Multi-tenant multi-user login method based on enhanced OAuth2

Abstract

The invention provides a multi-tenant multi-user login method based on enhanced OAuth2, which relates to the technical field of network security, and comprises the following steps: obtaining a key threshold through a tenant identifier, and executing OAuth2 authentication to obtain an access token; tenant fingerprint information is generated through zero-knowledge proof and homomorphic encryption, and a tenant verification token is generated through secure multi-party calculation; constructing a reinforcement learning access controller in combination with the historical access data, and generating and verifying an authority list; and finally forming a session identifier and storing the session identifier in a distributed cache. According to the invention, the authentication security is improved, cross-tenant fine-grained authority management is realized, and unauthorized access is effectively prevented.

Description

Technical Field

[0001] This invention relates to network security technology, and more particularly to a multi-tenant, multi-user login method based on enhanced OAuth2. Background Technology

[0002] With the widespread adoption of cloud computing and SaaS services, multi-tenant architecture has become a standard design pattern for modern enterprise applications. Under this architecture, the same software system needs to serve multiple tenants and a large number of users simultaneously, posing significant challenges to identity authentication and access control. The main shortcomings and deficiencies of existing technologies include: The standard OAuth2 protocol lacks an effective tenant isolation mechanism and cannot strictly distinguish the identity and permission scope of different tenants at the token level, which increases the risk of cross-tenant access, especially in multi-tenant environments with shared infrastructure. Once the access token is stolen, attackers may gain unauthorized access to resources of multiple tenants.

[0003] The permission management model adopts a static configuration method, which cannot dynamically adjust the permission policy according to user behavior patterns and context information, leading to problems such as over-authorization or permission spread. It cannot meet the needs of modern applications for fine-grained and dynamic permission control, especially in enterprise environments where user roles and business scenarios change frequently.

[0004] Existing authentication and authorization systems typically store sensitive credentials centrally, creating a single point of failure risk. Furthermore, they lack sufficient security mechanisms for key management. Once a key is leaked, the security of the entire system will be seriously threatened. At the same time, they are also unable to cope with increasingly complex network attack methods, such as replay attacks and man-in-the-middle attacks. Summary of the Invention

[0005] This invention provides a multi-tenant, multi-user login method based on enhanced OAuth2, which can solve the problems in the prior art.

[0006] A first aspect of this invention provides a multi-tenant, multi-user login method based on enhanced OAuth2, comprising: The tenant key threshold is obtained based on the tenant identifier in the login request, and the access token is obtained by performing standard OAuth2 authentication based on the user identifier. A tenant key proof is generated based on a zero-knowledge proof protocol and the tenant key threshold; the tenant key proof and the access token are encrypted using a homomorphic encryption algorithm to generate tenant fingerprint information; the master key is fragmented and stored in the key management node; a tenant verification token is generated based on the tenant fingerprint information through secure multi-party computation by the key management node; the tenant verification token and the access token are combined and encrypted to generate an enhanced access token. Obtain historical access data of users under a tenant; based on the historical access data, construct a reinforcement learning access controller, taking user behavior as the observation state and permission operations as the action space; collect real-time user behavior data, and the access controller continuously learns based on the real-time behavior data to generate an initial permission list; perform anomaly detection on the initial permission list, and generate a fine-grained permission list in combination with the tenant verification token. A session identifier is generated based on the enhanced access token and the fine-grained permission list, and the session identifier and authentication authorization information are stored in a distributed cache.

[0007] The steps for generating a tenant key proof based on a zero-knowledge proof protocol and the tenant key threshold include: Obtain the tenant security level and tenant resource sensitivity associated with the tenant identifier; generate a baseline security value based on the tenant security level and a resource sensitivity coefficient based on the tenant resource sensitivity; generate a tenant key threshold based on the baseline security value, the resource sensitivity coefficient, and a dynamic adjustment factor, wherein the dynamic adjustment factor is calculated by weighting the real-time security threat level, the number of tenant authentication failures, and the frequency of historical attacks. Zero-knowledge proof parameters are generated based on preset elliptic curve parameters, and an interactive commitment value is generated using the zero-knowledge proof parameters and the tenant's private key. A tenant identity commitment is generated based on the tenant's private key and the interaction commitment value. A threshold satisfaction proof is constructed using the tenant key threshold and the interaction commitment value. An auxiliary random value is generated based on a preset group order. The tenant identity commitment, the threshold satisfaction proof, and the auxiliary random value are combined to generate a zero-knowledge proof. The zero-knowledge proof is validated by parameters. When the validation passes, a tenant key proof is generated based on the zero-knowledge proof, the interaction commitment value, and the tenant's private key.

[0008] The steps of storing the master key in fragments to the key management node, and generating a tenant verification token through secure multi-party computation by the key management node based on the tenant fingerprint information include: The master key is fragmented and stored across multiple key management nodes using a hierarchical dynamic threshold scheme. The threshold value and total number of nodes for the hierarchical dynamic threshold scheme are determined based on the load intensity and communication efficiency of the key management nodes. The key management nodes are divided into multiple hierarchical groups based on node computing power scores and network topology distances. A nested polynomial structure is constructed for each hierarchical group, where the constant term of the inner polynomial is set as the master key value, and the coefficients of the outer polynomial are determined by a weighted value of the trustworthiness of the tenant's access behavior and the frequency of resource calls. A unique key fragment is generated for each key management node according to the constructed polynomial and distributed for storage. After processing the tenant fingerprint information for privacy protection, differential privacy calculations are performed in the homomorphic encryption domain through key sharding in each of the key management nodes, and distributed zero-knowledge proofs are executed to generate tenant verification tokens.

[0009] After performing privacy protection processing on the tenant fingerprint information, the steps of generating a tenant verification token by performing differential privacy computation in the homomorphic encryption domain through key fragmentation in each of the key management nodes and executing distributed zero-knowledge proofs include: Extract identity feature vectors and behavioral feature vectors from the tenant fingerprint information, and perform linear transformation to generate privacy-preserving feature fragments; The feature fragment is sent to multiple key management nodes. Each key management node performs a homomorphic inner product operation between the key fragment it holds and the feature fragment in the cryptographic domain, and introduces Laplace-distributed differential privacy noise into the result of the homomorphic inner product operation to obtain a partial verification factor. The computational weight of each key management node is determined based on the trustworthiness of the key management node. The computational weight is then used to perform a secure multi-party summation operation with the corresponding partial verification factor to generate an aggregate verification value. When the number of key management nodes participating in the secure multi-party summation operation reaches a preset threshold, the key management nodes execute a distributed zero-knowledge proof protocol to verify the calculation process of the aggregated verification value, and combine the verified aggregated verification value with the hash value of the identity feature vector to generate a tenant verification token.

[0010] Based on the historical access data, a reinforcement learning access controller is constructed, using user behavior as the observation state and permission operations as the action space; the steps of collecting real-time user behavior data and continuously learning based on the real-time behavior data to generate an initial permission list include: The historical access data is extracted with temporal features, behavioral features, and environmental features. After being segmented by a sliding time window, the data is standardized to obtain standardized features. A reinforcement learning access controller is constructed, and the standardized features are combined into a user state vector. The user state vector includes a temporal feature vector, a behavioral feature vector, and a contextual feature vector. The granting, revocation, and maintenance of permissions are constructed as an action space. A composite reward function is constructed based on security compliance rewards, access efficiency rewards, and risk penalty items. Real-time user behavior data is collected, and the real-time user behavior data is sequence encoded using an attention mechanism to obtain a real-time feature vector. The attention mechanism processes the current query vector and historical behavior key-value pairs. The access controller continuously learns based on the real-time feature vector, updates the access control policy through policy gradient, and calculates the action value based on value function estimation. The confidence level of each permission is calculated based on the action value and consistency of historical behavior. The confidence level is then filtered based on a preset filtering threshold, and conflict resolution is performed using a permission dependency graph to generate an initial permission list.

[0011] The steps of the access controller performing continuous learning based on the real-time feature vector include: The real-time feature vector is input into the dual-channel neural network of the access controller. The first channel constructs a local policy network to extract short-term behavioral features, and the second channel constructs a global policy network to extract long-term behavioral patterns. The policy gradient of the access control policy is calculated based on the outputs of the local policy network and the global policy network. The policy gradient evaluates the historical decision trajectory through importance sampling and introduces an entropy regularization term. A dual-valued function is constructed to calculate the value of the action. The dual-valued function estimates the immediate reward value and the long-term reward value respectively. The time difference error guides the update direction of the access control policy. An adaptive learning rate is set based on the confidence interval theory. When the change in user behavior distribution caused by the update of the access control policy exceeds the preset confidence interval, the learning step size is automatically adjusted to ensure that the access control policy converges stably.

[0012] The steps of performing anomaly detection on the initial permission list and generating a fine-grained permission list in conjunction with the tenant verification token include: Based on the sliding time window analysis, the user's historical access behavior to each permission in the initial permission list is analyzed, the time-series access pattern is calculated, and the time-series access pattern is converted into permission frequency features. The tenant access time constraints are extracted using the tenant verification token, and an access permission rule base is constructed based on a preset time-series rule template. The frequency characteristics of the permissions are matched with the permission access rule base to identify abnormal permissions that do not conform to the time sequence rules; the access time of the abnormal permissions is constrained to generate a time-restricted permission set; the permission set is further divided into fine-grained parts based on the security level in the tenant verification token to generate a fine-grained permission list with time constraints.

[0013] A second aspect of the present invention provides an electronic device, comprising: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0014] A third aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0015] The multi-tenant, multi-user login method based on enhanced OAuth2 provided by this invention protects tenant keys by combining zero-knowledge proofs with homomorphic encryption, realizes the verifiability and security isolation of tenant identities, effectively prevents unauthorized access and identity impersonation across tenants, and significantly improves authentication security in multi-tenant environments.

[0016] The access controller built using reinforcement learning in this invention can dynamically adjust the scope of permissions based on the user's historical behavior, achieving adaptive allocation of permissions. It also filters abnormal operation requests through an anomaly detection mechanism, which improves user experience while ensuring system security and reducing false alarm rate and authentication friction.

[0017] This invention combines an enhanced access token with a fine-grained permission list to generate a session identifier and stores it in a distributed cache, thereby decoupling authentication and authorization, supporting fast permission verification under large-scale concurrent access, and improving system availability and scalability through a distributed architecture, adapting to the complex access control needs in cloud-native multi-tenant environments. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating the multi-tenant, multi-user login method based on enhanced OAuth2 according to an embodiment of the present invention. Figure 2 A flowchart illustrating the key fragmentation storage and verification token generation technology. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0021] Figure 1 This is a flowchart illustrating the multi-tenant, multi-user login method based on Enhanced OAuth2 according to an embodiment of the present invention, as shown below. Figure 1 As shown, the method includes: The tenant key threshold is obtained based on the tenant identifier in the login request, and the access token is obtained by performing standard OAuth2 authentication based on the user identifier. A tenant key proof is generated based on a zero-knowledge proof protocol and the tenant key threshold; the tenant key proof and the access token are encrypted using a homomorphic encryption algorithm to generate tenant fingerprint information; the master key is fragmented and stored in the key management node; a tenant verification token is generated based on the tenant fingerprint information through secure multi-party computation by the key management node; the tenant verification token and the access token are combined and encrypted to generate an enhanced access token. Obtain historical access data of users under a tenant; based on the historical access data, construct a reinforcement learning access controller, taking user behavior as the observation state and permission operations as the action space; collect real-time user behavior data, and the access controller continuously learns based on the real-time behavior data to generate an initial permission list; perform anomaly detection on the initial permission list, and generate a fine-grained permission list in combination with the tenant verification token. A session identifier is generated based on the enhanced access token and the fine-grained permission list, and the session identifier and authentication authorization information are stored in a distributed cache.

[0022] In this embodiment, when a user initiates a login request, a tenant identifier is extracted from the request. This identifier is typically a unique 24-character string. A tenant configuration database is maintained to store security parameters such as tenant key thresholds. The tenant identifier is used as the key to query the database and retrieve the corresponding tenant key threshold. The tenant key threshold defines the number of key fragments and the minimum number of fragments required for reconstruction. For example, if a company tenant's key threshold is configured as (5,3), it means the key is divided into 5 fragments, and at least 3 fragments are needed to reconstruct the complete key. Using the OAuth2 authorization code mode, the user is first redirected to the authorization endpoint of the authentication server. After the user provides identity credentials (such as username, password, or biometrics), the authentication server returns an authorization code. This authorization code is used to request an access token from the token endpoint. The standard OAuth2 access token uses the JWT format and contains information such as user identifier, permission scope, and token expiration time, and is signed by the authentication server's private key. For example, an access token obtained after successful authentication contains the user identifier "u789012", the permission scope "readwrite", and an expiration time of 3600 seconds after the current time.

[0023] Zero-knowledge proofs allow the proof of the validity of a tenant's key without disclosing the key itself. Using the Schnorr protocol, a zero-knowledge proof is constructed, with the proof generation process consisting of three steps: commitment, challenge, and response. The prover first generates a commitment value based on the tenant key and a random number, and sends the commitment value to the verifier. The verifier generates a random challenge value and returns it to the prover. The prover calculates the response value based on the original key, the random number, and the challenge value. The final tenant key proof contains the commitment and response values, and is approximately 64 bytes in size. Homomorphic encryption is used to encrypt the tenant key proof and access token to generate tenant fingerprint information. Homomorphic encryption allows specific operations to be performed on encrypted data without prior decryption. The Paillier homomorphic encryption algorithm is used, employing a 2048-bit key for encryption. The encryption process first concatenates the tenant key proof and access token into a data block of a uniform format, and then applies a homomorphic encryption function to generate ciphertext. Homomorphic encryption ensures that the tenant fingerprint information remains confidential even during transmission and computation, while retaining the ability to perform specific operations on the encrypted data. The generated tenant fingerprint information is an encrypted data block of approximately 512 bytes that can be securely transmitted between different components.

[0024] The Shamir secret sharing scheme is used to implement master key sharding. Based on a tenant key threshold (t, n), the master key is divided into n shards, where any t shards can reconstruct the master key, while fewer than t shards cannot obtain any information about the master key. Each key shard is represented by an (x, y) coordinate pair, where x is the shard index and y is the corresponding shard value. These shards are encrypted and stored on different key management nodes, with each node holding only one shard. For example, for the aforementioned (5, 3) threshold configuration, the master key is divided into 5 shards, stored on 5 independent key management nodes. Tenant verification tokens are generated through secure multi-party computation using tenant fingerprint information. Secure multi-party computation allows multiple participants to jointly compute a function while maintaining the privacy of their respective inputs. Key management nodes are used as computation participants, with each node holding its own key shard. During computation, nodes only exchange intermediate results and do not expose their respective key shards. Specifically, a threshold signature protocol is used, requiring at least t nodes to participate in the computation to generate a valid signature. The result of secure multi-party computation is a tenant authentication token signed using the reconstructed master key, containing information such as tenant identifier, security level, resource scope, and usage restrictions. For example, a tenant's authentication token might contain the tenant identifier "t123456", security level 4 (the highest level among levels 1-5), permitted resource scope, and working time constraints. The tenant authentication token is then encrypted with the access token to generate an enhanced access token. The combination process uses the HMAC-SHA256 algorithm, with the access token as the message and the tenant authentication token as the key, to generate an authentication code. The access token, tenant authentication token, and authentication code are then concatenated and encrypted using the AES-256-GCM algorithm to generate the final enhanced access token. The enhanced access token employs a layered structure: an outer transport encryption layer and an inner layer containing the original access token, tenant authentication token, and integrity verification information. This structure ensures the token's confidentiality, integrity, and non-repudiation.

[0025] Historical access data is extracted from access logs, including user operation records from the past 90 days, to construct a reinforcement learning access controller. The controller employs a Deep Q-Network (DQN) architecture, treating user behavior as the observation state and permission operations as the action space. The observation state is a multi-dimensional vector containing user features, temporal features, and behavioral sequence features. User features include user role, department, and job level; temporal features include current time, workday marker, and time period type; behavioral sequence features include the type, frequency, and time interval of the last 10 operations. The action space defines the executable permission control operations, including granting permissions, denying permissions, and requesting additional verification. Each action corresponds to a permission operation decision. The Deep Q-Network consists of three layers: the input layer corresponds to the state dimension, the hidden layer contains 64 neurons, and the output layer corresponds to the action space size. An experience replay mechanism is used to optimize the learning process, maintaining a 10,000-level experience pool to store state-action-reward-next-state transition samples.

[0026] Real-time behavioral data includes the sequence of actions, resource access requests, and environmental information within the current session. This data is encoded into state vectors and fed into a deep Q-network. The network outputs the Q-value for each action, selecting the action with the highest Q-value as the permission decision. For example, when a user requests access to a sensitive database, recognizing that such operations typically occur during working hours and that the user has a relevant history, temporary access is granted. Each resource and operation combination is evaluated to generate a complete initial permission list. The permission list is represented in JSON format, containing information such as resource identifier, operation type, permission level, and validity period. During continuous learning, the Q-value is updated based on user feedback and operation results, adjusting the permission policy accordingly. For example, if the user successfully completes an operation without triggering a security alert, a positive reward is given; if the operation is flagged as a potential risk by security, a negative reward is given.

[0027] Anomaly detection of the initial permission list uses a hybrid statistical and rule-based approach to calculate a risk score for each permission. The risk score is based on multiple factors: operational sensitivity, user historical behavior deviations, time anomalies, and environmental risks. For example, operations with high sensitivity, rarely performed by the user historically, or requested outside of working hours are assigned a high-risk score. Permissions with risk scores exceeding a threshold are marked as anomalous permissions. Security levels and access restrictions are extracted from tenant authentication tokens to adjust permission granularity and restrictions. For tenants with high security levels, coarse-grained permissions (such as "file management") are subdivided into multiple fine-grained permissions (such as "file read," "file create," etc.). Time constraints are also added to anomalous permissions based on time constraints in the tenant authentication token. For example, a database modification permission might be restricted to use between 9:00 AM and 5:00 PM on weekdays, and each use requires secondary authentication. The final generated fine-grained permission list is more granular and stringent than the initial permission list, especially for high-risk operations.

[0028] A session identifier is a 128-bit random identifier used to uniquely identify a user's current access session. The session identifier is generated using the HMAC-SHA256 algorithm, with the hash value of the enhanced access token and permission list as input. This ensures that the session identifier is bound to a specific user, tenant, and permission set, preventing session hijacking and replay attacks. The session identifier and authentication / authorization information are stored in a distributed cache. Authentication / authorization information includes the enhanced access token, fine-grained permission list, session creation time, and expiration time. The distributed cache uses a consistent hashing algorithm to distribute data across multiple nodes, improving read / write performance and availability. The key of a cache entry is the session identifier, and the value is an encrypted authentication / authorization information packet. The cached content is encrypted using the AES-256-GCM algorithm, and the key is distributed to the authorization service nodes through a secure channel. The cache entry has an appropriate expiration time, typically consistent with the access token's expiration time. When a user requests access to a protected resource, the session identifier is verified, authentication / authorization information is retrieved from the cache, and access is granted based on the fine-grained permission list.

[0029] In one optional implementation, the step of generating a tenant key proof based on a zero-knowledge proof protocol and the tenant key threshold includes: Obtain the tenant security level and tenant resource sensitivity associated with the tenant identifier; generate a baseline security value based on the tenant security level and a resource sensitivity coefficient based on the tenant resource sensitivity; generate a tenant key threshold based on the baseline security value, the resource sensitivity coefficient, and a dynamic adjustment factor, wherein the dynamic adjustment factor is calculated by weighting the real-time security threat level, the number of tenant authentication failures, and the frequency of historical attacks. Zero-knowledge proof parameters are generated based on preset elliptic curve parameters, and an interactive commitment value is generated using the zero-knowledge proof parameters and the tenant's private key. A tenant identity commitment is generated based on the tenant's private key and the interaction commitment value. A threshold satisfaction proof is constructed using the tenant key threshold and the interaction commitment value. An auxiliary random value is generated based on a preset group order. The tenant identity commitment, the threshold satisfaction proof, and the auxiliary random value are combined to generate a zero-knowledge proof. The zero-knowledge proof is validated by parameters. When the validation passes, a tenant key proof is generated based on the zero-knowledge proof, the interaction commitment value, and the tenant's private key.

[0030] For example, tenant security levels are derived from a comprehensive score based on the following multi-dimensional quantitative indicators: data importance (30%), number of accessed sensitive APIs (25%), compliance requirement level (25%), and business criticality (20%). These indicators are standardized and weighted, mapping to three levels: high (80-100 points), medium (50-79 points), and low (0-49 points), corresponding to baseline security values ​​of 100, 60, and 30, respectively. Tenant resource sensitivity is quantified using a resource classification assessment framework. This framework considers data privacy levels (GDPR classification standards), regulatory compliance requirements, and the potential impact of data breaches, generating four levels: extremely sensitive (coefficient 2.0, such as containing payment information), highly sensitive (coefficient 1.5, such as personally identifiable information), moderately sensitive (coefficient 1.2, such as user preference data), and low sensitive (coefficient 1.0, such as publicly available information).

[0031] The dynamic adjustment factor considers three dimensions: real-time security threat level, number of tenant authentication failures, and historical attack frequency. The real-time security threat level is assessed in real-time using anomaly detection algorithms in security monitoring, converting the severity of detected abnormal behavior into a standardized value between 0 and 1. For example, when a large amount of abnormal traffic is detected in the network, this value can be set to 0.8. The number of tenant authentication failures is converted into a weighted value between 0 and 1 using an exponential decay function f(x) = 1 - e^(-x / 5), where x is the number of failures in the last 24 hours. The historical attack frequency is based on attack records against the tenant in the past 30 days, and its weight is calculated using a normalization function g(y) = min(y / 20, 1), where y is the number of attacks. These three dimensions are linearly combined with weights of 0.4, 0.3, and 0.3 respectively to obtain the final dynamic adjustment factor.

[0032] Tenant key threshold = baseline security value × resource sensitivity coefficient × (1 + dynamic adjustment factor). This ensures that the key threshold can be dynamically adjusted according to security requirements.

[0033] To generate zero-knowledge proof parameters, operations are performed based on preset elliptic curve parameters (such as the secp256k1 curve). First, two base points are generated: a primary base point G and an auxiliary base point H, where H is calculated using a secret random number h and G (H = h × G). These points constitute the zero-knowledge proof parameter set. Using these zero-knowledge proof parameters and the tenant's private key sk, an interaction commitment value comm is generated, specifically calculated as comm = sk × G + r × H, where r is the generated random obfuscation factor. The interaction commitment value enables verification operations without directly exposing the private key.

[0034] Based on the tenant's private key `sk` and the generated interaction commitment value `comm`, a tenant identity commitment `id_comm` is constructed, calculated as `id_comm = SHA-256(sk||comm)`. Next, using the previously calculated tenant key threshold `threshold` and the interaction commitment value `comm`, a threshold satisfaction proof `proof_threshold` is constructed. This threshold satisfaction proves that the security strength value of the tenant's private key (calculated as `V = SHA-256(sk)mod(2^32)`) is greater than or equal to the required threshold `threshold`, without revealing the actual value of `V`. Simultaneously, an auxiliary random value `aux` is generated based on a preset elliptic curve group order `n`, with a selection range between 1 and `n-1`. The tenant identity commitment `id_comm`, the threshold satisfaction proof `proof_threshold`, and the auxiliary random value `aux` are combined into a standardized data structure to generate a complete zero-knowledge proof `proof`. Specifically, `id_comm`, `proof_threshold`, and `aux` are serialized sequentially, concatenated, and a type identifier and length prefix are added to form DER format proof data conforming to ASN.1 encoding rules. This structured proof format ensures that each component in the verification process can be accurately identified and processed, while guaranteeing the integrity and immutability of the proof. This zero-knowledge proof contains sufficient information to verify the authenticity of the tenant's identity and compliance with security levels, while also protecting the security of the tenant's private key.

[0035] The validity of the zero-knowledge proof is verified, including checking whether `id_comm` is correctly constructed, whether `proof_threshold` conforms to the range proof verification algorithm, and whether `aux` is within the valid range. After successful verification, the HMAC-SHA256 algorithm is used, with the tenant's private key `sk` as the key, and the zero-knowledge proof `proof` and the interaction commitment value `comm` as the message content, to generate the final tenant key proof `key_proof = HMAC-SHA256(sk, proof||comm)`.

[0036] This invention provides differentiated protection for tenants at different security levels by dynamically adjusting key thresholds and automatically adjusts security policies based on real-time security threats. The application of zero-knowledge proofs ensures authentication is completed without disclosing sensitive information, effectively preventing man-in-the-middle attacks and credential theft. This method significantly improves security verification strength in multi-tenant environments while reducing trust dependencies in traditional methods, providing a higher level of security and compliance support for sensitive business scenarios.

[0037] In one optional implementation, the step of storing the master key in fragments to a key management node, and generating a tenant verification token through secure multi-party computation by the key management node based on the tenant fingerprint information, includes: The master key is fragmented and stored across multiple key management nodes using a hierarchical dynamic threshold scheme. The threshold value and total number of nodes for the hierarchical dynamic threshold scheme are determined based on the load intensity and communication efficiency of the key management nodes. The key management nodes are divided into multiple hierarchical groups based on node computing power scores and network topology distances. A nested polynomial structure is constructed for each hierarchical group, where the constant term of the inner polynomial is set as the master key value, and the coefficients of the outer polynomial are determined by a weighted value of the trustworthiness of the tenant's access behavior and the frequency of resource calls. A unique key fragment is generated for each key management node according to the constructed polynomial and distributed for storage. After processing the tenant fingerprint information for privacy protection, differential privacy calculations are performed in the homomorphic encryption domain through key sharding in each of the key management nodes, and distributed zero-knowledge proofs are executed to generate tenant verification tokens.

[0038] Combination Figure 2 The flowchart illustrating the key sharding storage and verification token generation technology is provided. For example, the load intensity metric for each key management node is calculated. This metric is derived by monitoring the weighted average of the node's CPU utilization, memory usage, and network bandwidth utilization. For instance, if a node has a CPU utilization of 65%, a memory usage of 70%, and a network bandwidth utilization of 50%, with weights set to 0.4, 0.3, and 0.3 respectively, then the load intensity of this node is 65% × 0.4 + 70% × 0.3 + 50% × 0.3 = 62%. Simultaneously, the communication efficiency between nodes is measured, including average response time and data transfer rate. For a node pair with a response time of 15 milliseconds and a data transfer rate of 80 MB / s, its communication efficiency score is calculated to be 85 points (out of 100).

[0039] The threshold determination process uses load intensity and communication efficiency as key input parameters, setting a base threshold ratio of 30%, which is dynamically adjusted based on the load intensity index. Specifically, for every 5 percentage point increase in average load intensity, the threshold increases by 2% of the number of nodes. Simultaneously, considering the impact of communication efficiency, for network environments with a communication efficiency score below 70, an additional 3% threshold is added to address network partitioning and communication latency. For example, in a network containing 100 key management nodes, with an average load intensity of 75% and a communication efficiency score of 65, the base threshold is 30, the load intensity contribution increment is (75%-60%) / 5%×2%×100=6, the communication efficiency contribution increment is 3%×100=3, and the final threshold is 30+6+3=39. The total number of nodes is also determined based on load intensity and communication efficiency, using a resource estimation function to calculate the required number of nodes. This function compares the peak service load with the processing capacity of a single node to determine the basic node requirement, and then adds redundant nodes based on the communication efficiency score. For example, for a service with an estimated peak of 1000 key operations per second and a single node processing capacity of 15 operations per second, the basic node requirement is 1000÷15≈67 nodes. If the communication efficiency score is 80 points and a redundancy rate of 25% is set, the final total number of nodes is determined to be 67×(1+25%)≈84 nodes, which is rounded to 85 nodes.

[0040] The computing power of the key management nodes is scored through a standardized encryption speed test. In the test, a fixed number of RSA encryption / decryption operations and symmetric encryption operations are performed on each node, and the completion time is recorded and converted into a standard score. For example, a node that completes 10,000 RSA-2048 encryption operations in 2 seconds receives a computing power score of 92. Simultaneously, the network topology distance between nodes is measured, calculated using the average round-trip time and network hop count. If the round-trip time from node A to node B is 8 milliseconds and the network hop count is 3, the topology distance is rated as "short distance".

[0041] Based on the aforementioned computing power scores and network topology distances, a hierarchical clustering algorithm is used to divide the key management nodes into multiple hierarchical groups. For example, for 100 nodes, they can be divided into four hierarchical groups: the first level contains 20 high-performance core nodes (scores 90-100); the second level contains 30 medium-performance nodes (scores 80-89); the third level contains 30 medium-performance nodes (scores 70-79); and the fourth level contains 20 basic-performance nodes (scores 60-69). The nodes within each hierarchical group are close in network topology, ensuring efficient communication.

[0042] The inner polynomial of the nested polynomial structure is implemented using the Shamir secret sharing scheme and is a polynomial of order t-1, where t is the inner threshold value. The constant term of the inner polynomial is set as the master key value, such as a 256-bit master key, while the other coefficient terms are randomly generated values. Taking 30 as the inner threshold value as an example, a polynomial of order 29 is constructed, with the constant term set as the master key value, and 29 random coefficients generated to fill the other terms of the polynomial. The outer polynomial is constructed separately for each level group. For the i-th level group, a polynomial of order ni-1 is constructed, where ni is the threshold value for that level. The constant term of the outer polynomial is set to the value of the inner polynomial at that level's identifier point.

[0043] When calculating the coefficients of the outer polynomial, the trustworthiness of tenant access behavior and the frequency of resource calls are considered. Access behavior trustworthiness is calculated by analyzing the consistency of tenant's historical access behavior, anomaly detection results, and authentication success rate, with a value ranging from 0 to 1. For example, if a tenant's access pattern is consistent over the past 30 days, with no abnormal behavior and an authentication success rate of 98%, its access behavior trustworthiness is rated as 0.92. Resource call frequency is determined by recording the number of times a tenant calls a resource and comparing it to the average level. For example, if a tenant calls the API an average of 15 times per minute over the past 24 hours, while the average is 10 times per minute, its standardized resource call frequency is 1.5.

[0044] The access behavior trustworthiness and standardized resource call frequency are weighted and averaged to calculate a weight factor. The weight calculation formula is: Weight factor = Access behavior trustworthiness × 0.6 + Standardized resource call frequency × 0.4. For the above tenant, the weight factor = 0.92 × 0.6 + 1.5 × 0.4 = 1.152. The weight factor is converted into the coefficient values ​​of the outer polynomial through a mapping function to ensure that the key fragments generated by the coefficients corresponding to high-trust tenants are more stable and reliable.

[0045] Each key management node is assigned a unique identifier. This identifier is then substituted into the outer polynomial of the corresponding level group to calculate the key fragment for that node. For example, the key fragment of a node identified as 42 in the second level is the function value of the outer polynomial of the second level at x=42. The key fragment is securely transmitted to each node via a TLS encrypted channel. Upon receiving the key fragment, each node encrypts and stores it using its local key and sets access control policies to restrict access to the key fragment.

[0046] When processing tenant fingerprint information, privacy protection is implemented first. Device characteristics, behavioral patterns, and access history data are extracted from the tenant fingerprint information, and feature hashing technology is applied to convert the fingerprint information into a fixed-length feature vector. For sensitive information such as IP addresses, obfuscation is applied, converting precise IP addresses into region-level information. For device identifiers, salted hashing is used with added random perturbation. For access time patterns, precise time points are converted into time-period distribution statistics. For example, the precise pattern of "accessing at 9:05 AM every day" is converted into the obfuscated feature of "high access frequency on weekday mornings".

[0047] The processed tenant fingerprint information is encrypted and distributed to the key management nodes participating in the computation. A homomorphic encryption scheme is employed, allowing necessary computational operations to be performed on the data even in an encrypted state. Each node uses its own key fragment to perform homomorphic operations on the encrypted fingerprint information, obtaining partial verification results. During the computation process, nodes introduce random noise following a Laplace distribution to achieve differential privacy protection. For example, for a certain statistical value v, the node adds Laplace noise with a mean of 0 and a scaling parameter of Δf / ε, where Δf is the sensitivity and ε is the privacy budget, typically set to a value between 0.1 and 1.

[0048] After each node completes a homomorphic computation with differential privacy, it executes a distributed zero-knowledge proof protocol. Each node generates a partial proof based on its own key fragment, proving that it correctly executed the computation process and holds a valid key fragment without revealing its contents. Once a minimum number of valid partial proofs are collected, these partial proofs are combined using an aggregation algorithm to generate a complete tenant verification token. This token contains the tenant's identity, access permissions, validity period, and the collective signature of the key management nodes; it is verifiable but difficult to forge.

[0049] This invention achieves highly secure distributed storage of master keys through a hierarchical dynamic threshold scheme and a nested polynomial structure, effectively preventing single points of failure and internal threats. This scheme significantly improves authentication strength in multi-tenant environments while maintaining good performance and scalability, providing a higher level of security for sensitive business scenarios.

[0050] In one optional implementation, after privacy-preserving processing of the tenant fingerprint information, the steps of performing differential privacy computation in the homomorphic encryption domain through key fragmentation in each of the key management nodes, and generating a tenant verification token by executing distributed zero-knowledge proof include: Extract identity feature vectors and behavioral feature vectors from the tenant fingerprint information, and perform linear transformation to generate privacy-preserving feature fragments; The feature fragment is sent to multiple key management nodes. Each key management node performs a homomorphic inner product operation between the key fragment it holds and the feature fragment in the cryptographic domain, and introduces Laplace-distributed differential privacy noise into the result of the homomorphic inner product operation to obtain a partial verification factor. The computational weight of each key management node is determined based on the trustworthiness of the key management node. The computational weight is then used to perform a secure multi-party summation operation with the corresponding partial verification factor to generate an aggregate verification value. When the number of key management nodes participating in the secure multi-party summation operation reaches a preset threshold, the key management nodes execute a distributed zero-knowledge proof protocol to verify the calculation process of the aggregated verification value, and combine the verified aggregated verification value with the hash value of the identity feature vector to generate a tenant verification token.

[0051] For example, the identity feature vector extracted from tenant fingerprint information includes static identity features such as device hardware identifiers, account history information, and authentication credential features, typically constructed as a 128-dimensional vector. For instance, a tenant's device hardware identifier includes processor serial number hashes, network adapter MAC address hashes, and hard drive serial number hashes; account history information includes account creation time, historical login location distribution, and password change frequency; authentication credential features include biometric templates and two-factor authentication usage patterns. The behavioral feature vector includes dynamic behavioral features such as access patterns, operating habits, and resource usage preferences, typically constructed as a 64-dimensional vector. For instance, a tenant's access patterns include daily access time distribution, average session duration, and page access order features; operating habits include keyboard input rate, mouse movement characteristics, and functional module usage preferences; resource usage preferences include distribution of frequently used API calls, data access frequency, and query pattern features.

[0052] The extracted feature vectors are transformed into feature fragments using a random projection matrix, generated based on a security seed value, with twice the dimension of the original feature vectors. The 128-dimensional identity feature vector and the 64-dimensional behavior feature vector are merged into a 192-dimensional joint feature vector, which is then transformed using a 384×192-dimensional random projection matrix to obtain a 384-dimensional transformed vector. This vector is then uniformly divided into multiple feature fragments, the number of which is the same as the number of key management nodes participating in the computation. For example, if there are 12 key management nodes participating in the computation, each node is assigned a 32-dimensional feature fragment. The linear transformation process preserves the similarity relationships of the original features while preventing the inference of original feature information from individual feature fragments, thus achieving data privacy protection.

[0053] The feature fragment is sent to multiple key management nodes via a TLS 1.3 encrypted channel. Each node processes the received feature fragment using Paillier homomorphic encryption, supporting addition and scalar multiplication operations in the encrypted state. Upon receiving the 32-dimensional encrypted feature fragment, a node can perform calculations without decryption. Each node locally stores the corresponding 32-dimensional key fragment value. The node performs a homomorphic multiplication operation on each encrypted feature value a number of times the key fragment value is represented, effectively multiplying the feature value and the key fragment value in the encrypted state. After completing the multiplication of the 32-dimensional data, the node utilizes the addition property of homomorphic encryption to perform homomorphic addition on the 32 encrypted products, obtaining the final homomorphic inner product encrypted value.

[0054] After calculating the homomorphic inner product, the key management node introduces differential privacy noise following a Laplace distribution into the result. The node first calculates the sensitivity of the homomorphic inner product operation, which is the maximum output change caused by a single input change. For 32-dimensional feature fragments and key slices, if each dimension ranges from 0 to 1, the sensitivity is calculated to be 32. The node generates random noise following a Laplace distribution based on a preset privacy budget ε (usually set to a value between 0.5 and 1) and the sensitivity. The noise scaling parameter is set to the sensitivity divided by the privacy budget value; for example, with a sensitivity of 32 and a privacy budget of 0.8, the noise scaling parameter is 40. The noise generated by the node is added to the homomorphic inner product result, forming a partial verification factor. Differential privacy noise ensures that even if an attacker obtains multiple calculation results, they cannot accurately infer the original feature information.

[0055] The trustworthiness of a key management node is determined through a comprehensive evaluation of its historical performance, hardware security level, and network environment security. Historical performance includes node operational stability, response time consistency, and the accuracy of past verification results. Hardware security level assesses whether the node is equipped with secure hardware such as a trusted execution environment and secure encryption chips. Network environment security considers the protection level of the network in which the node resides and historical security incidents. Node trustworthiness is converted into a weighted value between 0 and 1, with nodes having higher trustworthiness receiving higher weights. For example, if three nodes have trustworthiness scores of 95, 88, and 82, their normalized weights would be 0.36, 0.33, and 0.31, respectively.

[0056] Each key management node performs a secure multi-party summation operation using a calculated weight and a corresponding partial verification factor. Employing a secret-sharing mechanism, each node multiplies its partial verification factor by the calculated weight to obtain a weighted verification factor. The node decomposes the weighted verification factor into the sum of multiple random values, retains one, and encrypts and transmits the other random values ​​to other participating nodes. Each node aggregates all received random values ​​with its retained random value to obtain a local aggregation result. The sum of all nodes' local aggregation results is the final aggregated verification value. This process ensures that no single node can know the partial verification factors of other nodes.

[0057] When the number of key management nodes participating in the secure multi-party summation operation reaches a preset threshold, the distributed zero-knowledge proof protocol uses non-interactive proofs. The proving party (each key management node) proves that it has correctly executed the verification computation and holds a valid key fragment without revealing its contents. Each node generates a proof of the computation process, including a proof of feature fragment reception, a proof of homomorphic inner product calculation, and a proof of differential privacy addition. Other nodes verify the validity of these proofs to ensure the integrity and correctness of the computation process. For example, a proof generated by a node might show that it indeed received the assigned 32-dimensional feature fragment, correctly performed the homomorphic inner product calculation, and added differential privacy noise as required.

[0058] After successful verification, the aggregated verification value is combined with the hash value of the identity feature vector to generate a tenant verification token. A secure hash algorithm (such as SHA-256) is used to calculate the hash value of the identity feature vector, producing a fixed-length unique identifier. This identifier is combined with the aggregated verification value, timestamp, and access permission level information, and signed using the collective signature of the key management nodes participating in the calculation to generate the final tenant verification token. The tenant verification token structure includes: a token header (version information, algorithm identifier, token type), a payload (identity identifier, verification value, issuance time, expiration time, permission scope), and a signature portion (collective signature of the nodes). The generated tenant verification token is verifiable but difficult to forge.

[0059] This invention achieves privacy protection for tenant fingerprint information through feature vector extraction and linear transformation; homomorphic encryption and differential privacy ensure data privacy during computation; key sharding and secure multi-party computation mechanisms prevent single-point attack risks; and distributed zero-knowledge proofs ensure the security and correctness of the verification process. The overall design forms a multi-layered protection system, significantly improving authentication security in multi-tenant environments while protecting tenant privacy, providing a highly secure authentication solution for sensitive business scenarios.

[0060] In one optional implementation, a reinforcement learning access controller is constructed based on the historical access data, using user behavior as the observation state and permission operations as the action space; the steps of collecting real-time user behavior data and the access controller continuously learning based on the real-time behavior data to generate an initial permission list include: The historical access data is extracted with temporal features, behavioral features, and environmental features. After being segmented by a sliding time window, the data is standardized to obtain standardized features. A reinforcement learning access controller is constructed, and the standardized features are combined into a user state vector. The user state vector includes a temporal feature vector, a behavioral feature vector, and a contextual feature vector. The granting, revocation, and maintenance of permissions are constructed as an action space. A composite reward function is constructed based on security compliance rewards, access efficiency rewards, and risk penalty items. Real-time user behavior data is collected, and the real-time user behavior data is sequence encoded using an attention mechanism to obtain a real-time feature vector. The attention mechanism processes the current query vector and historical behavior key-value pairs. The access controller continuously learns based on the real-time feature vector, updates the access control policy through policy gradient, and calculates the action value based on value function estimation. The confidence level of each permission is calculated based on the action value and consistency of historical behavior. The confidence level is then filtered based on a preset filtering threshold, and conflict resolution is performed using a permission dependency graph to generate an initial permission list.

[0061] For example, time-series features include time-related characteristics such as user access time distribution, operation interval patterns, and session duration. For instance, for historical access data of a user in a technical department, time-series features extracted include a weekday access frequency of 35 times per day, a non-weekday access frequency of 5 times per day, a 45% access rate between 9:00 AM and 12:00 PM, a 50% access rate between 1:00 PM and 6:00 PM, and a 5% access rate in the evening, with a typical session duration of 45 minutes. Behavioral features include characteristics describing user behavior habits, such as operation type distribution, accessed resource categories, and interaction patterns. For example, this user's resource library access accounts for 60%, document access for 25%, monitoring access for 15%, the ratio of submission to query operations is 1:4, and the ratio of keyboard operations to mouse operations is 3:1. Environmental features include contextual information such as access location, device type, and network environment. For example, this user's access comes from the corporate intranet for 95%, from VPN connections for 5%, from workstations for 85%, and from mobile devices for 15%.

[0062] The extracted features are segmented using a sliding time window. The time window is set to 7 days, with a sliding step of 1 day, meaning each window contains data from 7 consecutive days, with adjacent windows overlapping by 6 days. Features within each time window are aggregated and statistically analyzed, calculating the mean, standard deviation, maximum, minimum, and quantiles. For example, within a certain time window, the average access frequency is 30 times per day, the standard deviation is 5, the maximum is 42 times, the minimum is 20 times, and the 75th quantile is 35. The aggregated features are then standardized to map each feature value to the same numerical range, eliminating dimensional differences. Standardization uses the z-score method, subtracting the mean from the original feature value and dividing by the standard deviation, resulting in a mean of 0 and a standard deviation of 1. For example, if the original access frequency is 35 times, the mean is 30 times, and the standard deviation is 5, the standardized value is (35-30) / 5 = 1. This standardization process yields a standardized feature set, which is used to subsequently build the reinforcement learning model.

[0063] A reinforcement learning access controller is constructed, assembling standardized features into a user state vector. This user state vector consists of three parts: a temporal feature vector, a behavioral feature vector, and a contextual feature vector. The temporal feature vector has a dimension of 24, including access frequency, operation interval distribution, and session duration statistics for each time period. The behavioral feature vector has a dimension of 32, including operation type distribution, resource access patterns, and interaction behavior characteristics. The contextual feature vector has a dimension of 16, including location encoding, device type encoding, and network environment characteristics. These three feature vectors are concatenated to form a 72-dimensional user state vector, serving as the state space for reinforcement learning. The granting, revocation, and maintenance of permissions are constructed as the action space. For a system containing 50 basic permissions, each permission has three operations: granting, revoking, and maintaining, resulting in 150 basic actions.

[0064] In the composite reward function, the security compliance reward is calculated as follows: Security Compliance = 1 - (Number of Granted Permissions - Minimum Number of Permissions Required for the Duty) / Total Number of Permissions. This value ranges from 0 to 1; a higher value indicates that the permission configuration adheres more closely to the principle of least privilege. For example, if a user's duty requires 12 permissions, and 15 permissions are currently granted, resulting in a total of 50 permissions, then the security compliance is 1 - (15 - 12) / 50 = 0.94. The access efficiency reward is calculated as follows: Access Efficiency = Baseline Completion Time / Actual Completion Time. The baseline completion time is derived from historical data statistics and represents the average time a user with an ideal permission configuration completes a specific task. For example, if the baseline time for a resource review task is 30 minutes, and the user's actual completion time is 35 minutes, then the access efficiency is 30 / 35 = 0.857. The risk penalty is calculated based on the permission risk score: Risk Penalty = Sum of Risk Scores for All Granted Permissions / Maximum Risk Score. The risk score for each permission is predefined based on its sensitivity and potential impact, ranging from 1 to 10. For example, if the total risk score of granted permissions is 25, and the maximum risk score is 500, then the risk penalty is 25 / 500 = 0.05. The composite reward function weights these three indicators: Composite Reward = 0.3 × Security Compliance + 0.2 × Access Efficiency - 0.5 × Risk Penalty. The weighting ratio of 3:2:5 reflects that security risk control has a higher priority than compliance and efficiency.

[0065] Real-time user behavior data is collected, including the operation sequence, resource access requests, and environmental information in the current session. For example, a user sequentially accesses Project Management, Resource Library, and Build in the current session, submits an update, and triggers the build process. An attention mechanism is used to sequence-encode the real-time user behavior data to obtain a real-time feature vector. The attention mechanism is implemented as follows: the current operation is encoded as a query vector with a dimension of 32; historical operations are encoded as a set of key vectors, each with a dimension of 32; and the corresponding context information is encoded as a set of value vectors, each with a dimension of 48. The dot product of the query vector and each key vector is calculated and adjusted using a scaling factor equal to the square root of the key vector's dimension. An exponential function is applied to the adjusted dot product, and all exponential values ​​are summed. The attention weight for each key is equal to the corresponding exponential value divided by the sum, ensuring that the sum of all weights is 1. Finally, these attention weights are weighted and summed with the corresponding value vectors to obtain a context-aware real-time feature representation. For example, when a user performs a resource submission operation, the similarity between this operation and historical operations is calculated. It is found that the similarity with a similar resource submission operation three months ago is 0.85, and the similarity with a configuration modification operation last week is 0.35. Based on this, attention weights of 0.78 and 0.22 are assigned respectively, and the generated real-time feature vector retains more contextual information of similar resource submission operations.

[0066] Two neural networks are used: a policy network and a value function network. The policy network takes a real-time feature vector as input and outputs the probability distribution of each action. Its structure contains three fully connected layers with hidden layers of dimensions 128 and 64, respectively, using the ReLU activation function. The output layer uses the Softmax function to ensure the probability sum is 1. The value function network also takes a real-time feature vector as input and outputs a state value estimate. Its structure contains two fully connected layers with a hidden layer dimension of 64, using the ReLU activation function. Policy gradient updates use the REINFORCE algorithm: for each permission action 'a', the policy network parameters are updated according to the learning rate α multiplied by the cumulative reward G multiplied by the log probability gradient of action 'a'. In practice, a learning rate α = 0.001 is used, and a baseline is introduced to reduce variance; the baseline is the state value predicted by the value function network. The value function network is updated through temporal difference learning, aiming to minimize the mean squared error between the predicted value and the actual cumulative reward. The learning rate is set to 0.01, and the discount factor γ = 0.95. The network parameters are updated after processing every 50 user sessions, using mini-batch gradient descent with a batch size of 32. For example, when it is observed that after granting a user resource review permission, the user is able to complete the work more efficiently without causing security problems, the actual compound reward is 0.75, which is higher than the expected 0.65. This will increase the probability of granting the permission in a similar situation, and the corresponding parameters of the policy network will increase by about 0.001×(0.75-0.65)×0.08=0.0008 (assuming the log probability gradient is 0.08).

[0067] Action value is estimated using a value function network, representing the expected cumulative reward for performing a specific action in the current state. Historical behavior consistency measures the degree to which the current action matches the user's historical behavior patterns, calculated as: Historical behavior consistency = Frequency of current action in history × 0.4 + Cosine similarity between current action and historically high-frequency actions × 0.6. Frequency statistics use behavioral data from the last 30 days, and cosine similarity is calculated using the vector representation of the action. The action value and historical behavior consistency are weighted and summed in a 7:3 ratio to obtain the confidence score for each permission operation. For example, for a user's library read permission, if the action value is 0.85 and the historical behavior consistency is 0.90, then the confidence score for this permission is 0.85 × 0.7 + 0.90 × 0.3 = 0.865.

[0068] For general permissions, the filtering threshold is set to 0.7; for highly sensitive permissions, the threshold is set to 0.85, ensuring that sensitive permissions are only granted under conditions of high confidence. Conflict resolution is achieved using a permission dependency graph, a directed graph where nodes represent permissions and edges represent relationships between permissions. The permission dependency graph is represented using an adjacency matrix, where element values ​​are: 1 for dependency (the former depends on the latter), -1 for mutual exclusion, and 0 for no relationship. For example, 50 permissions form a 50×50 adjacency matrix. The permission dependency graph is pre-built based on design and business rules and can be updated through runtime learning. The conflict resolution algorithm is as follows: For the filtered permission list, first check the dependencies and construct a permission dependency tree. Starting from the leaf nodes, check upwards whether each permission's dependency is already included in the list; if not, add the dependency. For example, if the resource delete permission (permission ID 15) depends on the resource write permission (permission ID 10), but only the delete permission is recognized and not the write permission, check the element matrix

[15]

[10] =1 in the adjacency matrix to confirm the dependency relationship, and therefore automatically add the write permission. After adding the dependency, check the mutual exclusion relationship and construct a conflict set. For each pair of mutually exclusive permissions, retain the one with the higher confidence. For example, if the tenant administrator role (permission ID 30) and the tenant ordinary user role (permission ID 31) are mutually exclusive, the element matrix

[30]

[31] =matrix

[31]

[30] =-1 in the adjacency matrix, and their confidences are 0.82 and 0.78 respectively, retain the administrator role and remove the ordinary user role. When there are multiple complex situations where there are mutual dependencies or mutual exclusions, a graph traversal algorithm is used to find the optimal solution. First, a permission conflict graph is constructed, and then the maximum weighted independent set algorithm is used to find the permission set with the highest total confidence and no mutual conflict. The algorithm employs a greedy strategy, selecting the permission with the highest confidence level that does not conflict with previously selected permissions and adding it to the result set at each step. Dependency graph processing is used to generate the final initial permission list, ensuring the completeness and consistency of the permission configuration.

[0069] This invention achieves adaptive access control based on user behavior through reinforcement learning technology, effectively solving the problems of over-authorization and complexity in traditional access management. It can continuously learn user behavior patterns and adjust access policies in real time, improving user efficiency while ensuring security. Through the application of attention mechanisms and access dependency graphs, it can more accurately capture user intent and access relationship, generating reasonable and secure access configurations, significantly reducing security risks and management costs.

[0070] In one optional implementation, the step of the access controller performing continuous learning based on the real-time feature vector includes: The real-time feature vector is input into the dual-channel neural network of the access controller. The first channel constructs a local policy network to extract short-term behavioral features, and the second channel constructs a global policy network to extract long-term behavioral patterns. The policy gradient of the access control policy is calculated based on the outputs of the local policy network and the global policy network. The policy gradient evaluates the historical decision trajectory through importance sampling and introduces an entropy regularization term. A dual-valued function is constructed to calculate the value of the action. The dual-valued function estimates the immediate reward value and the long-term reward value respectively. The time difference error guides the update direction of the access control policy. An adaptive learning rate is set based on the confidence interval theory. When the change in user behavior distribution caused by the update of the access control policy exceeds the preset confidence interval, the learning step size is automatically adjusted to ensure that the access control policy converges stably.

[0071] For example, the access controller receives a 48-dimensional real-time feature vector as input and feeds it into a dual-channel neural network for processing. The dual-channel neural network contains two parallel processing paths: a local policy network and a global policy network. The local policy network focuses on extracting short-term user behavior features, employing a three-layer fully connected network structure with hidden layer dimensions of 64 and 32, and using ReLU activation. The input layer of the local policy network receives the complete 48-dimensional real-time feature vector, performs a linear transformation through the weight matrix and bias term, and then processes it through the activation function to generate a 64-dimensional intermediate feature representation. These intermediate features are then processed by a second layer of weight transformation and activation to obtain a 32-dimensional local behavior feature representation. The final layer maps the features to the action space, and the output dimension equals the number of actions (e.g., 150 basic actions). The local policy network emphasizes user behavior patterns over the past 7 days, assigning higher weights to features with higher time sensitivity. For example, for a user's recent frequent access to the library, the local policy network will generate a policy output that tends to grant library access.

[0072] The Global Policy Network (GPR) is responsible for extracting long-term behavioral patterns. It employs a recurrent neural network structure with memory units to capture long-term dependencies in user behavior. The GPR first passes a 48-dimensional real-time feature vector through a 32-dimensional embedding layer, then inputs it into a bidirectional gated recurrent unit containing 64 memory units. The recurrent unit processes the input sequence bidirectionally: forward propagation captures the information flow from past to present, and backward propagation captures dependencies from present to past. The GPR's time window is set to 90 days, effectively memorizing long-term stable user behavioral features through the recurrent structure. The results of the bidirectional processing are merged into a 64-dimensional global feature representation, which is then mapped to an action space of the same dimension as the local policy network through a fully connected layer. The GPR is more sensitive to long-term stable behavioral patterns related to user roles; for example, the code review behavior consistently exhibited by technical managers is identified as a stable feature, even if such actions are not performed in the short term.

[0073] The outputs of the two networks are weighted and combined in a 7:3 ratio, with a short-term behavior weight of 0.7 and a long-term behavior weight of 0.3, to obtain the comprehensive policy output. For example, for resource library write permissions, if the local policy network outputs a grant probability of 0.82 and the global policy network outputs a grant probability of 0.65, then the comprehensive policy output is 0.82 × 0.7 + 0.65 × 0.3 = 0.769. Importance sampling techniques are used to evaluate historical decision trajectories, with importance weights calculated based on the ratio of the behavior distribution of the current policy to that of historical policies. In the specific implementation, an experience replay buffer with a capacity of 1000 is maintained to store historical user interaction data, including status, actions, rewards, and the next state. At each update, 128 historical trajectories are randomly sampled from the buffer, and the ratio of the likelihood probability of each trajectory under the current policy to the likelihood probability under the policy at the time of recording is calculated as the importance weight. For example, if the likelihood probability of a historical trajectory at the time of recording is 0.15, and its likelihood probability under the current policy is 0.18, then its importance weight is 0.18 / 0.15 = 1.2. An entropy regularization term is also introduced to encourage policy diversity and prevent policies from prematurely converging to suboptimal solutions. The entropy regularization term calculates the entropy value of the policy distribution and multiplies it by a weight factor (initially set to 0.01, gradually decreasing to 0.001 during training) and adds it to the optimization objective. For situations where permission operations are highly deterministic, the policy distribution tends to be deterministic, resulting in a lower entropy value; while for situations where operational decisions are uncertain, the policy distribution is more dispersed, resulting in a higher entropy value.

[0074] The dual-valued function estimates the immediate and long-term rewards of the permission operation, respectively. The immediate-valued function employs a three-layer fully connected network structure. The input layer receives a combined representation of the real-time feature vector and the action. This combined representation is formed by concatenating the 48-dimensional real-time feature vector with a 150-dimensional one-hot action encoding vector to create a 198-dimensional input vector. Different normalization processes are applied to continuous features and discrete encodings: continuous features use min-max normalization to map values ​​to the [0,1] interval, while discrete encodings retain their one-hot representation. The first hidden layer has a dimension of 128, the second hidden layer has a dimension of 64, and ReLU activation is used. The output layer is a single neuron that uses a linear activation function to output a scalar value representing the immediate reward estimate for performing a specific action. The long-term-valued function uses a similar fully connected structure, but adds an LSTM memory module after the first hidden layer. This module contains 64 memory units with a time step of 10, enabling it to capture the long-term impact sequence of the action. The LSTM module receives the historical state-action sequence as input and extracts temporal dependencies. The long-term value function's input includes not only the current state-action pair but also state-action pairs from the past nine time steps, forming a complete time window. The outputs of the two value functions are weighted and combined based on permission sensitivity: a predefined permission sensitivity list categorizes all permissions into ordinary permissions and high-sensitivity permissions. High-sensitivity permissions include 15 critical operation permissions such as data deletion, user management, permission configuration, and encryption key access, with a sensitivity score greater than 7 (out of 10); the rest are ordinary permissions. For ordinary permission operations, the immediate value function has a weight of 0.6, and the long-term value function has a weight of 0.4; for high-sensitivity permission operations, the immediate value function has a weight of 0.4, and the long-term value function has a weight of 0.6, placing greater emphasis on long-term security impact. Time difference error is used to guide policy updates. The time difference error is calculated by adding a discount to the next state value function estimate to the actual reward, then subtracting the current state value function estimate. The discount factor is set to 0.95, indicating the importance placed on future rewards. A mean squared error loss function is constructed to minimize the time difference error; the loss function is the square of the time difference error. The value function network is updated using gradient descent with the Adam optimizer, an initial learning rate of 0.001, and a batch size of 64. For example, if the current state value function estimate is 0.65, and an action yields a reward of 0.3, and the next state value function estimate is 0.72, then the temporal difference error is 0.3 + 0.95 × 0.72 - 0.65 = 0.334. The network parameter update amount is related to this error, the learning rate, and the input gradient. Training stability is enhanced using a target network technique, maintaining two copies of the value function: an online network and a target network. The online network is updated after each interaction, while the target network parameters are updated every 100 interactions using a soft update method, with an update ratio of 0.01 (i.e., 1% of the target network parameters are shifted to the online network parameters).Positive time difference error indicates that the action is better than expected, and the policy update direction is to increase the probability of that action; negative time difference error indicates that the action is worse than expected, and the policy update direction is to decrease the probability of that action. The two value functions work together: the immediate value function is more sensitive to the short-term effects of permission operations (such as access efficiency), while the long-term value function is more sensitive to cumulative security risks. The comprehensive judgment can balance security and ease of use.

[0075] Setting an adaptive learning rate based on confidence interval theory ensures the stability of policy updates. Before each policy update, the difference in behavioral distribution between the current policy and the previous policy is calculated. This difference is measured by the KL divergence of the action probability distributions of the two policies under the same state. A preset confidence interval threshold of 0.02 represents the maximum allowable distribution variation. When the calculated KL divergence value exceeds the threshold, the learning step size is automatically adjusted. Specifically, if the KL divergence value is 0.035, exceeding the threshold of 0.02, the learning rate is multiplied by the ratio of the threshold to the actual value (0.02 / 0.035 ≈ 0.57), thus reducing the update step size. If the KL divergence value is 0.01, below the threshold, the learning rate is multiplied by 1.1, moderately increasing the update step size to accelerate convergence. The initial learning rate is set to 0.001, with an upper limit of 0.01 and a lower limit of 0.0001, ensuring adjustments are made within a reasonable range. This adaptive mechanism ensures stable policy convergence while adapting to the learning needs at different stages. For users whose behavior patterns change abruptly, the learning rate will be automatically reduced to avoid overreaction; for users whose behavior is stable, the learning rate will be appropriately increased to accelerate strategy optimization.

[0076] The access controller periodically evaluates policy performance and saves the current policy as a checkpoint when the accumulated rewards stabilize or reach a preset number of iterations (e.g., 1000 iterations). A rollback mechanism is also implemented: if a new policy performs poorly in practice (accumulated rewards drop by more than 15%), it automatically rolls back to the previous stable checkpoint, ensuring that policy updates do not lead to significant performance degradation. For example, if an update detects a 20% decrease in user operation efficiency and a 10% reduction in security compliance, it will roll back to the previous checkpoint, adjust the exploration strategy, and try other optimization directions.

[0077] This invention utilizes a dual-channel neural network structure and an adaptive learning mechanism to achieve comprehensive analysis of short-term behavior and long-term patterns, effectively solving the problems of lag and overgeneralization in traditional access control. The dual-valued function design simultaneously considers the immediate effects and long-term impacts of permission operations, improving the accuracy and security of permission allocation. The adaptive learning rate mechanism ensures a smooth transition when user behavior patterns change, avoiding policy oscillations and overreaction.

[0078] In one optional implementation, the step of performing anomaly detection on the initial permission list and generating a fine-grained permission list in conjunction with the tenant verification token includes: Based on the analysis of the user's historical access behavior to each permission in the initial permission list using a sliding time window, the time-series access pattern is calculated and converted into permission frequency features. The tenant access time constraints are extracted using the tenant verification token, and an access permission rule base is constructed based on a preset time-series rule template. The frequency characteristics of the permissions are matched with the permission access rule base to identify abnormal permissions that do not conform to the time sequence rules; the access time of the abnormal permissions is constrained to generate a time-restricted permission set; the permission set is further divided into fine-grained parts based on the security level in the tenant verification token to generate a fine-grained permission list with time constraints.

[0079] For example, historical access behavior is analyzed based on a sliding time window. The sliding time window is set to 14 days, with a sliding step of 1 day, meaning each window contains data for 14 consecutive days, and adjacent windows overlap by 13 days. For each permission, multi-dimensional temporal features are extracted within the time window, including access frequency, access time distribution, and access duration. Access frequency is calculated by counting the number of times a specific permission is accessed each day, forming a 14-dimensional daily frequency vector; access time distribution divides a 24-hour day into 8 time periods (3 hours each), and the access percentage for each time period is calculated, forming an 8-dimensional time period distribution vector; access duration is calculated by calculating the average duration and standard deviation of each permission usage, forming a 2-dimensional duration vector. These features are combined to form a 24-dimensional temporal feature vector. For example, regarding a user's resource editing permissions, the following time-series characteristics were extracted: the average access frequency on weekdays is 12 times / day, and the average access frequency on weekends is 2 times / day; access is mainly concentrated in two time periods: 9:00-12:00 (accounting for 35%) and 14:00-17:00 (accounting for 40%); the average duration is 25 minutes, and the standard deviation is 8 minutes.

[0080] The temporal access patterns are converted into permission frequency features. The conversion process includes three steps: feature aggregation, pattern extraction, and frequency calculation. Feature aggregation reduces the dimensionality of the original 24-dimensional temporal features by using principal component analysis to retain the principal components needed to explain 90% of the variance, typically reducing it to 8-10 dimensions. Pattern extraction uses a density clustering algorithm to identify high-density regions in the temporal feature space, classifying user access behaviors into several typical patterns. In the specific implementation, the DBSCAN density clustering algorithm is used, with parameters set as follows: neighborhood radius of 0.35 and minimum number of points of 5. These parameters are optimized through grid search to balance clustering quality and computational efficiency. For each identified access pattern, its frequency is calculated, i.e., the proportion of the pattern appearing in all observation windows. The final permission frequency features include the main access patterns for each permission and their corresponding frequency values. For example, for the aforementioned resource editing permission, two main access patterns are identified: short editing sessions on weekday mornings (frequency of 0.65) and long editing sessions on weekday afternoons (frequency of 0.30), with the remainder being atypical patterns (frequency of 0.05).

[0081] Tenant authentication tokens contain tenant-level security policy information in JSONWebToken format, including fields such as tenant identifier, security level, time constraints, and resource scope. The time constraint field specifies the allowed time range for tenant access, including allowed weekdays, working hours, and special time periods. A typical tenant authentication token structure includes a tenant identifier, a security level value (an integer from 1 to 5), time constraints (a list of weekdays, a range of working hours, and special time periods), and resource scope. The tenant authentication token is parsed to extract the time constraint information and convert it into a standardized time constraint representation. For example, a company tenant's authentication token might contain the following time constraints: allowing access from 8:00 AM to 8:00 PM on weekdays (Monday to Friday), and allowing technical maintenance personnel to access specific resources from 10:00 AM to 4:00 PM on weekends under special circumstances. An access control rule base is built based on preset time-series rule templates. A time-series rule template is a set of predefined time pattern descriptions, including working hour patterns, non-working hour patterns, and abnormal access patterns. Each template contains two parts: time conditions (such as time period, periodicity, and continuity) and behavioral conditions (such as frequency threshold and duration). By combining tenant time constraints with time-series rule templates, specific access rules are generated for each type of permission. Rules are represented using decision tables, with the behavior permission type as the column, time conditions as the column, and the cell content as the allowed access behavior characteristics. For example, for resource editing permissions, the following rules are generated: Normal rule - high-frequency access (>10 times / day) is allowed from 9:00 to 18:00 on weekdays; Restricted rule - low-frequency access (≤5 times / day) is allowed from 18:00 to 22:00 on weekdays; Abnormal rule - access from 22:00 to 9:00 the next day on weekdays or all day on weekends requires additional verification. The rule base is stored using a decision tree structure for easy and fast querying and matching. Rule storage uses a key-value database, where the key is a combination of permission identifier and time conditions, and the value is the corresponding behavior condition and processing strategy.

[0082] The frequency characteristics of permissions are matched against the permission access rule base. The matching process uses a fuzzy logic scoring mechanism to calculate the degree of conformity between the actual usage pattern of each permission and the rule. The conformity score ranges from 0 to 1, with a score closer to 1 indicating a stronger conformity. Specifically, for each time period, the cosine similarity between the user behavior feature vector and the feature vector required by the rule is calculated, and then a weighted average is taken based on the importance of the time period. For each access pattern of each permission, the conformity is calculated against the rules in the rule base, and the weighted average is taken as the overall conformity of that permission. When the conformity of a permission is lower than a preset threshold (usually set to 0.75), the permission is marked as an abnormal permission. For example, if a user's resource export permission is mainly used outside of working hours (2:00-4:00 AM, accounting for 85% of total usage), and the conformity with the normal rules in the rule base is only 0.35, which is lower than the threshold of 0.75, then this permission is marked as an abnormal permission. An anomaly classification system was implemented, defining anomalies with a compliance score of 0.5-0.75 as low-risk anomalies, 0.25-0.5 as medium-risk anomalies, and 0-0.25 as high-risk anomalies. Different handling strategies correspond to different risk levels.

[0083] In the process of generating a time-restricted permission set, constraint generation follows the principle of least privilege. For each abnormal permission, the algorithm identifies the compliant time period in its historical access pattern that is closest to the rule base and restricts permission usage to these time periods. The constraint generation algorithm first calculates the ratio of the frequency of abnormal permissions in each time period to the frequency allowed by the rules, and selects the time period with the ratio closest to 1 as the baseline time period. Then, the allowed time period is expanded forward and backward from the baseline time period until it covers 80% of normal user usage scenarios or reaches a preset maximum time window (usually 50% of working hours). For permissions that do not comply with the rules at all, access is completely prohibited or additional verification steps are required. Time constraints use fine-grained time expressions to support complex cases such as weekday / non-working day distinctions, time period restrictions, and exceptions for special dates. For example, for the aforementioned resource export permission, the following time constraint is generated: it is only allowed to be used on weekdays from 10:00 to 16:00, each use requires secondary authentication, and the number of uses per day cannot exceed 3. The generated time-restricted permission set adopts a standardized JSON format, and each permission item contains fields such as permission identifier, resource scope, operation type, time constraint, and additional conditions.

[0084] The time-restricted permission set is granularly divided based on the security level in the tenant authentication token. The security level field in the tenant authentication token defines the overall security policy strictness of the tenant, using an integer value from 1 to 5, where 1 represents the lowest security level and 5 represents the highest security level. A security level mapping table is maintained to map security level values ​​to specific granularity partitioning policy parameters: security level 1-2 corresponds to a low security policy with a granularity coefficient of 0.3; security level 3 corresponds to a medium security policy with a granularity coefficient of 0.6; and security levels 4-5 correspond to a high security policy with a granularity coefficient of 0.9. The granularity coefficient directly affects the level of detail in permission splitting; the higher the coefficient, the more granular the splitting.

[0085] A permission dependency graph is constructed based on the functional relevance and operational risk of permissions. The dependency graph is a weighted directed graph where nodes represent permissions, edges represent dependencies between permissions, and edge weights represent dependency strength. Dependencies and their strengths are determined by analyzing historical operation logs and calculating conditional probabilities between permissions. For example, if there is an 80% probability that permission A will be used in conjunction with permission B, then B is considered dependent on A, with a dependency strength of 0.8. Furthermore, business expert knowledge is incorporated to assign a risk coefficient to each permission, ranging from 0 to 1, with values ​​closer to 1 indicating higher risk. For example, the risk coefficient for "viewing public documents" is 0.1, while the risk coefficient for "deleting core databases" is 0.95. The dependency graph construction algorithm first extracts operation sequences from the original operation logs, then uses a sliding window (with a window size of 5 operations) to count the co-occurrence frequency of operations, and finally calculates the edge weights using conditional probabilities.

[0086] Spectral clustering is used to segment the permission dependency graph, dividing permissions into subsets of different granularities. The parameters of spectral clustering are dynamically adjusted based on the tenant's security level: the number of clusters K is determined based on the security level and the total number of permissions, calculated by multiplying the base cluster number by (1 plus the security level multiplied by 0.2), where the base cluster number is a preset baseline value based on the size of the permission set. For example, for a tenant with a security level of 3, the base cluster number is 10, so the actual number of clusters is 16. The spectral clustering results are post-processed to ensure that high-risk permissions are not grouped with low-risk permissions in the same cluster. For each cluster, subsets are further divided based on the functional similarity and risk level of the permissions. Functional similarity is calculated using the textual similarity of the permission descriptions, using TF-IDF vectorization and cosine similarity metrics.

[0087] For tenants with higher security levels, single permissions are further decomposed into multiple fine-grained operation permissions. The decomposition process is based on a predefined permission decomposition template library, containing fine-grained decomposition schemes for common permission types. For example, the "file management" permission can be decomposed into five fine-grained permissions: "file read," "file create," "file modify," "file delete," and "file share." The decomposition depth is directly related to the security level: tenants with security levels 1-2 typically do not undergo decomposition; tenants with security levels 3 undergo first-level decomposition; and tenants with security levels 4-5 undergo second-level or deeper decomposition. For example, for a tenant with a security level of 5, the "file modify" permission is further decomposed into three more fine-grained permissions: "modify file content," "modify file attributes," and "modify file permissions."

[0088] Appropriate time constraints from the time-restricted permission set are applied to each fine-grained permission. The strictness of the time constraints is also related to the security level: the higher the security level, the stricter the time constraints. Control is achieved using a time constraint adjustment factor, calculated as the base time constraint multiplied by (1 plus (security level minus 1) multiplied by 0.15), where the base time constraint is a preset standard constraint. For example, if the base time constraint allows access from 9:00 AM to 6:00 PM on weekdays, a tenant with security level 4 will have their actual constraint narrowed to 10:00 AM to 5:00 PM on weekdays.

[0089] The final generated fine-grained permission list is in XACML (Extensible Access Control Markup Language) format, containing complete access control information such as permission identifier, resource scope, operation type, time constraints, and additional conditions. The XACML document structure includes elements such as policies, rules, objectives, and conditions, enabling precise expression of complex access control rules. For permission information that needs to be shared among multiple entities, a JWT format token is generated for easy transmission, containing a cryptographic digest of the permission list. The JWT token structure consists of a header, payload, and signature. The payload contains the permission information and is represented in a compressed format to reduce token size. The token is signed using the RSA-256 algorithm to ensure its integrity and immutability.

[0090] When generating a new fine-grained permission list, the previous version is saved, and the reason for the change, the content of the change, and the time of the change are recorded. For permission changes with high security sensitivity, administrator confirmation or additional authorization is required. Permission usage logs are also maintained, recording the time, resources, and operation results of each permission access, providing a data foundation for subsequent anomaly detection and rule optimization. Permission list updates are performed incrementally, transmitting only the changed parts to reduce communication overhead. Update operations use a two-phase commit protocol to ensure the consistency of permission data. In a multi-tenant environment, permission lists for different tenants are stored in isolation to prevent permission leaks between tenants. The entire permission generation and management process follows the principles of least privilege and separation of duties to ensure security and auditability.

[0091] When generating a new fine-grained permission list, the system checks for conflicts between permissions, such as one permission allowing access for a certain time period while another prohibits access during the same time period. Conflict detection employs a Boolean satisfiability problem-solving method, converting permission rules into Boolean expressions and using a solver to detect conflicts. For detected conflicts, a pre-defined conflict resolution strategy is applied, typically following a "deny first" principle, meaning that when multiple rules conflict, the rule that denies access has higher priority.

[0092] This invention achieves accurate detection of permission anomalies through time-series access pattern analysis and rule matching, and implements fine-grained access control based on the security level of tenant verification tokens. The time constraint mechanism, combined with security levels, enables differentiated access restrictions, effectively preventing abnormal access during unauthorized periods.

[0093] A second aspect of the present invention provides an electronic device, comprising: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0094] A third aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0095] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0096] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A multi-tenant, multi-user login method based on enhanced OAuth2, characterized in that, include: The tenant key threshold is obtained based on the tenant identifier in the login request, and the access token is obtained by performing standard OAuth2 authentication based on the user identifier. A tenant key proof is generated based on the zero-knowledge proof protocol and the tenant key threshold. The tenant key proof and the access token are encrypted using a homomorphic encryption algorithm to generate tenant fingerprint information; The master key is fragmented and stored in the key management node, and a tenant verification token is generated through secure multi-party computation by the key management node based on the tenant fingerprint information. The tenant verification token and the access token are combined and encrypted to generate an enhanced access token; Obtain historical access data of users under the tenant; based on the historical access data, construct a reinforcement learning access controller, taking user behavior as the observation state and permission operation as the action space; Collect real-time user behavior data, and the access controller continuously learns based on the real-time behavior data to generate an initial permission list; Anomaly detection is performed on the initial permission list, and a fine-grained permission list is generated by combining the tenant verification token; A session identifier is generated based on the enhanced access token and the fine-grained permission list, and the session identifier and authentication authorization information are stored in a distributed cache.

2. The method according to claim 1, characterized in that, The steps for generating a tenant key proof based on a zero-knowledge proof protocol and the tenant key threshold include: Obtain the tenant security level and tenant resource sensitivity associated with the tenant identifier; generate a baseline security value based on the tenant security level and a resource sensitivity coefficient based on the tenant resource sensitivity; generate a tenant key threshold based on the baseline security value, the resource sensitivity coefficient, and a dynamic adjustment factor, wherein the dynamic adjustment factor is calculated by weighting the real-time security threat level, the number of tenant authentication failures, and the frequency of historical attacks. Zero-knowledge proof parameters are generated based on preset elliptic curve parameters, and an interactive commitment value is generated using the zero-knowledge proof parameters and the tenant's private key. A tenant identity commitment is generated based on the tenant's private key and the interaction commitment value. A threshold satisfaction proof is constructed using the tenant key threshold and the interaction commitment value. An auxiliary random value is generated based on a preset group order. The tenant identity commitment, the threshold satisfaction proof, and the auxiliary random value are combined to generate a zero-knowledge proof. The zero-knowledge proof is validated by parameters. When the validation passes, a tenant key proof is generated based on the zero-knowledge proof, the interaction commitment value, and the tenant's private key.

3. The method according to claim 1, characterized in that, The steps of storing the master key in fragments to the key management node, and generating a tenant verification token through secure multi-party computation by the key management node based on the tenant fingerprint information include: The master key is fragmented and stored across multiple key management nodes using a hierarchical dynamic threshold scheme. The threshold value and total number of nodes for the hierarchical dynamic threshold scheme are determined based on the load intensity and communication efficiency of the key management nodes. The key management nodes are divided into multiple hierarchical groups based on node computing power scores and network topology distances. A nested polynomial structure is constructed for each hierarchical group, where the constant term of the inner polynomial is set as the master key value, and the coefficients of the outer polynomial are determined by a weighted value of the trustworthiness of the tenant's access behavior and the frequency of resource calls. A unique key fragment is generated for each key management node according to the constructed polynomial and distributed for storage. After processing the tenant fingerprint information for privacy protection, differential privacy calculations are performed in the homomorphic encryption domain through key sharding in each of the key management nodes, and distributed zero-knowledge proofs are executed to generate tenant verification tokens.

4. The method according to claim 3, characterized in that, After performing privacy protection processing on the tenant fingerprint information, the steps of generating a tenant verification token by performing differential privacy computation in the homomorphic encryption domain through key fragmentation in each of the key management nodes and executing distributed zero-knowledge proofs include: Extract identity feature vectors and behavioral feature vectors from the tenant fingerprint information, and perform linear transformation to generate privacy-preserving feature fragments; The feature fragment is sent to multiple key management nodes. Each key management node performs a homomorphic inner product operation between the key fragment it holds and the feature fragment in the cryptographic domain, and introduces Laplace-distributed differential privacy noise into the result of the homomorphic inner product operation to obtain a partial verification factor. The computational weight of each key management node is determined based on the trustworthiness of the key management node. The computational weight is then used to perform a secure multi-party summation operation with the corresponding partial verification factor to generate an aggregate verification value. When the number of key management nodes participating in the secure multi-party summation operation reaches a preset threshold, the key management nodes execute a distributed zero-knowledge proof protocol to verify the calculation process of the aggregated verification value, and combine the verified aggregated verification value with the hash value of the identity feature vector to generate a tenant verification token.

5. The method according to claim 1, characterized in that, Based on the historical access data, a reinforcement learning access controller is constructed, which takes user behavior as the observation state and permission operation as the action space. The steps of collecting real-time user behavior data and having the access controller continuously learn based on the real-time behavior data to generate an initial permission list include: The historical access data is extracted with temporal features, behavioral features, and environmental features. After being segmented by a sliding time window, the data is standardized to obtain standardized features. A reinforcement learning access controller is constructed, and the standardized features are combined into a user state vector. The user state vector includes a temporal feature vector, a behavioral feature vector, and a contextual feature vector. The granting, revocation, and maintenance of permissions are constructed as an action space. A composite reward function is constructed based on security compliance rewards, access efficiency rewards, and risk penalty items. Real-time user behavior data is collected, and the real-time user behavior data is sequence encoded using an attention mechanism to obtain a real-time feature vector. The attention mechanism processes the current query vector and historical behavior key-value pairs. The access controller continuously learns based on the real-time feature vector, updates the access control policy through policy gradient, and calculates the action value based on value function estimation. The confidence level of each permission is calculated based on the action value and consistency of historical behavior. The confidence level is then filtered based on a preset filtering threshold, and conflict resolution is performed using a permission dependency graph to generate an initial permission list.

6. The method according to claim 5, characterized in that, The steps of the access controller performing continuous learning based on the real-time feature vector include: The real-time feature vector is input into the dual-channel neural network of the access controller. The first channel constructs a local policy network to extract short-term behavioral features, and the second channel constructs a global policy network to extract long-term behavioral patterns. The policy gradient of the access control policy is calculated based on the outputs of the local policy network and the global policy network. The policy gradient evaluates the historical decision trajectory through importance sampling and introduces an entropy regularization term. A dual-valued function is constructed to calculate the value of the action. The dual-valued function estimates the immediate reward value and the long-term reward value respectively. The time difference error guides the update direction of the access control policy. An adaptive learning rate is set based on the confidence interval theory. When the change in user behavior distribution caused by the update of the access control policy exceeds the preset confidence interval, the learning step size is automatically adjusted to ensure that the access control policy converges stably.

7. The method according to claim 1, characterized in that, The steps of performing anomaly detection on the initial permission list and generating a fine-grained permission list in conjunction with the tenant verification token include: Based on the sliding time window analysis, the user's historical access behavior to each permission in the initial permission list is analyzed, the time-series access pattern is calculated, and the time-series access pattern is converted into permission frequency features. The tenant access time constraints are extracted using the tenant verification token, and an access permission rule base is constructed based on a preset time-series rule template. The frequency characteristics of the permissions are matched with the permission access rule base to identify abnormal permissions that do not conform to the time sequence rules; the access time of the abnormal permissions is constrained to generate a time-restricted permission set; the permission set is further divided into fine-grained parts based on the security level in the tenant verification token to generate a fine-grained permission list with time constraints.

8. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 7.

9. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 7.

Images