A cloud server access control method and device

Abstract

This invention provides a cloud server access control method and apparatus, relating to the field of information security technology, and applicable to the financial sector or other technical fields. The method includes: acquiring each current behavior authentication information item of a user, determining the authentication priority of each current behavior authentication information item; performing behavior authentication on each current behavior authentication information item according to its corresponding historical behavior authentication information item and in accordance with the authentication priority; if all behavior authentications are successful, determining the user's access result to the cloud server based on a comparison between the current total behavior authentication information corresponding to each current behavior authentication information item and the predicted total behavior authentication information corresponding to each historical behavior authentication information item. The apparatus executes the above method. The method and apparatus provided by this invention can ensure the security of cloud server access authentication.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to a cloud server access control method and apparatus. Background Technology

[0002] Currently, in the field of cloud computing, improving end-user authentication is one of the most important research topics. To ensure the security of identity authentication mechanisms, key technology and biometric authentication methods are commonly used to enhance the security of cloud services.

[0003] Existing identity authentication technologies only authenticate people, verifying only the user's identity. Once an intruder enters the system as a legitimate user, the existing identity authentication mechanism lacks corresponding countermeasures and cannot guarantee system security. Summary of the Invention

[0004] To address the problems in the prior art, embodiments of the present invention provide a cloud server access control method and apparatus, which can at least partially solve the problems existing in the prior art.

[0005] On one hand, this invention proposes a cloud server access control method, comprising:

[0006] Obtain the authentication information items of each current behavior of the user, and determine the authentication priority of each current behavior authentication information item;

[0007] Based on the historical behavior authentication information items corresponding to each current behavior authentication information item, and in accordance with the authentication priority, behavior authentication is performed on each current behavior authentication information item in turn;

[0008] If all behavior authentications are successful, the user's access result to the cloud server is determined based on the comparison between the current total behavior authentication information corresponding to each current behavior authentication information item and the predicted total behavior authentication information corresponding to each historical behavior authentication information item.

[0009] Each current behavior authentication information item includes current behavior status authentication information, current behavior content authentication information, current behavior habit authentication information, current behavior security authentication information, and current behavior contract authentication information; correspondingly, determining the authentication priority of each current behavior authentication information item includes:

[0010] The authentication priority is determined in the following order:

[0011] The current behavior security authentication information, the current behavior contract authentication information, the current behavior content authentication information, the current behavior status authentication information, and the current behavior habit authentication information.

[0012] The step of performing behavior authentication on each current behavior authentication information item according to its corresponding historical behavior authentication information item and in accordance with the authentication priority includes:

[0013] Starting with the current behavior security authentication information, the current behavior security authentication information item is compared with the historical behavior security authentication information item for behavior authentication, and the next current behavior authentication information item and the next historical behavior authentication information item are traversed in sequence according to the authentication priority until all comparison behavior authentications are completed.

[0014] The cloud server access control method further includes:

[0015] During the process of sequentially traversing the next current behavior authentication information item and the next historical behavior authentication information item according to the authentication priority, if it is determined that the comparison behavior authentication between the currently traversed current behavior authentication information item and the historical behavior authentication information item has failed, then the user's access result to the cloud server is directly determined to be the first access result that does not allow the user to access the cloud server.

[0016] The step of determining the user's access result to the cloud server based on the comparison results between the current total behavior authentication information corresponding to each current behavior authentication information item and the predicted total behavior authentication information corresponding to each historical behavior authentication information item includes:

[0017] If the comparison result is determined to be a first comparison result where the difference is greater than or equal to a preset comparison threshold, then the user's access result to the cloud server is determined to be a first access result where the user is not allowed to access the cloud server.

[0018] The step of determining the user's access result to the cloud server based on the comparison results between the current total behavior authentication information corresponding to each current behavior authentication information item and the predicted total behavior authentication information corresponding to each historical behavior authentication information item includes:

[0019] If the comparison result is determined to be a second comparison result with a difference less than the preset comparison threshold, then the user's access result to the cloud server is determined to be a second access result that allows the user to access the cloud server.

[0020] The cloud server access control method further includes:

[0021] During the process of sequentially traversing the next current behavior authentication information item and the next historical behavior authentication information item according to the authentication priority, if it is determined that a preset number of behavior authentication information items have been reached, the user's access result to the cloud server is determined based on the comparison result between the current target total behavior authentication information corresponding to each current target behavior authentication information item equal to the preset number and the predicted target total behavior authentication information corresponding to each historical target behavior authentication information item.

[0022] On one hand, the present invention proposes a cloud server access control device, comprising:

[0023] The acquisition unit is used to acquire the authentication information items of each current behavior of the user and determine the authentication priority of each current behavior authentication information item.

[0024] The authentication unit is used to perform behavior authentication on each current behavior authentication information item according to the historical behavior authentication information items corresponding to each current behavior authentication information item, and in accordance with the authentication priority.

[0025] The determining unit is used to determine the user's access result to the cloud server based on the comparison result between the current total behavior authentication information corresponding to each current behavior authentication information item and the predicted total behavior authentication information corresponding to each historical behavior authentication information item if all behavior authentications are determined to be successful.

[0026] In another aspect, embodiments of the present invention provide an electronic device, including: a processor, a memory, and a bus, wherein,

[0027] The processor and the memory communicate with each other via the bus;

[0028] The memory stores program instructions that can be executed by the processor, and the processor can execute the following methods by calling the program instructions:

[0029] Obtain the authentication information items of each current behavior of the user, and determine the authentication priority of each current behavior authentication information item;

[0030] Based on the historical behavior authentication information items corresponding to each current behavior authentication information item, and in accordance with the authentication priority, behavior authentication is performed on each current behavior authentication information item in turn;

[0031] If all behavior authentications are successful, the user's access result to the cloud server is determined based on the comparison between the current total behavior authentication information corresponding to each current behavior authentication information item and the predicted total behavior authentication information corresponding to each historical behavior authentication information item.

[0032] This invention provides a non-transitory computer-readable storage medium, comprising:

[0033] The non-transitory computer-readable storage medium stores computer instructions that cause the computer to perform the following methods:

[0034] Obtain the authentication information items of each current behavior of the user, and determine the authentication priority of each current behavior authentication information item;

[0035] Based on the historical behavior authentication information items corresponding to each current behavior authentication information item, and in accordance with the authentication priority, behavior authentication is performed on each current behavior authentication information item in turn;

[0036] If all behavior authentications are successful, the user's access result to the cloud server is determined based on the comparison between the current total behavior authentication information corresponding to each current behavior authentication information item and the predicted total behavior authentication information corresponding to each historical behavior authentication information item.

[0037] The cloud server access control method and apparatus provided in this invention obtains each current behavior authentication information item of a user and determines the authentication priority of each current behavior authentication information item; based on each historical behavior authentication information item corresponding to each current behavior authentication information item, and sequentially performs behavior authentication on each current behavior authentication information item according to the authentication priority; if all behavior authentications are determined to be successful, the user's access result to the cloud server is determined based on the comparison result between the current total behavior authentication information corresponding to each current behavior authentication information item and the predicted total behavior authentication information corresponding to each historical behavior authentication information item. By performing behavior authentication step by step according to the authentication priority and comparing current information with historical information, the security of cloud server access authentication can be guaranteed. Attached Figure Description

[0038] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings:

[0039] Figure 1 This is a flowchart illustrating a cloud server access control method provided in an embodiment of the present invention.

[0040] Figure 2 This is a schematic diagram of the structure of a cloud server access control device provided in an embodiment of the present invention.

[0041] Figure 3 This is a schematic diagram of the physical structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0042] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. Here, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention. It should be noted that, unless otherwise specified, the embodiments and features in the embodiments of this application can be arbitrarily combined with each other.

[0043] Figure 1 This is a flowchart illustrating a cloud server access control method according to an embodiment of the present invention, as shown below. Figure 1 As shown, the cloud server access control method provided in this embodiment of the invention includes:

[0044] Step S1: Obtain the authentication information items of each current behavior of the user and determine the authentication priority of each current behavior authentication information item.

[0045] Step S2: Based on the historical behavior authentication information items corresponding to each current behavior authentication information item, and in accordance with the authentication priority, perform behavior authentication on each current behavior authentication information item in turn.

[0046] Step S3: If all behavior authentications are successful, the user's access result to the cloud server is determined based on the comparison between the current total behavior authentication information corresponding to each current behavior authentication information item and the predicted total behavior authentication information corresponding to each historical behavior authentication information item.

[0047] In step S1 above, the device acquires each current behavior authentication information item of the user and determines the authentication priority of each current behavior authentication information item. The device may be a computer device or the like that executing the method. It should be noted that the information collected in the embodiments of the present invention is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with the relevant laws, regulations, and standards of the relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0048] Provide users with corresponding operation entry points, allowing them to choose to agree to or reject the automated decision results; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0049] A listener can monitor user U1's access to cloud server P1 and store the behavioral evidence in the listener. The listener, user U1, and cloud server P1 can be located in cloud domain C1 to achieve user behavior authentication within cloud domain C1. Cloud server P2 can be located in cloud domain C2, and the listener can achieve cross-cloud domain user behavior authentication by monitoring user U1's access to cloud server P2.

[0050] The listener calculates each current behavior authentication information item based on behavioral evidence, specifically including current behavior status authentication information, current behavior content authentication information, current behavior habit authentication information, current behavior security authentication information, and current behavior contract authentication information.

[0051] Current behavior status authentication information refers to the user's status behavior when accessing the system, such as the user's online time and location, IP address, MAC address, operating system version, etc. The cloud server number can be determined based on the IP address and MAC address, such as cloud server P1 and cloud server P2.

[0052] Current behavior content authentication information refers to the content behavior of users accessing the system. Different users have different needs, such as accessing the price range of items in e-commerce.

[0053] Current behavioral habit authentication information refers to a user's habitual behavior when accessing the system, mainly including operating habits and access habits. The order of operations differs among different users. Examples include operation sequences, resource release operations, and user input characteristics.

[0054] Current behavior security authentication information refers to abnormal behavior by the user that is destructive, such as repeatedly changing their password.

[0055] Current behavior contract authentication information refers to the contract signed between the service provider and the user before providing the service, such as the content, time, prohibited behaviors, and fee standards of the service.

[0056] Determining the authentication priority of each current behavior authentication information item includes:

[0057] The authentication priority is determined in the following order:

[0058] The current behavior security authentication information, the current behavior contract authentication information, the current behavior content authentication information, the current behavior status authentication information, and the current behavior habit authentication information.

[0059] In step S2 above, the device performs behavior authentication on each current behavior authentication information item according to its corresponding historical behavior authentication information item and the authentication priority. The content of each historical behavior security authentication information item can be the same as the content of each current behavior security authentication information item, as detailed above. The time limit of the historical behavior security authentication information item can be set independently according to the actual situation, and can be selected as the historical behavior status authentication information, historical behavior content authentication information, historical behavior habit authentication information, historical behavior security authentication information, and historical behavior contract authentication information of user U1 in the past month.

[0060] Obtain security authentication information for each historical behavior, including:

[0061] Based on the trained xgboost model, historical behavior evidence is calculated to obtain each historical behavior authentication information item. It can be understood that each historical behavior authentication information item is the historical behavior authentication information item for predicting user U1.

[0062] The step of performing behavior authentication on each current behavior authentication information item according to its corresponding historical behavior authentication information item and in accordance with the authentication priority includes:

[0063] Starting with the current behavior security authentication information, the current behavior security authentication information item is compared with the historical behavior security authentication information item for behavior authentication, and the next current behavior authentication information item and the next historical behavior authentication information item are traversed in sequence according to the authentication priority until all comparison behavior authentications are completed.

[0064] That is, the current behavior security authentication information, current behavior contract authentication information, current behavior content authentication information, current behavior status authentication information, and current behavior habit authentication information are authenticated one by one in the above order.

[0065] The cloud server access control method also includes:

[0066] During the process of sequentially traversing the next current behavior authentication information item and the next historical behavior authentication information item according to the aforementioned authentication priority, if it is determined that the authentication behavior between the currently traversed current behavior authentication information item and the historical behavior authentication information item has failed, then the user's access result to the cloud server is directly determined to be the first access result that disallows the user to access the cloud server. An example is given below:

[0067] The current behavior security authentication information is compared with the historical behavior security authentication information. If the information similarity between the current behavior security authentication information and the historical behavior security authentication information is within a preset similarity threshold, the behavior security authentication is considered to be passed. Then, the current behavior contract authentication information is compared with the historical behavior contract authentication information. If the information similarity between the current behavior contract authentication information and the historical behavior contract authentication information is within a preset similarity threshold, the behavior contract authentication is considered to be passed, and so on.

[0068] If the information similarity between the current behavior contract authentication information and the historical behavior contract authentication information is not within the preset similarity threshold, the behavior contract authentication is considered to have failed. The user's access result to the cloud server is directly determined to be the first access result that the user is not allowed to access the cloud server, and no further behavior authentication steps are required.

[0069] In step S3 above, if the device determines that all behavior authentications are successful, it determines the user's access result to the cloud server based on the comparison result between the current total behavior authentication information corresponding to each current behavior authentication information item and the predicted total behavior authentication information corresponding to each historical behavior authentication information item.

[0070] The current total behavior authentication information refers to the information calculated based on the weights corresponding to each current behavior authentication information item.

[0071] Predicted total behavioral authentication information refers to information calculated based on the weights corresponding to each historical behavioral authentication information item.

[0072] The step of determining the user's access result to the cloud server based on the comparison results between the current total behavior authentication information corresponding to each current behavior authentication information item and the predicted total behavior authentication information corresponding to each historical behavior authentication information item includes:

[0073] If the comparison result is determined to be a first comparison result where the difference is greater than or equal to a preset comparison threshold, then the user's access result to the cloud server is determined to be a first access result where the user is not allowed to access the cloud server.

[0074] The step of determining the user's access result to the cloud server based on the comparison results between the current total behavior authentication information corresponding to each current behavior authentication information item and the predicted total behavior authentication information corresponding to each historical behavior authentication information item includes:

[0075] If the comparison result is determined to be a second comparison result with a difference less than the preset comparison threshold, then the user's access result to the cloud server is determined to be a second access result allowing the user to access the cloud server. The preset comparison threshold can be set independently according to actual conditions and can be represented by a preset trust level.

[0076] The cloud server access control method also includes:

[0077] During the process of sequentially traversing the next current behavior authentication information item and the next historical behavior authentication information item according to the authentication priority, if a preset number of behavior authentication information items is determined, the user's access result to the cloud server is determined based on the comparison result between the current total target behavior authentication information corresponding to each current target behavior authentication information item equal to the preset number and the predicted total target behavior authentication information corresponding to each historical target behavior authentication information item. The preset number can be set independently according to the actual situation and can be selected as 3. Referring to the above description, when traversing to the behavior status authentication information, if the previous 3 authentication information items have all been authenticated successfully, then each current target behavior authentication information item can be determined as current behavior security authentication information, current behavior contract authentication information, and current behavior content authentication information, and each historical target behavior authentication information item can be determined as historical behavior security authentication information, historical behavior contract authentication information, and historical behavior content authentication information.

[0078] The current target total behavior authentication information refers to the information calculated based on the weights corresponding to each current target behavior authentication information item.

[0079] The predicted target total behavior authentication information refers to the information calculated based on the weights corresponding to each historical target behavior authentication information item.

[0080] To determine the results of a user's access to the cloud server, please refer to the above explanation; further details are omitted here.

[0081] The cloud server access control method provided in this invention utilizes a predictive model to compare predicted data with actual user behavior, addressing the current situation where legitimate users lack proper authentication when entering the cloud service environment, thus significantly improving cloud service security. Based on user behavior authentication, and predicting user behavior using the XGBoost model, a new authentication mechanism combining identity authentication and behavior authentication is proposed within the cloud service framework. This enhances the system's monitoring of untrusted user behavior, ensuring the dual trustworthiness of user identity and behavior.

[0082] The cloud server access control method provided in this invention obtains each current behavior authentication information item of a user and determines the authentication priority of each current behavior authentication information item; based on each historical behavior authentication information item corresponding to each current behavior authentication information item, and in accordance with the authentication priority, performs behavior authentication on each current behavior authentication information item in sequence; if all behavior authentications are determined to be successful, the user's access result to the cloud server is determined based on the comparison result between the current total behavior authentication information corresponding to each current behavior authentication information item and the predicted total behavior authentication information corresponding to each historical behavior authentication information item. By performing behavior authentication step by step according to authentication priority and comparing current information with historical information, the security of cloud server access authentication can be guaranteed.

[0083] Furthermore, each current behavior authentication information item includes current behavior status authentication information, current behavior content authentication information, current behavior habit authentication information, current behavior security authentication information, and current behavior contract authentication information; correspondingly, determining the authentication priority of each current behavior authentication information item includes:

[0084] The authentication priority is determined in the following order:

[0085] The current behavior security authentication information, the current behavior contract authentication information, the current behavior content authentication information, the current behavior status authentication information, and the current behavior habit authentication information are described in the above embodiments and will not be repeated here.

[0086] The cloud server access control method provided in this invention can accurately determine the authentication priority according to the importance of behavioral authentication.

[0087] Further, the step of performing behavior authentication on each current behavior authentication information item according to its corresponding historical behavior authentication information item and in accordance with the authentication priority includes:

[0088] Starting with the current behavior security authentication information, the current behavior security authentication information item is compared with the historical behavior security authentication information item for behavior authentication. Then, according to the authentication priority, the next current behavior authentication information item and the next historical behavior authentication information item are traversed sequentially until all comparison behavior authentications are completed. This can be referred to the above embodiment for explanation, and will not be repeated here.

[0089] The cloud server access control method provided in this embodiment of the invention can perform behavior authentication comparison in an orderly manner, ensuring that all comparison behavior authentications are completed.

[0090] Furthermore, the cloud server access control method also includes:

[0091] During the process of sequentially traversing the next current behavior authentication information item and the next historical behavior authentication information item according to the authentication priority, if it is determined that the authentication of the current behavior authentication information item and the historical behavior authentication information item fails, then the user's access result to the cloud server is directly determined to be the first access result that the user is not allowed to access the cloud server. This can be referred to the above embodiment for explanation, and will not be repeated here.

[0092] The cloud server access control method provided in this embodiment of the invention can improve the efficiency of cloud server access authentication.

[0093] Further, determining the user's access result to the cloud server based on the comparison results between the current total behavior authentication information corresponding to each current behavior authentication information item and the predicted total behavior authentication information corresponding to each historical behavior authentication information item includes:

[0094] If the comparison result is determined to be a first comparison result where the difference is greater than or equal to a preset comparison threshold, then the user's access result to the cloud server is determined to be a first access result that disallows the user from accessing the cloud server. This can be referred to the above embodiments for explanation, and will not be repeated here.

[0095] The cloud server access control method provided in this embodiment of the invention can improve the accuracy of access results.

[0096] Further, determining the user's access result to the cloud server based on the comparison results between the current total behavior authentication information corresponding to each current behavior authentication information item and the predicted total behavior authentication information corresponding to each historical behavior authentication information item includes:

[0097] If the comparison result is determined to be a second comparison result where the difference is less than the preset comparison threshold, then the user's access result to the cloud server is determined to be a second access result that allows the user to access the cloud server. This can be referred to the above embodiments for explanation, and will not be repeated here.

[0098] The cloud server access control method provided in this embodiment of the invention can improve the accuracy of access results.

[0099] Furthermore, the cloud server access control method also includes:

[0100] During the process of sequentially traversing the next current behavior authentication information item and the next historical behavior authentication information item according to the authentication priority, if it is determined that a preset number of behavior authentication information items have been reached, then the user's access result to the cloud server is determined based on the comparison result between the current target total behavior authentication information corresponding to each current target behavior authentication information item equal to the preset number and the predicted target total behavior authentication information corresponding to each historical target behavior authentication information item. This can be referred to the above embodiment for explanation, and will not be repeated here.

[0101] The cloud server access control method provided in this embodiment of the invention can further improve the security of cloud server access authentication while also taking into account the efficiency of cloud server access authentication.

[0102] It should be noted that the cloud server access control method provided in this embodiment of the invention can be used in the financial field, or in any technical field other than the financial field. This embodiment of the invention does not limit the application field of the cloud server access control method.

[0103] Figure 2This is a schematic diagram of the structure of a cloud server access control device provided in an embodiment of the present invention, as shown below. Figure 2 As shown, the cloud server access control device provided in this embodiment of the invention includes an acquisition unit 201, an authentication unit 202, and a determination unit 203, wherein:

[0104] The acquisition unit 201 is used to acquire each current behavior authentication information item of the user and determine the authentication priority of each current behavior authentication information item; the authentication unit 202 is used to perform behavior authentication on each current behavior authentication information item according to the historical behavior authentication information items corresponding to each current behavior authentication information item and in accordance with the authentication priority; the determination unit 203 is used to determine the user's access result to the cloud server based on the comparison result between the current total behavior authentication information corresponding to each current behavior authentication information item and the predicted total behavior authentication information corresponding to each historical behavior authentication information item if all behavior authentication is determined to be successful.

[0105] Specifically, the acquisition unit 201 in the device is used to acquire each current behavior authentication information item of the user and determine the authentication priority of each current behavior authentication information item; the authentication unit 202 is used to perform behavior authentication on each current behavior authentication information item according to the historical behavior authentication information items corresponding to each current behavior authentication information item and in accordance with the authentication priority; the determination unit 203 is used to determine the user's access result to the cloud server based on the comparison result between the current total behavior authentication information corresponding to each current behavior authentication information item and the predicted total behavior authentication information corresponding to each historical behavior authentication information item if all behavior authentications are determined to be successful.

[0106] The cloud server access control device provided in this embodiment of the invention obtains each current behavior authentication information item of the user and determines the authentication priority of each current behavior authentication information item; according to each historical behavior authentication information item corresponding to each current behavior authentication information item, and in accordance with the authentication priority, the device performs behavior authentication on each current behavior authentication information item in sequence; if all behavior authentications are determined to be successful, the device determines the user's access result to the cloud server based on the comparison result between the current total behavior authentication information corresponding to each current behavior authentication information item and the predicted total behavior authentication information corresponding to each historical behavior authentication information item. By performing behavior authentication step by step according to the authentication priority and comparing the current information with the historical information, the security of cloud server access authentication can be guaranteed.

[0107] Furthermore, each current behavior authentication information item includes current behavior status authentication information, current behavior content authentication information, current behavior habit authentication information, current behavior security authentication information, and current behavior contract authentication information; correspondingly, the acquisition unit 201 is specifically used for:

[0108] The authentication priority is determined in the following order:

[0109] The current behavior security authentication information, the current behavior contract authentication information, the current behavior content authentication information, the current behavior status authentication information, and the current behavior habit authentication information.

[0110] The cloud server access control device provided in this embodiment of the invention can accurately determine the authentication priority according to the importance of the behavior authentication.

[0111] Furthermore, the authentication unit 202 is specifically used for:

[0112] Starting with the current behavior security authentication information, the current behavior security authentication information item is compared with the historical behavior security authentication information item for behavior authentication, and the next current behavior authentication information item and the next historical behavior authentication information item are traversed in sequence according to the authentication priority until all comparison behavior authentications are completed.

[0113] The cloud server access control device provided in this embodiment of the invention can perform behavior authentication comparison in an orderly manner, ensuring that all comparison behavior authentications are completed.

[0114] Furthermore, the cloud server access control device is also used for:

[0115] During the process of sequentially traversing the next current behavior authentication information item and the next historical behavior authentication information item according to the authentication priority, if it is determined that the comparison behavior authentication between the currently traversed current behavior authentication information item and the historical behavior authentication information item has failed, then the user's access result to the cloud server is directly determined to be the first access result that does not allow the user to access the cloud server.

[0116] The cloud server access control device provided in this embodiment of the invention can improve the efficiency of cloud server access authentication.

[0117] Furthermore, the determining unit 203 is specifically used for:

[0118] If the comparison result is determined to be a first comparison result where the difference is greater than or equal to a preset comparison threshold, then the user's access result to the cloud server is determined to be a first access result where the user is not allowed to access the cloud server.

[0119] The cloud server access control device provided in this embodiment of the invention can improve the accuracy of access results.

[0120] Furthermore, the determining unit 203 is specifically used for:

[0121] If the comparison result is determined to be a second comparison result with a difference less than the preset comparison threshold, then the user's access result to the cloud server is determined to be a second access result that allows the user to access the cloud server.

[0122] The cloud server access control device provided in this embodiment of the invention can improve the accuracy of access results.

[0123] Furthermore, the cloud server access control device is also used for:

[0124] During the process of sequentially traversing the next current behavior authentication information item and the next historical behavior authentication information item according to the authentication priority, if it is determined that a preset number of behavior authentication information items have been reached, the user's access result to the cloud server is determined based on the comparison result between the current target total behavior authentication information corresponding to each current target behavior authentication information item equal to the preset number and the predicted target total behavior authentication information corresponding to each historical target behavior authentication information item.

[0125] The cloud server access control device provided in this embodiment of the invention can further improve the security of cloud server access authentication while also taking into account the efficiency of cloud server access authentication.

[0126] The embodiments of the cloud server access control device provided in this invention can be used to execute the processing flow of the above-described method embodiments. Its functions will not be repeated here, but can be referred to the detailed description of the above-described method embodiments.

[0127] Figure 3 This is a schematic diagram of the physical structure of an electronic device provided in an embodiment of the present invention, such as... Figure 3 As shown, the electronic device includes: a processor 301, a memory 302, and a bus 303;

[0128] The processor 301 and the memory 302 communicate with each other via the bus 303.

[0129] The processor 301 is used to call program instructions in the memory 302 to execute the methods provided in the above-described method embodiments, including, for example:

[0130] Obtain the authentication information items of each current behavior of the user, and determine the authentication priority of each current behavior authentication information item;

[0131] Based on the historical behavior authentication information items corresponding to each current behavior authentication information item, and in accordance with the authentication priority, behavior authentication is performed on each current behavior authentication information item in turn;

[0132] If all behavior authentications are successful, the user's access result to the cloud server is determined based on the comparison between the current total behavior authentication information corresponding to each current behavior authentication information item and the predicted total behavior authentication information corresponding to each historical behavior authentication information item.

[0133] This embodiment discloses a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions, and when the program instructions are executed by a computer, the computer can perform the methods provided in the above-described method embodiments, such as:

[0134] Obtain the authentication information items of each current behavior of the user, and determine the authentication priority of each current behavior authentication information item;

[0135] Based on the historical behavior authentication information items corresponding to each current behavior authentication information item, and in accordance with the authentication priority, behavior authentication is performed on each current behavior authentication information item in turn;

[0136] If all behavior authentications are successful, the user's access result to the cloud server is determined based on the comparison between the current total behavior authentication information corresponding to each current behavior authentication information item and the predicted total behavior authentication information corresponding to each historical behavior authentication information item.

[0137] This embodiment provides a computer-readable storage medium storing a computer program that causes the computer to execute the methods provided in the above-described method embodiments, including, for example:

[0138] Obtain the authentication information items of each current behavior of the user, and determine the authentication priority of each current behavior authentication information item;

[0139] Based on the historical behavior authentication information items corresponding to each current behavior authentication information item, and in accordance with the authentication priority, behavior authentication is performed on each current behavior authentication information item in turn;

[0140] If all behavior authentications are successful, the user's access result to the cloud server is determined based on the comparison between the current total behavior authentication information corresponding to each current behavior authentication information item and the predicted total behavior authentication information corresponding to each historical behavior authentication information item.

[0141] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0142] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0143] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0144] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0145] In the description of this specification, the references to terms such as "an embodiment," "a specific embodiment," "some embodiments," "for example," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0146] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A cloud server access control method, characterized by, include: The system obtains the user's current behavior authentication information items, which include current behavior status authentication information, current behavior content authentication information, current behavior habit authentication information, current behavior security authentication information, and current behavior contract authentication information. The authentication priority is determined in the following order: current behavior security authentication information, current behavior contract authentication information, current behavior content authentication information, current behavior status authentication information, and current behavior habit authentication information. Based on the trained xgboost model, historical behavior evidence is calculated to obtain each historical behavior authentication information item corresponding to each current behavior authentication information item; Based on the historical behavior authentication information items corresponding to each current behavior authentication information item, and in accordance with the authentication priority, each current behavior authentication information item is sequentially authenticated. If any behavior authentication fails, the user's access result to the cloud server is directly determined to be the first access result that is not allowed. If all behavior authentications are confirmed to be successful, the current total behavior authentication information is calculated based on the weights corresponding to each current behavior authentication information item, and the predicted total behavior authentication information is calculated based on the weights corresponding to each historical behavior authentication information item. Compare the difference between the current total behavior authentication information and the predicted total behavior authentication information. If the comparison result is determined to be a first comparison result where the difference is greater than or equal to a preset comparison threshold, then the user's access result to the cloud server is determined to be a first access result where the user is not allowed to access the cloud server. If the comparison result is determined to be a second comparison result with a difference less than the preset comparison threshold, then the user's access result to the cloud server is determined to be a second access result that allows the user to access the cloud server.

2. The cloud server access control method of claim 1, wherein, The step of performing behavior authentication on each current behavior authentication information item according to its corresponding historical behavior authentication information item and in accordance with the authentication priority includes: Starting with the current behavior security authentication information, the current behavior security authentication information item is compared with the historical behavior security authentication information item for behavior authentication, and the next current behavior authentication information item and the next historical behavior authentication information item are traversed in sequence according to the authentication priority until all comparison behavior authentications are completed.

3. The cloud server access control method of claim 2, wherein, The cloud server access control method also includes: During the process of sequentially traversing the next current behavior authentication information item and the next historical behavior authentication information item according to the authentication priority, if it is determined that the comparison behavior authentication between the currently traversed current behavior authentication information item and the historical behavior authentication information item has failed, then the user's access result to the cloud server is directly determined to be the first access result that does not allow the user to access the cloud server.

4. The cloud server access control method of claim 2, wherein, The cloud server access control method also includes: During the process of sequentially traversing the next current behavior authentication information item and the next historical behavior authentication information item according to the authentication priority, if it is determined that a preset number of behavior authentication information items have been reached, the user's access result to the cloud server is determined based on the comparison result between the current target total behavior authentication information corresponding to each current target behavior authentication information item equal to the preset number and the predicted target total behavior authentication information corresponding to each historical target behavior authentication information item.

5. A cloud server access control apparatus characterized by comprising: include: The acquisition unit is used to acquire each current behavior authentication information item of the user. Each current behavior authentication information item includes current behavior status authentication information, current behavior content authentication information, current behavior habit authentication information, current behavior security authentication information, and current behavior contract authentication information. The authentication priority is determined in the following order: the current behavior security authentication information, the current behavior contract authentication information, the current behavior content authentication information, the current behavior status authentication information, and the current behavior habit authentication information, and the authentication priority of each current behavior authentication information item is determined. The authentication unit is used to perform behavior authentication on each current behavior authentication information item according to the authentication priority, based on the historical behavior authentication information items corresponding to each current behavior authentication information item; wherein, the historical behavior evidence is calculated based on the trained xgboost model to obtain the historical behavior authentication information items corresponding to each current behavior authentication information item. The determining unit is configured to: if all behavior authentications are determined to be successful, calculate the current total behavior authentication information based on the weights corresponding to each current behavior authentication information item, and calculate the predicted total behavior authentication information based on the weights corresponding to each historical behavior authentication information item; compare the difference between the current total behavior authentication information and the predicted total behavior authentication information; if the comparison result is determined to be a first comparison result where the difference is greater than or equal to a preset comparison threshold, then determine the user's access result to the cloud server as a first access result where the user is not allowed to access the cloud server; if the comparison result is determined to be a second comparison result where the difference is less than the preset comparison threshold, then determine the user's access result to the cloud server as a second access result where the user is allowed to access the cloud server. The determining unit is further configured to, if any comparison behavior authentication fails, directly determine that the user's access result to the cloud server is the first access result that is not allowed.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 4.

7. A computer readable storage medium having stored thereon a computer program, characterized in that When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4.

Images