Electronic identity link mapping authentication system and method for trusted identity resolution

Abstract

This application relates to the field of cyberspace security, and discloses an electronic identity link mapping authentication system and method for trusted identifier resolution. The system includes an identity link mapping authentication center, integrating modules for message reception and parsing, user identity verification, link integrity verification, and path matching. The method includes: parsing the data packet to be authenticated and extracting the link tracing list; verifying the legality of the user's logical identity; traversing and verifying the validity of node signatures in the link feature entries and the rationality of the timing logic of adjacent nodes; comparing the consistency of the link feature sequence to be detected with a preset standard legal link feature sequence to generate a path compliance signal. The system can also dynamically adjust the reputation score based on path deviation to execute hierarchical authorization, or identify VPN bypass behavior through cross-verification of logical addresses and physical paths. By constructing physical link evidence, this invention achieves the binding of user identity and physical location, effectively defending against replay attacks and unauthorized remote access.

Description

Technical Field

[0001] This invention relates to the field of cyberspace security technology, specifically to an electronic identity link mapping authentication system and method for trusted identifier resolution. Background Technology

[0002] With the increasing complexity of digital campuses and research network environments, network identity authentication has become a core line of defense for ensuring information system security. Existing identity authentication technologies primarily rely on logical-layer credential verification, such as digital certificates based on Public Key Infrastructure (PKI), dynamic passwords, or biometric identification. When processing access requests, authentication centers typically only focus on the correctness of the user's submitted credentials, lacking the ability to perceive the actual physical path of data packets. In this model, logical identity and physical location are separated. Once a user's identity key or login credentials are leaked, attackers can initiate access from unauthorized physical areas or external networks using legitimate credentials, making it difficult for the system to distinguish between external attackers holding legitimate credentials and genuine internal users.

[0003] Traditional address-based defense mechanisms have significant limitations when facing complex network attack methods. Attackers often use Virtual Private Networks (VPNs) or tunneling proxy technologies to encapsulate raw data packets, thereby obscuring the real source IP address and routing path, rendering access control policies based on network segmentation ineffective. Furthermore, due to the lack of hop-by-hop integrity verification and precise timing detection of the physical nodes traversed by data packets during transmission, the system struggles to detect and defend against delayed replay attacks after man-in-the-middle interception, and cannot guarantee that received data packets are transmitted in real-time along the predetermined secure path.

[0004] Furthermore, existing authorization systems typically employ a static binary decision model, directly granting full access or denying full access based on the authentication result. When a user's access behavior or environment exhibits slight anomalies but it's uncertain whether it constitutes an attack, the system often lacks an intermediate processing mechanism based on real-time risk measurement. This "black and white" control approach cannot dynamically adjust the granularity of resource access according to risk levels, easily leading to normal business interruptions by directly blocking connections, making it difficult to strike a balance between ensuring core data security and maintaining business continuity. Summary of the Invention

[0005] The technical problem that this invention aims to solve is that existing network identity authentication systems mainly rely on keys or passwords at the logic layer, which cannot perceive the physical environment in which the user accesses the system. This makes it difficult to defend against security threats such as unauthorized access by those holding legitimate keys but launching attacks from unauthorized physical locations, virtual private network bypass attacks, and man-in-the-middle attacks.

[0006] To address the aforementioned technical problems, the first aspect of this invention provides an electronic identity link mapping authentication system for trusted identifier resolution, the system comprising an identity link mapping authentication center. The identity link mapping authentication center integrates a message receiving and parsing module, a user identity verification module, a link integrity verification module, and a path matching module.

[0007] The message receiving and parsing module is used to parse the received data packet to be authenticated, separating the data packet into a basic service message portion and a link tracing extension field portion. The message receiving and parsing module extracts a link tracing list from the link tracing extension field portion. This link tracing list consists of multiple link feature entries sequentially written by trusted awareness nodes along the network transmission path.

[0008] The user identity verification module is used to verify the legitimacy of the user holder's identity based on the user's electronic identity identifier and user digital signature data in the basic business message section.

[0009] The link integrity verification module is used to iterate through each link feature entry in the link tracing list, verifying the validity of the node's digital signature and the rationality of the timing logic between adjacent nodes. When verifying the timing logic, the link integrity verification module calculates the time difference between the processing timestamps of two adjacent nodes and determines whether the time difference is within a preset maximum single-hop physical transmission delay range. If any signature is invalid or the time difference exceeds the allowed range, the link integrity verification is deemed to have failed.

[0010] The path matching module is activated after the user identity verification module and the link integrity verification module have passed the verification. The path matching module performs a consistency comparison between the link feature sequence to be detected extracted from the link tracing list and the standard legal link feature sequence in the preset identity link mapping rules, and generates a path compliance signal based on the comparison result.

[0011] In one specific embodiment of the present invention, the system further integrates a security response module for handling abnormal situations of path mismatch. The security response module uses a sequence edit distance algorithm (such as the Lewinstein distance algorithm) to calculate the minimum number of single-character edit operations required to convert the detected link feature sequence into a standard legal link feature sequence. The security response module determines the corresponding penalty score based on the minimum number of single-character edit operations and calculates the difference between the current user's security reputation score and the penalty score to obtain an updated reputation score.

[0012] In one specific embodiment of the present invention, the system further integrates a dynamic authorization execution module. The dynamic authorization execution module performs tiered authorization based on the updated reputation score and the security sensitivity level of the target resource object. The dynamic authorization execution module compares the updated reputation score with preset first and second reputation thresholds: if the reputation score reaches or exceeds the first reputation threshold, full operation permissions are granted; if the reputation score is lower than the first reputation threshold but reaches or exceeds the second reputation threshold, a restricted authorization instruction is generated. This restricted authorization instruction is used to zero out the download and modification permission bits, retain only the read-only permission bit, and instruct the terminal to draw a semi-transparent watermark layer containing the user's identifier; if the reputation score is lower than the second reputation threshold but higher than the blocking line, a challenge-response authentication process is triggered, requiring the user to perform secondary signature authentication on a random challenge code.

[0013] In one specific embodiment of the present invention, the system further integrates a scenario-based defense logic module for defending against VPN bypass attacks. The scenario-based defense logic module performs cross-validation of the consistency between the logical address and the physical path. When it is identified that the source IP address of the data packet to be authenticated belongs to an internal private logical network segment, but the fingerprint identifier of the trusted sensing node device of the physical building and floor bound to that logical network segment is missing from the feature sequence of the link to be detected, it is determined that VPN bypass behavior exists, and the generation of an access token is refused.

[0014] The second aspect of this invention provides an electronic identity link mapping authentication method for trusted identifier resolution. The method is executed by an identity link mapping authentication center and includes the following steps: parsing a received data packet to be authenticated, separating the data packet into a basic service message portion and a link tracing extended field portion, and extracting a link tracing list; verifying the legitimacy of the user holder's identity based on the user's electronic identity identifier and user digital signature data in the basic service message portion; traversing each link feature entry in the link tracing list item by item to verify the validity of the node's digital signature and the rationality of the temporal logic between adjacent nodes; after the user holder's identity and link integrity have been verified, extracting the link feature sequence to be detected from the link tracing list; comparing the link feature sequence to be detected with the standard legitimate link feature sequence in a preset identity link mapping rule; if they match, the path is deemed compliant and an access token is generated.

[0015] This invention provides an electronic identity link mapping authentication system and method for trusted identifier resolution. By introducing trusted sensing nodes at the network layer to sign and time each hop of the data packet transmission path, physical link evidence is constructed. The system combines logical authentication with physical topology consistency verification to bind user identity, network path, and physical location. By quantifying path deviations and dynamically adjusting reputation scores, the system can achieve hierarchical authorization and defend against account theft, unauthorized VPN access, and replay attacks.

[0016] This invention provides an electronic identity link mapping authentication system and method for trusted identifier resolution. It has the following beneficial effects:

[0017] 1. This invention deploys trusted sensing nodes along the network transmission path and embeds device fingerprints and node digital signatures in the extended fields of data packets, thereby forcibly binding the user's logical identity to the physical transmission path. Compared with traditional authentication methods that rely solely on keys or passwords, this invention can identify and block access requests initiated by holders of legitimate credentials in unauthorized physical areas, effectively solving the security risks caused by the separation of logical identity and physical location.

[0018] 2. This invention enhances the defense against complex network attacks by utilizing hop-by-hop timestamp verification and cross-validation mechanisms for the consistency of logical addresses and physical paths. The system determines whether there are abnormal bypasses or replay attacks on the link by calculating the transmission delay of adjacent nodes, and identifies VPN bypass behavior by detecting conflicts between internal logical IPs and physical link characteristics. Thus, it achieves proactive defense against man-in-the-middle attacks and tunnel encapsulation attacks without changing the existing network architecture.

[0019] 3. A sequence edit distance algorithm is introduced to quantify the deviation between the actual transmission path and the preset legal path, and a tiered authorization strategy is implemented based on dynamic reputation scores. The system can automatically adjust resource access permissions according to the risk level. For example, when the reputation level decreases, only read-only permissions are retained and a screen watermark is forcibly loaded, rather than directly cutting off the connection. This mechanism maintains business continuity while ensuring the security of core data and reduces the risk of business interruption due to misjudgment. Attached Figure Description

[0020] Figure 1 This is a perspective view of the present invention. Detailed Implementation

[0021] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] Example: Please see the appendix Figure 1 This invention provides an electronic identity link mapping authentication system for trusted identifier resolution. The electronic identity link mapping authentication system for trusted identifier resolution mainly includes: campus terminal agent, campus network trusted sensing node, and identity link mapping authentication center.

[0023] The campus terminal agent is installed and runs in the memory of the user's handheld mobile terminal, and is executed by the processor of the user's handheld mobile terminal. The campus terminal agent internally maintains electronic identity data generated based on a trusted identifier resolution system. This electronic identity data includes the user's unique digital identity identifier. The campus terminal agent has a built-in cryptographic operation unit based on national cryptographic standards, which is configured to execute the SM2 asymmetric encryption algorithm, the SM3 hash algorithm, and the SM4 symmetric encryption algorithm. The campus terminal agent generates access request data packets in response to user operations, and uses the cryptographic operation unit and the user's private key to digitally sign the access request data packets, generating an initial request packet with the user's digital signature.

[0024] The campus network trusted sensing nodes are deployed at network access points and data transmission aggregation points in the campus network topology. These locations include teaching buildings, laboratories, dormitories, and administrative areas. Each campus network trusted sensing node is a router, network switch, or smart gateway hardware device equipped with an independent processor and programmable network interface. A unique device fingerprint is burned into the non-volatile storage medium of each campus network trusted sensing node. The campus network trusted sensing nodes intercept and parse access request data packets passing through them. By appending data to the header extension fields or data payload area of ​​the access request data packet, the device fingerprint of the campus network trusted sensing node and the timestamp of the processing time are superimposed onto the access request data packet.

[0025] The Identity Link Mapping Authentication Center is deployed on the school's data center server or cloud computing resources. It establishes data communication connections with campus terminal agents and trusted sensing nodes on the campus network via the TCP / IP network protocol. The center is equipped with a database storage unit that stores an identity link mapping rule base. This rule base contains multiple mapping records, each including an associated user electronic identity field, an authorized access range condition field, and a legitimate link feature sequence field. The authorized access range condition field defines the time period or specific resource object that the user is authorized to access; the legitimate link feature sequence field defines the set of device fingerprints of the trusted sensing nodes on the campus network that must be traversed when the authorized access range condition field is met.

[0026] The Identity Link Mapping Authentication Center receives access request data packets containing overlaid information from multiple trusted sensing nodes on the campus network. The processor of the Identity Link Mapping Authentication Center is configured to execute parsing and verification logic to decrypt the digital signature in the access request data packet to verify the authenticity of the user's identity. The Identity Link Mapping Authentication Center also sequentially extracts the device fingerprint identifier sequence overlaid in the access request data packet, constructs the actual network transmission path traversed by the data packet, and matches and verifies the network transmission path against the corresponding legitimate link feature sequence field in the Identity Link Mapping rule base.

[0027] The network topology environment involved in this invention is built on a hierarchical Ethernet and wireless LAN physical architecture, realizing bidirectional data packet transmission between campus terminal agents and identity link mapping authentication centers.

[0028] The campus terminal agent is located at the edge access side of the network topology. The campus terminal agent establishes a physical layer connection with the campus network trusted sensing node via radio frequency signals or wired twisted-pair cables. In this embodiment, the campus network trusted sensing node directly connected to the campus terminal agent is a wireless access point or an access layer switch.

[0029] The campus network's trusted sensing nodes are deployed in a cascaded manner using a tree or star topology within the network topology environment. Based on network layers, these nodes are divided into access layer devices, aggregation layer devices, and core layer devices. Access layer devices are deployed in the terminal network cabinets of teaching buildings, student dormitories, laboratories, and libraries, providing physical ports or wireless radio frequency coverage. Aggregation layer devices are deployed in building electrical rooms or the regional network center, connecting the uplink ports of multiple access layer devices via fiber optic links.

[0030] The Identity Link Mapping Authentication Center is deployed in the core switching area of ​​the network topology. It is directly connected to core layer devices via a fiber optic backbone network. As the logical endpoint for all network data traffic, the Identity Link Mapping Authentication Center aggregates access request data packets from campus terminal agents in different physical areas.

[0031] In this network topology, data transmission paths are strictly defined by physical connections. When a campus terminal agent initiates an access request, the access request data packet must strictly follow the physical lines, passing through the access layer devices, aggregation layer devices, and core layer devices in sequence. The physical transmission link composed of the aforementioned interconnected trusted sensing nodes of the campus network uniquely corresponds to a specific area in the campus geographic space.

[0032] The network topology is based on physical ports to divide virtual LANs or subnets. Trusted awareness nodes in the laboratory area and those in the public teaching area are isolated from each other on physical links or logical routing table entries. The identity link mapping authentication center identifies the physical network location of the campus terminal agent based on the routing hop count and node characteristic sequence carried in the received access request data packet.

[0033] This invention provides an electronic identity link mapping authentication method for trusted identifier resolution, including steps S100 to S400.

[0034] Step S100: The Identity Link Mapping Authentication Center establishes and stores mapping rules between user electronic identities and legitimate network link characteristics. The Identity Link Mapping Authentication Center receives permission configuration data from the school management system through a data interface. The permission configuration data includes the user's identity identifier, the resource objects the user is authorized to access, and the physical network areas the user is allowed to traverse when accessing the resource objects. The Identity Link Mapping Authentication Center calls a pre-set network topology database and, based on the physical location and network device correspondence stored in the database, converts the physical network areas into device fingerprint identifier sequences for the corresponding campus network trusted sensing nodes. The Identity Link Mapping Authentication Center generates a mapping record in the Identity Link Mapping Rule Base, which defines the association constraints between the user's identity identifier, resource objects, and legitimate device fingerprint identifier sequences.

[0035] Step S200: The campus terminal agent initiates an access request. During transmission, the access request data packet is superimposed with link feature information hop-by-hop by the trusted sensing nodes of the campus network. The campus terminal agent uses its built-in national cryptographic algorithm module to generate an initial access request data packet containing the user's digital signature and sends the initial access request data packet to the campus network. When the initial access request data packet is transmitted in the physical network, it passes through multiple trusted sensing nodes of the campus network in sequence. Each trusted sensing node of the campus network that receives the initial access request data packet extracts the digest information of the initial access request data packet and uses the device private key stored in the trusted sensing node to digitally sign the digest information, the device fingerprint identifier of the trusted sensing node, and the current processing timestamp. The trusted sensing node of the campus network encapsulates the device fingerprint identifier, the current processing timestamp, and the generated digital signature into link feature information and appends it to the extended field of the initial access request data packet to form a data packet to be authenticated containing complete transmission path evidence.

[0036] Step S300: The Identity Link Mapping Authentication Center verifies the consistency between the user's identity and the network link characteristics. The Identity Link Mapping Authentication Center receives the data packet to be authenticated. The center uses the user's public key to verify the validity of the user's digital signature in the data packet. After confirming the validity of the user's digital signature, the center extracts the link feature information sequence generated by multiple campus network trusted sensing nodes carried in the data packet. The center uses the pre-stored public keys of each campus network trusted sensing node to verify the integrity of the digital signature in the link feature information sequence one by one. If all digital signatures pass verification, the center parses the device fingerprint identification sequence that the data packet actually passed through and matches the device fingerprint identification sequence with the mapping record stored in step S. If the device fingerprint identification sequence is included in the set of valid device fingerprint identification sequences defined in the mapping record, the link authentication is deemed successful.

[0037] Step S400: The Identity Link Mapping Authentication Center performs hierarchical authorization operations based on the link trust level. The Identity Link Mapping Authentication Center obtains the preset security weight values ​​of each trusted sensing node in the campus network through which the data packet actually passes. The Identity Link Mapping Authentication Center performs statistical calculations on the security weight values ​​to obtain a security trust level value reflecting the overall security status of the current transmission link. The statistical calculation method includes calculating the arithmetic mean or weighted cumulative value of the security weight values ​​of all traversed nodes.

[0038] The Identity Link Mapping Authentication Center compares the calculated security trust level with a preset permission threshold. When the security trust level is greater than or equal to the high security threshold, the Identity Link Mapping Authentication Center generates an authorization command containing read and write permissions. When the security trust level is less than the high security threshold but greater than or equal to the basic threshold, the Identity Link Mapping Authentication Center generates an authorization command containing browsing permissions. The Identity Link Mapping Authentication Center then sends the authorization command to the Resource Access Control Gateway.

[0039] This invention provides a method for constructing identity link mapping rules, which is executed by an identity link mapping authentication center and is used to establish a static trust relationship between a user identity and a fixed network access environment.

[0040] The identity link mapping authentication center is equipped with a rule management module. This module provides a management configuration interface, through which it receives organizational structure information and network asset allocation information entered by the administrator. The organizational structure information defines the user's functional attributes, including those for financial personnel, academic affairs management personnel, and personnel handling classified research. The network asset allocation information defines the fixed office locations of users with different functional attributes within the campus physical space. Based on this network asset allocation information, the rule management module determines the physical network port number or wireless access point hardware identifier used by the user at their fixed office location.

[0041] The Identity Link Mapping Authentication Center integrates a topology resolution module. This module connects to and reads the campus infrastructure network topology database. This database records the physical connections and neighbor relationships between physical network ports and trusted sensing nodes within the campus network. Based on the physical network port numbers or wireless access point hardware identifiers determined by the rule management module, the topology resolution module uses graph search algorithms or next-hop routing lookup mechanisms to calculate the complete network transmission path from the fixed office location to the Identity Link Mapping Authentication Center. The module then sequentially extracts the device fingerprints of all trusted sensing nodes along the network transmission path, combining them to form a static, legitimate link feature sequence.

[0042] The rule management module associates the user's electronic identity, restricted resource identifier, and the static legal link feature sequence in a data table to generate static identity link mapping rules. Taking a financial private network application scenario as an example, the rule management module establishes access rules that only allow access containing the fingerprint identifier of a specific switch device in the finance department. When the identity link mapping authentication center receives an access request that does not contain the fingerprint identifier of a specific switch device in the finance department, the identity link mapping authentication center will execute an access denial operation.

[0043] The Identity Link Mapping Authentication Center stores the generated static identity link mapping rules in a non-volatile database storage unit. During the operation of the Identity Link Mapping Authentication Center, it uses these static identity link mapping rules as a basis to perform link compliance verification on access requests from specific high-security areas.

[0044] This invention provides a dynamic topology template generation method, which is executed by an identity link mapping authentication center to generate identity link mapping rules containing time constraints.

[0045] The identity link mapping authentication center is internally configured with an external data interface module. This module establishes a one-way data transmission channel with the campus academic affairs management system and the research scheduling management system via an application programming interface (API) or a read-only database view. The external data interface module polls for users' spatiotemporal activity plan data at preset time intervals. This data includes the user's digital identity, the plan's start and end timestamps, and the physical room number of the planned activity.

[0046] The identity link mapping authentication center is internally configured with a dynamic rule generation module. This module receives spatiotemporal activity plan data collected by an external data interface module. It performs network location mapping processing on the physical room numbers. The module retrieves a pre-set physical location-to-network device lookup table. This table stores a one-to-one correspondence between physical room numbers and the device fingerprints of trusted sensing nodes on the campus network covering the area of ​​those physical room numbers. The module extracts the device fingerprint of the trusted sensing node on the campus network corresponding to the physical room number, using it as the source node identifier for path calculation.

[0047] The dynamic rule generation module reads the campus network topology database. This database stores the adjacency matrix and link routing weights of all network devices. Starting with the source node identifier and ending with the access node identifier of the identity link mapping authentication center, the module calculates the logical forwarding path for data transmission using the shortest path first algorithm, based on the adjacency matrix and link routing weights. The module then sequentially extracts the device fingerprints of all trusted sensing nodes along the logical forwarding path, constructing a dynamic legitimate link feature sequence.

[0048] The dynamic rule generation module defines the effective time conditions of the rules based on the plan start timestamp and plan end timestamp. The dynamic rule generation module combines the user's digital identity identifier, the dynamic legal link feature sequence, the plan start timestamp, and the plan end timestamp to generate dynamic identity link mapping rules.

[0049] The Identity Link Mapping Authentication Center writes the generated dynamic identity link mapping rules into a cache memory. The Identity Link Mapping Authentication Center runs a timed monitoring process. When the system clock time is greater than the scheduled end timestamp, the timed monitoring process deletes the corresponding dynamic identity link mapping rule from the cache memory.

[0050] This invention provides an initial access request generation method, which is executed by a campus terminal agent.

[0051] The campus terminal agent is internally configured with an interaction interface module. This module responds to user clicks on resources or application calls on the mobile terminal screen. From these clicks or calls, the interaction interface module extracts the Uniform Resource Locator (URL) and operation type parameters of the target resource object requested by the user.

[0052] The campus terminal agent is internally configured with an identity data storage module. This module is constructed using a hardware trusted execution environment based on ARM TrustZone or a white-box cryptographic library. The identity data storage module securely stores the user's electronic identity and the user's private key from their asymmetric key pair. The campus terminal agent reads the user's electronic identity from the identity data storage module via a secure API call.

[0053] The campus terminal agent constructs basic business messages. The campus terminal agent generates a 32-bit high-strength pseudo-random number. The campus terminal agent obtains the client's timestamp at the current system moment. The campus terminal agent assembles the user's electronic identity, the target resource object's Uniform Resource Locator, the operation type parameter, the client timestamp, and the pseudo-random number according to preset serialization rules to form the basic business message.

[0054] The campus terminal agent is internally configured with a cryptographic processing module. This module integrates the SM2 elliptic curve public key cryptography algorithm library and the SM3 cryptographic hash algorithm library. The module uses the SM3 cryptographic hash algorithm to perform hash operations on basic business messages, generating a fixed-length message digest. Then, the module calls the user's private key from the identity data storage module and uses the SM2 elliptic curve digital signature algorithm to encrypt the message digest, generating the user's digital signature data.

[0055] The campus terminal agent is internally configured with a message encapsulation module. This module defines the frame structure of the initial access request data packet. It fills the data payload area of ​​the initial access request data packet with basic service messages. Finally, it fills the signature verification field in the header of the initial access request data packet with the user's digital signature data.

[0056] The message encapsulation module defines a link tracing extension field in the custom extended header of the initial access request data packet. The module initializes this field to an empty JSON array object or an empty TLV container. This link tracing extension field is specifically used to store link characteristic data superimposed from each network node in the subsequent transmission path. The message encapsulation module then sends the encapsulated initial access request data packet to the access layer device that has established a physical connection with the mobile terminal via the mobile terminal's physical network adapter.

[0057] This invention provides a trusted node link tagging method, which is executed by a campus network trusted sensing node deployed in the network transmission path.

[0058] The campus network trusted sensing node integrates a packet parsing module. This module resides within the data plane forwarding engine or network processor of the trusted sensing node. When the trusted sensing node receives a data frame through a physical ingress port, the packet parsing module parses the network layer protocol header of the data frame. The module identifies specific protocol identifiers within the protocol header and determines that the data frame is an authentication packet carrying an IPv6 hop-by-hop options extension header or TCP option fields. The module directly reads the user's digital signature data from the protocol header of the authentication packet and locates the variable-length field area used to store the link tracing list.

[0059] The campus network trusted sensing node integrates a secure signature module. This module is built on an FPGA programmable logic array or a high-performance cryptographic acceleration card. The secure signature module is connected to an onboard tamper-proof security chip, which stores the device identity private key and device fingerprint identifier of the campus network trusted sensing node. The secure signature module obtains the current high-precision hardware clock timestamp of the campus network trusted sensing node. The secure signature module concatenates the user digital signature data, the device fingerprint identifier, and the high-precision hardware clock timestamp into binary bits to form a data block to be signed. The secure signature module calls the device identity private key to perform elliptic curve digital signature operations on the data block to be signed, generating the digital signature of the currently hopped node.

[0060] The campus network's trusted sensing node integrates a forwarding and encapsulation module. This module is responsible for performing packet rewriting operations. It encapsulates the device fingerprint, the high-precision hardware clock timestamp, and the node's digital signature into a standard type-length-value data unit. The module then appends this type-length-value data unit to the end of the link tracing list of the data packet to be authenticated.

[0061] The forwarding and encapsulation module detects the length of the modified data packet to be authenticated. If the length of the data packet to be authenticated does not exceed the maximum transmission unit limit of the interface, the forwarding and encapsulation module recalculates the IP header checksum and frame check sequence. The forwarding and encapsulation module queries the local hardware routing table and matches the interface index based on the destination IP address of the data packet to be authenticated. The forwarding and encapsulation module sends the data packet to be authenticated, carrying the link characteristic information of this node, to the next-hop network device through the physical output port. The packet parsing module, the security signature module, and the forwarding and encapsulation module perform the above operations sequentially when the data packet passes through each campus network trusted awareness node on the transmission path.

[0062] This invention provides a dual signature verification method, which is executed by an identity link mapping authentication center.

[0063] The Identity Link Mapping Authentication Center integrates a message receiving and parsing module. This module receives data packets to be authenticated via a high-speed network interface card. It parses the protocol structure of the data packets, separating them into a basic service message portion and a link tracing extension field portion. From the basic service message portion, the module extracts the user's electronic identity, the Uniform Resource Locator (URL) of the target resource object, operation type parameters, client timestamp, pseudo-random number, and user digital signature data. From the link tracing extension field portion, the module extracts a link tracing list consisting of multiple link feature entries.

[0064] The identity link mapping authentication center integrates a user identity verification module. This module is responsible for verifying the identity of the user holder.

[0065] The user identity verification module first performs request freshness and anti-replay checks. The module calculates the difference between the current system time and the client's timestamp. If the absolute value of the difference exceeds a preset valid time window threshold, the module determines the request has timed out. If the request has not timed out, the module queries the anti-replay cache database. If a record matching the pseudo-random number already exists in the anti-replay cache database, the module determines the current request is a replay attack request, and the identity link mapping authentication center discards the data packet to be authenticated.

[0066] If the request passes the above checks, the user identity verification module retrieves the corresponding user public key from the user certificate database based on the user's electronic identity. The user identity verification module then uses the SM3 cryptographic hash algorithm to perform a hash operation on the combined data containing the user's electronic identity, the Uniform Resource Locator (URL) of the target resource object, operation type parameters, client timestamp, and pseudo-random number to obtain a local computed digest. The user identity verification module then uses the user's public key and the user's digital signature data to perform SM2 signature validity verification on the local computed digest. If verification fails, the Identity Link Mapping Authentication Center terminates subsequent processing.

[0067] The identity link mapping authentication center integrates a link integrity verification module. This module is responsible for verifying the network transmission path. It iterates through each link feature entry in the link tracing list.

[0068] For the currently traversed link feature entry, the link integrity verification module parses and obtains the device fingerprint, node processing timestamp, and node digital signature. The link integrity verification module retrieves the device public key corresponding to the device fingerprint from the network device identity database. The link integrity verification module concatenates the user digital signature data, the device fingerprint, and the node processing timestamp according to preset rules to reconstruct the data block to be verified. The link integrity verification module uses the device public key to perform signature verification operations on the node digital signature and the data block to be verified.

[0069] The link integrity verification module performs a hop-by-hop delay logic check. The module calculates the time difference between the node processing timestamp in the currently traversed link feature entry and the node processing timestamp in the previous hop link feature entry. If the current hop is the first hop, it calculates the time difference with the client's timestamp. The link integrity verification module then determines whether the time difference is less than or equal to a preset maximum physical transmission delay threshold for a single hop.

[0070] If the digital signature verification of any link feature entry fails, or the latency logic check between any adjacent nodes fails, the link integrity verification module outputs a link anomaly signal. When all link feature entries in the link tracing list pass verification and the timing logic is normal, the link integrity verification module outputs a link verification pass signal. After receiving the pass signals from the user identity verification module and the link integrity verification module, the identity link mapping authentication center triggers the subsequent permission decision process.

[0071] This invention provides a path matching and defense method based on topology consistency, which is executed by an identity link mapping authentication center.

[0072] The identity link mapping authentication center integrates a path matching module. The path matching module is activated upon receiving a link verification pass signal from the link integrity verification module. The path matching module extracts the user's electronic identity and the target resource object identifier from the data packet to be authenticated. Based on the user's electronic identity and the target resource object identifier, the path matching module jointly retrieves the corresponding identity link mapping rule from the database storage unit.

[0073] The path matching module executes the rule priority determination logic. First, it checks if a dynamic identity link mapping rule exists within its effective time window. If it does, the path matching module retrieves that dynamic identity link mapping rule as the current matching benchmark. If it does not exist, the path matching module retrieves a static identity link mapping rule as the current matching benchmark.

[0074] The path matching module reads a preset standard valid link feature sequence from the current matching benchmark. The path matching module extracts the link feature sequence to be detected, composed of device fingerprints, from the link tracing list of the data packets to be authenticated. The path matching module performs a sequence consistency comparison. The path matching module compares the device fingerprints in the standard valid link feature sequence with those in the link feature sequence to be detected, item by item, according to their index positions.

[0075] If the content and order of the standard legitimate link feature sequence are completely identical to the link feature sequence to be detected, the path matching module determines that the path is compliant. The path matching module generates an access token containing the user's current permission level and validity period. The path matching module sends the access token to the campus terminal agent to authorize the establishment of an encrypted communication session.

[0076] The identity link mapping authentication center integrates a security response module. When the path matching module determines that the standard legitimate link feature sequence is inconsistent with the link feature sequence to be detected, the security response module is triggered.

[0077] The security response module sends an access denial command to the campus terminal agent and issues a blocking signaling message to the firewall device for the current TCP connection. The security response module generates a security audit log, which records the user's electronic identity, detailed information about the detected link's characteristic sequence, and the interception timestamp.

[0078] The security response module performs a reputation score calculation based on path deviation. It employs a sequence similarity calculation algorithm to determine the minimum number of single-character editing operations required to convert the detected link feature sequence into the standard legitimate link feature sequence. These single-character editing operations include insertion, deletion, and replacement.

[0079] The security response module reads the current security reputation score associated with the user's electronic identity. The security response module determines the corresponding penalty score based on the minimum number of single-character edit operations. The security response module calculates the difference between the current security reputation score and the penalty score to obtain the updated reputation score.

[0080] The security response module writes the updated reputation score into the user's reputation database. If the updated reputation score is lower than a preset gray-scale monitoring threshold, the security response module marks the user's electronic identity as suspicious. If the updated reputation score is lower than a preset blocking threshold, the security response module revokes the user's electronic identity's access permissions across the entire network.

[0081] This invention provides a trust-based hierarchical authorization method, which is executed by an identity link mapping authentication center.

[0082] The identity link mapping authentication center integrates a dynamic authorization execution module. This module is activated in response to a path compliance signal output by the path matching module. The dynamic authorization execution module receives currently pending access requests, which include the user's electronic identity and the target resource object identifier.

[0083] The dynamic authorization execution module performs a resource security level assessment. Based on the target resource object identifier, the module retrieves the corresponding security sensitivity level from the resource attribute database. The security sensitivity levels include general public, internal restricted, and core confidential levels. The module then extracts the permission control list supported by the target resource object, which includes bitmasks for read-only, read-write, download, and management operations.

[0084] The dynamic authorization execution module performs real-time user reputation reading. Using the user's electronic identity, the dynamic authorization execution module reads the user's current real-time security reputation score from the user reputation database.

[0085] The dynamic authorization execution module obtains a first reputation threshold and a second reputation threshold corresponding to the security sensitivity level based on a preset hierarchical authorization mapping strategy table, wherein the first reputation threshold is greater than the second reputation threshold.

[0086] The dynamic authorization execution module compares the real-time security reputation score with the first reputation threshold and the second reputation threshold, and executes the following branch logic: If the real-time security reputation score is greater than or equal to the first reputation threshold, the dynamic authorization execution module generates a full authorization instruction. The dynamic authorization execution module enables read-only, read-write, and download permission bits in the full authorization instruction.

[0087] If the real-time security reputation score is less than the first reputation threshold but greater than or equal to the second reputation threshold, the dynamic authorization execution module performs a service degradation operation. The dynamic authorization execution module generates a restricted authorization instruction. In the restricted authorization instruction, the dynamic authorization execution module sets the download permission bit and modification permission bit to zero, retaining only the read-only permission bit. The dynamic authorization execution module also attaches watermark rendering metadata to the restricted authorization instruction. This watermark rendering metadata is used to instruct the campus terminal agent to draw a semi-transparent overlay layer containing the user's electronic identity and the current time on the display interface.

[0088] If the real-time security reputation score is less than the second reputation threshold but higher than the preset blocking line, the dynamic authorization execution module triggers the challenge-response authentication process. The dynamic authorization execution module returns a response message containing a random challenge code to the campus terminal agent, requiring the user to provide biometrics or a dynamic password to sign the random challenge code. The dynamic authorization execution module generates a single-use temporary access instruction only after receiving and verifying a response message containing a correct signature.

[0089] The dynamic authorization execution module constructs an access token in JSON Web Token format based on the generated instructions. It writes the permission bitmask, expiration timestamp, watermark rendering metadata, and session unique identifier into the JWT payload. The module then digitally signs the JWT header and payload using the private key of the identity link mapping authentication center, generating the final access token. Finally, the module returns this access token to the campus terminal agent via an encrypted channel, serving as credential for subsequent access to the target resource object.

[0090] This invention provides a scenario-based defense method based on physical path trust, which is executed by an identity link mapping authentication center.

[0091] The identity link mapping authentication center integrates a scenario-based defense logic module. This module pre-stores physical location binding policies for high-security areas in the database. For target resources such as laboratory access controllers or core scientific research data servers, the module associates these resources with static identity link mapping rules. These static rules explicitly define the unique and legitimate physical topology path that must be matched to access the target resource. This unique and legitimate physical topology path consists of the fingerprints of specific building aggregation layer switch devices and the fingerprints of access layer switch devices on specific floors.

[0092] When a user attempts to access the target resource object using Virtual Private Network (VPN) technology via a mobile terminal, the campus terminal agent encapsulates the original access request data packet within the payload of a VPN tunnel protocol message. As the VPN tunnel protocol message is transmitted through the physical lines of the campus network's access and aggregation layers, the campus network's trusted awareness nodes deployed along the transmission path can only recognize the outer tunnel protocol header and cannot parse and manipulate the inner original access request data packet. Therefore, the link tracing list field of the original access request data packet is either blank or outdated.

[0093] The VPN tunnel protocol message arrives at the VPN gateway device at the campus network boundary. The VPN gateway device performs a decapsulation operation to restore the original access request data packet and forwards the original access request data packet to the identity link mapping authentication center.

[0094] The scenario-based defense logic module receives the original access request data packet and performs a cross-validation of the logical address and physical path. The module parses the network layer header of the original access request data packet to identify that the source IP address belongs to a dedicated logical network segment within the laboratory. Simultaneously, the module extracts the link feature sequence to be detected from the custom extended header.

[0095] The scenario-based defense logic module detected that the feature sequence of the link to be detected lacked the device fingerprint identifier of the campus network trusted perception node of the physical building and floor where the laboratory is located, as required by the static identity link mapping rules. The scenario-based defense logic module determined that the current request had a conflict between logical identity and physical location, confirming that the current request was an unauthorized remote access behavior initiated through a VPN tunnel, rather than a real local physical access behavior.

[0096] The scenario-based defense logic module generates an authorization denial command. For laboratory access control scenarios, this module refuses to issue access tokens containing door-opening instructions, preventing campus terminal agents from driving the access control controller via near-field communication or QR codes.

[0097] The scenario-based defense logic module generates security audit logs containing physical path anomaly identifiers. It then sends alarm data packets to the campus network security management platform via the Syslog logging protocol or the Simple Network Management Protocol (SMMP). Finally, it sends an account status update command to the authentication database, temporarily freezing the user account that initiated the request to prevent subsequent brute-force attacks or internal network penetration attacks.

[0098] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. An electronic identity link mapping authentication system for trusted identifier resolution, characterized in that, Including identity link mapping authentication center; The identity link mapping authentication center integrates a message receiving and parsing module, a user identity verification module, a link integrity verification module, and a path matching module. The message receiving and parsing module is used to parse the received data packet to be authenticated, separate the data packet to be authenticated into a basic service message part and a link tracing extended field part, and extract a link tracing list composed of multiple link feature entries from the link tracing extended field part; The user identity verification module is used to verify the legitimacy of the user holder's identity based on the user's electronic identity identifier and user digital signature data in the basic business message section. The link integrity verification module is used to traverse each link feature entry in the link tracing list item by item to verify the validity of the node digital signature and the rationality of the timing logic between adjacent nodes. The path matching module is used to perform a consistency comparison between the link feature sequence to be detected extracted from the link tracing list and the standard legal link feature sequence in the preset identity link mapping rules after the user identity verification module and the link integrity verification module have passed the verification, and generate a path compliance signal based on the comparison result.

2. The electronic identity link mapping authentication system for trusted identifier resolution according to claim 1, characterized in that, The data packet to be authenticated is generated by the campus terminal agent and processed by the campus network trusted sensing node on the network transmission path; When generating the data packet to be authenticated, the campus terminal agent encapsulates the user's electronic identity, timestamp, pseudo-random number and user digital signature data in the basic business message portion. When the trusted sensing node of the campus network forwards the data packet to be authenticated, it adds a link feature entry to the link tracing extension field. The link feature entry includes the device fingerprint of the node, the node processing timestamp, and the node digital signature generated using the node's private key.

3. The electronic identity link mapping authentication system for trusted identifier resolution according to claim 2, characterized in that, When verifying the legitimacy of a user's identity, the user identity verification module performs the following operations: Calculate the difference between the current system time and the client timestamp in the data packet to be authenticated, and determine whether the difference is within a preset effective time window threshold; Query the anti-replay cache database to determine whether the pseudo-random number in the data packet to be authenticated already exists; If the time is valid and the pseudo-random number does not exist, the signature validity of the hash digest of the basic business message is verified using the user's public key.

4. The electronic identity link mapping authentication system for trusted identifier resolution according to claim 2, characterized in that, When verifying the timing logic rationality between adjacent nodes, the link integrity verification module performs the following operations: Calculate the time difference between the node processing timestamp in the currently traversed link feature entry and the node processing timestamp in the previous hop link feature entry; if the current hop is the first hop, calculate the time difference with the client's timestamp. Determine whether the time difference is less than or equal to a preset single-hop maximum physical transmission delay threshold; If the node digital signature verification of any link feature entry fails, or if the time difference between any adjacent nodes exceeds the single-hop maximum physical transmission delay threshold, a link abnormality signal is output.

5. The electronic identity link mapping authentication system for trusted identifier resolution according to claim 1, characterized in that, The identity link mapping authentication center also integrates a security response module; The security response module is used to perform a reputation score calculation based on path deviation when the path matching module determines that the standard legal link feature sequence is inconsistent with the link feature sequence to be detected. The security response module uses the Levenstein distance algorithm to calculate the minimum number of single-character editing operations required to convert the detected link feature sequence into the standard legal link feature sequence. The security response module determines the penalty score based on the minimum number of single-character editing operations, and subtracts the penalty score from the current security reputation score associated with the user's electronic identity to obtain the updated reputation score.

6. The electronic identity link mapping authentication system for trusted identifier resolution according to claim 5, characterized in that, The identity link mapping authentication center also integrates a dynamic authorization execution module; The dynamic authorization execution module is used to perform hierarchical authorization based on the updated reputation score and the security sensitivity level of the target resource object; When the updated reputation score is less than the first reputation threshold but greater than or equal to the second reputation threshold, the dynamic authorization execution module generates a restricted authorization instruction; The restricted authorization instruction is configured to set the download permission bit and modification permission bit to zero, retain only the read-only permission bit, and attach watermark rendering metadata to the instruction. The watermark rendering metadata is used to instruct the campus terminal agent to draw a semi-transparent overlay containing the user's electronic identity on the display interface.

7. The electronic identity link mapping authentication system for trusted identifier resolution according to claim 6, characterized in that, The dynamic authorization execution module is also used to perform the following operations: When the updated reputation score is less than the second reputation threshold but higher than the preset blocking line, the challenge-response authentication process is triggered. Return a verification response message containing a random challenge code to the campus terminal agent; Upon receiving a response message confirming the correct signature of the random challenge code, a single-use temporary access instruction is generated.

8. The electronic identity link mapping authentication system for trusted identifier resolution according to claim 1, characterized in that, The identity link mapping authentication center also integrates a scenario-based defense logic module; The scenario-based defense logic module is used to perform cross-validation of the consistency between the logical address and the physical path; When the source IP address of the data packet to be authenticated is identified as belonging to an internal private logical network segment, but the device fingerprint identifier of the campus network trusted perception node of the physical building and floor bound to the logical network segment is missing in the feature sequence of the link to be detected, it is determined that there is a virtual private network bypass behavior, and the generation of access token is refused.

9. The electronic identity link mapping authentication system for trusted identifier resolution according to claim 6, characterized in that, The authorization instructions generated by the dynamic authorization execution module are encapsulated as access tokens in JSONWebToken format; The payload of the access token includes a permission bitmask, an expiration timestamp, watermark rendering metadata, and a session unique identifier. The access token is digitally signed by the private key of the identity link mapping authentication center.

10. A method for electronic identity link mapping authentication oriented to trusted identifier resolution, based on the electronic identity link mapping authentication system oriented to trusted identifier resolution as described in any one of claims 1-9, characterized in that, The method is executed by the identity link mapping authentication center and includes the following steps: The received data packet to be authenticated is parsed, and the data packet to be authenticated is separated into the basic service message part and the link tracing extended field part, and the link tracing list is extracted; The legitimacy of the user holder's identity is verified based on the user's electronic identity and digital signature data in the basic business message section. Each link feature entry in the link tracing list is traversed item by item to verify the validity of the node digital signature and the rationality of the timing logic between adjacent nodes. After the user holder's identity and link integrity are verified, the feature sequence of the link to be detected in the link tracing list is extracted; The detection link feature sequence is compared with the standard legal link feature sequence in the preset identity link mapping rules. If they match, the path is deemed compliant and an access token is generated.

Images