performed on the knowledge graph, and knowledge enhancement features are obtained by calculating normalization coefficients and weighted summation; based on the knowledge enhancement features, a state vector is generated in combination with the user's historical access behavior, and the state transition probability is calculated. Temporal difference learning is used to predict the probability of user access intention, thereby achieving dynamic grouping of target resources;

[0007] A homomorphic encryption algorithm is used to generate an independent permission certificate for each resource group, and the verifiability of the permission certificate is achieved through a zero-knowledge proof protocol. A certificate verification program is deployed in the distributed node network. The verification program continuously updates the session key through a verifiable random function, and the nodes collaborate to complete the certificate verification through a sharding mechanism. When any node detects abnormal access behavior, an early warning message is broadcast to the entire network through the Byzantine fault tolerance protocol. After receiving confirmation from more than two-thirds of the nodes, the distributed permission certificate revocation is initiated.

[0008] Based on the user resource access request, a resource access domain knowledge graph including user, resource, and operation entity nodes is constructed; feature encoding is performed on the knowledge graph, and knowledge enhancement features are obtained by calculating normalization coefficients and weighted summation, including:

[0009] Extracting a user's portrait feature vector, a resource attribute feature vector, and an environment context feature vector based on the user's resource access request;

[0010] Extract user entity nodes based on the user's portrait feature vector, extract resource entity nodes based on the resource attribute feature vector, and extract operation entity nodes based on the environment context feature vector. Establish semantic relationship edges between entity pairs that interact among the user entity node, the resource entity node, and the operation entity node to generate a resource access domain knowledge graph.

[0011] For each node in the resource access domain knowledge graph, the normalization coefficient between the node and its neighbor node set is calculated, the features of the neighbor node set are weighted and summed based on the normalization coefficient, and the feature representation of the node is updated through nonlinear transformation. This process is repeated until the update amplitude of the feature representation of all nodes is less than the convergence threshold, and the knowledge enhancement feature of each node is obtained.

[0012] Based on the knowledge enhancement features, the state vector is generated in combination with the user's historical access behavior, and the state transition probability is calculated. Temporal difference learning is used to predict the probability of user access intention, realizing dynamic grouping of target resources, including:

[0013] Obtain the user's historical access behavior and calculate the temporal attention weight of the historical access behavior; based on the temporal attention weight, perform weighted summation on the knowledge enhancement features of each historical access behavior to obtain a temporal feature; input the temporal feature into the gated recurrent unit, and the gated recurrent unit updates the state vector at the current moment based on the state vector at the previous moment and the temporal feature at the current moment;

[0014] Based on the resource access domain knowledge graph, extract the feature vector of each resource in the user-accessible resource set, perform weighted fusion with the current state vector, and obtain the transition probability of the current state through sigmoid function mapping;

[0015] Obtain the next state based on the user's historical access behavior, calculate the state transition probability of each resource in the next state, select the largest state transition probability and multiply it by the time series attenuation factor to obtain the expected return;

[0016] The state action value is obtained by weighted summing the current state transition probability and the expected benefit. The Q value is updated based on the temporal difference learning rate. The Q value represents the expected long-term benefit of the user accessing each resource in the current state. The access behavior randomness parameter is introduced to adjust the Q value. The adjusted Q value is normalized by the softmax function to obtain the probability of the user's access intention to different resources.

[0017] The cosine similarity between target resources based on access intention probability is calculated, and target resources with cosine similarity greater than the resource clustering threshold are aggregated into the same resource group to complete dynamic grouping of resources.

[0018] A homomorphic encryption algorithm is used to generate an independent permission certificate for each resource group, and the verifiability of the permission certificate is achieved through a zero-knowledge proof protocol, including:

[0019] Extract the permission characteristic value of each resource group and generate a permission certificate; perform homomorphic encryption on the permission characteristic value based on a random number sequence to obtain an encrypted permission value;

[0020] Obtain a system master key and a current timestamp, concatenate the system master key and the current timestamp, and perform a hash operation on them to obtain a base key; calculate the access frequency of the resource group based on the historical access records of the resource group, and multiply it by the base key to obtain a resource group private key; combine the resource group identification information, encrypted permission value, permission certificate, resource group private key, and current timestamp to generate a permission certificate;

[0021] For adjacent resource groups, their authority certificates are concatenated and hashed to obtain a certificate hash value, and the certificate hash value is multiplied by the exponential operation result of the access frequency between the resource groups to obtain a certificate association value; a permission validity certificate is generated based on the encrypted authority value, a timeliness certificate is generated based on the current timestamp, and an association verification certificate is generated based on the certificate association value;

[0022] Based on the accuracy of historical verification results and the frequency of resource group access, the verification weight value of each resource group is calculated; the verification weight value is multiplied by the permission validity proof, timeliness proof and associated verification proof, and the sum is calculated to obtain the certificate score. When the certificate score is greater than the certificate trust threshold, the permission certificate is confirmed to be valid and the user can access the resource group.

[0023] For adjacent resource groups, their authority certificates are concatenated and hashed to obtain a certificate hash value, and the certificate hash value is multiplied by the exponential operation result of the access frequency between resource groups to obtain a certificate association value, including:

[0024] Calculate the cosine similarity between resource group identification information to generate a resource group adjacency matrix; extract the identification information and permission certificates from the adjacent resource group permission certificates and concatenate them with the current system timestamp to form a cascade sequence;

[0025] Performing a SHA-256 hash operation on the concatenated sequence to obtain a first hash value, dividing the first hash value into a left half and a right half, performing an MD5 hash operation on the left half to obtain an intermediate hash value, and performing an XOR operation on the intermediate hash value and the right half to obtain a second hash value;

[0026] Generate a random salt value based on a preset encryption key and the current system timestamp; alternately divide the second hash value and the random salt value into multiple data blocks, and perform hash operations on the multiple data blocks in sequence to obtain a certificate hash value;

[0027] The time axis is divided into multiple time windows, the number of interactive visits of the adjacent resource groups in each time window is counted, the access frequency of the time window is calculated, the access frequency is multiplied by the smoothing factor and then an exponential operation is performed to obtain an access frequency index value; the certificate hash value is multiplied by the access frequency index value to obtain a certificate association value.

[0028] A certificate verification program is deployed on a distributed node network. The verification program continuously updates the session key through a verifiable random function. The nodes collaborate to complete the certificate verification through a sharding mechanism, including:

[0029] Obtaining a verification rule sequence for the authority certificate, extracting logical dependencies between the rules, and constructing a rule verification directed graph; marking a target verification path in the rule verification directed graph, dividing the authority certificate into multiple certificate shards according to the target verification path, and assigning verification weights to the certificate shards;

[0030] Select available nodes from the set of verification nodes, analyze the nodes' computing power and network latency, and generate a node performance score; construct a two-dimensional index structure for the verification nodes based on the node performance score, the two-dimensional index structure comprising a computing dimension and a communication dimension; map the certificate shards to the two-dimensional index structure using a consistent hashing algorithm to generate an optimal shard distribution plan; distribute the certificate shards among the verification nodes according to the shard distribution plan, and the verification nodes store the certificate shards in a secure storage area;

[0031] Obtain the node private key of the current timestamp of the verification node, input the node private key and the current timestamp as random sources into a verifiable random function, generate a session key seed according to the verification period, perform key derivation on the session key seed, and integrate the certificate shard identification information of the verification node to generate a shard verification key; determine the key update period according to the verification weight of the certificate shard; the verification node uses the shard verification key to decrypt the certificate shard, generate a shard verification result, and perform weighted summation according to the verification weight of the certificate shard to obtain the authority certificate verification result.

[0032] A second aspect of an embodiment of the present invention provides a multi-level dynamic authorization and access control system based on identity tokens, comprising:

[0033] The first unit is used to receive a user identity token request, generate a user master token and bind it to the terminal device; verify the legitimacy of the user master token and the device binding relationship, and receive and resolve the user's resource access request after verification;

[0034] The second unit is configured to construct a resource access domain knowledge graph containing user, resource, and operation entity nodes based on the user resource access request; perform feature encoding on the knowledge graph and obtain knowledge enhancement features by calculating normalization coefficients and weighted summation; generate a state vector based on the knowledge enhancement features and combine it with the user's historical access behavior, calculate the state transition probability, and use temporal difference learning to predict the probability of user access intention to achieve dynamic grouping of target resources;

[0035] The third unit is used to generate an independent permission certificate for each resource group using a homomorphic encryption algorithm, and to achieve verifiability of the permission certificate through a zero-knowledge proof protocol; a certificate verification program is deployed in a distributed node network, and the verification program continuously updates the session key through a verifiable random function, and the nodes collaborate to complete the certificate verification through a sharding mechanism; when any node detects abnormal access behavior, it broadcasts an early warning message to the entire network through the Byzantine fault tolerance protocol, and initiates the revocation of the distributed permission certificate after receiving confirmation from more than two-thirds of the nodes.

[0036] According to a third aspect of the embodiments of the present invention,

[0037] An electronic device is provided, comprising:

[0038] processor;

[0039] a memory for storing processor-executable instructions;

[0040] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0041] According to a fourth aspect of the embodiments of the present invention,

[0042] A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the method described above is implemented.

[0043] The beneficial effects of this application are as follows:

[0044] The present invention implements multi-level dynamic authorization and access control based on identity tokens, and realizes accurate dynamic grouping of resources through knowledge graphs and intelligent algorithms, enabling the system to automatically adjust the scope of permissions based on user historical behavior and access intentions, avoiding the over-authorization problem of traditional fixed permission models and effectively improving the security of data access.

[0045] The present invention uses a combination of homomorphic encryption and zero-knowledge proof to generate and verify authority certificates, ensuring that sensitive information is not leaked during the authority verification process. At the same time, the verifiability of the authority certificates greatly improves the system's ability to resist forgery attacks and enhances the reliability and security of the overall system.

[0046] The distributed certificate verification network constructed by the present invention realizes distributed management of permissions through node collaboration and consensus mechanism. The introduction of dynamic session keys and Byzantine fault-tolerant protocols enables the system to quickly respond to security threats and revoke permissions, thereby improving the system's resilience and defense capabilities in the face of complex network environments and security attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 A flowchart of a multi-level dynamic authorization and access control method based on identity tokens according to an embodiment of the present invention;

[0048] Figure 2 This is a schematic diagram of the resource group permission certificate system architecture based on homomorphic encryption and zero-knowledge proof. DETAILED DESCRIPTION

[0049] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0050] The following specific embodiments are used to describe the technical solution of the present invention in detail. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0051] Figure 1 FIG is a flow chart of a multi-level dynamic authorization and access control method based on identity tokens according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0052] Receive user identity token requests, generate user master tokens and bind them to the terminal device; verify the legitimacy of the user master token and the device binding relationship; after verification, receive and resolve the user's resource access request;

[0053] Based on the user's resource access request, a resource access domain knowledge graph containing user, resource, and operation entity nodes is constructed; feature encoding is performed on the knowledge graph, and knowledge enhancement features are obtained by calculating normalization coefficients and weighted summation; based on the knowledge enhancement features, a state vector is generated in combination with the user's historical access behavior, and the state transition probability is calculated. Temporal difference learning is used to predict the probability of user access intention, thereby achieving dynamic grouping of target resources;

[0054] A homomorphic encryption algorithm is used to generate an independent permission certificate for each resource group, and the verifiability of the permission certificate is achieved through a zero-knowledge proof protocol. A certificate verification program is deployed in the distributed node network. The verification program continuously updates the session key through a verifiable random function, and the nodes collaborate to complete the certificate verification through a sharding mechanism. When any node detects abnormal access behavior, an early warning message is broadcast to the entire network through the Byzantine fault tolerance protocol. After receiving confirmation from more than two-thirds of the nodes, the distributed permission certificate revocation is initiated.

[0055] In an optional embodiment, based on the user resource access request, a resource access domain knowledge graph including user, resource, and operation entity nodes is constructed; feature encoding is performed on the knowledge graph, and knowledge enhancement features are obtained by calculating normalization coefficients and weighted summation, including:

[0056] Extracting a user's portrait feature vector, a resource attribute feature vector, and an environment context feature vector based on the user's resource access request;

[0057] Extract user entity nodes based on the user's portrait feature vector, extract resource entity nodes based on the resource attribute feature vector, and extract operation entity nodes based on the environment context feature vector. Establish semantic relationship edges between entity pairs that interact among the user entity node, the resource entity node, and the operation entity node to generate a resource access domain knowledge graph.

[0058] For each node in the resource access domain knowledge graph, the normalization coefficient between the node and its neighbor node set is calculated, the features of the neighbor node set are weighted and summed based on the normalization coefficient, and the feature representation of the node is updated through nonlinear transformation. This process is repeated until the update amplitude of the feature representation of all nodes is less than the convergence threshold, and the knowledge enhancement feature of each node is obtained.

[0059] In this embodiment, a user resource access request is received and parsed to extract a user profile feature vector, a resource attribute feature vector, and an environment context feature vector. The user profile feature vector includes information such as user ID, department, position level, and authority level; the resource attribute feature vector includes attributes such as resource ID, resource type, security level, and department; and the environment context feature vector includes information such as operation type, access time, access location, and device used.

[0060] For example, when Mr. Zhang, a senior sales manager in the sales department, requests access to a sales contract document marked as "confidential" on a company laptop on a weekday morning, the system extracts the following features: the user profile feature vector is [U1001, Sales Department, Senior Manager, P3], where the P3 permission level can meet his daily management needs, including information access rights, business operation permissions, and management permissions; the resource attribute feature vector is [R2045, Contract Document, Confidential Level, Sales Department]; and the environmental context feature vector is [Read, Monday morning 10:15, company intranet, laptop].

[0061] Based on the extracted feature vectors, the system further extracts entity nodes. From the user profile feature vector, the system extracts user entity nodes, including specific user nodes (e.g., U1001) and user attribute nodes (e.g., Sales Department, Senior Manager). From the resource attribute feature vector, the system extracts resource entity nodes, including specific resource nodes (e.g., R2045) and resource attribute nodes (e.g., Contract Document, Confidentiality Level). From the environmental context feature vector, the system extracts operation entity nodes, including operation type nodes (e.g., Read Operation) and environmental nodes (e.g., Working Hours, Company Intranet).

[0062] After extracting entity nodes, the system establishes semantic relationship edges between them to construct a resource access domain knowledge graph. These semantic relationship edges include: the "belongs to" relationship between users and departments, the "serves" relationship between users and positions, the "belongs to" relationship between resources and types, the "classified as" relationship between resources and security levels, the "access" relationship between users and resources, the "execute" relationship between users and operations, and the "targets" relationship between operations and resources. Through these relationship edges, discrete entity nodes are connected to form a complete knowledge graph structure.

[0063] In the above example, some of the established relationship edges include: a "Belongs to" relationship edge between user U1001 and the sales department, a "Serves as" relationship edge between user U1001 and the senior manager, a "Belongs to" relationship edge between resource R2045 and the contract document, a "Classified as" relationship edge between resource R2045 and the confidentiality level, an "Executes" relationship edge between user U1001 and the read operation, and a "Targets" relationship edge between the read operation and resource R2045.

[0064] After constructing the resource access domain knowledge graph, the system performs feature encoding and updates on the knowledge graph. Initial feature representations are extracted for each node in the knowledge graph. For user nodes, the initialization feature can be an embedding vector of the user's historical behavior; for resource nodes, the initialization feature can be an embedding vector of the resource content; and for operation nodes, the initialization feature can be an encoding vector of the operation type.

[0065] For each node in the knowledge graph, the system calculates the normalization coefficient between the node and its neighbor node set. The specific method is to calculate the normalization coefficient α for node i and its neighbor node j. ij , which reflects the degree of influence of neighbor node j on node i. The calculation of the normalization coefficient takes into account the influence of node degree, ensuring that a single connection from a high-degree node does not have too large an impact. For example, for a connection between a user node with degree 10 and a resource node with degree 2, the normalization coefficient will appropriately reduce the influence of the high-degree user node.

[0066] In the above example, user node U1001 is connected to multiple nodes, such as departments, positions, and historically accessed resources, and therefore has a high degree. Resource node R2045, on the other hand, is connected to only a few nodes, such as resource types and security levels, and therefore has a low degree. The system calculates normalized coefficients based on node degrees. For example, the normalized influence coefficient of node U1001 on R2045 is 0.15, while the normalized influence coefficient of R2045 on U1001 is 0.35.

[0067] Based on the calculated normalization coefficient, the system performs a weighted summation of the neighbor node features of each node. For node i, the feature vectors of all its neighbor node j are summed with the corresponding normalization coefficient α ij After multiplication, the sum is obtained to obtain the aggregated features. The aggregated features are then processed through a nonlinear transformation function (such as the ReLU function) to update the feature representation of node i.

[0068] For example, during the feature update process of resource node R2045, the features of its connected neighboring nodes, such as the resource type node (contract document), security level node (confidential level), and user node (U1001), are considered, weighted summed according to the normalization coefficient, and then the updated feature representation is obtained through nonlinear transformation.

[0069] The system repeats the feature update process until the update amplitude of the feature representation of all nodes is less than the preset convergence threshold (0.001), indicating that the feature representation has stabilized. The system obtains a knowledge-enhanced feature representation for each node, which integrates the structural and semantic information in the knowledge graph.

[0070] Through the above implementation methods, the system successfully constructed a resource access domain knowledge graph and generated knowledge enhancement features, providing rich feature representations for subsequent resource access authorization decisions, effectively improving the accuracy and intelligence of access control.

[0071] In an optional embodiment, based on the knowledge enhancement feature, a state vector is generated in combination with the user's historical access behavior, and the state transition probability is calculated. Temporal difference learning is used to predict the probability of user access intention to achieve dynamic grouping of target resources, including:

[0072] Obtain the user's historical access behavior and calculate the temporal attention weight of the historical access behavior; based on the temporal attention weight, perform weighted summation on the knowledge enhancement features of each historical access behavior to obtain a temporal feature; input the temporal feature into the gated recurrent unit, and the gated recurrent unit updates the state vector at the current moment based on the state vector at the previous moment and the temporal feature at the current moment;

[0073] Based on the resource access domain knowledge graph, extract the feature vector of each resource in the user-accessible resource set, perform weighted fusion with the current state vector, and obtain the transition probability of the current state through sigmoid function mapping;

[0074] Obtain the next state based on the user's historical access behavior, calculate the state transition probability of each resource in the next state, select the largest state transition probability and multiply it by the time series attenuation factor to obtain the expected return;

[0075] The state action value is obtained by weighted summing the current state transition probability and the expected benefit. The Q value is updated based on the temporal difference learning rate. The Q value represents the expected long-term benefit of the user accessing each resource in the current state. The access behavior randomness parameter is introduced to adjust the Q value. The adjusted Q value is normalized by the softmax function to obtain the probability of the user's access intention to different resources.

[0076] The cosine similarity between target resources based on access intention probability is calculated, and target resources with cosine similarity greater than the resource clustering threshold are aggregated into the same resource group to complete dynamic grouping of resources.

[0077] This embodiment provides a method for predicting access intention based on user historical access behavior and realizing dynamic resource grouping. Obtain the user's historical access behavior and calculate the temporal attention weight of the historical access behavior. For the user's historical access behavior sequence {a1, a2, ..., a t-1 The temporal attention weight corresponding to each behavior can be determined by comparing its relevance to the current state. For example, if a user has historically visited three resources: "Network Security Guide," "Firewall Configuration," and "Security Vulnerability Fixes," the system assigns a weight of 0.5 to the more recent "Security Vulnerability Fixes," 0.3 to "Firewall Configuration," and 0.2 to "Network Security Guide," reflecting the time decay characteristic.

[0078] Based on the calculated temporal attention weights, the system performs a weighted summation of the knowledge-enhanced features of each historical access behavior to generate a temporal feature. For example, the knowledge-enhanced feature vector for "Network Security Guide" is [0.8, 0.2, 0.5], the knowledge-enhanced feature vector for "Firewall Configuration" is [0.3, 0.9, 0.4], and the knowledge-enhanced feature vector for "Security Vulnerability Fix" is [0.4, 0.6, 0.7]. The weighted summed temporal feature is [0.8×0.2+0.3×0.3+0.4×0.5, 0.2×0.2+0.9×0.3+0.6×0.5, 0.5×0.2+0.4×0.3+0.7×0.5], or [0.47, 0.57, 0.56].

[0079] The generated temporal features are input into a gated recurrent unit. In a gated recurrent unit, the update gate controls the degree to which the state information from the previous moment is retained, while the reset gate controls the degree to which the current input information is used. For example, when the system recognizes that the user is performing a new task, the update gate tends to reduce reliance on historical state, while the reset gate tends to make greater use of current input information. In specific implementation, assuming the state vector at the previous moment is [0.6, 0.3, 0.8], the temporal features at the current moment are [0.47, 0.57, 0.56], the update gate values ​​are [0.7, 0.6, 0.5], and the reset gate values ​​are [0.4, 0.8, 0.3]. Then, the gated recurrent unit generates a state vector at the current moment of [0.56, 0.41, 0.68], which represents the user's current state of interest.

[0080] Based on the resource access domain knowledge graph, the system extracts feature vectors for each resource in the user-accessible resource set. For example, for the resource "Data Encryption Standard," its feature vector is [0.9, 0.2, 0.4]; for the resource "Intrusion Detection System," its feature vector is [0.3, 0.8, 0.5]. These feature vectors are weighted and fused with the current state vector [0.56, 0.41, 0.68], respectively. Similarity is calculated using element-wise multiplication and summation, resulting in a similarity of 0.78 with "Data Encryption Standard" and 0.69 with "Intrusion Detection System." Using sigmoid function mapping, the probabilities of transferring to these two resources in the current state are 0.69 and 0.63, respectively.

[0081] Based on the user's historical access behavior, the system can determine the resource the user will actually access at the next moment, assuming it's "Data Encryption Standard." At the next moment, the system recalculates the state transition probabilities for each resource. For example, the probability of transitioning from "Data Encryption Standard" to "Encryption Algorithm Comparison" is 0.75, and the probability of transitioning to "Key Management Best Practices" is 0.82. The system selects the maximum transition probability of 0.82 and multiplies it by the time decay factor of 0.9, resulting in an expected return of 0.738.

[0082] The state action value is obtained by taking the weighted sum of the current state's transition probability and expected reward. For example, for "Data Encryption Standard," its current transition probability is 0.69 and its expected reward is 0.738. Assuming the weights are 0.4 and 0.6, respectively, the state action value is 0.69 × 0.4 + 0.738 × 0.6 = 0.719. If the temporal difference learning rate is set to 0.2 and the original Q-value is 0.65, the updated Q-value is 0.65 + 0.2 × (0.719 - 0.65) = 0.664, representing the expected long-term reward of the user accessing "Data Encryption Standard" in the current state.

[0083] The system introduces a parameter called randomness for access behavior to adjust the Q value and enhance exploratory power. Assuming a randomness parameter of 0.1, the adjusted Q value is 0.664 × (1 - 0.1) + 0.1 × random value = 0.598 + 0.1 × random value. The adjusted Q values ​​for all resources are normalized using a softmax function to obtain the probability of a user's access intention for different resources. For example, the probability of accessing "Data Encryption Standard" is 0.28, "Intrusion Detection System" is 0.15, "Network Firewall" is 0.22, and "Security Audit" is 0.35.

[0084] Based on these access intent probabilities, the system calculates cosine similarity between target resources. For example, the access intent probability vectors for "Data Encryption Standard" and "Key Management Best Practices" are [0.28, 0.23, 0.19, 0.30] and [0.30, 0.25, 0.18, 0.27], resulting in a cosine similarity of 0.97. However, the similarity between "Data Encryption Standard" and "Intrusion Detection System" is only 0.62. Setting the resource clustering threshold to 0.8 will result in "Data Encryption Standard" and "Key Management Best Practices" being grouped together, while "Intrusion Detection System" will be assigned to a separate resource group. This achieves dynamic resource grouping based on user access intent.

[0085] Figure 2 This is a diagram of the resource group permission certificate architecture based on homomorphic encryption and zero-knowledge proof. In an optional implementation, a homomorphic encryption algorithm is used to generate an independent permission certificate for each resource group, and the verifiability of the permission certificate is achieved through a zero-knowledge proof protocol, including:

[0086] Extract the permission characteristic value of each resource group and generate a permission certificate; perform homomorphic encryption on the permission characteristic value based on a random number sequence to obtain an encrypted permission value;

[0087] Obtain a system master key and a current timestamp, concatenate the system master key and the current timestamp, and perform a hash operation on them to obtain a base key; calculate the access frequency of the resource group based on the historical access records of the resource group, and multiply it by the base key to obtain a resource group private key; combine the resource group identification information, encrypted permission value, permission certificate, resource group private key, and current timestamp to generate a permission certificate;

[0088] For adjacent resource groups, their authority certificates are concatenated and hashed to obtain a certificate hash value, and the certificate hash value is multiplied by the exponential operation result of the access frequency between the resource groups to obtain a certificate association value; a permission validity certificate is generated based on the encrypted authority value, a timeliness certificate is generated based on the current timestamp, and an association verification certificate is generated based on the certificate association value;

[0089] Based on the accuracy of historical verification results and the frequency of resource group access, the verification weight value of each resource group is calculated; the verification weight value is multiplied by the permission validity proof, timeliness proof and associated verification proof, and the sum is calculated to obtain the certificate score. When the certificate score is greater than the certificate trust threshold, the permission certificate is confirmed to be valid and the user can access the resource group.

[0090] In this embodiment, a method for generating and verifying a resource group authority certificate based on a homomorphic encryption algorithm is provided, including:

[0091] During the permission certificate generation process, the resource group's permission characteristic values ​​are extracted as the basis for generating the permission certificate. The system analyzes the resource group's data type, operation permission level, sensitivity, and other dimensional information to form a permission characteristic vector. For example, for a resource group containing user data, its permission characteristic value can be represented as a combination of multiple dimensions: read permission is 5, modify permission is 3, delete permission is 1, and export permission is 0, forming a characteristic value [5, 3, 1, 0]. The system generates the initial permission certificate based on this characteristic value.

[0092] To protect the security of the permission characteristic value, the system generates a random number sequence, such as [98, 23, 56, 71], and performs a homomorphic encryption operation on this random number sequence and the permission characteristic value. This homomorphic encryption process uses a partially homomorphic encryption scheme, ensuring that the encrypted permission characteristic value can still be verified without decryption. After encryption, the original permission characteristic value [5, 3, 1, 0] becomes an encrypted permission value, such as [483, 763, 209, 531]. This encryption protects the original permission information while retaining the ability to perform homomorphic operations.

[0093] Generating an authority certificate requires a secure key system. The system retrieves the system master key (e.g., the 128-bit string "a7f6d5e4c3b2a1b2c3d4e5f6a7b8c9d0") from secure storage and the current system timestamp (e.g., 1678234567). The system concatenates the master key and timestamp to obtain "a7f6d5e4c3b2a1b2c3d4e5f6a7b8c9d01678234567," then performs a SHA-256 hash on this string to obtain the base key "8e9d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2b1c0d9e8f7a6b5c4d3e2f1a0b9."

[0094] To make the key more targeted, the system analyzes the historical access logs of the resource group and calculates its access frequency. For example, if a resource group has been accessed 214 times in the past 30 days, its average daily access frequency is 7.13. The system groups the basic key into 8 groups of 8 bits, obtaining 8 groups of hexadecimal values, namely 8e9d7c6b, 5a4f3e2d, 1c0b9a8f, 7e6d5c4b, 3a2b1c0d, 9e8f7a6b, 5c4d3e2f, and 1a0b9a89; the 8 groups of hexadecimal values ​​are converted into decimal values, respectively, to obtain 2392903787, 1515237933, 470524559, 2121436235, 976494605, 2660751979, and 154827 9343, 437573257; calculate the average value of the 8 groups of decimal values ​​to obtain the basic key value 1515400212.25; multiply the basic key value 1515400212.25 by the average daily access frequency 7.13 to obtain the product value 10804804514.34375; round the product value 10804804514.34375 and convert the rounded value into a hexadecimal value 283A7B4B32, the hexadecimal value 283A7B4B32 is the resource group private key.

[0095] The system combines the resource group identifier "RG-20230310-0054", the encrypted permission value [483,763,209,531], the permission certificate, the calculated resource group private key 283A7B4B32, and the timestamp 1678234567 to form a complete permission certificate data structure.

[0096] For adjacent resource groups in the system, it is necessary to establish an association mechanism between certificates and calculate the certificate hash value. Taking resource groups RG-20230310-0054 and RG-20230310-0055 as an example, the system obtains the permission certificate content of the first resource group RG-20230310-0054, including the certificate identifier CERT_A_123 and the permission scope READ_WRITE, and obtains the permission certificate content of the second resource group RG-20230310-0055, including the certificate identifier CERT_B_456 and the permission scope READ_ONLY; the certificate identifier and permission scope of the first resource group and the certificate identifier and permission scope of the second resource group are string-concatenated in a preset order to obtain the initial string CERT_A_123READ_WRITECERT_B_456READ_ONLY. The length of the initial string is 45 bytes, equivalent to 360 bits.

[0097] Perform SHA-256 padding on the initial string: add one bit "1" to the end of the string, then add "0" until the string length satisfies the condition that the modulo 512 is equal to 448, and finally add the 64-bit original length value 360 ​​to the end of the string to obtain a padded 512-bit message block; initialize the 8 32-bit initial hash values ​​of the SHA-256 algorithm: h0 is assigned to 0x6a09e667, h1 is assigned to 0xbb67ae85, h2 is assigned to 0x3c6ef372, and h3 Assign a value of 0xa54ff53a, h4 to 0x510e527f, h5 to 0x9b05688c, h6 to 0x1f83d9ab, and h7 to 0x5be0cd19; perform 64 rounds of compression function operations on the message block: in the first round of operations, the value of register a is 0x6a09e667, and the value of register h is 0x5be0cd19; after the last round of operations, the value of register a is updated to 0xf1e2d3c4, and the value of register h is updated to 0x7b6c5d4e;

[0098] Add the results of 64 rounds of compression function operations to the initial hash value: h0 is updated to 0xf1e2d3c4, h1 is updated to 0xb5a69786, h2 is updated to 0x85746362, h3 is updated to 0x514a3b2c, h4 is updated to 0x1d0e9f8a, h5 is updated to 0x7b6c5d4e, h6 is updated to 0x3f2g1h0i, and h7 is updated to 0x9j8k7l6m; concatenate the eight updated 32-bit hash values ​​in sequence to obtain the final 256-bit certificate hash value f1e2d3c4b5a6978685746362514a3b2c1d0e9f8a7b6c5d4e3f2g1h0i9j8k7.

[0099] The system also calculates the access association frequency between two resource groups. For example, if the probability of a user accessing the first resource group and then accessing the second resource group within 15 minutes is 0.45, the system exponentially calculates this access frequency (for example, 0.45 squared) to get 0.2025, which is then multiplied by the certificate hash value (using a specific mapping algorithm) to obtain the certificate association value. The certificate hash value is grouped into 8 groups according to every 8 bits to obtain 8 groups of hexadecimal values, namely f1e2d3c4, b5a69786, 85746362, 514a3b2c, 1d0e9f8a, 7b6c5d4e, 3f2g1h0i, and 9j8k7l6m; the 8 groups of hexadecimal values ​​are converted into decimal values ​​respectively to obtain 4058174404, 3047333766, 2238941026, 1363961644, 487358346, 2073331022, 1059192842, and 26194837 58; calculate the average value of the 8 groups of decimal values ​​to obtain the hash value numerical benchmark 2118472101; obtain the access association frequency 0.45 between the two resource groups, and calculate the square value of the access association frequency 0.2025; multiply the hash value numerical benchmark 2118472101 by the square value of the access association frequency 0.2025 to obtain the product value 428990700.45; round the product value 428990700.45, and convert the rounded value into a hexadecimal value 19947D3C, where the hexadecimal value 19947D3C is the certificate association value.

[0100] During the verification phase, the system generates multiple proofs to verify the validity of the permission certificate. Based on the encrypted permission value, the system uses a zero-knowledge proof protocol to generate a proof of validity, proving that the user possesses the declared permissions for the resource group without revealing the specific permissions. The system also generates a timeliness proof based on the timestamp to ensure the certificate is within its validity period. The current timestamp is 1678240000, and the certificate was generated at 1678234567, with a time difference of 5433 seconds. This is less than the system-set validity threshold of 86400 seconds (24 hours), making the timeliness proof valid. The system also generates an association verification proof based on the certificate association value to ensure the legitimacy of access between resource groups.

[0101] To optimize the verification process, the system calculates a verification weight for each resource group. Based on historical verification records, for example, if a resource group has a verification accuracy of 0.98 and an access frequency of 7.13, the system multiplies these two values ​​together to obtain a weight of 7.0. The system then multiplies this weight by the three previously generated proofs and sums them. Assuming the permission validity proof score is 0.95, the timeliness proof score is 0.99, and the association verification proof score is 0.85, the calculated certificate score is (7.0 × 0.95 + 7.0 × 0.99 + 7.0 × 0.85) = 7.0 × 2.79 = 19.53. The system sets a certificate trust threshold of 15.0. Since 19.53 is greater than 15.0, the permission certificate is confirmed to be valid, and the user can access the requested resource group.

[0102] Through the above methods, the system implements a resource group permission management mechanism based on homomorphic encryption and zero-knowledge proof, ensuring the security and effectiveness of the permission verification process while protecting user privacy and system security.

[0103] In an optional implementation, for adjacent resource groups, their authority certificates are concatenated and hashed to obtain a certificate hash value, and the certificate hash value is multiplied by an exponential operation result of the access frequency between the resource groups to obtain a certificate association value, including:

[0104] Calculate the cosine similarity between resource group identification information to generate a resource group adjacency matrix; extract the identification information and permission certificates from the adjacent resource group permission certificates and concatenate them with the current system timestamp to form a cascade sequence;

[0105] Performing a SHA-256 hash operation on the concatenated sequence to obtain a first hash value, dividing the first hash value into a left half and a right half, performing an MD5 hash operation on the left half to obtain an intermediate hash value, and performing an XOR operation on the intermediate hash value and the right half to obtain a second hash value;

[0106] Generate a random salt value based on a preset encryption key and the current system timestamp; alternately divide the second hash value and the random salt value into multiple data blocks, and perform hash operations on the multiple data blocks in sequence to obtain a certificate hash value;

[0107] The time axis is divided into multiple time windows, the number of interactive visits of the adjacent resource groups in each time window is counted, the access frequency of the time window is calculated, the access frequency is multiplied by the smoothing factor and then an exponential operation is performed to obtain an access frequency index value; the certificate hash value is multiplied by the access frequency index value to obtain a certificate association value.

[0108] In this implementation, the system calculates the cosine similarity between resource group identification information to generate a resource group adjacency matrix. Assume that there are resource groups A, B, and C in the system, each with an identification information vector. The identification information vector for resource group A is [0.5, 0.8, 0.3], the identification information vector for resource group B is [0.6, 0.7, 0.2], and the identification information vector for resource group C is [0.1, 0.2, 0.9]. Calculate the cosine similarity between resource groups A and B: The vector dot product is 0.5×0.6+0.8×0.7+0.3×0.2=0.3+0.56+0.06=0.92. The modulus of A is √(0.5²+0.8²+0.3²)=√(0.25+0.64+0.09)=√0.98≈0.99, and the modulus of B is √(0.6²+0.7²+0.2²)=√(0.36+0.49+0.04)=√0.89≈0.94. The cosine similarity is 0.92 / (0.99×0.94)≈0.987. Similarly, calculate the cosine similarity between other pairs of resource groups. If the similarity is greater than the preset threshold of 0.8, the corresponding position in the adjacency matrix is ​​marked as 1, indicating that the two resource groups are adjacent. Otherwise, it is marked as 0. The adjacency matrix obtained by calculation is [[0,1,0],[1,0,0],[0,0,0]], indicating that resource groups A and B are adjacent.

[0109] For the identified adjacent resource groups A and B, the system extracts the identification information and permission proof from their respective permission certificates and concatenates them with the current system timestamp to form a cascading sequence. Assuming that resource group A's permission certificate is identified by "ResA_ID123" and its permission proof is "AccessLevel_5," and resource group B's permission certificate is identified by "ResB_ID456" and its permission proof is "AccessLevel_3," and the current system timestamp is "1650284562," the cascading sequence is "ResA_ID123_AccessLevel_5_ResB_ID456_AccessLevel_3_1650284562."

[0110] The system performs a SHA-256 hash operation on the concatenated sequence to obtain a first hash value. The concatenated sequence is processed by SHA-2567: the original string length is 504 bits, one "1" bit is added, zeros are padded until the modulo 512 equals 448, and the 64-bit original length value 504 is added to obtain a padded 512-bit message block; eight 32-bit hash values ​​of the SHA-256 algorithm are initialized: h0 is assigned to 0x6a09e667, h1 is assigned to 0xbb67ae85, h2 is assigned to 0x3c6ef372, h3 is assigned to 0xa54ff53a, h4 is assigned to 0x510e527f, h5 is assigned to 0x9b05688c, h6 is assigned to 0x1f83d9ab, and h7 is assigned to 0x5be0cd19;

[0111] Execute 64 rounds of compression function operations. In the first round, the value of register a is 0x6a09e667, and the value of register h is 0x5be0cd19. After the last round, the value of register a is updated to 0xa1b2c3d4, and the value of register h is updated to 0x8e7d6c5b. Update 8 32-bit hash values: h0 is updated to 0xa1b2c3d4, h1 is updated to 0xe5f6g7h8, h2 is updated to 0xi9j8k7l6, and h3 is updated to 0xm 5n4o3p2, the value of h4 is updated to 0xq1r0s9t8, the value of h5 is updated to 0xu7v6w5x4, the value of h6 is updated to 0xy3z2a1b0, and the value of h7 is updated to 0x8e7d6c5b; the updated 8 32-bit hash values ​​are concatenated in sequence to obtain the first hash value a1b2c3d4e5f6g7h8i9j8k7l6m5n4o3p2q1r0s9t8u7v6w5x4y3z2a1b08e7d6c5b4a.

[0112] Split the first hash value into the left half, "a1b2c3d4e5f6g7h8i9j8k7l6m5n4o3p2" (first 128 bits), and the right half, "q1r0s9t8u7v6w5x4y3z2a1b08e7d6c5b4a" (last 128 bits). Perform an MD5 hash operation on the left half to obtain the intermediate hash value, "f7e6d5c4b3a2m1n0p9q8r7s6t5u4v3w2x1y0" (128 bits). Perform an XOR operation on the intermediate hash value and the right half: if the corresponding binary bits are the same, the result is 0; if they are different, the result is 1, resulting in the second hash value, "k9h8g7f6e5d4c3b2a1z0y9x8w7v6u5t4s3r2" (128 bits).

[0113] The system generates a random salt value based on the preset encryption key "SecurityKey_876" and the current system timestamp "1650284562." The encryption key and timestamp are concatenated, and a pseudo-random number generator is used to calculate the random salt value "r2s3t4u5v6w7x8y9z0a1b2c3d4e5f6g7h8i9." The second hash value and the random salt value are alternately divided into multiple data blocks. For example, the first block uses the first 16 bits of the second hash value "k9h8g7f6", the second block uses the first 16 bits of the random salt value "r2s3t4u5", the third block uses the next 16 bits of the second hash value "e5d4c3b2", and so on, for a total of 16 data blocks. Hash operations are performed on these 16 data blocks in sequence: the first block is hashed directly, the second block is hashed after being concatenated with the hash result of the first block, and the third block is hashed after being concatenated with the hash result of the second block. In each round, the current data block is concatenated with the hash result of the previous round to calculate a new hash value, and the certificate hash value is obtained: x7y8z9a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5.

[0114] The system divides the timeline into multiple time windows, for example, one window per hour. Suppose that over the past 24 hours, the number of interactive accesses between resource groups A and B in each time window is [5, 8, 12, 7, 4, 2, 3, 6, 9, 11, 15, 10, 8, 7, 5, 3, 2, 4, 6, 8, 10, 9, 7, 6]. Calculate the access frequency of the time window, that is, the number of visits in each window divided by the total number of visits 167, and get [0.03, 0.048, 0.072, 0.042, 0.024, 0.012,0.018, 0.036, 0.054, 0.066, 0.09, 0.06, 0.048, 0.042, 0.03, 0.018, 0.012,0.024, 0.036, 0.048, 0.06, 0.054, 0.042, 0.036].

[0115] The system multiplies the access frequency by a smoothing factor of 0.5 and then performs an exponential operation to obtain the access frequency index. Taking the first window as an example, 0.03 × 0.5 = 0.015, and e^0.015 ≈ 1.015. Similarly, the exponential values ​​for all windows are calculated as [1.015, 1.024, 1.037, 1.021, 1.012, 1.006, 1.009, 1.018, 1.027, 1.034, 1.046, 1.03, 1.024, 1.021, 1.015, 1.009, 1.006, 1.012, 1.018, 1.024, 1.03, 1.027, 1.021, 1.018]. Multiplying these index values ​​together yields a comprehensive access frequency index value of 1.015×1.024×...×1.018≈1.52.

[0116] Finally, the certificate hash value "x7y8z9a1b2..." is converted to the value 3856204731 (by taking its hexadecimal value) and multiplied by the access frequency index value of 1.52 to obtain the certificate association value 5861431192.12. This certificate association value represents the comprehensive relationship between the degree of association and access frequency of adjacent resource group permission certificates and can be used in subsequent scenarios such as permission allocation, resource scheduling, and security risk assessment.

[0117] Through the above method, the system realizes the organic integration of secure hash processing of permission certificates of adjacent resource groups and access frequency, effectively improving the security and accuracy of resource access control.

[0118] In an optional implementation, a certificate verification program is deployed in a distributed node network. The verification program continuously updates the session key using a verifiable random function. The nodes collaborate to complete the certificate verification through a sharding mechanism, including:

[0119] Obtaining a verification rule sequence for the authority certificate, extracting logical dependencies between the rules, and constructing a rule verification directed graph; marking a target verification path in the rule verification directed graph, dividing the authority certificate into multiple certificate shards according to the target verification path, and assigning verification weights to the certificate shards;

[0120] Select available nodes from the set of verification nodes, analyze the nodes' computing power and network latency, and generate a node performance score; construct a two-dimensional index structure for the verification nodes based on the node performance score, the two-dimensional index structure comprising a computing dimension and a communication dimension; map the certificate shards to the two-dimensional index structure using a consistent hashing algorithm to generate an optimal shard distribution plan; distribute the certificate shards among the verification nodes according to the shard distribution plan, and the verification nodes store the certificate shards in a secure storage area;

[0121] Obtain the node private key of the current timestamp of the verification node, input the node private key and the current timestamp as random sources into a verifiable random function, generate a session key seed according to the verification period, perform key derivation on the session key seed, and integrate the certificate shard identification information of the verification node to generate a shard verification key; determine the key update period according to the verification weight of the certificate shard; the verification node uses the shard verification key to decrypt the certificate shard, generate a shard verification result, and perform weighted summation according to the verification weight of the certificate shard to obtain the authority certificate verification result.

[0122] The present invention provides a distributed node network certificate verification method, which includes core technologies such as certificate verification rule analysis, node performance evaluation, certificate sharding distribution and security verification mechanism.

[0123] During the certificate verification process, the system obtains the certificate's verification rule sequence. For example, a certificate may contain multiple verification rules, such as digital signature verification, certificate chain verification, and revocation status check. By analyzing these rules, the system extracts the logical dependencies between the rules and constructs a rule verification directed graph. The nodes in this directed graph represent the verification rules, and the edges represent the dependencies between the rules. For a certificate containing 10 verification rules, the system creates a directed graph with 10 nodes. Digital signature verification is a prerequisite for other verifications, represented in the graph as multiple edges pointing from this node to other nodes.

[0124] Based on the verification scenario requirements, the system marks the target verification path in the rule verification directed graph. For example, for high-security access requests, the system selects a path that includes all key verification rules; for low-risk operations, it selects a lighter verification path. Based on the target verification path, the system divides the authority certificate into multiple certificate shards. A typical division divides a 2048-bit RSA certificate into four 512-bit shards. At the same time, the system assigns verification weights to each shard based on its importance in the verification process. For example, the shard that includes digital signature verification has a weight of 0.4, while the shard that includes validity period check has a weight of 0.2.

[0125] At the node management level, the system selects available nodes from the set of validating nodes. For each node, the system verifies its availability through heartbeat checks and analyzes its computing power and network latency through test tasks. For example, the system records the time it takes a node to complete a standard validation task (e.g., 50 milliseconds) and the communication latency (e.g., 30 milliseconds). Based on this data, the system generates a node performance score. The performance score is based on a 100-point scale, with computing power and communication performance each accounting for 50% of the score.

[0126] The system constructs a two-dimensional index structure for validator nodes based on node performance scores. This structure ranks nodes from highest to lowest computing power in the computational dimension and from lowest to highest network latency in the communication dimension. For example, a network with 100 validator nodes is divided into a 10×10 grid in the two-dimensional index structure. The system then maps certificate shards to the two-dimensional index structure using a consistent hashing algorithm. This algorithm ensures that the distribution of shards remains relatively stable even as the number of nodes changes, reducing redistribution overhead.

[0127] Based on the mapping results, the system generates an optimal shard distribution plan. In this plan, high-weight certificate shards are assigned to nodes with better performance to ensure efficient execution of critical verification tasks. The system distributes the certificate shards to the corresponding verification nodes, which store the shards in secure storage areas such as trusted execution environments or encrypted storage areas.

[0128] To ensure the security of the verification process, the system implements a session key update mechanism based on a verifiable random function. The validating node obtains the node's private key with the current timestamp (e.g., 1635724800, representing 00:00:00 UTC on November 1, 2021) and inputs this private key and the timestamp into a verifiable random function as a source of randomness. This function generates a deterministic but unpredictable output value, which serves as the session key seed. For example, for the input private key and timestamp combination, the function outputs a 256-bit pseudo-random value.

[0129] The system generates a new session key seed at a predetermined verification interval (e.g., every four hours). It performs a key derivation operation on the session key seed and incorporates the shard identification information from the validating node's certificate to generate a shard verification key. For example, the system uses HKDF (HMAC-based key derivation function) to derive a shard-specific key from the session key seed.

[0130] The verification weight of a certificate shard also determines the rekeying cycle. Shards with higher weights have more frequent rekeying. For example, a shard with a weight of 0.4 rekeys every 2 hours, while a shard with a weight of 0.1 rekeys every 8 hours. The validator uses the shard verification key to decrypt the corresponding certificate shard, executes the verification logic, and generates a shard verification result, typically a value between 0 and 1 indicating the degree of verification success for that shard.

[0131] Finally, the system performs a weighted summation of the shard verification results based on the verification weight of each shard. For example, if the verification results of the four shards are 1.0, 0.8, 1.0, and 0.9, and the weights are 0.4, 0.2, 0.3, and 0.1, respectively, the weighted sum is 0.4 × 1.0 + 0.2 × 0.8 + 0.3 × 1.0 + 0.1 × 0.9 = 0.93. The system uses this result as the final verification result of the authority certificate and determines whether the certificate verification has passed based on a preset threshold (such as 0.9).

[0132] The multi-level dynamic authorization and access control system based on identity tokens in an embodiment of the present invention includes:

[0133] The first unit is used to receive a user identity token request, generate a user master token and bind it to the terminal device; verify the legitimacy of the user master token and the device binding relationship, and receive and resolve the user's resource access request after verification;

[0134] The second unit is configured to construct a resource access domain knowledge graph containing user, resource, and operation entity nodes based on the user resource access request; perform feature encoding on the knowledge graph and obtain knowledge enhancement features by calculating normalization coefficients and weighted summation; generate a state vector based on the knowledge enhancement features and combine it with the user's historical access behavior, calculate the state transition probability, and use temporal difference learning to predict the probability of user access intention to achieve dynamic grouping of target resources;

[0135] The third unit is used to generate an independent permission certificate for each resource group using a homomorphic encryption algorithm, and to achieve verifiability of the permission certificate through a zero-knowledge proof protocol; a certificate verification program is deployed in a distributed node network, and the verification program continuously updates the session key through a verifiable random function, and the nodes collaborate to complete the certificate verification through a sharding mechanism; when any node detects abnormal access behavior, it broadcasts an early warning message to the entire network through the Byzantine fault tolerance protocol, and initiates the revocation of the distributed permission certificate after receiving confirmation from more than two-thirds of the nodes.

[0136] According to a third aspect of an embodiment of the present invention, an electronic device is provided, including:

[0137] processor;

[0138] a memory for storing processor-executable instructions;

[0139] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0140] According to a fourth aspect of an embodiment of the present invention, a computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the method described above is implemented.

[0141] The present invention may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present invention.

[0142] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A multi-level dynamic authorization and access control method based on identity tokens, characterized in that: include: Receive user identity token request, generate user master token and bind it to terminal device; Verify the legitimacy of the user's primary token and the device binding relationship. After verification, receive and resolve the user's resource access request; Based on the user resource access request, construct a resource access domain knowledge graph including user, resource and operation entity nodes; Perform feature encoding on the knowledge graph and obtain knowledge enhancement features by calculating normalization coefficients and weighted summation; Based on the knowledge enhancement features, the state vector is generated in combination with the user's historical access behavior, and the state transition probability is calculated. Temporal difference learning is used to predict the probability of user access intention to achieve dynamic grouping of target resources; A homomorphic encryption algorithm is used to generate an independent permission certificate for each resource group, and the verifiability of the permission certificate is achieved through a zero-knowledge proof protocol. A certificate verification program is deployed on the distributed node network. The verification program continuously updates the session key through a verifiable random function, and the nodes collaborate to complete the certificate verification through a sharding mechanism. When any node detects abnormal access behavior, it broadcasts warning information to the entire network through the Byzantine fault tolerance protocol. After receiving confirmation from more than two-thirds of the nodes, it initiates the revocation of the distributed authority certificate.

2. The method according to claim 1, characterized in that Based on the user resource access request, construct a resource access domain knowledge graph including user, resource and operation entity nodes; The knowledge graph is feature encoded and the knowledge enhancement features are obtained by calculating the normalization coefficient and weighted sum, including: Extracting a user's portrait feature vector, a resource attribute feature vector, and an environment context feature vector based on the user's resource access request; Extract user entity nodes based on the user's portrait feature vector, extract resource entity nodes based on the resource attribute feature vector, and extract operation entity nodes based on the environment context feature vector. Establish semantic relationship edges between entity pairs that interact among the user entity node, the resource entity node, and the operation entity node to generate a resource access domain knowledge graph. For each node in the resource access domain knowledge graph, the normalization coefficient between the node and its neighbor node set is calculated, the features of the neighbor node set are weighted and summed based on the normalization coefficient, and the feature representation of the node is updated through nonlinear transformation. This process is repeated until the update amplitude of the feature representation of all nodes is less than the convergence threshold, and the knowledge enhancement feature of each node is obtained.

3. The method according to claim 1, characterized in that Based on the knowledge enhancement features, the state vector is generated in combination with the user's historical access behavior, and the state transition probability is calculated. Temporal difference learning is used to predict the probability of user access intention, realizing dynamic grouping of target resources, including: Obtain the user's historical access behavior and calculate the temporal attention weight of the historical access behavior; based on the temporal attention weight, perform weighted summation on the knowledge enhancement features of each historical access behavior to obtain a temporal feature; input the temporal feature into the gated recurrent unit, and the gated recurrent unit updates the state vector at the current moment based on the state vector at the previous moment and the temporal feature at the current moment; Based on the resource access domain knowledge graph, extract the feature vector of each resource in the user-accessible resource set, perform weighted fusion with the current state vector, and obtain the transition probability of the current state through sigmoid function mapping; Obtain the next state based on the user's historical access behavior, calculate the state transition probability of each resource in the next state, select the largest state transition probability and multiply it by the time series attenuation factor to obtain the expected return; The state action value is obtained by weighted summing the current state transition probability and the expected benefit. The Q value is updated based on the temporal difference learning rate. The Q value represents the expected long-term benefit of the user accessing each resource in the current state. The access behavior randomness parameter is introduced to adjust the Q value. The adjusted Q value is normalized by the softmax function to obtain the probability of the user's access intention to different resources. The cosine similarity between target resources based on access intention probability is calculated, and target resources with cosine similarity greater than the resource clustering threshold are aggregated into the same resource group to complete dynamic grouping of resources.

4. The method according to claim 1, wherein A homomorphic encryption algorithm is used to generate an independent permission certificate for each resource group, and the verifiability of the permission certificate is achieved through a zero-knowledge proof protocol, including: Extract the permission characteristic value of each resource group and generate a permission certificate; perform homomorphic encryption on the permission characteristic value based on a random number sequence to obtain an encrypted permission value; Obtain a system master key and a current timestamp, concatenate the system master key and the current timestamp, and perform a hash operation on them to obtain a base key; calculate the access frequency of the resource group based on the historical access records of the resource group, and multiply it by the base key to obtain a resource group private key; combine the resource group identification information, encrypted permission value, permission certificate, resource group private key, and current timestamp to generate a permission certificate; For adjacent resource groups, their authority certificates are concatenated and hashed to obtain a certificate hash value, and the certificate hash value is multiplied by the exponential operation result of the access frequency between the resource groups to obtain a certificate association value; a permission validity certificate is generated based on the encrypted authority value, a timeliness certificate is generated based on the current timestamp, and an association verification certificate is generated based on the certificate association value; Based on the accuracy of historical verification results and the frequency of resource group access, the verification weight value of each resource group is calculated; the verification weight value is multiplied by the permission validity proof, timeliness proof and associated verification proof, and the sum is calculated to obtain the certificate score. When the certificate score is greater than the certificate trust threshold, the permission certificate is confirmed to be valid and the user can access the resource group.

5. The method according to claim 4, characterized in that For adjacent resource groups, their authority certificates are concatenated and hashed to obtain a certificate hash value, and the certificate hash value is multiplied by the exponential operation result of the access frequency between resource groups to obtain a certificate association value, including: Calculate the cosine similarity between resource group identification information to generate a resource group adjacency matrix; extract the identification information and permission certificates from the adjacent resource group permission certificates and concatenate them with the current system timestamp to form a cascade sequence; Performing a SHA-256 hash operation on the concatenated sequence to obtain a first hash value, dividing the first hash value into a left half and a right half, performing an MD5 hash operation on the left half to obtain an intermediate hash value, and performing an XOR operation on the intermediate hash value and the right half to obtain a second hash value; Generate a random salt value based on a preset encryption key and the current system timestamp; alternately divide the second hash value and the random salt value into multiple data blocks, and perform hash operations on the multiple data blocks in sequence to obtain a certificate hash value; The time axis is divided into multiple time windows, the number of interactive visits of the adjacent resource groups in each time window is counted, the access frequency of the time window is calculated, the access frequency is multiplied by the smoothing factor and then an exponential operation is performed to obtain an access frequency index value; the certificate hash value is multiplied by the access frequency index value to obtain a certificate association value.

6. The method according to claim 1, characterized in that A certificate verification program is deployed on a distributed node network. The verification program continuously updates the session key through a verifiable random function. The nodes collaborate to complete the certificate verification through a sharding mechanism, including: Obtaining a verification rule sequence for the authority certificate, extracting logical dependencies between the rules, and constructing a rule verification directed graph; marking a target verification path in the rule verification directed graph, dividing the authority certificate into multiple certificate shards according to the target verification path, and assigning verification weights to the certificate shards; Select available nodes from the set of verification nodes, analyze the nodes' computing power and network latency, and generate a node performance score; construct a two-dimensional index structure for the verification nodes based on the node performance score, the two-dimensional index structure comprising a computing dimension and a communication dimension; map the certificate shards to the two-dimensional index structure using a consistent hashing algorithm to generate an optimal shard distribution plan; distribute the certificate shards among the verification nodes according to the shard distribution plan, and the verification nodes store the certificate shards in a secure storage area; Obtain the node private key of the current timestamp of the verification node, input the node private key and the current timestamp as random sources into a verifiable random function, generate a session key seed according to the verification period, perform key derivation on the session key seed, and integrate the certificate shard identification information of the verification node to generate a shard verification key; determine the key update period according to the verification weight of the certificate shard; the verification node uses the shard verification key to decrypt the certificate shard, generate a shard verification result, and perform weighted summation according to the verification weight of the certificate shard to obtain the authority certificate verification result.

7. A multi-level dynamic authorization and access control system based on identity tokens, used to implement the method according to any one of claims 1 to 6, characterized in that: include: The first unit is used to receive a user identity token request, generate a user master token and bind it to the terminal device; Verify the legitimacy of the user's primary token and the device binding relationship. After verification, receive and resolve the user's resource access request; The second unit is used to construct a resource access domain knowledge graph including user, resource and operation entity nodes based on the user resource access request; Perform feature encoding on the knowledge graph and obtain knowledge enhancement features by calculating normalization coefficients and weighted summation; Based on the knowledge enhancement features, the state vector is generated in combination with the user's historical access behavior, and the state transition probability is calculated. Temporal difference learning is used to predict the probability of user access intention to achieve dynamic grouping of target resources; The third unit is used to generate an independent permission certificate for each resource group using a homomorphic encryption algorithm and to verify the permission certificate through a zero-knowledge proof protocol. Deploy a certificate verification program on a distributed node network. The verification program continuously updates the session key through a verifiable random function, and nodes collaborate to complete certificate verification through a sharding mechanism. When any node detects abnormal access behavior, it broadcasts warning information to the entire network through the Byzantine fault tolerance protocol. After receiving confirmation from more than two-thirds of the nodes, it initiates the revocation of the distributed authority certificate.

8. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images