Dynamic access control method based on multi-factor authentication combined with multi-dimensional authorization model

Abstract

The application discloses a dynamic access control method based on multi-factor authentication combined with a multi-dimensional authorization model, which utilizes the combination of identity and access control, biometric identification and policy-based authorization (PBAC) technology, continuously verifies and evaluates the whole access process, greatly enhances the pre-protection capability, improves the overall security and management efficiency of customers, and when authentication is performed in the process, flexible authentication strategies are used for authentication according to the authentication measurement factors, so that multiple protection effects can be achieved when a user requests to access application resources.

Description

Technical Field

[0001] This invention relates to the field of data security communication technology, specifically to a dynamic access control method based on multi-factor authentication combined with a multi-dimensional authorization model. Background Technology

[0002] Multi-dimensional policy-level authorization is a fine-grained, dynamic access control model. Its principle is that during online resource access, users do not trust any person, device, or system inside or outside the enterprise network. It establishes a trust foundation for access control through user authentication and application authorization, ensuring that user identities, devices used, application resources, and access links are trustworthy. IAM is a unified identity management platform solution with centralized account management, unified identity authentication, authorization, and security audit management.

[0003] Currently, mainstream identity authentication and access control technologies are not deeply integrated with multi-dimensional authorization models. Although there are implemented project cases in some industries and scenarios, they do not demonstrate the value and highlights of linking and integrating multi-dimensional authorization with IAM. There is no relatively mature and comprehensive dynamic access control solution on the market. Existing technologies mainly include the following three solutions.

[0004] (1) Improve the authentication experience and reduce the complexity of identity management through IAM technology:

[0005] It provides unified identity management, unified identity authentication, a unified portal, single sign-on (SSO), auditing, and analysis functions. Users do not need to remember complex passwords; a single authentication is sufficient to access all authorized services. As a unified identity source and identity management platform, it provides identity provisioning or account binding for business systems, enabling unified hierarchical account management, efficiently addressing weak password issues, and strengthening authentication when login environments are risky, effectively meeting identity compliance requirements and improving account security.

[0006] (2) Implement dynamic access control based on fine-grained permission management technology to improve internal security and reliability:

[0007] By shrinking business systems to reduce exposure, it effectively addresses the risks and challenges in hardware and daily security operations. It provides authorization based on organizational structure, groups, roles, and identities. In addition to static authorization, it conducts dynamic risk assessment and dynamic access control based on multi-dimensional information such as terminal environment, identity, behavior, and network location to achieve fine-grained permission management. Furthermore, it can block or enhance authentication when risks are detected based on dynamic continuous assessment, effectively ensuring the security of user access to business.

[0008] (3) Introduce biometric technology to improve authentication methods and dynamic access control levels:

[0009] By introducing fingerprint recognition technology into the process of dynamic access control and continuous trust assessment, the authentication service agent can flexibly configure authentication policies based on factors such as the user's trust level in the terminal environment, context information, and sensitivity of the accessed application. This provides multiple layers of protection when a user requests access to application resources, ensuring the security and compliance of the identity authentication process, and thus protecting against the risks of identity theft and unauthorized access during the user's access to application resources.

[0010] However, the above solution has the following drawbacks:

[0011] (1) Insufficient authentication security: Currently, many business systems still use traditional account passwords as the primary authentication method, with mobile verification codes and mobile QR code scanning as secondary authentication methods. Relatively speaking, the above authentication methods have a low level of security and are prone to unauthorized access and identity forgery. Furthermore, when users use password authentication, they often use the same password in multiple software applications. With the increase in phishing software and malicious software, hackers can easily obtain or crack user passwords through various means, resulting in the leakage of related accounts.

[0012] (2) Inflexible response and handling strategies: The integration of Policy-Level Authorization (PBAC) and IAM technology is currently fragmented. PBAC primarily addresses fine-grained access control, implementing a multi-dimensional trust assessment mechanism based on the contextual risk of the user's current access environment. However, its security control within the application system accessed by the user is relatively weak. IAM platforms, on the other hand, primarily address unified access control within application systems. However, their control over application access lacks continuous and dynamic access control capabilities. During the authentication process, the policies and authentication methods of the IAM platform are not flexible enough, failing to provide real-time response and handling actions (such as demotion or enhanced authentication) based on terminal and behavioral risks. Summary of the Invention

[0013] To address the shortcomings of existing technologies, this invention aims to provide a dynamic access control method based on multi-factor authentication technology combined with a multi-dimensional authorization model.

[0014] To achieve the above objectives, the present invention adopts the following technical solution:

[0015] The dynamic access control method based on multi-factor authentication combined with a multi-dimensional authorization model includes the following steps:

[0016] S1. User initiates access request:

[0017] S1.1 When a user logs in to access application A using a browser on a PC, the authentication service agent monitors the terminal type (Type) information of the terminal used for login in real time through the authentication client agent, completes the known information in the process vector, and synchronizes it to the IAM platform; the process vector is User_Authentication_Status(ID, a, b, c, d, e), where ID, a, b, c, d, and e are respectively the unique identifier Identity (User), user identity ID, accessed application system ID, terminal type (Type), status code (Code), and authentication method (Type); the status code (Code) is used to indicate the current access and authentication status; the authentication method is one or a combination of ordinary authentication method and biometric authentication method;

[0018] S1.2 The IAM platform compares the process vector User_Authentication_Status synchronized by the authentication service agent with the rule vector IAM_Authentication of the IAM platform to obtain the authentication method corresponding to the current access, refreshes the authentication page, and refreshes the values ​​of d and e in the process vector before returning it to the authentication service agent; the rule vector IAM_Authentication of the IAM platform is denoted as IAM_Authentication(ID, A, B, C, D, E), where ID, A, B, C, D, and E correspond to the cross-platform unique identifier Identity(User), user identity ID, accessed application system ID, terminal type Type, status code Code, and authentication method Type, respectively;

[0019] S2. User authentication and login:

[0020] In step S1, if the value of e in the process vector returned by the IAM platform is either the normal authentication method or the biometric authentication method, the user can enter the normal authentication information or the biometric authentication information on the IAM authentication page.

[0021] In step S1, the value of e in the process vector returned by the IAM platform is either the normal authentication method or the biometric authentication method. The user then enters the normal authentication information and the biometric authentication information according to the IAM authentication page.

[0022] After the user enters authentication information, the authentication service agent refreshes the value of d in the process vector and generates a specific authentication vector User_Authentication_Value(ID,Type1,Type2), which is then returned to the IAM platform for authentication of ordinary authentication information and biometric authentication information. In the authentication vector User_Authentication_Value, ID, Type1, and Type2 correspond to the cross-platform unique identifier Identity(User), ordinary authentication information, and biometric authentication information, respectively.

[0023] S3. Identity verification and mutual trust establishment:

[0024] Once authentication is successful, the IAM platform will refresh the value of d in the process vector User_Authentication_Status based on the authentication result. If authentication is successful, the IAM platform will allow the user to log in and access application A, and will notify the authentication service to proxy the user's login. Otherwise, access will not be allowed, the user will remain on the current authentication page, or a login lockout policy will be triggered.

[0025] Furthermore, the above method also includes step S4, continuous dynamic evaluation:

[0026] When a user successfully logs in and accesses application A on PC device X using their account, if the same user account also successfully logs in and accesses application A on tablet device Y at the same time, the authentication service agent will automatically notify the authentication client on PC device X to trigger the account cancellation and offline process on PC device X.

[0027] Furthermore, in step 1.2, the specific process by which the IAM platform compares the process vector User_Authentication_Status with the IAM platform's rule vector IAM_Authentication is as follows:

[0028] 1.2.1 Verify user identity: The IAM platform first verifies the value of 'a' in the process vector, i.e., the user ID, to verify the user's identity during the actual access process. If the visitor is not a user managed by the IAM platform or the user token is invalid, the access request will be rejected.

[0029] 1.2.2 Confirm the sensitivity level of the accessed application: The IAM platform determines the sensitivity level of the application based on the value of b in the process vector, i.e., the application system ID;

[0030] 1.2.3 Confirm Terminal Type: The IAM platform determines the authentication method required for the current access based on the value of 'c' in the process vector, i.e., the terminal type, combined with the application system ID and its sensitivity level, and according to the pre-set dynamic control policy of application A.

[0031] Furthermore, when application A is launched and released, the administrator will pre-set dynamic control policies for application A on the IAM platform, including the sensitivity level of application A and the authentication methods required for each type of terminal to access application A.

[0032] Furthermore, common authentication methods include one or more of account password login, QR code login, and mobile phone number verification code login, while biometric authentication methods include one or more of fingerprint recognition, biometric image recognition, and voice recognition.

[0033] Furthermore, the IAM platform pre-connects with the biometric authentication platform, pushing the user's basic information to the biometric authentication platform. Subsequently, the biometric authentication platform performs the user's biometric information collection process and binds the user's basic information to determine the uniqueness and consistency of the user's biometric information and basic information across multiple platforms. The basic information includes at least the user's cross-platform unique identifier, Identity (User).

[0034] Furthermore, there is a pre-set database of user information on the biometric authentication platform. When the IAM platform pushes user basic information to the biometric authentication platform, the biometric authentication platform stores it in the pre-set database of user information. The biometric authentication platform collects, verifies, and associates biometric information for each user's basic information in the pre-set database of user information. The cross-platform unique identifier Identity(User) is a unique identifier that associates user biometric information and user basic information during biometric authentication.

[0035] After collecting biometric information, the biometric feature values ​​are extracted from the biometric information and converted into a digital code Standard(X,Y,…,Z) according to a preset rule, where X, Y,…,Z are the collected multi-dimensional biometric values ​​of the user, including face, iris, fingerprint, voiceprint, etc.; the encoded digital code is saved to the user information preset database of the biometric authentication platform.

[0036] The collected user biometric digital code Standard(X,Y,…,Z) is associated with the preset value of the cross-platform unique identifier Identity(User) in the user information preset database to complete the user integrity archiving of the biometric authentication platform. When a user requests access to an application and needs to perform biometric authentication, the IAM platform and the biometric authentication platform work together. The user's biometric information is matched and compared with the requested value of Identity(User) in the actual request and the preset value of Identity(User) in the user information preset database. If no match is found, it means that the biometric authentication has failed.

[0037] The beneficial effects of this invention are as follows:

[0038] This invention combines identity and access control, biometrics, and policy-level authorization (PBAC) technologies, and through continuous verification and evaluation throughout the access process, it greatly enhances proactive protection capabilities and improves overall customer security and management efficiency. During the authentication process, it uses flexible authentication strategies based on authentication metrics to provide multiple layers of protection when users request access to application resources.

[0039] (1) High security

[0040] For authentication of enterprise information or highly sensitive data, simple usernames and passwords are no longer sufficient. Biometric authentication technology can accurately locate the identity information of logged-in users, and the uniqueness of the information collected by biometric authentication technology can prevent unauthorized use of users' passwords and accounts after they have been lost. Furthermore, the diversity of authentication technologies can also improve security.

[0041] (2) Diversified authentication methods

[0042] The main application areas of biometric technology include facial recognition, voice recognition, and fingerprint recognition. There are many types of identification required during initial user registration, and subsequent authentication methods are available for users accessing resources, offering flexible operation.

[0043] (3) Easy to use

[0044] The use of biometric technology eliminates the need for traditional methods like mobile phone account passwords and QR codes, which rely on external objects for access or memorization. This can lead to forgotten passwords or lost mobile devices, resulting in login failures. Biometric information is unique, relying primarily on the user's own characteristics for identification.

[0045] (4) Use certification in combination to prevent special circumstances

[0046] Combining authentication methods can effectively protect against similarities in user facial recognition and the difficulty in obtaining fingerprints from specific individual users. Individual biometric information may also have very few similarities, but when used in combination, the probability can be reduced to an extremely low level, approaching zero. Attached Figure Description

[0047] Figure 1 This is a schematic diagram of the method flow according to an embodiment of the present invention;

[0048] Figure 2 This is a schematic diagram illustrating the linkage process between the IAM platform and the biometric authentication platform in an embodiment of the present invention. Detailed Implementation

[0049] The present invention will be further described below with reference to the accompanying drawings. It should be noted that this embodiment is based on the present technical solution and provides detailed implementation methods and specific operation processes, but the protection scope of the present invention is not limited to this embodiment.

[0050] Example 1

[0051] This embodiment provides a dynamic access control method based on multi-factor authentication combined with a multi-dimensional authorization model. Key components include:

[0052] (1) Introducing biometric technology. Although existing biometric technologies such as facial recognition, voice recognition, and fingerprint recognition are very mature, they still have many limitations. For example, facial recognition is easily affected by occlusion, angle, lighting, and changes in posture, while voice recognition is easily affected by ambient noise and changes in the user's physical condition, resulting in insufficient recognition performance in certain specific scenarios. Therefore, the environment and information dimensions for collecting biometric information should be multi-dimensional. For example, facial recognition should collect information such as the user's overall facial features, blinking, mouth opening, and profile to convert biometric information into reasonable biometric values, i.e., a multi-dimensional value.

[0053] (2) The IAM platform and the biometric authentication platform are linked and connected to push the user's basic information to the biometric authentication platform. Then the biometric authentication platform implements the corresponding user's biometric information collection process and binds the user's basic information to determine the uniqueness and uniformity of the user's biometric information and basic information across multiple platforms.

[0054] (3) A comprehensive metric for policy authentication on the IAM platform is the rule vector IAM_Authentication(ID, A, B, C, D, E), where ID, A, B, C, D, and E are respectively the cross-platform unique identifier Identity (User), user identity ID, accessed application system ID, terminal type Type, status code Code, and authentication method Type. The core of the overall rule vector is to trigger different biometric authentication methods when a user accesses applications with different sensitivity levels using different terminal types, thereby ensuring the access security of different applications. The original independent IAM platform only manages permissions for a single application and can only achieve static policy configuration protection. It cannot achieve the dynamic access control of the combined platform in this embodiment. Therefore, a rule vector containing dynamic change factors and application ID (which will be indexed to the application sensitivity level) is introduced to more effectively deal with dynamic risk protection and dynamic permission control when accessing applications. The application sensitivity level division in this embodiment is shown in Table 1.

[0055] Table 1

[0056]

[0057] Common authentication methods include account and password login, QR code login, and mobile phone verification code login, while biometric authentication methods include fingerprint recognition, facial recognition, iris recognition, and voice recognition. Terminal types include PCs, Macs, mobile phones, tablets, and other terminals.

[0058] For regular user login scenarios, standard authentication is the primary method. To enhance authentication and access security, when a user accesses an application, the authentication service proxy and the IAM platform work together to dynamically select the appropriate authentication method based on the terminal type and application sensitivity level. For example, PCs and Macs, which mostly access applications from within the intranet and have high trustworthiness, can use a single standard authentication method. Mobile phones and tablets, which mostly access applications from the external network and have lower trustworthiness, require secondary authentication (standard authentication). Other terminal devices, operating in complex environments, require enhanced authentication (standard authentication + biometric authentication). Secondly, different application sensitivity levels (based on factors such as the application's port openness, data importance, and accessibility) will trigger different authentication methods. For highly sensitive applications, biometric authentication is mandatory, while for low-sensitivity or non-sensitive applications, it is optional. Introducing strict biometric authentication helps identify risks such as identity theft.

[0059] In summary, this embodiment's method is based on biometric technology and combines an authentication service proxy with an IAM platform to achieve dynamic access control during application resource access. The core is applying biometric technology to the continuous dynamic authentication and identity verification process, thereby achieving security and compliance in identity authentication and verification. Figure 1 As shown, the specific steps include the following:

[0060] S1. User initiates access request: When a user initiates a request to access application A, the authentication service proxy detects that the user account is not yet online. At this time, the access request is forwarded to the IAM platform for unified authentication. The process vector at this time is User_Authentication_Status(ID, a, b, c, d, e), where ID, a, b, c, d, and e correspond to the cross-platform unique identifier Identity (User), user identity ID, application system ID, terminal type Type, status code Code, and authentication method Type, respectively. The status code Code is used to indicate the current access and authentication status, such as "authentication, request access", "access allowed, but authentication required", "authenticated, request access", "authentication passed, access allowed", etc.

[0061] Taking a PC as an example, the specific process of step S1 is further explained as follows:

[0062] S1.1 When a user logs in to access application A using a browser on a PC, the authentication service agent monitors the terminal type (Type) information of the terminal used by the current account in real time through the authentication client agent, and completes the known information in the process vector and synchronizes it to the IAM platform. That is, at this time the process vector is User_Authentication_Status(ID=Identity(User), a=User identity ID1, b=Application system ID1, c=Terminal type Type1_PC, d=Unauthenticated, requesting access, e=None), where e is unknown information.

[0063] In this embodiment, when application A is launched, the administrator will pre-configure dynamic control policies for application A on the IAM platform, including the sensitivity level of application A and the authentication methods required for various terminal types to access application A. For example, application A may be defined as a high-sensitivity application, and when the accessing terminal is a PC or Mac computer, account password authentication and biometric authentication (such as face or iris recognition) for application A may be used. However, when the accessing terminal is a mobile device such as a smartphone or platform, account password authentication, biometric authentication, and fingerprint authentication for application A may all be required.

[0064] S1.2 The IAM platform compares the process vector User_Authentication_Status synchronized by the authentication service agent with the rule vector IAM_Authentication of the IAM platform to obtain the authentication method corresponding to the current access, refreshes the authentication page, and returns the updated values ​​of d and e in the process vector to the authentication service agent. For example, the latest value of the process vector is User_Authentication_Status(ID = Identity(User), a = User Identity ID1, b = Application System ID1, c = Terminal Type Type1_PC, d = Access allowed, but authentication required, e = Account authentication and image authentication).

[0065] In this embodiment, step 1.2, where the IAM platform compares the process vector User_Authentication_Status with the rule vector IAM_Authentication of the IAM platform, is as follows:

[0066] 1.2.1 Verify User Identity: The IAM platform first verifies the value of 'a' in the process vector, i.e., the user ID (which can be a unique identifier for the user or a user token), to verify the user's identity during the actual access process. If the visitor is not a user managed by the IAM platform or the user token is invalid, the access request will be rejected.

[0067] 1.2.2 Confirming the Sensitivity Level of Accessed Applications: The IAM platform determines the sensitivity level of an application based on the value of 'b' in the process vector, i.e., the application system ID (which can be a unique identifier for the application or an application token). For example, if application system ID1 matches the OA office system, the OA office system will be defined as having a normal sensitivity level during the application governance (classification and grading) process.

[0068] 1.2.3. Terminal Type Confirmation: The IAM platform determines the authentication method required for the current access based on the value of 'c' in the process vector, i.e., the terminal type (detected by the authentication service agent through the authentication client), combined with the application system ID and its sensitivity level, and according to the pre-set dynamic control policy of application A. For example, if Zhang San is currently accessing the OA office system using a PC, the PC will match the corresponding authentication method in the authentication policy management module.

[0069] S2. The user authenticates and logs in;

[0070] In step S1, if the value of e in the process vector returned by the IAM platform is either the normal authentication method or the biometric authentication method, the user can enter the normal authentication information or the biometric authentication information on the IAM authentication page.

[0071] In step S1, the value of e in the process vector returned by the IAM platform is either the normal authentication method or the biometric authentication method. The user then enters the normal authentication information and the biometric authentication information according to the IAM authentication page.

[0072] After the user enters the authentication information, the authentication service agent refreshes the value of d in the process vector and generates a specific authentication vector User_Authentication_Value(ID,Type1,Type2), which is then returned to the IAM platform for authentication of ordinary authentication information and biometric authentication information. In the authentication vector User_Authentication_Value, ID, Type1, and Type2 correspond to the cross-platform unique identifier Identity(User), ordinary authentication information, and biometric authentication information, respectively.

[0073] Taking the authentication method that combines conventional authentication and biometric authentication as an example, the specific process of step S2 is further explained as follows:

[0074] S2.1 The user sees the refreshed IAM authentication page in the browser on the current PC. At this time, the user performs authentication input according to the account authentication and image authentication displayed on the page. After completion, the process vector value is refreshed again, specifically User_Authentication_Status(ID=Identity(User), a=User identity ID1, b=Application system ID1, c=Terminal type Type1_PC, d=Authenticated, requesting access, e=Account authentication and image authentication) and the specific authentication vector User_Authentication_Value(ID=Identity(User), Type1=Account value, Type2=Biometric image value) is returned for the IAM platform to compare account and biometric features.

[0075] S2.2 The IAM platform uses the cross-platform unique identifier Identity(User) in the returned authentication vector User_Authentication_Value(ID = Identity(User), Type1 = account value, Type2 = biometric image value) to index and match the user's account information and biometric information. If the Type1 account value matches the user's pre-stored account information, the first authentication verification is successful. If the Type2 image value matches the pre-stored biometric image value and the deviation is less than a preset threshold (e.g., 5%), the match is considered successful, and the second authentication verification is successful. Authentication is successful only if both authentication information is verified successfully; otherwise, authentication fails, and access to services is unavailable.

[0076] S3. Identity verification and mutual trust establishment:

[0077] Upon successful authentication, the IAM platform refreshes the value of 'd' in the process vector based on the authentication result. If authentication is successful, the process vector is User_Authentication_Status(ID = Identity(User), a = User ID1, b = Application System ID1, c = Terminal Type Type1_PC, d = Authentication Successful, Access Allowed, e = Account Authentication and Image Authentication). At this point, the IAM platform allows the user to log in and access application A, and notifies the authentication service to proxy the user's login. If authentication fails, the process vector User_Authentication_Status(ID = Identity(User), a = User ID1, b = Application System ID1, c = Terminal Type Type1_PC, d = Authentication Failed, Re-authenticate / Lock, e = Account Authentication and Image Authentication) is refreshed, meaning access is disallowed, the user remains on the current authentication page, or a login lockout policy is triggered.

[0078] S4. Continuous dynamic evaluation:

[0079] When a user successfully logs in and accesses application A on PC device X using their account, and simultaneously logs in and accesses application A on tablet device Y using the same account, the authentication service agent will automatically notify the authentication client on PC device X to trigger account deregistration on PC device X. If the access on tablet device Y is normal at this time, then the default user's main control panel is tablet device Y. If an unauthorized user is logging in on tablet device Y, the normal user will also be immediately aware of the account deregistration on PC device X and will check the relevant access logs on the authentication service agent and IAM platform for further investigation.

[0080] Because the IAM platform is pre-configured with dynamic control policies based on terminal type and application sensitivity level, when an account accesses the application on tablet device Y, the process vector is User_Authentication_Status(ID = Identity(User), a = User Identity ID1, b = Application System ID1, c = Terminal Type Type1_Tablet, d = Unauthenticated, requesting access, e = None). This will trigger a matching process with the rule vector IAM_Authentication(ID, A, B, C, D, E) and a refresh of User_Authentication_Status. If the authentication method includes biometric authentication, then when accessing the application on tablet device Y, an authentication page containing biometric authentication will also be triggered. If a hacker or impersonator is present at this time, they will not be able to access the application successfully because they lack relevant or highly matching biometric information. Regardless of whether the user authentication is successful or not, the authentication service agent and the IAM platform will record the access logs of related users of the same account for further source tracing and risk assessment.

[0081] In this embodiment, the IAM platform pre-connects with the biometric authentication platform, pushing user basic information to the biometric authentication platform. The biometric authentication platform then performs a biometric information collection process and binds the user's basic information to ensure the uniqueness and consistency of user biometric and basic information across multiple platforms. The basic information includes at least the user's cross-platform unique identifier (Identity(User)), and may also include the user name, user group (which can be determined based on business needs, such as role, position, organization, etc., for easy querying and statistics), user status (reference example: 0 default normal, 1 frozen, 2 locked, 3 other), and device serial number (used for feature comparison within the device), etc.

[0082] It should be noted that, apart from biometrics, biometric authentication platforms are not allowed to store other sensitive user information, such as mobile phone numbers, ID card numbers, home addresses, bank card numbers, etc.

[0083] like Figure 2 As shown, the specific process of the IAM platform's pre-connection and integration with the biometric authentication platform is as follows:

[0084] The biometric authentication platform maintains a pre-set database of user information. When the IAM platform pushes basic user information to the biometric authentication platform, the platform stores it in this database. The biometric authentication platform then collects, verifies, and associates biometric information for each user's basic information within the database. The cross-platform unique identifier, Identity(User), serves as the unique identifier linking the user's biometric information and basic user information during biometric authentication.

[0085] Biometric information is collected using a biometric scanner. A camera captures biometric images, with video or pictures as the basic unit. Frames are captured and stored based on multi-angle shots of the face, profile, and facial expressions. A microphone captures biometric audio information, including the user's voice pitch, timbre, and loudness. A text is provided to the user for complete reading to capture key audio factors. A touchscreen is used to collect biometric fingerprint information, including planar fingerprints, swipe fingerprints, and fingerprints from both hands.

[0086] After collecting biometric information, the biometric feature values ​​are extracted from the biometric information and converted into a digital code Standard(X,Y,…,Z) according to preset rules, where X, Y,…,Z are the collected multi-dimensional biometric values ​​of the user, including face, iris, fingerprint, voiceprint, etc. The encoded digital code is saved to the user information preset database of the biometric authentication platform, and corresponding thresholds are set for the digital code in the user information preset database so that it can be effectively matched during the authentication process.

[0087] The collected user biometric digital code Standard(X,Y,…,Z) is associated with the preset value of the cross-platform unique identifier Identity(User) in the user information preset database to complete the user integrity archiving of the biometric authentication platform. When a user requests access to an application and requires biometric authentication, the IAM platform and the biometric authentication platform work together. The user's biometric information is matched and compared with the requested value of Identity(User) in the actual request and the preset value of Identity(User) in the user information preset database. If no match is found, the biometric authentication fails.

[0088] For those skilled in the art, various corresponding changes and modifications can be made based on the above technical solutions and concepts, and all such changes and modifications should be included within the protection scope of the claims of this invention.

Claims

1. A dynamic access control method based on multi-factor authentication combined with a multi-dimensional authorization model, characterized in that, Specifically, the steps include the following: S1. User initiates access request: S1.1 When a user logs in to access application A using a PC's browser, the authentication service agent monitors the terminal type (Type) information of the terminal used for login in real time through the authentication client agent, completes the known information in the process vector, and synchronizes it to the IAM platform. The process vector is User_Authentication_Status(ID, a, b, c, d, e), where ID, a, b, c, d, and e are respectively the cross-platform unique identifier Identity User, user identity ID, accessed application system ID, terminal type (Type), status code (Code), and authentication method (Type). The status code (Code) is used to indicate the current access and authentication status. The authentication method is one or a combination of two of the following: ordinary authentication method and biometric authentication method. S1.2 The IAM platform compares the process vector User_Authentication_Status synchronized by the authentication service agent with the rule vector IAM_Authentication of the IAM platform to obtain the authentication method corresponding to the current access, refreshes the authentication page, and refreshes the values ​​of d and e in the process vector before returning them to the authentication service agent; the rule vector IAM_Authentication of the IAM platform is denoted as IAM_Authentication(ID, A, B, C, D, E), where ID, A, B, C, D, and E correspond to the cross-platform unique identifier Identity User, user identity ID, accessed application system ID, terminal type Type, status code Code, and authentication method Type, respectively; S2. User authentication and login: In step S1, if the value of e in the process vector returned by the IAM platform is either the normal authentication method or the biometric authentication method, the user can enter the normal authentication information or the biometric authentication information on the IAM authentication page. In step S1, the value of e in the process vector returned by the IAM platform is either the normal authentication method or the biometric authentication method. The user then enters the normal authentication information and the biometric authentication information according to the IAM authentication page. After the user enters the authentication information, the authentication service agent refreshes the value of d in the process vector and generates a specific authentication vector User_Authentication_Value(ID, Type1, Type2), which is then returned to the IAM platform for authentication of ordinary authentication information and biometric authentication information; In the authentication vector User_Authentication_Value, ID, Type1, and Type2 correspond to the cross-platform unique identifier Identity User, general authentication information, and biometric authentication information, respectively. S3. Identity verification and mutual trust establishment: Once authentication is successful, the IAM platform will refresh the value of d in the process vector User_Authentication_Status based on the authentication result. If authentication is successful, the IAM platform will allow the user to log in and access application A, and will notify the authentication service to proxy the user's login. Otherwise, access will not be allowed, the user will remain on the current authentication page, or a login lockout policy will be triggered.

2. The method according to claim 1, characterized in that, It also includes step S4, continuous dynamic evaluation: When a user successfully logs in and accesses application A on PC device X using their account, if the same user account also successfully logs in and accesses application A on tablet device Y at the same time, the authentication service agent will automatically notify the authentication client on PC device X to trigger the account cancellation and offline process on PC device X.

3. The method according to claim 1, characterized in that, In step 1.2, the IAM platform will compare the process vector User_Authentication_Status with the rule vector IAM_Authentication of the IAM platform as follows: 1.2.1 Verify user identity: The IAM platform first verifies the value of 'a' in the process vector, i.e., the user ID, to verify the user's identity during the actual access process. If the visitor is not a user managed by the IAM platform or the user token is invalid, the access request will be rejected. 1.2.2 Confirm the sensitivity level of the accessed application: The IAM platform determines the sensitivity level of the application based on the value of b in the process vector, i.e., the application system ID; 1.2.3 Confirm Terminal Type: The IAM platform determines the authentication method required for the current access based on the value of 'c' in the process vector, i.e., the terminal type, combined with the application system ID and its sensitivity level, and according to the pre-set dynamic control policy of application A.

4. The method according to claim 1, characterized in that, When application A is launched, the administrator will pre-set dynamic control policies for application A on the IAM platform, including the sensitivity level of application A and the authentication methods required for each type of terminal to access application A.

5. The method according to claim 1 or 2, characterized in that, Common authentication methods include one or more of account password login, QR code login, and mobile phone number verification code login, while biometric authentication methods include one or more of fingerprint recognition, biometric image recognition, and voice recognition.

6. The method according to claim 1, characterized in that, The IAM platform pre-connects with the biometric authentication platform, pushing user basic information to the biometric authentication platform. Subsequently, the biometric authentication platform performs the user's biometric information collection process and binds the user's basic information to determine the uniqueness and consistency of user biometric information and basic information across multiple platforms. The basic information includes at least the user's cross-platform unique identifier, Identity User.

7. The method according to claim 6, characterized in that, There is a preset database of user information on the biometric authentication platform. When the IAM platform pushes basic user information to the biometric authentication platform, the biometric authentication platform stores it in the preset database of user information. The biometric authentication platform collects, verifies, and associates biometric information with each user's basic information in a pre-set database; the cross-platform unique identifier, Identity User, serves as a unique identifier that links user biometric information with user basic information during biometric authentication. After collecting biometric information, the biometric feature values ​​are extracted from the biometric information and converted into a digital code Standard(X,Y,…,Z) according to a preset rule, where X, Y,…,Z are the collected multi-dimensional biometric values ​​of the user, including face, iris, fingerprint and voiceprint; the encoded digital code is saved to the user information preset database of the biometric authentication platform. The collected user biometric digital code Standard(X,Y,…,Z) is associated with the preset value of the cross-platform unique identifier IdentityUser in the user information preset database to complete the user integrity archiving of the biometric authentication platform. When a user requests access to an application and needs to perform biometric authentication, the IAM platform and the biometric authentication platform work together. The user's biometric information is matched and compared with the requested value of IdentityUser in the actual request and the preset value of IdentityUser in the user information preset database. If no match is found, it means that the biometric authentication has failed.

Images