A secure access policy chain authentication method and system

Abstract

The application relates to the technical field of network security, and discloses a security access policy chain authentication method and system, which acquires a to-be-authenticated data policy chain, performs data analysis on the to-be-authenticated data policy chain, determines an IP address, a destination IP address and to-be-transmitted data carried by the to-be-authenticated data policy chain, calculates a data transmission risk level coefficient of the to-be-authenticated data policy chain based on the IP address and the destination IP address, sets a security authentication strategy of the to-be-authenticated data policy chain according to the data transmission risk level coefficient, performs security authentication on the to-be-authenticated data policy chain according to the security authentication strategy, transmits the to-be-transmitted data to the destination IP address if the authentication succeeds, and generates an alarm if the authentication fails. The application solves the technical problem that a data policy chain cannot be authenticated in a safe manner, guarantees the authentication accuracy and safety of the data policy chain, and has randomness in authentication, so that the security authentication efficiency is relatively high.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a secure access policy chain authentication method and system. Background Technology

[0002] Network security typically refers to the security of computer networks, but it can also refer to the security of computer communication networks. A computer communication network interconnects several independent computers through communication equipment and transmission media, enabling information transmission and exchange between computers with the support of communication software. A computer network, on the other hand, refers to a system that connects several geographically dispersed independent computer systems, terminal devices, and data devices using communication means for the purpose of resource sharing, and exchanges data under the control of protocols. The fundamental purpose of a computer network is resource sharing, and the communication network is the means to achieve this. Therefore, if a computer network is secure, the corresponding computer communication network must also be secure and capable of enabling information exchange and resource sharing for network users. Thus, inventing a secure access policy chain authentication method becomes particularly important.

[0003] Current network security authentication processes lack verification of the source MAC and IP addresses of authenticated users' IP packets, making them susceptible to address spoofing and related network attacks. These spoofing and attacks are difficult to trace, making effective network management increasingly challenging for administrators. This leads to network threats such as eavesdropping, spoofing, tampering, replay attacks, rerouting, incorrect routing, message deletion, and network flooding, severely impacting network security. Summary of the Invention

[0004] This invention provides a secure access policy chain authentication method and system to solve the technical problem in the prior art that it is impossible to perform secure authentication of the data policy chain for network access, and that the authentication accuracy and security of the data policy chain cannot be guaranteed.

[0005] To achieve the above objectives, the present invention provides a secure access policy chain authentication method, the method comprising: Obtain the data policy chain to be authenticated, and parse the data policy chain to determine the IP address, destination IP address and data to be transmitted carried by the data policy chain to be authenticated. Calculate the data transmission risk level coefficient of the data policy chain to be authenticated based on the IP address and the destination IP address; The security authentication strategy for the data policy chain to be authenticated is set according to the data transmission risk level coefficient. The security authentication policy chain to be authenticated is performed according to the security authentication policy. If the authentication is successful, the data to be transmitted is transmitted to the destination IP address. If the authentication fails, an alarm is generated.

[0006] In one embodiment, calculating the data transmission risk level coefficient of the data policy chain to be authenticated based on the IP address and the destination IP address includes: Obtain the historical network attack and defense behaviors of the IP address; The historical network attack behaviors and historical network defense behaviors of the IP addresses are matched one-to-one, and a first risk set is generated; Obtain the historical network attack and defense behaviors of the target IP address; The historical network attack behavior and historical network defense behavior of the target IP address are matched one-to-one, and a second risk set is generated; Analyze the historical network defense behaviors in the first risk set to determine the number of successful defenses in the first risk set; Analyze the historical network defense behaviors in the second risk set to determine the number of successful defenses in the second risk set; The data transmission risk level coefficient is calculated based on the first risk set, the second risk set, the number of successful defenses in the first risk set, and the number of successful defenses in the second risk set.

[0007] In one embodiment, when setting the security authentication policy for the data policy chain to be authenticated based on the data transmission risk level coefficient, the following steps are included: The key authentication count and key authentication bit length of the data to be authenticated policy chain are set according to the data transmission risk level coefficient A; The key authentication count and the key authentication bit length are used as the security authentication strategy for the data strategy chain to be authenticated.

[0008] In one embodiment, when setting the key authentication count and key authentication bit length of the data policy chain to be authenticated according to the data transmission risk level coefficient A, the following steps are included: A data transmission risk level coefficient matrix B is preset for the data strategy chain to be authenticated, and B(B1, B2, B3, B4) is set, where B1 is the first preset data transmission risk level, B2 is the second preset data transmission risk level, B3 is the third preset data transmission risk level, and B4 is the fourth preset data transmission risk level, and B1 < B2 < B3 < B4. A key authentication count matrix C is preset for the data strategy chain to be authenticated, and C is set as (C1, C2, C3, C4, C5), where C1 is the first preset key authentication count, C2 is the second preset key authentication count, C3 is the third preset key authentication count, C4 is the fourth preset key authentication count, and C5 is the fifth preset key authentication count, and C1 < C2 < C3 < C4 < C5; A key authentication bit length matrix D is preset for the data strategy chain to be authenticated, and D is set as (D1, D2, D3, D4, D5), where D1 is the first preset key authentication bit length, D2 is the second preset key authentication bit length, D3 is the third preset key authentication bit length, D4 is the fourth preset key authentication bit length, and D5 is the fifth preset key authentication bit length, and D1 < D2 < D3 < D4 < D5. Based on the relationship between the data transmission risk level A of the data policy chain to be authenticated and each preset data transmission risk level, the key authentication count and key authentication bit length of the data policy chain to be authenticated are set: When A < B1, the first preset key authentication count C1 is selected as the key authentication count of the data policy chain to be authenticated, and the first preset key authentication bit count D1 is selected as the key authentication bit count of the data policy chain to be authenticated. When B1≤A<B2, the second preset key authentication count C2 is selected as the key authentication count of the data strategy chain to be authenticated, and the second preset key authentication bit count D2 is selected as the key authentication bit count of the data strategy chain to be authenticated. When B2≤A<B3, the third preset key authentication count C3 is selected as the key authentication count of the data strategy chain to be authenticated, and the third preset key authentication bit count D3 is selected as the key authentication bit count of the data strategy chain to be authenticated. When B3≤A<B4, the fourth preset key authentication count C4 is selected as the key authentication count of the data strategy chain to be authenticated, and the fourth preset key authentication bit count D4 is selected as the key authentication bit count of the data strategy chain to be authenticated. When B4≤A, the fifth preset key authentication count C5 is selected as the key authentication count of the data policy chain to be authenticated, and the fifth preset key authentication bit count D5 is selected as the key authentication bit count of the data policy chain to be authenticated.

[0009] To achieve the above objectives, the present invention provides a secure access policy chain authentication system, the system comprising: The determination module is used to obtain the data policy chain to be authenticated, and to parse the data policy chain to be authenticated to determine the IP address, destination IP address and data to be transmitted carried by the data policy chain to be authenticated. The calculation module is used to calculate the data transmission risk level coefficient of the data policy chain to be authenticated based on the IP address and the destination IP address; The setting module is used to set the security authentication policy of the data policy chain to be authenticated according to the data transmission risk level coefficient. The authentication module is used to perform security authentication on the data policy chain to be authenticated according to the security authentication policy. If the authentication is successful, the data to be transmitted is transmitted to the destination IP address. If the authentication fails, an alarm is generated.

[0010] In one embodiment, the computing module is specifically used for: The calculation module is used to obtain the historical network attack behavior and historical network defense behavior of the IP address; The calculation module is used to map the historical network attack behaviors and historical network defense behaviors of the IP address one by one, and generate a first risk set; The calculation module is used to obtain the historical network attack behavior and historical network defense behavior of the destination IP address; The calculation module is used to map the historical network attack behavior and historical network defense behavior of the target IP address one by one, and generate a second risk set; The calculation module is used to analyze the historical network defense behavior in the first risk set and determine the number of successful defenses in the first risk set. The calculation module is used to analyze the historical network defense behavior in the second risk set and determine the number of successful defenses in the second risk set; The calculation module is used to calculate the data transmission risk level coefficient based on the first risk set, the second risk set, the number of successful defenses in the first risk set, and the number of successful defenses in the second risk set.

[0011] In one embodiment, the setting module is specifically used for: The setting module is used to set the key authentication count and key authentication bit length of the data to be authenticated policy chain according to the data transmission risk level coefficient A; The setting module is used to set the key authentication count and the key authentication bit length as the security authentication strategy of the data strategy chain to be authenticated.

[0012] In one embodiment, the setting module is specifically used for: The setting module is used to preset the data transmission risk level coefficient matrix B of the data policy chain to be authenticated, setting B (B1, B2, B3, B4), where B1 is the first preset data transmission risk level, B2 is the second preset data transmission risk level, B3 is the third preset data transmission risk level, B4 is the fourth preset data transmission risk level, and B1 < B2 < B3 < B4. The setting module is used to preset the key authentication count matrix C of the data strategy chain to be authenticated, and set C (C1, C2, C3, C4, C5), where C1 is the first preset key authentication count, C2 is the second preset key authentication count, C3 is the third preset key authentication count, C4 is the fourth preset key authentication count, C5 is the fifth preset key authentication count, and C1 < C2 < C3 < C4 < C5; The setting module is used to preset the key authentication bit matrix D of the data policy chain to be authenticated, setting D (D1, D2, D3, D4, D5), where D1 is the first preset key authentication bit, D2 is the second preset key authentication bit, D3 is the third preset key authentication bit, D4 is the fourth preset key authentication bit, D5 is the fifth preset key authentication bit, and D1 < D2 < D3 < D4 < D5. The setting module is used to set the key authentication count and key authentication bit length of the data policy chain to be authenticated based on the relationship between the data transmission risk level A of the data policy chain to be authenticated and each preset data transmission risk level: When A < B1, the first preset key authentication count C1 is selected as the key authentication count of the data policy chain to be authenticated, and the first preset key authentication bit count D1 is selected as the key authentication bit count of the data policy chain to be authenticated. When B1≤A<B2, the second preset key authentication count C2 is selected as the key authentication count of the data strategy chain to be authenticated, and the second preset key authentication bit count D2 is selected as the key authentication bit count of the data strategy chain to be authenticated. When B2≤A<B3, the third preset key authentication count C3 is selected as the key authentication count of the data strategy chain to be authenticated, and the third preset key authentication bit count D3 is selected as the key authentication bit count of the data strategy chain to be authenticated. When B3≤A<B4, the fourth preset key authentication count C4 is selected as the key authentication count of the data strategy chain to be authenticated, and the fourth preset key authentication bit count D4 is selected as the key authentication bit count of the data strategy chain to be authenticated. When B4≤A, the fifth preset key authentication count C5 is selected as the key authentication count of the data policy chain to be authenticated, and the fifth preset key authentication bit count D5 is selected as the key authentication bit count of the data policy chain to be authenticated.

[0013] This invention provides a secure access policy chain authentication method and system, which has the following advantages compared to the prior art: This invention discloses a secure access policy chain authentication method and system. The method involves acquiring a data policy chain to be authenticated, parsing the chain to determine the IP address, destination IP address, and data to be transmitted. Based on the IP address and destination IP address, a data transmission risk level coefficient is calculated for the data policy chain. A security authentication policy is then set based on this coefficient. Finally, the data policy chain is authenticated according to the security authentication policy. If authentication is successful, the data to be transmitted is transmitted to the destination IP address; if authentication fails, an alarm is generated. This invention solves the technical problem of the inability to securely authenticate data policy chains for network access, ensuring the accuracy and security of data policy chain authentication. Furthermore, the randomness of the authentication process contributes to its high efficiency. Attached Figure Description

[0014] Figure 1 A flowchart illustrating a secure access policy chain authentication method according to an embodiment of the present invention is shown. Figure 2 A schematic diagram of a secure access policy chain authentication system according to an embodiment of the present invention is shown. Detailed Implementation

[0015] The specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples. The following examples are for illustrative purposes only and are not intended to limit the scope of the invention.

[0016] In the description of this application, it should be understood that the terms "center", "upper", "lower", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this application.

[0017] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0018] In the description of this application, it should be noted that, unless otherwise expressly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection between two components. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0019] The following is a description of preferred embodiments of the present invention in conjunction with the accompanying drawings.

[0020] like Figure 1 As shown, an embodiment of the present invention discloses a secure access policy chain authentication method, the method comprising: S110: Obtain the data policy chain to be authenticated, and parse the data policy chain to be authenticated to determine the IP address, destination IP address and data to be transmitted carried by the data policy chain to be authenticated; In this embodiment, during data transmission, the data to be transmitted, the IP address, and the destination IP address are encapsulated to generate a data policy chain to be authenticated.

[0021] S120: Calculate the data transmission risk level coefficient of the data policy chain to be authenticated based on the IP address and the destination IP address; In some embodiments of this application, calculating the data transmission risk level coefficient of the data policy chain to be authenticated based on the IP address and the destination IP address includes: Obtain the historical network attack and defense behaviors of the IP address; The historical network attack behaviors and historical network defense behaviors of the IP addresses are matched one-to-one, and a first risk set is generated; Obtain the historical network attack and defense behaviors of the target IP address; The historical network attack behavior and historical network defense behavior of the target IP address are matched one-to-one, and a second risk set is generated; Analyze the historical network defense behaviors in the first risk set to determine the number of successful defenses in the first risk set; Analyze the historical network defense behaviors in the second risk set to determine the number of successful defenses in the second risk set; The data transmission risk level coefficient is calculated based on the first risk set, the second risk set, the number of successful defenses in the first risk set, and the number of successful defenses in the second risk set.

[0022] In this embodiment, each historical network attack behavior corresponds to a historical network defense behavior, which can be either successful or unsuccessful.

[0023] The beneficial effects of the above technical solution are: by calculating the data transmission risk level coefficient based on the first risk set, the second risk set, the number of successful defenses in the first risk set and the number of successful defenses in the second risk set, the present invention can provide reliable data support for the security authentication of the data policy chain to be authenticated, and ensure the authentication security of the data policy chain to be authenticated.

[0024] S130: Set the security authentication policy for the data policy chain to be authenticated according to the data transmission risk level coefficient; In some embodiments of this application, when setting the security authentication policy of the data policy chain to be authenticated based on the data transmission risk level coefficient, the following is included: The key authentication count and key authentication bit length of the data to be authenticated policy chain are set according to the data transmission risk level coefficient A; The key authentication count and the key authentication bit length are used as the security authentication strategy for the data strategy chain to be authenticated.

[0025] Specifically, when setting the key authentication count and key authentication bit length of the data to be authenticated policy chain according to the data transmission risk level coefficient A, the following is included: A data transmission risk level coefficient matrix B is preset for the data strategy chain to be authenticated, and B(B1, B2, B3, B4) is set, where B1 is the first preset data transmission risk level, B2 is the second preset data transmission risk level, B3 is the third preset data transmission risk level, and B4 is the fourth preset data transmission risk level, and B1 < B2 < B3 < B4. A key authentication count matrix C is preset for the data strategy chain to be authenticated, and C is set as (C1, C2, C3, C4, C5), where C1 is the first preset key authentication count, C2 is the second preset key authentication count, C3 is the third preset key authentication count, C4 is the fourth preset key authentication count, and C5 is the fifth preset key authentication count, and C1 < C2 < C3 < C4 < C5; A key authentication bit length matrix D is preset for the data strategy chain to be authenticated, and D is set as (D1, D2, D3, D4, D5), where D1 is the first preset key authentication bit length, D2 is the second preset key authentication bit length, D3 is the third preset key authentication bit length, D4 is the fourth preset key authentication bit length, and D5 is the fifth preset key authentication bit length, and D1 < D2 < D3 < D4 < D5. Based on the relationship between the data transmission risk level A of the data policy chain to be authenticated and each preset data transmission risk level, the key authentication count and key authentication bit length of the data policy chain to be authenticated are set: When A < B1, the first preset key authentication count C1 is selected as the key authentication count of the data policy chain to be authenticated, and the first preset key authentication bit count D1 is selected as the key authentication bit count of the data policy chain to be authenticated. When B1≤A<B2, the second preset key authentication count C2 is selected as the key authentication count of the data strategy chain to be authenticated, and the second preset key authentication bit count D2 is selected as the key authentication bit count of the data strategy chain to be authenticated. When B2≤A<B3, the third preset key authentication count C3 is selected as the key authentication count of the data strategy chain to be authenticated, and the third preset key authentication bit count D3 is selected as the key authentication bit count of the data strategy chain to be authenticated. When B3≤A<B4, the fourth preset key authentication count C4 is selected as the key authentication count of the data strategy chain to be authenticated, and the fourth preset key authentication bit count D4 is selected as the key authentication bit count of the data strategy chain to be authenticated. When B4≤A, the fifth preset key authentication count C5 is selected as the key authentication count of the data policy chain to be authenticated, and the fifth preset key authentication bit count D5 is selected as the key authentication bit count of the data policy chain to be authenticated.

[0026] In this embodiment, the number of key authentication times refers to how many key authentications are required when a data policy chain to be authenticated is received, such as 2 times, 3 times, or 4 times.

[0027] In this embodiment, the key authentication bit length refers to the number of bits in the key. For example, if the key is 4586, then the key authentication bit length is four bits.

[0028] In this embodiment, the key is randomly generated. The specific generation method is lengthy and well-established, so it will not be described in detail here.

[0029] The beneficial effects of the above technical solution are as follows: Based on the relationship between the data transmission risk level A of the authentication data policy chain and each preset data transmission risk level, the number of key authentication attempts and the number of key authentication bits for the data policy chain to be authenticated are set. By setting the number of key authentication attempts and the number of key authentication bits for the data policy chain to be authenticated, the present invention can ensure the security of the data policy chain to be authenticated, thereby ensuring the security of the data to be transmitted and preventing leakage. Furthermore, by dynamically generating the number of key authentication attempts and the number of key authentication bits, the present invention ensures that the data policy chain to be authenticated has authentication randomness, thus achieving high security authentication efficiency.

[0030] S140: Perform security authentication on the data policy chain to be authenticated according to the security authentication policy. If the authentication is successful, transmit the data to be transmitted to the destination IP address. If the authentication fails, generate an alarm reminder.

[0031] To further illustrate the technical concept of this invention, the technical solution of this invention will now be described in conjunction with specific application scenarios.

[0032] Correspondingly, such as Figure 2 As shown, this application also provides a secure access policy chain authentication system, the system comprising: The determination module is used to obtain the data policy chain to be authenticated, and to parse the data policy chain to be authenticated to determine the IP address, destination IP address and data to be transmitted carried by the data policy chain to be authenticated. The calculation module is used to calculate the data transmission risk level coefficient of the data policy chain to be authenticated based on the IP address and the destination IP address; The setting module is used to set the security authentication policy of the data policy chain to be authenticated according to the data transmission risk level coefficient. The authentication module is used to perform security authentication on the data policy chain to be authenticated according to the security authentication policy. If the authentication is successful, the data to be transmitted is transmitted to the destination IP address. If the authentication fails, an alarm is generated.

[0033] In some embodiments of this application, the computing module is specifically used for: The calculation module is used to obtain the historical network attack behavior and historical network defense behavior of the IP address; The calculation module is used to map the historical network attack behaviors and historical network defense behaviors of the IP address one by one, and generate a first risk set; The calculation module is used to obtain the historical network attack behavior and historical network defense behavior of the destination IP address; The calculation module is used to map the historical network attack behavior and historical network defense behavior of the target IP address one by one, and generate a second risk set; The calculation module is used to analyze the historical network defense behavior in the first risk set and determine the number of successful defenses in the first risk set. The calculation module is used to analyze the historical network defense behavior in the second risk set and determine the number of successful defenses in the second risk set; The calculation module is used to calculate the data transmission risk level coefficient based on the first risk set, the second risk set, the number of successful defenses in the first risk set, and the number of successful defenses in the second risk set.

[0034] In some embodiments of this application, the setting module is specifically used for: The setting module is used to set the key authentication count and key authentication bit length of the data to be authenticated policy chain according to the data transmission risk level coefficient A; The setting module is used to set the key authentication count and the key authentication bit length as the security authentication strategy of the data strategy chain to be authenticated.

[0035] In some embodiments of this application, the setting module is specifically used for: The setting module is used to preset the data transmission risk level coefficient matrix B of the data policy chain to be authenticated, setting B (B1, B2, B3, B4), where B1 is the first preset data transmission risk level, B2 is the second preset data transmission risk level, B3 is the third preset data transmission risk level, B4 is the fourth preset data transmission risk level, and B1 < B2 < B3 < B4. The setting module is used to preset the key authentication count matrix C of the data strategy chain to be authenticated, and set C (C1, C2, C3, C4, C5), where C1 is the first preset key authentication count, C2 is the second preset key authentication count, C3 is the third preset key authentication count, C4 is the fourth preset key authentication count, C5 is the fifth preset key authentication count, and C1 < C2 < C3 < C4 < C5; The setting module is used to preset the key authentication bit matrix D of the data policy chain to be authenticated, setting D (D1, D2, D3, D4, D5), where D1 is the first preset key authentication bit, D2 is the second preset key authentication bit, D3 is the third preset key authentication bit, D4 is the fourth preset key authentication bit, D5 is the fifth preset key authentication bit, and D1 < D2 < D3 < D4 < D5. The setting module is used to set the key authentication count and key authentication bit length of the data policy chain to be authenticated based on the relationship between the data transmission risk level A of the data policy chain to be authenticated and each preset data transmission risk level: When A < B1, the first preset key authentication count C1 is selected as the key authentication count of the data policy chain to be authenticated, and the first preset key authentication bit count D1 is selected as the key authentication bit count of the data policy chain to be authenticated. When B1≤A<B2, the second preset key authentication count C2 is selected as the key authentication count of the data strategy chain to be authenticated, and the second preset key authentication bit count D2 is selected as the key authentication bit count of the data strategy chain to be authenticated. When B2≤A<B3, the third preset key authentication count C3 is selected as the key authentication count of the data strategy chain to be authenticated, and the third preset key authentication bit count D3 is selected as the key authentication bit count of the data strategy chain to be authenticated. When B3≤A<B4, the fourth preset key authentication count C4 is selected as the key authentication count of the data strategy chain to be authenticated, and the fourth preset key authentication bit count D4 is selected as the key authentication bit count of the data strategy chain to be authenticated. When B4≤A, the fifth preset key authentication count C5 is selected as the key authentication count of the data policy chain to be authenticated, and the fifth preset key authentication bit count D5 is selected as the key authentication bit count of the data policy chain to be authenticated.

[0036] In the description of the above embodiments, specific features, structures, materials, or characteristics may be combined in any suitable manner in one or more embodiments or examples.

[0037] Although the invention has been described above with reference to embodiments, various modifications can be made and components can be replaced with equivalents without departing from the scope of the invention. In particular, features in the embodiments disclosed herein can be combined with each other in any manner, provided there is no structural conflict. The omission of all such combinations in this specification is merely for brevity and resource conservation. Therefore, the invention is not limited to the specific embodiments disclosed herein, but includes all technical solutions falling within the scope of the claims.

[0038] It will be understood by those skilled in the art that the above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A secure access policy chain authentication method, characterized in that, The method includes: Obtain the data policy chain to be authenticated, and parse the data policy chain to determine the IP address, destination IP address and data to be transmitted carried by the data policy chain to be authenticated. Calculate the data transmission risk level coefficient of the data policy chain to be authenticated based on the IP address and the destination IP address; The security authentication strategy for the data policy chain to be authenticated is set according to the data transmission risk level coefficient. The security authentication policy chain to be authenticated is performed according to the security authentication policy. If the authentication is successful, the data to be transmitted is transmitted to the destination IP address. If the authentication fails, an alarm is generated. When setting the security authentication policy for the data policy chain to be authenticated based on the data transmission risk level coefficient, the following are included: The key authentication count and key authentication bit length of the data to be authenticated policy chain are set according to the data transmission risk level coefficient A; The key authentication count and the key authentication bit length are used as the security authentication strategy for the data strategy chain to be authenticated. When setting the key authentication count and key authentication bit length of the data policy chain to be authenticated according to the data transmission risk level coefficient A, the following is included: A data transmission risk level coefficient matrix B is preset for the data strategy chain to be authenticated, and B(B1, B2, B3, B4) is set, where B1 is the first preset data transmission risk level, B2 is the second preset data transmission risk level, B3 is the third preset data transmission risk level, and B4 is the fourth preset data transmission risk level, and B1 < B2 < B3 < B4. A key authentication count matrix C is preset for the data strategy chain to be authenticated, and C is set as (C1, C2, C3, C4, C5), where C1 is the first preset key authentication count, C2 is the second preset key authentication count, C3 is the third preset key authentication count, C4 is the fourth preset key authentication count, and C5 is the fifth preset key authentication count, and C1 < C2 < C3 < C4 < C5; A key authentication bit length matrix D is preset for the data strategy chain to be authenticated, and D is set as (D1, D2, D3, D4, D5), where D1 is the first preset key authentication bit length, D2 is the second preset key authentication bit length, D3 is the third preset key authentication bit length, D4 is the fourth preset key authentication bit length, and D5 is the fifth preset key authentication bit length, and D1 < D2 < D3 < D4 < D5. Based on the relationship between the data transmission risk level A of the data policy chain to be authenticated and each preset data transmission risk level, the key authentication count and key authentication bit length of the data policy chain to be authenticated are set: When A < B1, the first preset key authentication count C1 is selected as the key authentication count of the data policy chain to be authenticated, and the first preset key authentication bit count D1 is selected as the key authentication bit count of the data policy chain to be authenticated. When B1≤A<B2, the second preset key authentication count C2 is selected as the key authentication count of the data strategy chain to be authenticated, and the second preset key authentication bit count D2 is selected as the key authentication bit count of the data strategy chain to be authenticated. When B2≤A<B3, the third preset key authentication count C3 is selected as the key authentication count of the data strategy chain to be authenticated, and the third preset key authentication bit count D3 is selected as the key authentication bit count of the data strategy chain to be authenticated. When B3≤A<B4, the fourth preset key authentication count C4 is selected as the key authentication count of the data strategy chain to be authenticated, and the fourth preset key authentication bit count D4 is selected as the key authentication bit count of the data strategy chain to be authenticated. When B4≤A, the fifth preset key authentication count C5 is selected as the key authentication count of the data policy chain to be authenticated, and the fifth preset key authentication bit count D5 is selected as the key authentication bit count of the data policy chain to be authenticated.

2. The secure access policy chain authentication method according to claim 1, characterized in that, When calculating the data transmission risk level coefficient of the data policy chain to be authenticated based on the IP address and the destination IP address, the following steps are included: Obtain the historical network attack and defense behaviors of the IP address; The historical network attack behaviors and historical network defense behaviors of the IP addresses are matched one-to-one, and a first risk set is generated; Obtain the historical network attack and defense behaviors of the target IP address; The historical network attack behavior and historical network defense behavior of the target IP address are matched one-to-one, and a second risk set is generated; Analyze the historical network defense behaviors in the first risk set to determine the number of successful defenses in the first risk set; Analyze the historical network defense behaviors in the second risk set to determine the number of successful defenses in the second risk set; The data transmission risk level coefficient is calculated based on the first risk set, the second risk set, the number of successful defenses in the first risk set, and the number of successful defenses in the second risk set.

3. A secure access policy chain authentication system, characterized in that, The system includes: The determination module is used to obtain the data policy chain to be authenticated, and to parse the data policy chain to be authenticated to determine the IP address, destination IP address and data to be transmitted carried by the data policy chain to be authenticated. The calculation module is used to calculate the data transmission risk level coefficient of the data policy chain to be authenticated based on the IP address and the destination IP address; The setting module is used to set the security authentication policy of the data policy chain to be authenticated according to the data transmission risk level coefficient. The authentication module is used to perform security authentication on the data policy chain to be authenticated according to the security authentication policy. If the authentication is successful, the data to be transmitted is transmitted to the destination IP address. If the authentication fails, an alarm reminder is generated. The setting module is used to set the key authentication count and key authentication bit length of the data to be authenticated policy chain according to the data transmission risk level coefficient A; The setting module is used to use the key authentication count and the key authentication bit length as the security authentication strategy of the data strategy chain to be authenticated. The setting module is used to preset the data transmission risk level coefficient matrix B of the data policy chain to be authenticated, setting B (B1, B2, B3, B4), where B1 is the first preset data transmission risk level, B2 is the second preset data transmission risk level, B3 is the third preset data transmission risk level, B4 is the fourth preset data transmission risk level, and B1 < B2 < B3 < B4. The setting module is used to preset the key authentication count matrix C of the data strategy chain to be authenticated, and set C (C1, C2, C3, C4, C5), where C1 is the first preset key authentication count, C2 is the second preset key authentication count, C3 is the third preset key authentication count, C4 is the fourth preset key authentication count, C5 is the fifth preset key authentication count, and C1 < C2 < C3 < C4 < C5; The setting module is used to preset the key authentication bit matrix D of the data policy chain to be authenticated, setting D (D1, D2, D3, D4, D5), where D1 is the first preset key authentication bit, D2 is the second preset key authentication bit, D3 is the third preset key authentication bit, D4 is the fourth preset key authentication bit, D5 is the fifth preset key authentication bit, and D1 < D2 < D3 < D4 < D5. The setting module is used to set the key authentication count and key authentication bit length of the data policy chain to be authenticated based on the relationship between the data transmission risk level A of the data policy chain to be authenticated and each preset data transmission risk level: When A < B1, the first preset key authentication count C1 is selected as the key authentication count of the data policy chain to be authenticated, and the first preset key authentication bit count D1 is selected as the key authentication bit count of the data policy chain to be authenticated. When B1≤A<B2, the second preset key authentication count C2 is selected as the key authentication count of the data strategy chain to be authenticated, and the second preset key authentication bit count D2 is selected as the key authentication bit count of the data strategy chain to be authenticated. When B2≤A<B3, the third preset key authentication count C3 is selected as the key authentication count of the data strategy chain to be authenticated, and the third preset key authentication bit count D3 is selected as the key authentication bit count of the data strategy chain to be authenticated. When B3≤A<B4, the fourth preset key authentication count C4 is selected as the key authentication count of the data strategy chain to be authenticated, and the fourth preset key authentication bit count D4 is selected as the key authentication bit count of the data strategy chain to be authenticated. When B4≤A, the fifth preset key authentication count C5 is selected as the key authentication count of the data policy chain to be authenticated, and the fifth preset key authentication bit count D5 is selected as the key authentication bit count of the data policy chain to be authenticated.

4. The secure access policy chain authentication system according to claim 3, characterized in that, The calculation module is specifically used for: The calculation module is used to obtain the historical network attack behavior and historical network defense behavior of the IP address; The calculation module is used to map the historical network attack behaviors and historical network defense behaviors of the IP address one by one, and generate a first risk set; The calculation module is used to obtain the historical network attack behavior and historical network defense behavior of the destination IP address; The calculation module is used to map the historical network attack behavior and historical network defense behavior of the target IP address one by one, and generate a second risk set; The calculation module is used to analyze the historical network defense behavior in the first risk set and determine the number of successful defenses in the first risk set. The calculation module is used to analyze the historical network defense behavior in the second risk set and determine the number of successful defenses in the second risk set; The calculation module is used to calculate the data transmission risk level coefficient based on the first risk set, the second risk set, the number of successful defenses in the first risk set, and the number of successful defenses in the second risk set.

Images