A method, device and storage medium for intelligent security authentication

Abstract

This application monitors the current requests of a target account. When a target account accesses and operates the virtualization system, it determines the corresponding target account behavior profile based on the target account information. Based on the target account behavior profile, it compares the target account's current request with the following criteria: It determines whether the target account's current request meets the preset conditions for initiating a multi-factor authentication mechanism; if so, it initiates the multi-factor authentication mechanism. It also determines whether the target account's current request meets the preset conditions for initiating a multi-factor authentication mechanism; if so, it initiates the multi-factor authentication mechanism. Finally, it determines whether the target account's current request meets the preset conditions for initiating a verification authentication mechanism; if so, it initiates the verification authentication mechanism. This application can identify abnormal account access operations and protect the virtualization system by verifying the account through multiple authentication and authorization methods.

Description

Technical Field

[0001] The present application relates to the field of virtualization system authentication and authorization, and in particular to an intelligent security authentication and authorization method, device and storage medium. Background Art

[0002] With the advent of the cloud computing era, as a key link in the development of cloud computing, the security of virtualization systems is becoming more and more important. Authentication is an important part of virtualization systems. Insecure authentication schemes not only threaten the computing resources, storage resources, and network resources of virtualization systems, but also act as a hacker network attack tool, which brings serious consequences. Therefore, secure authentication schemes are essential technologies for the safe, stable, and reliable operation of virtualization systems, and play an important role in promoting the development of the entire cloud computing industry.

[0003] Currently, the most popular authentication scheme for virtual cloud is RBAC system authentication scheme. RBAC system authentication scheme associates users with roles, and roles with permissions. There is generally a many-to-many relationship between user roles and role permissions. Its authentication method mainly verifies whether the account information provided by the user is the account information authorized by the system. Once the verification is passed, the user has the permission. Once the account information authorized by the system is obtained illegally, the user can access and operate the virtualization system at will within the scope of the permission, and the virtualization system has low security. Usually, some user behavior habits also pose a threat to the virtualization system. For example, if the user likes to maximize authorization, it may be easy to mistakenly perform high-risk operations during use. For example, excessive account creation or zombie accounts make account management loopholes easy to be stolen, which poses a serious threat to the security of the virtualization system.

[0004] This solution is mainly designed to solve the problem of system account information being stolen and redundant accounts or zombie accounts being illegally used. Through this solution, an intelligent security strategy can be provided based on the original authentication security strategy to strengthen the security of the virtualization system. Summary of the invention

[0005] In order to solve the above technical problems or at least partially solve the above technical problems, the present application provides an intelligent security authentication method, device and storage medium.

[0006] In a first aspect, the present application provides an intelligent security authentication method, comprising:

[0007] Call the data in the account behavior profile and cooperate with the preset rules or preset condition rules to form trigger conditions;

[0008] When the target account accesses the operation virtualization system, the corresponding target account behavior profile is determined according to the target account information, and the target trigger condition is formed by the target account behavior profile;

[0009] Monitor the current request of the target account, and analyze whether the current request of the target account triggers the authentication mechanism according to the target trigger condition. If it does, execute the triggered authentication mechanism:

[0010] Determine whether the current request of the target account meets the preset conditions for starting the multi-factor authentication mechanism, and if so, start the multi-factor authentication mechanism;

[0011] Determine whether the current request of the target account meets the preset conditions for starting the multi-factor authentication mechanism, and if so, start the multi-factor authentication mechanism;

[0012] Determine whether the current request of the target account meets the preset conditions for starting the multiple authentication mechanism, and if so, start the multiple authentication mechanism;

[0013] Determine whether the current request of the target account meets the preset conditions for starting the review and authentication mechanism, and if so, start the review and authentication mechanism.

[0014] Furthermore, behavioral data of account access operation virtualization system is collected, and the collected behavioral data includes account login log, request access log, operation log, content of audit log and account authorization information; the account behavior data is analyzed and mined through big data technology to summarize the account behavior portrait including account login device, IP address, usual operation time, account commonly used resources and resource types, account execution operations and frequency and authorization data.

[0015] Furthermore, the data in the account behavior profile is called and combined with the preset rules to form the trigger conditions for the account login authentication process:

[0016] When the login device, IP address and time used by the target account to log in are inconsistent with any corresponding data retrieved from the target account behavior profile, the multi-factor authentication mechanism is activated;

[0017] The data in the account behavior profile is called and combined with the preset rules to form a trigger condition containing an association relationship or through the preset condition rules. The trigger condition containing the association relationship is applied in the account operation and access authentication process. The association relationship includes:

[0018] The association of multiple authentication mechanisms, multiple authorization mechanisms, and verification authorization mechanisms with resources,

[0019] The association of multiple authentication mechanisms, multiple authorization mechanisms and verification authorization mechanisms with operations,

[0020] The corresponding mechanism is initiated when the target account performs the associated operation or accesses the associated resources.

[0021] Furthermore, the specific contents of the association relationship include: determining the operations not performed by the account based on the operations performed by the account in the account behavior profile or determining the resources not accessed by the account based on the resources accessed, and associating the account's request to perform the operations not performed or access the resources not accessed with any one or more of the multiple authentication mechanisms, multiple authorization mechanisms and double-check authorization mechanisms;

[0022] Determine the accounts that have not been authorized by the account based on the authorization data in the account behavior profile, and associate the authorization request for the unauthorized account with any one or more of the multiple authentication mechanism, multiple authentication mechanism and double-check authentication mechanism;

[0023] Pre-set the scope of high-risk requests, and associate high-risk requests with any one or more of the multiple authentication mechanisms, multiple authorization mechanisms, and review authorization mechanisms;

[0024] Pre-set abnormal request scenarios, and associate the abnormal request scenarios with any one or more of the multiple authentication mechanisms, multiple authorization mechanisms, and review authorization mechanisms.

[0025] Furthermore, the multi-factor authentication mechanism is activated to provide users with an account password authentication method, and also provides users with at least one or a combination of email authentication methods, SMS authentication methods, and key device authentication methods; the user is allowed to log in to the virtualization system after passing all authentication methods provided by the multi-factor authentication mechanism.

[0026] Furthermore, the review and authentication mechanism pre-sets a high-level account for account authorization;

[0027] Verify whether the target account that triggers the review authentication mechanism meets the RBAC permissions.

[0028] If the RBAC permissions are not met, the request to trigger the review and authentication mechanism for the target account will be rejected.

[0029] If the RBAC permissions are met, the corresponding senior account is requested to grant permissions.

[0030] If the senior account authorizes the target account, the target account triggers the request for the verification and authentication mechanism.

[0031] If the senior account refuses to authorize the target account, the target account's request to trigger the review and authentication mechanism is rejected.

[0032] Furthermore, when the multi-authentication mechanism is triggered by a target account request, the account password of the target account that triggers the multi-authentication mechanism is authenticated again. If the authentication is successful, the request to trigger the multi-authentication mechanism is allowed to execute; otherwise, the request to trigger the multi-authentication mechanism is rejected.

[0033] Furthermore, when the multi-factor authentication mechanism is triggered by the target account request,

[0034] Verify whether the target account that triggers the multi-authentication mechanism meets the RBAC permissions.

[0035] If the RBAC permissions are not met, the request to trigger the multiple authentication mechanism for the target account will be rejected.

[0036] If the RBAC permissions are met, an activation link will be sent via the target account's email or SMS.

[0037] Determine that the user of the target account activates the activation operation link via email or SMS,

[0038] If yes, execute the request of the target account to trigger the multiple authentication mechanism;

[0039] Otherwise, the request to trigger the multiple authentication mechanism for the target account is rejected.

[0040] In a second aspect, the present application provides a device for implementing intelligent security authentication, including:

[0041] A collection module, the collection module is used to collect behavior data of account access to the operation virtualization system;

[0042] A data analysis module, which is used to analyze the collected behavior data to generate an account behavior profile;

[0043] A condition configuration module, which is used to call the data in the account behavior profile and cooperate with preset rules or form trigger conditions through preset condition rules;

[0044] Monitoring module, which is used to monitor the current requests of the account;

[0045] The authentication control module analyzes whether the current request of the account triggers the authentication mechanism according to the triggering condition, and starts the authentication mechanism triggered by the current request.

[0046] In a third aspect, the present application provides a storage medium for implementing the intelligent security authentication method, storing at least one instruction, and reading and executing the instruction from the storage medium for implementing the intelligent security authentication method to implement the intelligent security authentication method.

[0047] The above technical solution provided by the embodiment of the present application has the following advantages compared with the prior art:

[0048] This application collects and analyzes the behavioral data of each account to form an account behavior portrait, uses the account behavior portrait and preset rules to form trigger conditions, or directly uses preset conditional rules to form trigger conditions; analyzes the current request of the account according to the trigger conditions to execute any one or more of the multi-factor authentication mechanism, multiple authentication mechanism, multiple authentication mechanism and review authentication mechanism. Compared with the existing method of controlling account access by only using RBAC authentication and authorization scheme, it can effectively identify abnormal access and abnormal operation of the account. When the account performs abnormal access and abnormal operation, the account is further verified through the corresponding authentication and authorization method, which can effectively prevent the account from being illegally stolen and used to invade and damage the virtualization system.

[0049] By using multi-factor authentication mechanism, multiple authentication mechanism, multiple authorization mechanism and review authentication mechanism to cooperate with each other, the authentication methods are diverse, making it difficult for hackers to grasp the rules and break through, thereby strengthening the security of the virtualization system.

[0050] The use of multi-factor authentication mechanism, multiple authentication mechanism, multiple authentication mechanism and review authentication mechanism in coordination with each other can effectively prevent accounts from performing high-risk operations due to mistakes and causing damage to the virtualization system. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0052] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0053] Figure 1 A flow chart of the intelligent security authentication method provided in the embodiment of the present application;

[0054] Figure 2 A flowchart of the process executed by the multiple authentication mechanism provided in the embodiment of the present application;

[0055] Figure 3 A flowchart of the process performed by the review and authentication mechanism provided in the embodiment of the present application;

[0056] Figure 4 A schematic diagram of a device for implementing intelligent security authentication and authorization provided in an embodiment of the present application. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0058] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0059] Example 1

[0060] See also Figure 1 As shown, the embodiment of the present application provides an intelligent security authentication method, including:

[0061] S100, monitoring and collecting behavior data of account access to the virtualized system in the virtualized system. The collected behavior data includes account login logs, request access logs, operation logs, audit logs and account authorization information, so as to collect behavior data of account access to the virtualized system.

[0062] S200, analyzing and mining the account behavior data of each account through big data technology to form an account behavior profile. Specifically, the account behavior data is summarized through big data technology to obtain an account behavior profile including account login device, IP address, usual operation time, account commonly used resources and resource types, account execution operations and frequency, and authorization data.

[0063] S300, calling the data in the account behavior profile and cooperating with the preset rules or the preset condition rules to form a trigger condition;

[0064] In the specific implementation process, the data in the account behavior profile is called and combined with the preset rules to form the trigger conditions for the account login authentication process:

[0065] The login device, IP address and login time period used for recent logins are obtained from the target account behavior portrait of the target account; and compared with the login device, IP address and time used for the current login of the target account. When the login device, IP address and time used for the current login of the target account are inconsistent with any corresponding data retrieved from the target account behavior portrait, the multi-factor authentication mechanism is initiated.

[0066] Calling the data in the account behavior profile and cooperating with the preset rules to form trigger conditions that include association relationships or forming trigger conditions that include association relationships through preset condition rules is applied in the account operation and access authentication process, where the association relationship includes:

[0067] The association of multiple authentication mechanisms, multiple authorization mechanisms, and verification authorization mechanisms with resources,

[0068] The association of multiple authentication mechanisms, multiple authorization mechanisms and double-check authorization mechanisms with operations.

[0069] The trigger condition of the association relationship is as follows: the corresponding mechanism is activated when the target account performs the associated operation or accesses the associated resource.

[0070] In the specific implementation process, the association relationships formed by calling the data in the account behavior profile and cooperating with the preset rules include:

[0071] Determine the operations that the account has not performed based on the operations that the account has performed in the account behavior profile, and associate the request for the account to perform the unperformed operations with any one or more of the multiple authentication mechanisms, multiple authorization mechanisms, and review authorization mechanisms;

[0072] Determine resources that have not been accessed by the account based on the resources that have been accessed by the account in the account behavior profile, and associate the account's request to access the resources that have not been accessed with any one or more of a multiple authentication mechanism, a multiple authorization mechanism, and a double-check authorization mechanism;

[0073] Determine the accounts that have not been authorized based on the authorization data in the account behavior profile, and associate the authorization request for the unauthorized account with any one or more of the multiple authentication mechanisms, multiple authentication mechanisms, and review authentication mechanisms.

[0074] The association relationships formed by the preset conditional rules include:

[0075] Pre-set the scope of high-risk requests, and associate high-risk requests with any one or more of the multiple authentication mechanisms, multiple authorization mechanisms, and review authorization mechanisms; for example, list the request to delete important files of the virtual system as one of the high-risk requests. When an account requests to delete important files of the virtual system, any one or more of the multiple authentication mechanisms, multiple authorization mechanisms, and review authorization mechanisms are triggered for authentication and authorization.

[0076] Pre-set abnormal request scenarios, and associate the abnormal request scenarios with any one or more of the multiple authentication mechanisms, multiple authorization mechanisms, and review authentication mechanisms; for example, list the scenario of reading a specified file in a virtual system at a frequency higher than the set frequency as an abnormal request scenario. When hackers invade a virtual system, they often obtain information in the virtual system by crawling and downloading the content in the virtual system through scripts. The crawling and downloading process often involves a high-frequency reading process. When monitoring occurs when a high-frequency reading of a specified file occurs, any one or more of the multiple authentication mechanisms, multiple authorization mechanisms, and review authentication mechanisms are used for authentication and authorization.

[0077] S400, when a target account accesses the operation virtualization system, a corresponding target account behavior profile is determined according to the target account information, and a target trigger condition is formed by the target account behavior profile.

[0078] S500, monitoring the current request of the target account, and analyzing whether the current request of the target account triggers the authentication mechanism according to the target trigger condition, and executing the triggered authentication mechanism if it does, specifically including:

[0079] Determine whether the current request of the target account meets the preset conditions for starting the multi-factor authentication mechanism, and if so, start the multi-factor authentication mechanism; specifically, start the multi-factor authentication mechanism to provide the user with an account password authentication method, and also provide the user with at least one or a combination of email authentication methods, SMS authentication methods, and key device authentication methods; the user is allowed to log in to the virtualization system after passing all authentication methods provided by the multi-factor authentication mechanism.

[0080] Determine whether the current request of the target account satisfies the preset conditions for starting the multi-authentication mechanism, and if so, start the multi-authentication mechanism; specifically, when the multi-authentication mechanism is triggered by the target account request, authenticate the account password of the target account that triggers the multi-authentication mechanism again, and if the authentication is successful, allow the request to trigger the multi-authentication mechanism to execute, otherwise refuse to execute the request to trigger the multi-authentication mechanism.

[0081] Determine whether the current request of the target account meets the preset conditions for starting the multiple authentication mechanism, and if so, start the multiple authentication mechanism.

[0082] For details, see Figure 2 As shown, the process of the multi-authentication mechanism includes:

[0083] S10, when the multi-authentication mechanism is triggered by the target account request,

[0084] S20, verify whether the target account that triggers the multi-authentication mechanism meets the RBAC permissions,

[0085] If the RBAC permissions are not met, S30 will be executed. If the RBAC permissions are met, S40 will be executed.

[0086] S30, rejecting the request to execute the target account to trigger the multiple authentication mechanism,

[0087] S40, sending an activation link via the target account’s email or SMS,

[0088] S50, determining whether the user of the target account activates the activation operation link via email or SMS, if yes, execute S60, otherwise execute S30.

[0089] S60, the target account triggers a request for a multiple authentication mechanism.

[0090] Determine whether the current request of the target account meets the preset conditions for starting the review and authentication mechanism, and if so, start the review and authentication mechanism.

[0091] For details, see Figure 3 As shown, the process of the review and authentication mechanism includes:

[0092] S1, the review and authentication mechanism pre-sets the senior account authorized for the account; specifically, a feasible way is to pre-set the requests that the senior account is responsible for, and when the account requests the request that is responsible for the target senior account, the target senior account provides the review and authentication authority to the account.

[0093] S2, the target account request triggers the multi-authentication mechanism.

[0094] S3: Verify whether the target account that triggers the review and authentication mechanism meets the RBAC permissions.

[0095] If the RBAC permission is not met, S4 is executed. If the RBAC permission is met, S5 is executed.

[0096] S4, reject the request to execute the target account to trigger the review and authentication mechanism,

[0097] S5, request permission from the corresponding senior account,

[0098] S6, determine whether the corresponding senior account authorizes the target account to review the authentication authority,

[0099] If the senior account authorizes the target account, execute S7; if the senior account refuses to authorize the target account, execute S4;

[0100] S7, executing the request of the target account to trigger the verification authentication mechanism.

[0101] This application collects and analyzes the behavioral data of each account to form an account behavior portrait, uses the account behavior portrait and preset rules to form trigger conditions, or directly uses preset conditional rules to form trigger conditions; analyzes the current request of the account according to the trigger conditions to execute any one or more of the multi-factor authentication mechanism, multiple authentication mechanism, multiple authentication mechanism and review authentication mechanism. Compared with the existing method of controlling account access by only using RBAC authentication and authorization scheme, it can effectively identify abnormal access and abnormal operation of the account. When the account performs abnormal access and abnormal operation, the account is further verified through the corresponding authentication and authorization method, which can effectively prevent the account from being illegally stolen and used to invade and damage the virtualization system.

[0102] By using multi-factor authentication mechanism, multiple authentication mechanism, multiple authorization mechanism and review authentication mechanism to cooperate with each other, the authentication methods are diverse, making it difficult for hackers to grasp the rules and break through, thereby strengthening the security of the virtualization system.

[0103] The use of multi-factor authentication mechanism, multiple authentication mechanism, multiple authentication mechanism and review authentication mechanism in coordination with each other can effectively prevent accounts from performing high-risk operations due to mistakes and causing damage to the virtualization system.

[0104] Example 2

[0105] See also Figure 4 As shown, the embodiment of the present application provides a device for implementing intelligent security authentication, including:

[0106] A collection module, the collection module is used to collect behavior data of account access to the operation virtualization system;

[0107] A data analysis module, which is used to analyze the collected behavior data to generate an account behavior profile;

[0108] A condition configuration module, which is used to call the data in the account behavior profile and cooperate with preset rules or form trigger conditions through preset condition rules;

[0109] Monitoring module, which is used to monitor the current requests of the account;

[0110] The authentication control module analyzes whether the current request of the account triggers the authentication mechanism according to the triggering condition, and starts the authentication mechanism triggered by the current request.

[0111] Example 3

[0112] An embodiment of the present application provides a storage medium for implementing an intelligent security authentication method. The storage medium for implementing the intelligent security authentication method stores at least one instruction, and the intelligent security authentication method is implemented by reading and executing the instruction from the storage medium for implementing the intelligent security authentication method.

[0113] In the embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0114] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0115] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0116] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.

Claims

1. An intelligent security authentication method, characterized in that: include: Call the data in the account behavior profile and cooperate with the preset rules to form trigger conditions, and use the preset condition rules to form trigger conditions; When the target account accesses the operation virtualization system, the corresponding target account behavior profile is determined according to the target account information, and the target trigger condition is formed by the target account behavior profile; Monitor the current request of the target account, and analyze whether the current request of the target account triggers the authentication mechanism according to the target trigger condition. If it does, execute the triggered authentication mechanism: Determine whether the current request of the target account meets the preset conditions for starting the multi-factor authentication mechanism, and if so, start the multi-factor authentication mechanism; wherein the multi-factor authentication mechanism provides the user with an account password authentication method on the one hand, and also provides the user with at least one or a combination of an email authentication method, a text message authentication method, and a key device authentication method on the other hand; the user is allowed to log in to the virtualization system after passing all the authentication methods provided by the multi-factor authentication mechanism; Determine whether the current request of the target account satisfies the preset conditions for starting the multi-authentication mechanism, and if so, start the multi-authentication mechanism; wherein, when the multi-authentication mechanism is triggered by the request of the target account, authenticate the account password of the target account that triggers the multi-authentication mechanism again, and if the authentication is passed, allow the request to trigger the multi-authentication mechanism to be executed, otherwise refuse to execute the request to trigger the multi-authentication mechanism; Determine whether the current request of the target account satisfies the preset conditions for starting the multiple authentication mechanism, and if so, start the multiple authentication mechanism; wherein, when the multiple authentication mechanism is triggered and started by the request of the target account, verify whether the target account that triggers the multiple authentication mechanism satisfies the RBAC authority, and if not, refuse to execute the request of the target account to trigger the multiple authentication mechanism; if it satisfies the RBAC authority, send an activation operation link through the mailbox or SMS of the target account, and determine whether the user of the target account activates the activation operation link through the mailbox or SMS, and if so, execute the request of the target account to trigger the multiple authentication mechanism; otherwise, refuse to execute the request of the target account to trigger the multiple authentication mechanism; Determine whether the current request of the target account meets the preset conditions for starting the review and authentication mechanism, and if so, start the review and authentication mechanism; wherein the review and authentication mechanism pre-sets a senior account for account authorization; verify whether the target account that triggers the review and authentication mechanism meets the RBAC authority, and if it does not meet the RBAC authority, refuse to execute the target account's request to trigger the review and authentication mechanism; if it meets the RBAC authority, request the corresponding senior account for authority; if the senior account authorizes the target account, execute the target account's request to trigger the review and authentication mechanism; if the senior account refuses to authorize the target account, refuse to execute the target account's request to trigger the review and authentication mechanism.

2. The intelligent security authentication method according to claim 1, characterized in that: Collecting behavioral data on account access to the virtualized system, including account login logs, request access logs, operation logs, audit logs, and account authorization information; By using big data technology to analyze and mine account behavior data, we can summarize the account behavior portrait, which includes the account login device, IP address, usual operation time, account commonly used resources and resource types, account execution operations and frequency, and authorization data.

3. The intelligent security authentication method according to claim 1, characterized in that: Call the data in the account behavior profile and cooperate with the preset rules to form the trigger conditions for the account login authentication process: When the login device, IP address and time used by the target account to log in are inconsistent with any corresponding data retrieved from the target account behavior profile, the multi-factor authentication mechanism is activated; The data in the account behavior profile is called and combined with the preset rules to form a trigger condition containing an association relationship or through the preset condition rules. The trigger condition containing the association relationship is applied in the account operation and access authentication process. The association relationship includes: The association of multiple authentication mechanisms, multiple authorization mechanisms, and verification authorization mechanisms with resources, The association of multiple authentication mechanisms, multiple authorization mechanisms and verification authorization mechanisms with operations, The corresponding mechanism is initiated when the target account performs the associated operation or accesses the associated resources.

4. The intelligent security authentication method according to claim 3, characterized in that: The specific contents of the association relationship include: determining the operations that the account has not performed based on the operations that the account has performed in the account behavior profile, or determining the resources that the account has not accessed based on the resources that have been accessed, and associating the account's request to perform the operations that have not been performed or access the resources that have not been accessed with any one or more of the multiple authentication mechanisms, multiple authorization mechanisms, and review authorization mechanisms; Determine the accounts that have not been authorized by the account based on the authorization data in the account behavior profile, and associate the authorization request for the unauthorized account with any one or more of the multiple authentication mechanism, multiple authentication mechanism and double-check authentication mechanism; Pre-set the scope of high-risk requests, and associate high-risk requests with any one or more of the multiple authentication mechanisms, multiple authorization mechanisms, and review authorization mechanisms; Pre-set abnormal request scenarios, and associate the abnormal request scenarios with any one or more of the multiple authentication mechanisms, multiple authorization mechanisms, and review authorization mechanisms.

5. A device for realizing intelligent security authentication, characterized in that: include: A collection module, the collection module is used to collect behavior data of account access to the operation virtualization system; A data analysis module, the data analysis module is used to analyze the collected behavior data to generate an account behavior profile; A condition configuration module, the condition configuration module is used to call the data in the account behavior profile and cooperate with the preset rules to form a trigger condition, and the condition configuration module forms the trigger condition through the preset condition rules; wherein, when the target account accesses the operation virtualization system, the corresponding target account behavior profile is determined according to the target account information, and the target trigger condition is formed by the target account behavior profile; Monitoring module, which is used to monitor the current request of the account; The authentication control module analyzes whether the current request of the account triggers the authentication mechanism according to the target trigger condition, and starts the authentication mechanism triggered by the current request: Determine whether the current request of the target account meets the preset conditions for starting the multi-factor authentication mechanism, and if so, start the multi-factor authentication mechanism; wherein the multi-factor authentication mechanism provides the user with an account password authentication method on the one hand, and also provides the user with at least one or a combination of an email authentication method, a text message authentication method, and a key device authentication method on the other hand; the user is allowed to log in to the virtualization system after passing all the authentication methods provided by the multi-factor authentication mechanism; Determine whether the current request of the target account satisfies the preset conditions for starting the multi-authentication mechanism, and if so, start the multi-authentication mechanism; wherein, when the multi-authentication mechanism is triggered by the request of the target account, authenticate the account password of the target account that triggers the multi-authentication mechanism again, and if the authentication is passed, allow the request to trigger the multi-authentication mechanism to be executed, otherwise refuse to execute the request to trigger the multi-authentication mechanism; Determine whether the current request of the target account satisfies the preset conditions for starting the multiple authentication mechanism, and if so, start the multiple authentication mechanism; wherein, when the multiple authentication mechanism is triggered and started by the request of the target account, verify whether the target account that triggers the multiple authentication mechanism satisfies the RBAC authority, and if not, refuse to execute the request of the target account to trigger the multiple authentication mechanism; if it satisfies the RBAC authority, send an activation operation link through the mailbox or SMS of the target account, and determine whether the user of the target account activates the activation operation link through the mailbox or SMS, and if so, execute the request of the target account to trigger the multiple authentication mechanism; otherwise, refuse to execute the request of the target account to trigger the multiple authentication mechanism; Determine whether the current request of the target account meets the preset conditions for starting the review and authentication mechanism, and if so, start the review and authentication mechanism; wherein the review and authentication mechanism pre-sets a senior account for account authorization; verify whether the target account that triggers the review and authentication mechanism meets the RBAC authority, and if it does not meet the RBAC authority, refuse to execute the target account's request to trigger the review and authentication mechanism; if it meets the RBAC authority, request the corresponding senior account for authority; if the senior account authorizes the target account, execute the target account's request to trigger the review and authentication mechanism; if the senior account refuses to authorize the target account, refuse to execute the target account's request to trigger the review and authentication mechanism.

6. A storage medium for implementing an intelligent security authentication method, characterized in that: The storage medium for implementing the intelligent security authentication method stores at least one instruction, and the instruction is read from the storage medium for implementing the intelligent security authentication method and executed to implement the intelligent security authentication method as claimed in any one of claims 1 to 4.

Images