Identity authentication method and device in edge computing scenario, electronic device and medium

Abstract

The present disclosure provides an identity verification method and device in an edge computing scenario, electronic equipment, computer readable storage medium and computer program product, relates to the field of data processing, and particularly relates to the fields of edge computing and user data security. The implementation scheme is: obtaining a target user request at an edge node; obtaining first geographic location information, first security level information and first interaction behavior information of a target user entity associated with the target user request at a first time; determining a target security coefficient of the target user entity at a second time according to the first geographic location information, the first security level information and the first interaction behavior information; and in response to the target security coefficient being less than a first threshold, transmitting the target user request to a cloud server for user identity verification.

Description

Technical Field

[0001] This disclosure relates to the field of data processing, and more particularly to the fields of edge computing and user data security technology, specifically to an authentication method, device, electronic device, computer-readable storage medium, and computer program product in an edge computing scenario. Background Technology

[0002] With the development of identity management services and edge computing technology, more and more enterprises are choosing to move the data resources needed by users to nodes closer to users in order to reduce network congestion and lower user request latency.

[0003] In existing technologies, the user authentication process for all user requests is often performed at the edge node. However, because the data security and privacy protection mechanisms in traditional cloud computing environments are not applicable to the protection of edge node data, malicious attackers can easily tamper with or hijack user requests on the data front-end link of the edge node, posing a great security risk to user data privacy. Summary of the Invention

[0004] This disclosure provides an authentication method, apparatus, electronic device, computer-readable storage medium, and computer program product for edge computing scenarios.

[0005] According to one aspect of this disclosure, an authentication method for edge computing scenarios is provided, comprising: obtaining a target user request at an edge node; obtaining first geographic location information, first security level information, and first interaction behavior information of a target user entity associated with the target user request at a first time; determining a target security coefficient of the target user entity at a second time based on the first geographic location information, first security level information, and first interaction behavior information; and, in response to the target security coefficient being less than a first threshold, transmitting the target user request to a cloud server for user authentication.

[0006] According to another aspect of this disclosure, an authentication device for an edge computing scenario is provided, comprising: a first acquisition unit for acquiring a target user request at an edge node; a second acquisition unit for acquiring first geographic location information, first security level information, and first interaction behavior information of a target user entity associated with the target user request at a first time moment; a determination unit for determining a target security coefficient of the target user entity at a second time moment based on the first geographic location information, the first security level information, and the first interaction behavior information; and a transmission unit for transmitting the target user request to a cloud server for user authentication in response to the target security coefficient being less than a first threshold.

[0007] According to another aspect of this disclosure, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; the memory storing instructions executable by the at least one processor to enable the at least one processor to perform the method described above.

[0008] According to another aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions for causing a computer to perform the methods described above.

[0009] According to another aspect of this disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements the method described above.

[0010] According to one or more embodiments of this disclosure, the security coefficient of a target user entity is determined by obtaining its geographical location information, security level information, and interaction behavior information at the edge node. Target user requests issued by target user entities with low security coefficients are then transmitted to the cloud server for authentication. This enables the data security and privacy protection mechanisms of traditional cloud computing scenarios to be applied during the subsequent data transmission process in response to the target user request. This reduces the possibility of malicious attackers tampering with or hijacking requests on the fronthaul link, effectively improving the security of data transmission.

[0011] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0012] The accompanying drawings exemplify embodiments and form part of the specification, serving together with the textual description to explain exemplary implementations of the embodiments. The illustrated embodiments are for illustrative purposes only and do not limit the scope of the claims. Throughout the drawings, the same reference numerals refer to similar but not necessarily identical elements.

[0013] Figure 1 A schematic diagram of an exemplary system in which the various methods described herein may be implemented according to embodiments of the present disclosure is shown;

[0014] Figure 2 An exemplary flowchart of an authentication method in an edge computing scenario according to embodiments of the present disclosure is shown;

[0015] Figure 3 An exemplary partial flowchart of an authentication method in an edge computing scenario according to an embodiment of the present disclosure is shown;

[0016] Figure 4 An exemplary flowchart illustrating the determination of the target security factor of a target user entity at a second time step according to an embodiment of the present disclosure is shown;

[0017] Figure 5 Another exemplary flowchart illustrating the determination of the target security factor of a target user entity at a second time step according to an embodiment of this disclosure is shown;

[0018] Figure 6 Another exemplary flowchart of an authentication method in an edge computing scenario according to an embodiment of this disclosure is shown;

[0019] Figure 7 A further exemplary partial flowchart of an authentication method in an edge computing scenario according to an embodiment of the present disclosure is shown;

[0020] Figure 8 A structural block diagram of an authentication device in an edge computing scenario according to embodiments of the present disclosure is shown; and

[0021] Figure 9 A structural block diagram of an exemplary electronic device that can be used to implement embodiments of the present disclosure is shown. Detailed Implementation

[0022] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0023] In this disclosure, unless otherwise stated, the use of terms such as "first," "second," etc., to describe various elements is not intended to limit the positional, temporal, or importance relationships of these elements; such terms are merely used to distinguish one element from another. In some examples, the first element and the second element may refer to the same instance of that element, while in other cases, based on the context, they may refer to different instances.

[0024] The terminology used in the description of the various examples described in this disclosure is for the purpose of describing particular examples only and is not intended to be limiting. Unless the context clearly indicates otherwise, an element may be one or more unless the number of elements is specifically limited. Furthermore, the term "and / or" as used in this disclosure covers any one of the listed items and all possible combinations thereof.

[0025] The embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0026] Figure 1 A schematic diagram of an exemplary system 100 in which the various methods and apparatus described herein can be implemented according to embodiments of this disclosure is shown. Reference Figure 1 The system 100 includes one or more client devices 101, 102, 103, 104, 105 and 106, a server 120, and one or more communication networks 110 coupling the one or more client devices to the server 120. The client devices 101, 102, 103, 104, 105 and 106 can be configured to execute one or more applications.

[0027] In embodiments of this disclosure, server 120 may run one or more services or software applications that enable the execution of authentication methods in edge computing scenarios.

[0028] In some embodiments, server 120 may also provide other services or software applications, which may include non-virtual and virtual environments. In some embodiments, these services may be provided as web-based services or cloud services, such as to users of client devices 101, 102, 103, 104, 105, and / or 106 under a Software as a Service (SaaS) model.

[0029] exist Figure 1 In the configuration shown, server 120 may include one or more components that implement the functions performed by server 120. These components may include software components, hardware components, or combinations thereof that can be executed by one or more processors. Users operating client devices 101, 102, 103, 104, 105, and / or 106 can sequentially interact with server 120 using one or more client applications to utilize the services provided by these components. It should be understood that various different system configurations are possible and may differ from system 100. Therefore, Figure 1 This is an example of a system used to implement the various methods described herein, and is not intended to be limiting.

[0030] Users can use client devices 101, 102, 103, 104, 105, and / or 106 to generate and send user requests, and receive data in response to user requests. The client devices can provide an interface that allows users to interact with the client devices. The client devices can also output information to the user through this interface. Although... Figure 1 Only six client devices are described, but those skilled in the art will understand that this disclosure can support any number of client devices.

[0031] Client devices 101, 102, 103, 104, 105, and / or 106 may include various types of computer devices, such as portable handheld devices, general-purpose computers (such as personal computers and laptops), workstation computers, wearable devices, smart screen devices, self-service terminal devices, service robots, gaming systems, thin clients, various messaging devices, sensors, or other sensing devices. These computer devices can run various types and versions of software applications and operating systems, such as Microsoft Windows, Apple iOS, UNIX-like operating systems, Linux or Linux-like operating systems (such as Google Chrome OS); or include various mobile operating systems, such as Microsoft Windows Mobile OS, iOS, Windows Phone, and Android. Portable handheld devices may include cellular phones, smartphones, tablets, personal digital assistants (PDAs), etc. Wearable devices may include head-mounted displays (such as smart glasses) and other devices. Gaming systems may include various handheld gaming devices, internet-enabled gaming devices, etc. Client devices are capable of executing various applications, such as various internet-related applications, communication applications (such as email applications), short message service (SMS) applications, and can use various communication protocols.

[0032] Network 110 can be any type of network well known to those skilled in the art, and can use any of a variety of available protocols (including but not limited to TCP / IP, SNA, IPX, etc.) to support data communication. By way of example only, one or more networks 110 can be a local area network (LAN), an Ethernet-based network, a token ring network, a wide area network (WAN), the Internet, a virtual network, a virtual private network (VPN), an intranet, an extranet, a blockchain network, a public switched telephone network (PSTN), an infrared network, a wireless network (e.g., Bluetooth, WIFI), and / or any combination of these and / or other networks.

[0033] Server 120 may include one or more general-purpose computers, special-purpose server computers (e.g., PC (personal computer) servers, UNIX servers, mid-range servers), blade servers, mainframe computers, server clusters, or any other suitable arrangement and / or combination. Server 120 may include one or more virtual machines running a virtual operating system, or other computing architectures involving virtualization (e.g., one or more flexible pools of logical storage devices that can be virtualized to maintain virtual storage devices for servers). In various embodiments, server 120 may run one or more services or software applications that provide the functionality described below.

[0034] The computing unit in server 120 can run one or more operating systems, including any of the aforementioned operating systems and any commercially available server operating system. Server 120 can also run any of a variety of additional server applications and / or middleware applications, including HTTP servers, FTP servers, CGI servers, JAVA servers, database servers, etc.

[0035] In some implementations, server 120 may include one or more applications to analyze and merge data feeds and / or event updates received from users of client devices 101, 102, 103, 104, 105, and 106. Server 120 may also include one or more applications to display data feeds and / or real-time events via one or more display devices of client devices 101, 102, 103, 104, 105, and 106.

[0036] In some implementations, server 120 can be a server for a distributed system or a server integrated with blockchain. Server 120 can also be a cloud server, or an intelligent cloud computing server or intelligent cloud host with artificial intelligence technology. A cloud server is a host product in the cloud computing service system, designed to address the shortcomings of traditional physical hosts and Virtual Private Server (VPS) services, such as high management difficulty and weak business scalability.

[0037] System 100 may also include one or more databases 130. In some embodiments, these databases may be used to store data and other information. For example, one or more of the databases 130 may be used to store information such as user identity information, geographic location information, interaction behavior information, and security level information. Databases 130 may reside in various locations. For example, a database used by server 120 may be local to server 120, or it may be located away from server 120 and may communicate with server 120 via a network-based or dedicated connection. Databases 130 may be of different types. In some embodiments, the database used by server 120 may be, for example, a relational database. One or more of these databases may store, update, and retrieve data from and from the databases in response to commands.

[0038] In some embodiments, one or more of the databases 130 may also be used by an application to store application data. The databases used by the application may be of different types, such as key-value stores, object stores, or regular stores supported by a file system.

[0039] Figure 1The system 100 can be configured and operated in various ways to enable the application of the various methods and apparatus described in this disclosure.

[0040] With the development of identity management services and edge computing technology, more and more enterprises are choosing to move the data resources needed by users to nodes closer to users to reduce network congestion and lower user request latency. In these technologies, the user authentication process for all user requests is often also performed at the edge node. However, because traditional cloud computing data security and privacy protection mechanisms are not applicable to the protection of edge node data, malicious attackers can easily tamper with or hijack user requests in the data front-end link at the edge node, posing a significant security risk to user data privacy.

[0041] to this end, Figure 2 An exemplary flowchart of an authentication method in an edge computing scenario according to embodiments of the present disclosure is shown. It can be utilized... Figure 1 The client or server implementation shown in the figure Figure 2 Method 200.

[0042] like Figure 2 As shown, an authentication method 200 for an edge computing scenario is provided according to an embodiment of this disclosure, including: obtaining a target user request at an edge node (step 210); obtaining first geographic location information, first security level information, and first interaction behavior information of a target user entity associated with the target user request at a first time (step 220); determining a target security coefficient of the target user entity at a second time based on the first geographic location information, first security level information, and first interaction behavior information (step 230); and determining whether to transmit the target user request to a cloud server for user authentication based on the target security coefficient (step 240).

[0043] According to some embodiments, the first security level information mentioned above includes at least one of the following: the security level of the terminal device that issued the target user request, the security level of the target user entity, the security level of the data interface requested by the target user, the security level of the data requested by the target user, and the historical access frequency of the data requested by the target user.

[0044] According to some embodiments, the first geographic location information mentioned above includes at least one of the following: the geographic location of the target user entity at a first moment, the distance between the target user entity and the first reference user entity at the first moment, and the location change of the target user entity within a preset time period.

[0045] According to some embodiments, the aforementioned first interaction behavior information includes: the interaction behavior between the target user entity and the second reference user entity for user authentication.

[0046] In one example, the second reference user entity can be an administrator, and the aforementioned interactions include the target user entity requesting to join a specific group or requesting access to specific data, and the administrator approving the target user entity's request. In another example, the second reference user entity can also be a colleague or friend of the target user entity, and the aforementioned interactions include the target user entity sending an authentication invitation to a colleague or friend when logging into the application, and whether the colleague or friend responds to the authentication invitation. In yet another example, the aforementioned interactions can also include dialogue between the target user entity and the second reference user entity, without limitation.

[0047] It should be noted that the aforementioned first security level information, first geographical location information, and first interaction behavior information may also include other security factor information related to the target user entity and the target user request, without limitation.

[0048] According to the edge computing scenario authentication of the present disclosure embodiment, the security coefficient of the target user entity is determined by obtaining the geographical location information, security level information and interaction behavior information of the target user entity at the edge node, and the target user request issued by the target user entity with low security coefficient is transmitted to the cloud server for authentication. This enables the data security and privacy protection mechanism of the traditional cloud computing scenario to be applied in the subsequent data transmission process in response to the target user request, reducing the possibility of malicious attackers tampering with or hijacking the request on the fronthaul link, and effectively improving the security of data transmission.

[0049] In step 210, the target user request at the edge node is obtained.

[0050] In some embodiments, the aforementioned edge node may be a user terminal or a base station connected to the user terminal, and there are no restrictions on this.

[0051] In some embodiments, the target user request includes an access key, which includes, but is not limited to, AccessKey information or SecretKey information. The access key can be used to implement signature authentication of the target user request; signature authentication refers to the method of using the access key to verify the application programming interface (API) of the target user request.

[0052] In the example, the target user entity can use an access key and the interface information of the requested data interface to generate a signature string, which includes the access key information. After receiving the target user's request, the edge node can verify the signature string by replaying the target user entity's signing process to determine whether the signature string is valid, thus judging the legitimacy of the target user's request.

[0053] However, in some implementations, malicious users might use non-existent access keys to construct false identity credentials (i.e., signature information) to generate a large number of user requests for malicious credential stuffing attacks. In this case, not only are the security mechanisms of the cloud server at risk of being compromised, but the massive amount of data used in malicious credential stuffing attacks could also further overwhelm the backend servers.

[0054] In response, Figure 3 An exemplary partial flowchart of an authentication method in an edge computing scenario according to an embodiment of this disclosure is shown.

[0055] According to some embodiments, such as Figure 3 As shown, step 210 includes: obtaining the user request to be processed at the edge node (step 311); obtaining the first key of the user request to be processed (step 312); matching the first key with a plurality of second keys in a preset key library (step 313); and in response to the first key matching with at least one second key in the preset key library, treating the user request to be processed as the target user request (step 314).

[0056] In the example, the remote cloud server pre-sends all existing access keys (e.g., AccessKey field information) as a preset keystore to the edge nodes. The edge nodes are equipped with Bloom filters. When a user request from a target user entity arrives at the edge node, the Bloom filter matches the access key of the request with the access keys in the preset keystore. If the Bloom filter indicates that the AccessKey field information in the user request's access key is real, the request is authenticated and accepted. If the Bloom filter indicates that the AccessKey field information is not real, the request is rejected, an error message is returned, and no further processing is performed.

[0057] Therefore, setting up pre-filters before calculating the security coefficient of user entities can effectively prevent malicious users from using non-existent keys to construct false identity credentials for malicious credential stuffing attacks, thereby reducing the risk of cloud service security mechanisms being compromised.

[0058] It should be understood that the above Bloom filters are for illustrative purposes only and are not intended to limit us to them.

[0059] In step 220, the first geographical location information, first security level information, and first interaction behavior information of the target user entity associated with the target user request are obtained at the first moment.

[0060] In some embodiments, a target user request may be a user request issued directly by a target user entity, or it may be a user request issued by another user entity associated with a user request issued by a target user entity, without limitation.

[0061] It should be noted that the aforementioned first security level information, first geographical location information, and first interaction behavior information may also include other security factor information related to the target user entity and the target user request, without limitation.

[0062] In step 230, the target security coefficient of the target user entity at the second time point is determined based on the first geographical location information, the first security level information, and the first interaction behavior information.

[0063] Figure 4 An exemplary flowchart illustrating the determination of the target security factor of a target user entity at a second time step according to an embodiment of this disclosure is shown.

[0064] According to some embodiments, such as Figure 4 As shown, step 230 includes: in response to the traffic value at the edge node at the first time not being greater than the second threshold, determining that the second time is the same as the first time (step 431); and using the first security coefficient model to process the first geographical location information, the first security level information and the first interaction behavior information to obtain the first security coefficient output by the first security coefficient model as the target security coefficient (step 432).

[0065] In step 431, when the edge node is not at a peak traffic time, the security coefficient of the target user entity at the current time can be determined directly based on the security factor-related information obtained at the current time, so that the obtained security coefficient can more accurately represent the security of the target user request at the current time.

[0066] The embodiments of this disclosure are illustrated using an enterprise office scenario as an example, but it should be understood that they are not limited thereto.

[0067] In step 432, the target user entity is enterprise user u, and both the first reference user entity and the second reference user entity are enterprise user v. The first security factor model first determines the user security value based on the geographical location and individual security level of enterprise user u, and then determines the aforementioned first security factor based on the user security value and the security level of the interface requested by the target user request.

[0068] The first safety factor model determines the user safety value V of enterprise user u at the first time t. u，t The formula is expressed as follows:

[0069]

[0070] Among them, l u，v This represents the Euclidean distance between enterprise user u and enterprise user v at time t, where the geographical location of enterprise user u at time t is (x... u，t y u，t The geographical location of enterprise user v at the first moment t is (x v，t y v，t ), F uv，t This refers to the interaction behavior between enterprise user u and enterprise user v regarding user authentication. h This indicates a value greater than 1 that is used as an adjustment parameter, and is achieved by setting l. h The value of V makes the obtained u，t The value of L always ranges from 0 to 1. u，t L represents the security level of the terminal device from which enterprise user u sends a request to the target user at the first moment t. d N represents the security level of enterprise user u within the enterprise. u，t This represents the number of different locations corresponding to when enterprise user u issues a user request within the second time period associated with the first time point t.

[0071] For the above F uv，t The specific types of interaction behaviors can be found above and will not be repeated here. In one example, F uv，t This could be the number or frequency of interactions between enterprise user u and enterprise user v. In another example, different types of interactions between enterprise user u and enterprise user v correspond to different scores, F. uv，t It can be the sum or average of the scores of all interactions between enterprise user u and enterprise user v, without any restrictions.

[0072] It should be understood that the aforementioned preset time period can be any time period before the first moment t, and there are no specific restrictions on it.

[0073] The first safety factor model determines the safety factor S of enterprise user u at time t. u，t The formula is expressed as follows:

[0074]

[0075] Where, p d d represents the historical access frequency of data requested by enterprise user u, and p represents the data requested by target user. d It follows a Zipf distribution (power-law distribution). The parameter β represents the steepness of the distribution and βγ > 0, N represents the total amount of data in the database, and D lC indicates the security level (e.g., privacy level) of the data requested by the target user. i This indicates the security level of the data interface requested by the target user.

[0076] It should be understood that the first time period and the second time period mentioned above can be any time period before the first time t, and the first time period and the second time period can be the same or different, without any specific restrictions.

[0077] It should be noted that, to avoid excessive differences in security levels among enterprise users from different companies, in some examples, D l The value range is (0, 1) and does not include endpoint values.

[0078] Figure 5 Another exemplary flowchart is shown for determining the target security factor of a target user entity at a second time step according to an embodiment of this disclosure.

[0079] According to some embodiments, such as Figure 5 As shown, step 230 includes: in response to the traffic value at the edge node at the first time being greater than the second threshold, determining the second time as the time after the first time (step 531); and using a pre-trained security prediction model to process the first geographical location information, the first security level information and the first interaction behavior information to obtain the second security coefficient output by the security prediction model, which is used as the target security coefficient (step 532).

[0080] In step 531, when the edge node is at its peak traffic moment, a pre-trained security prediction model can be used to predict the security coefficient of the target user entity at the second moment after the current moment based on the security factor-related information obtained at the current moment. This reduces the computational load at peak moments, improves processing efficiency, and reduces the latency of user requests.

[0081] It should be understood that when the edge node is not at its peak traffic, the security prediction model can be used to predict the security coefficient of the target user entity at the second moment after the current moment as the aforementioned target security coefficient, and there are no restrictions on this.

[0082] In some embodiments, due to the limited cache resources of edge nodes, the interval between the first and second moments can be set to 60 seconds to improve the utilization of cache resources, but it should be understood that this is not a limitation.

[0083] In step 532, the aforementioned security prediction model includes, but is not limited to, artificial intelligence (AI) prediction models.

[0084] Figure 6 A further exemplary partial flowchart of an authentication method in an edge computing scenario according to an embodiment of this disclosure is shown.

[0085] According to some embodiments, such as Figure 6 The method further includes: acquiring and storing the second geographic location information, second security level information, and second social behavior information of the target user entity at the second time moment (step 631); in response to the traffic value at the edge node dropping to no more than the second threshold, performing the following operations: processing the second geographic location information, second security level information, and second interaction behavior information using a second security coefficient model to obtain a third security coefficient output by the second security coefficient model (step 632); determining the difference between the third security coefficient and the second security coefficient (step 633); and adjusting the network parameters of the security prediction model according to the difference (step 634).

[0086] In step 631, after obtaining the second geographic location information, the second security level information, and the second social behavior information, data cleaning can be performed to remove abnormal data. This data cleaning includes: if at least one of the second geographic location information, the second security level information, and the second social behavior information is empty, then the corresponding target user entity is considered an abnormal user entity at the second time point, and the second geographic location information, the second security level information, and the second social behavior information of that target user entity at the second time point are removed.

[0087] In some embodiments, the data cleaning described above further includes performing a moving average on the data at the sampling interval to eliminate local oscillations as much as possible and prevent the adverse effects caused by spike data. In other embodiments, the data cleaning is followed by a data transformation operation on the cleaned data to convert the second geographic location information, the second security level information, and the second social behavior information into a data type that can be used as input to an AI prediction model.

[0088] In steps 632 to 634, when the traffic value of the edge node drops to a non-peak level, the stored second geographical location information, second security level information, and second interaction behavior information can be processed again using the second security coefficient model to obtain the actual third security coefficient for the second time moment. The actual third security coefficient is then compared with the second security coefficient predicted in step 532, and the network coefficient of the security prediction model is adjusted based on the difference between the two to continuously improve the prediction accuracy of the security prediction model.

[0089] It should be noted that the second safety factor model in step 632 may be the same as or different from the first safety factor model in step 432, and there is no restriction on this.

[0090] In step 240, it is determined whether to send the target user request to the cloud server for user authentication based on the target security factor.

[0091] According to some embodiments, step 240 includes: in response to the target security coefficient being less than a first threshold, transmitting the target user request to the cloud server for user authentication.

[0092] In some embodiments, a target security coefficient less than a first threshold indicates a high probability that the target user entity is a malicious user. Therefore, it is necessary to send the target user entity's target user request to the cloud server for processing, so as to apply a more stringent authentication and data transmission process.

[0093] In some embodiments, in response to a security factor not being less than a first threshold, user authentication can be performed on the target user request at the edge node to reduce the response latency of the user request. In other embodiments, in response to a security factor not being less than the first threshold, the target user request can also be transmitted to the cloud server for user authentication, and there is no limitation on this.

[0094] Figure 7 A further exemplary partial flowchart of an authentication method in an edge computing scenario according to an embodiment of this disclosure is shown.

[0095] According to some embodiments, such as Figure 7 Step 240 includes: determining whether to add the target user entity to the target cluster based on at least one of the first geographical location information, the first security level information, the first interaction behavior information, and the target security coefficient (step 741); in response to adding the target user entity to the target cluster, obtaining multiple fourth security coefficients corresponding to multiple user entities in the target cluster (step 742); calculating the average value of the multiple fourth security coefficients as the cluster security coefficient of the target cluster (step 743); and determining whether to send the target user request to the cloud server for user authentication based on the cluster security coefficient (step 744).

[0096] In some embodiments, in order to further reduce the number of authentication requests passed to the remote cloud server and thus reduce the computing pressure on the cloud server, users with similar security factors or similar security coefficients can be clustered.

[0097] In step 741, it is determined whether to add the target user entity to the target cluster based on at least one of the first geographical location information, the first security level information, the first interaction behavior information, and the target security coefficient.

[0098] In some embodiments, the set M consisting of all user entities within the enterprise can be randomly divided into K subsets {U1, U2, ..., U...}. k The above subsets satisfy the following conditions: k≠k′, meaning that the randomly generated subsets do not overlap. It should be noted that the number of subsets K can be a random value related to the size of the company's workforce, and there are no specific restrictions on this.

[0099] Taking the first time t as an example, each subset is treated as a cluster. For each cluster, the cluster threshold is determined based on the security coefficients of all user entities in the cluster at the first time t. If the target user entity's target security coefficient at the first time t is lower than the cluster threshold, the target user entity is assigned to a cluster with a lower cluster threshold; otherwise, the target user entity is retained in the current cluster.

[0100] It should be noted that if the target security coefficient of the target user entity is less than the cluster threshold of all clusters, a new cluster can be formed based on the target user entity without any restrictions.

[0101] In step 742, in response to adding the target user entity to the target cluster, multiple fourth security coefficients corresponding to multiple user entities in the target cluster are obtained; in step 743, the average value of the multiple fourth security coefficients is calculated as the cluster security coefficient of the target cluster.

[0102] In some embodiments, after traversing all user entities and completing the cluster partitioning, the average value can be recalculated based on the security coefficients of the user entities in the cluster, and used as the cluster security coefficient for the first time t. The formula for the security coefficient of each cluster is as follows:

[0103]

[0104] Among them, c k，t S represents the cluster security coefficient of the k-th subset among the K subsets mentioned above at time t, where the k-th subset includes X enterprise users. x，t Let represent the security coefficient of the xth user among the aforementioned X enterprise users at time t.

[0105] In step 744, it is determined whether to send the target user request to the cloud server for user authentication based on the cluster security factor.

[0106] In some embodiments, the proportion of user requests sent to the cloud server for user authentication in each cluster is:

[0107]

[0108] Where, p ,t This represents the proportion of user requests from the k-th subset of the above K subsets that are transmitted to the cloud server for user authentication at time t.

[0109] Based on the above formula, the higher the security level of the cluster, the smaller the proportion of user requests sent to the cloud server for user authentication. Therefore, it can effectively offload the traffic that is passed through to the remote cloud server, and at the same time, reduce the response latency of user requests and improve the user experience.

[0110] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in the technical solution disclosed herein comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0111] Figure 8 A structural block diagram of an authentication device in an edge computing scenario according to an embodiment of the present disclosure is shown.

[0112] like Figure 8 As shown, according to an embodiment of this disclosure, an authentication device 800 for edge computing scenarios is provided, comprising: a first acquisition unit 810, configured to acquire a target user request at an edge node; a second acquisition unit 820, configured to acquire first geographic location information, first security level information, and first interaction behavior information of a target user entity associated with the target user request at a first time; a determination unit 830, configured to determine a target security coefficient of the target user entity at a second time based on the first geographic location information, first security level information, and first interaction behavior information; and a transmission unit 840, configured to transmit the target user request to a cloud server for user authentication in response to the target security coefficient being less than a first threshold.

[0113] Here, the operations of the aforementioned units 810 to 840 of the authentication device 800 in the edge computing scenario are similar to the operations of steps 210 to 240 described above, and will not be repeated here.

[0114] According to embodiments of this disclosure, an electronic device, a readable storage medium, and a computer program product are also provided.

[0115] refer to Figure 9 The present invention describes a structural block diagram of an electronic device 900 that can serve as a server or client of the present disclosure, which is an example of a hardware device that can be applied to various aspects of the present disclosure. The electronic device is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0116] like Figure 9 As shown, the electronic device 900 includes a computing unit 901, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 902 or a computer program loaded into a random access memory (RAM) 903 from a storage unit 908. The RAM 903 may also store various programs and data required for the operation of the electronic device 900. The computing unit 901, ROM 902, and RAM 903 are interconnected via a bus 904. An input / output (I / O) interface 905 is also connected to the bus 904.

[0117] Multiple components in electronic device 900 are connected to I / O interface 905, including: input unit 906, output unit 907, storage unit 908, and communication unit 909. Input unit 906 can be any type of device capable of inputting information to electronic device 900. Input unit 906 can receive input digital or character information and generate key signal inputs related to user settings and / or function control of electronic device, and can include, but is not limited to, a mouse, keyboard, touchscreen, trackpad, trackball, joystick, microphone, and / or remote control. Output unit 907 can be any type of device capable of presenting information, and can include, but is not limited to, a monitor, speaker, video / audio output terminal, vibrator, and / or printer. Storage unit 908 can include, but is not limited to, hard disk and optical disk. Communication unit 909 allows electronic device 900 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks, and can include, but is not limited to, modems, network cards, infrared communication devices, wireless communication transceivers, and / or chipsets, such as Bluetooth devices, 802.11 devices, WiFi devices, WiMax devices, cellular communication devices, and / or the like.

[0118] The computing unit 901 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 901 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 901 performs the various methods and processes described above, such as method 999. For example, in some embodiments, method 999 may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 908. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 900 via ROM 902 and / or communication unit 909. When the computer program is loaded into RAM 903 and executed by the computing unit 901, one or more steps of method 999 described above may be performed. Alternatively, in other embodiments, the computing unit 901 may be configured to perform method 999 by any other suitable means (e.g., by means of firmware).

[0119] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0120] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0121] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0122] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0123] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), the Internet, and blockchain networks.

[0124] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0125] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be performed in parallel, sequentially, or in a different order, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0126] While embodiments or examples of this disclosure have been described with reference to the accompanying drawings, it should be understood that the methods, systems, and devices described above are merely exemplary embodiments or examples, and the scope of the invention is not limited by these embodiments or examples, but only by the granted claims and their equivalents. Various elements in the embodiments or examples may be omitted or replaced by their equivalents. Furthermore, the steps may be performed in a different order than that described in this disclosure. Further, various elements in the embodiments or examples may be combined in various ways. Importantly, as the technology evolves, many elements described herein can be replaced by equivalents that appear after this disclosure.

Claims

1. An authentication method for edge computing scenarios, comprising: Get the target user request at the edge node; Obtain the first geographical location information, first security level information, and first interaction behavior information of the target user entity associated with the target user request at the first moment; In response to the fact that the flow value at the edge node at the first time point is not greater than the second threshold, it is determined that the edge node is at a non-peak flow time, and the second time point is the same as the first time point; The first geographical location information, the first security level information, and the first interaction behavior information are processed using the first security coefficient model to obtain the first security coefficient output by the first security coefficient model as the target security coefficient of the target user request at the second time. In response to the fact that the traffic value at the edge node at the first time point is greater than the second threshold, it is determined that the edge node is at the traffic peak time, and the second time point is the time after the first time point; The first geographic location information, the first security level information, and the first interaction behavior information are processed using a pre-trained security prediction model to obtain a second security coefficient output by the security prediction model, which is used as the target security coefficient requested by the target user at the second time. as well as Based on the target security factor, determine whether to send the target user request to the cloud server for user authentication.

2. The method according to claim 1, wherein, The request to obtain the target user at the edge node includes: Obtain the user requests to be processed at the edge node; Obtain the first key of the user request to be processed; Match the first key with multiple second keys in a preset key library; and In response to the first key matching with at least one second key in the preset key library, the pending user request is taken as the target user request.

3. The method according to claim 1, further comprising: Obtain the second geographical location information, second security level information, and second interaction behavior information of the target user entity at the second time point; In response to the traffic value at the edge node dropping to no greater than the second threshold, the following operation is performed: The second security factor model is used to process the second geographical location information, the second security level information, and the second interaction behavior information to obtain the third security factor output by the second security factor model. Determine the difference between the third safety factor and the second safety factor; as well as The network parameters of the security prediction model are adjusted based on the difference.

4. The method according to claim 1, wherein, The step of determining whether to send the target user request to the cloud server for user authentication based on the target security coefficient includes: In response to the target security coefficient being less than a first threshold, it is determined that the target user request will be sent to the cloud server for user authentication.

5. The method according to claim 1, wherein determining whether to transmit the target user request to the cloud server for user authentication based on the target security coefficient includes: Whether to add the target user entity to the target cluster is determined based on at least one of the first geographic location information, the first security level information, the first interaction behavior information, and the target security coefficient. In response to determining to add the target user entity to the target cluster, Obtain multiple fourth security coefficients corresponding to multiple user entities in the target cluster; Calculate the average of the plurality of fourth security coefficients to serve as the cluster security coefficient of the target cluster; as well as The cluster security factor determines whether to send the target user request to the cloud server for user authentication.

6. The method according to any one of claims 1-5, wherein, The first security level information includes at least one of the following: The security level of the terminal device that issued the target user request, the security level of the target user entity, the security level of the data interface requested by the target user, the security level of the data requested by the target user, and the historical access frequency of the data requested by the target user. The first geographic location information includes at least one of the following: The geographical location of the target user entity at the first moment, the distance between the target user entity and the first reference user entity at the first moment, and the location change of the target user entity within the preset time period; Furthermore, the first interaction behavior information includes: The interaction behavior between the target user entity and the second reference user entity for user authentication.

7. An authentication device for edge computing scenarios, comprising: The first acquisition unit is used to acquire the target user request at the edge node; The second acquisition unit is used to acquire the first geographical location information, the first security level information, and the first interaction behavior information of the target user entity associated with the target user request at the first moment. The determining unit is configured to determine the target security coefficient of the target user entity at a second time based on the first geographical location information, the first security level information, and the first interaction behavior information. as well as The transmission unit is used to determine, based on the target security factor, whether to transmit the target user request to the cloud server for user authentication. The determining unit includes: A first determining subunit is configured to determine that the edge node is at a non-peak flow time in response to the flow value at the edge node at the first time being no greater than a second threshold, wherein the second time is the same as the first time. The second determining subunit is used to process the first geographical location information, the first security level information and the first interaction behavior information using the first security coefficient model, so as to obtain the first security coefficient output by the first security coefficient model as the target security coefficient. A third determining subunit is configured to determine, in response to the traffic value at the edge node being greater than a second threshold at the first time, that the edge node is at a traffic peak time, wherein the second time is a time after the first time; and The fourth determining subunit is used to process the first geographical location information, the first security level information, and the first interaction behavior information using a pre-trained security prediction model, so as to obtain the second security coefficient output by the security prediction model as the target security coefficient.

8. The apparatus according to claim 7, wherein, The first acquisition unit includes: The first acquisition subunit is used to acquire the user requests to be processed at the edge node; The second acquisition subunit is used to acquire the first key of the user request to be processed. A key matching subunit is used to match the first key with a plurality of second keys in a preset key library; and The request processing subunit is configured to, in response to the first key matching at least one second key in the preset key library, treat the user request to be processed as the target user request.

9. The apparatus according to claim 7, further comprising: The third acquisition unit is used to acquire the second geographical location information, the second security level information, and the second interaction behavior information of the target user entity at the second time. The training unit is configured to perform the following operation in response to the traffic value at the edge node dropping to no greater than the second threshold: The second security factor model is used to process the second geographical location information, the second security level information, and the second interaction behavior information to obtain the third security factor output by the second security factor model. Determine the difference between the third safety factor and the second safety factor; as well as The network parameters of the security prediction model are adjusted based on the difference.

10. The apparatus according to claim 7, wherein, The transmission unit is further configured to determine, in response to the target security coefficient being less than a first threshold, to transmit the target user request to the cloud server for user authentication.

11. The apparatus according to claim 7, wherein, The transmission unit includes: The fifth determining subunit is used to determine whether to add the target user entity to the target cluster based on at least one of the first geographical location information, the first security level information, the first interaction behavior information, and the target security coefficient. The sixth determining subunit is configured to respond to determining to add the target user entity to the target cluster. Obtain multiple fourth security coefficients corresponding to multiple user entities in the target cluster; Calculate the average of the plurality of fourth security factors to serve as the cluster security factor for the target cluster; and The cluster security factor determines whether to send the target user request to the cloud server for user authentication.

12. The apparatus according to any one of claims 7-11, wherein, The first security level information includes at least one of the following: The security level of the terminal device that issued the target user request, the security level of the target user entity, the security level of the data interface requested by the target user, the security level of the data requested by the target user, and the historical access frequency of the data requested by the target user. The first geographic location information includes at least one of the following: The geographical location of the target user entity at the first moment, the distance between the target user entity and the first reference user entity at the first moment, and the location change of the target user entity within the preset time period; Furthermore, the first interaction behavior information includes: the interaction behavior between the target user entity and the second reference user entity for user authentication.

13. An electronic device, comprising: At least one processor; as well as A memory that is communicatively connected to the at least one processor; in The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-6.

14. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-6.

15. A computer program product comprising a computer program, wherein, The computer program, when executed by a processor, implements the method of any one of claims 1-6.

Images