A single sign-on method and single point management device

Abstract

The present invention discloses a single-point login method and a single-point management device, which relate to the field of big data technology, including: a user triggers a single-point first login instruction to collect biometric data, and sends it to a single-point login management platform through a communication network for a first verification; a target user triggers a single-point second login instruction containing a login credential, and the single-point management platform sends the second verification information corresponding to the second login instruction to the user end for identity authentication; based on the user identification and the second verification information, a machine learning algorithm is used to analyze the user's behavior pattern, and the user's authority level is intelligently adjusted; the user sends a login request according to the corresponding authority level, and logs in after a final verification. The present invention ensures the validity of the login credential and the reconfirmation of the user's identity through a secondary verification mechanism, improves the security protection level of the overall system, and effectively prevents malicious attacks and unauthorized access.

Description

Technical Field

[0001] The present invention relates to the field of big data technology, and in particular to a single-point login method and a single-point management device. Background Art

[0002] In recent years, biometric recognition technology has been widely used and developed as a more secure and convenient means of identity authentication. Biometrics include but are not limited to fingerprints, facial features, irises, etc., which have the characteristics of uniqueness, stability and difficulty in duplication. The SSO mechanism allows users to access multiple related application systems with only one login, reducing the maintenance burden of the IT department. However, how to improve the usability and flexibility of the SSO system while ensuring security remains a challenge.

[0003] Although biometric recognition technology and SSO systems have made significant progress, there are still some key issues that need to be addressed. First, existing biometric recognition technologies often focus on a single type of biometrics and cannot guarantee consistent recognition accuracy in different environments and scenarios. Second, traditional SSO systems lack flexibility and intelligence when processing user identity authentication. Third, existing SSO solutions often rely on preset security policies when processing user login requests. Finally, differences in compatibility and interaction methods between different devices also pose new challenges to the popularization of SSO systems. Summary of the invention

[0004] In view of the above existing problems, the present invention is proposed.

[0005] Therefore, the present invention provides a single sign-on method and management system to solve the problems of low security of user identity authentication and insufficient intelligence and flexibility of authority management in the existing single sign-on technology.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] In a first aspect, an embodiment of the present invention provides a single sign-on method and management system, which includes: a user triggers a single sign-on first instruction to collect biometric data, and sends the data to a single sign-on management platform through a communication network for a first verification;

[0008] The biometric data that passes the first verification generates a temporary password, which is combined with the user ID to generate login information;

[0009] The single point management platform uses the login information for identity authentication and generates login credentials to send to the target user;

[0010] The target user triggers a single-point second login instruction containing login credentials, and the single-point management platform sends the second verification information corresponding to the second login instruction to the user end for identity authentication;

[0011] Based on the user ID and the second verification information, the machine learning algorithm is used to analyze the user's behavior pattern and intelligently adjust the user's permission level;

[0012] The user sends a login request according to the corresponding permission level and logs in after final verification.

[0013] As a preferred solution of the single sign-on method of the present invention, wherein: the user triggers the single sign-on first instruction to collect biometric data, and sends it to the single sign-on management platform through the communication network for the first verification, including the following steps:

[0014] The user starts an application that includes the single sign-on function and enters the login interface to perform single sign-on;

[0015] In the biometric data collection interface on the login page, follow the system prompts to collect biometric data;

[0016] The system selects AES as the encryption algorithm, generates an original key for the collected biometric data through the AES encryption algorithm, and then encrypts the biometric data to generate encrypted biometric data and encryption key;

[0017] The encrypted biometric data and encryption key are packaged into a data packet and sent to the single sign-on management platform via the HTTPS protocol for the first verification.

[0018] As a preferred solution of the single sign-on method of the present invention, wherein: the biometric data that passes the first verification generates a temporary password, and the login information is generated in combination with the user identification, including the following steps:

[0019] After receiving the data packet, the single sign-on management platform sends a receipt confirmation message to the user end;

[0020] Decrypt the encryption key using the RSA algorithm to obtain the original encryption key;

[0021] Decrypting the biometric data using the decryption key to obtain the original biometric data;

[0022] The single sign-on management platform compares the stored biometric template with the decrypted original biometric data to verify whether the two match. If they match, the biometric data verification is successful;

[0023] Extract the user's unique ID from the data packet, obtain the current time stamp and generate a random number;

[0024] A hash function is used to calculate the user's unique identifier, timestamp and random number to obtain a temporary password, set the validity period of the temporary password, and generate login information.

[0025] As a preferred solution of the single sign-on method of the present invention, the single point management platform uses the login information to perform identity authentication, generates login credentials and sends them to the target user, including the following steps:

[0026] The single sign-on management platform receives the login information packet sent by the front end and verifies whether the timestamp is within the current time minus the allowable error;

[0027] Use the same hash function to recalculate the user's unique ID, timestamp, and random number to obtain a temporary password, and compare it with the received temporary password. If the verification results are consistent, the temporary password is valid;

[0028] When both the timestamp and the temporary password are valid, authentication is performed to obtain the hash value of the login credentials;

[0029] Set a security key, use the security key to encrypt the login credentials, and generate the final login credentials;

[0030] Encrypt the final login credentials using the target user's public key to generate encrypted login credentials;

[0031] Use TLS 13 protocol to establish a secure connection and encrypt the transmission of the encrypted login credentials to the target user.

[0032] As a preferred solution of the single sign-on method of the present invention, wherein: the target user triggers the single sign-on second login instruction containing the login credentials, and the verification of the validity of the login credentials includes the following steps:

[0033] After the target user receives the login credentials, a single-point second login instruction is triggered;

[0034] After receiving the second login instruction, the single point management platform checks the login credentials therein and verifies the validity of the login credentials by calculating the validity score of the login credentials, which is expressed as:

[0035] ;

[0036] in, To verify the validity score of the login credentials, For login credentials, is the timestamp in the second login instruction received, is the current timestamp, E is the allowable error, and bit(·) is used to obtain the login credentials The number of digits, Represents login credentials The i-th digit of , n is the total number of digits of the login credential, and i is the digit index of the login credential.

[0037] As a preferred solution of the single sign-on method of the present invention, the single point management platform sends the second verification information corresponding to the second login instruction to the user terminal for identity authentication, including the following steps:

[0038] Set the validity threshold of the login credential to θ, if >θ, the login credentials are considered valid and the second verification information is generated, expressed as:

[0039] ;

[0040] in, For the second verification information, is a random number, is a security key;

[0041] The second verification information is encrypted using the public key of the target user to generate encrypted second verification information;

[0042] The encrypted second verification information is sent to the target user through a secure connection. The target user uses his own private key to decrypt the information and obtain the original second verification information.

[0043] The target user recalculates the second verification information using the same formula and compares it with the second verification information received;

[0044] If the calculation result is the same as the second verification information received, the verification is successful and the user continues to access the target system.

[0045] As a preferred solution of the single sign-on method of the present invention, wherein: based on the user identification and the second verification information, the user's behavior pattern is analyzed using a machine learning algorithm, and the user's authority level is intelligently adjusted, including the following steps:

[0046] Collect the user's login time, login frequency, login device type, and login location information over a period of time;

[0047] After preliminary processing of the information, it is integrated into a feature vector;

[0048] Build a login behavior pattern model, define a prediction function based on the user's current login behavior and verification information, and predict the user's future login behavior. The expression is:

[0049] ;

[0050] in, is a vector composed of the user's historical login data. is the prediction result of the normality of user behavior, j is the feature index variable, is the weight of the jth feature, For vector The jth feature in A vector of historical user login data The number of features in In order to adjust the adjustment factor of the influence of the second verification information on the prediction results, To adjust the adjustment factor of the influence of the difference between the current timestamp and the timestamp in the received second login instruction on the prediction result, To adjust the influence of the login credential validity score on the prediction results, A tuning factor for adjusting the exponential decay rate of the validity score of the verified login credentials;

[0051] As a preferred solution of the single sign-on method of the present invention, wherein: intelligently adjusting the user authority level according to the prediction result includes the following steps:

[0052] According to the prediction results of the normality of user behavior, the user's authority level is divided to obtain the user's final authority level ;

[0053] Define the threshold for reducing permissions as , the threshold for escalating privileges , the adjustment process is as follows:

[0054] if > , then increase the user authority level;

[0055] if < , then reduce the user's authority level;

[0056] if ≤ ≤ , the user permission level remains unchanged.

[0057] As a preferred solution of the single sign-on method of the present invention, wherein: the user sends a login request according to the corresponding authority level, and the login after final verification includes the following steps:

[0058] The user checks the current permission level and sends an encrypted login request to the single point management platform according to the corresponding permission level;

[0059] The single point management platform receives the encrypted login request and decrypts it using the security key;

[0060] Calculate the user request credibility score and use the authorization probability distribution and request probability distribution to calculate the distance between the two;

[0061] Combine the user request credibility score and the user behavior credibility score to calculate the final verification credibility score;

[0062] The single-point management platform performs final verification based on the final verification credibility score to determine whether the final verification result meets the login conditions;

[0063] If the verification is successful, the login conditions are met and you can log in directly;

[0064] If the verification fails, the login conditions are not met and a login failure message is displayed.

[0065] In a second aspect, the present invention provides a single point management device, comprising:

[0066] Biometric data collection and first verification module: The user triggers the single-point first login instruction to collect biometric data, and sends it to the single-point login management platform through the communication network for the first verification;

[0067] Login information generation module: Generates a temporary password based on the biometric data that passes the first verification, and generates login information based on the user ID;

[0068] Login credential generation module: The single point management platform uses the login information for identity authentication, generates login credentials and sends them to the target user;

[0069] Login credential verification module: The target user triggers a single-point second login instruction containing the login credential, and the single-point management platform sends the second verification information corresponding to the second login instruction to the user end for identity authentication;

[0070] User behavior analysis module: Based on user identification and secondary verification information, it uses machine learning algorithms to analyze user behavior patterns and intelligently adjust user permission levels;

[0071] Final login verification module: The user sends a login request according to the corresponding permission level and logs in after final verification.

[0072] In a third aspect, an embodiment of the present invention provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, any step of the single sign-on method described in the first aspect of the present invention is implemented.

[0073] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, any step of the single sign-on method as described in the first aspect of the present invention is implemented.

[0074] The beneficial effects of the present invention are as follows: the user collects biometric data through the application and transmits it to the single sign-on management platform for the first verification in an encrypted manner, thereby ensuring the security of the data. After successful verification of the biometric data, a temporary password is generated, and login information is generated in combination with the user identification, thereby enhancing the accuracy of identity authentication. After verifying the validity of the login information, the single sign-on management platform generates and securely transmits the login credentials to the target user, thereby further protecting the security of the login credentials. The validity of the login credentials is ensured by calculating the validity score of the login credentials and the secondary verification information. At the same time, the user behavior pattern is analyzed through a machine learning algorithm, and the permission level is intelligently adjusted, thereby enhancing the security and flexibility of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0076] Figure 1 This is a flow chart of the single sign-on method and single point management device in Example 1.

[0077] Figure 2 This is a diagram for intelligently adjusting user authority levels in Example 1. DETAILED DESCRIPTION

[0078] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0079] Example 1, reference Figure 1 and Figure 2 , which is the first embodiment of the present invention, and provides a single sign-on method, comprising the following steps:

[0080] S1, the user triggers the single sign-on first instruction to collect biometric data, and sends it to the single sign-on management platform through the communication network for the first verification, including the following steps:

[0081] The user starts an application that includes the single sign-on function and enters the login interface to perform single sign-on;

[0082] In the biometric collection interface on the login interface, biometric data is collected according to the system prompts. For example, if it is fingerprint recognition, the user places his finger on the fingerprint recognition sensor of the device; if it is facial recognition, the user faces the front camera of the device; the system selects AES as the encryption algorithm, and encrypts the biometric data after generating the original key through the AES encryption algorithm to generate encrypted biometric data and encryption key; the encrypted biometric data and encryption key are packaged into a data packet and sent to the single sign-on management platform through the HTTPS protocol for the first verification.

[0083] S2, the biometric data that passes the first verification generates a temporary password, and the login information is generated in combination with the user identification, including the following steps:

[0084] After receiving the data packet, the single sign-on management platform sends a receipt confirmation message to the user end; uses the RSA algorithm to decrypt the encryption key to obtain the original encryption key; uses the decryption key to decrypt the biometric data to obtain the original biometric data; the single sign-on management platform compares the stored biometric template with the decrypted original biometric data to verify whether the two match. If they match, the biometric data verification is successful; extracts the user's unique identifier from the data packet, obtains the timestamp of the current time and generates a random number; uses a hash function to calculate the user's unique identifier, timestamp and random number, obtains a temporary password and sets the validity period of the temporary password, and generates login information.

[0085] Furthermore, the expression for generating a temporary password using a hash function is:

[0086] ;

[0087] in, represents a temporary password, H(·) represents a hash function, ID represents the unique identifier of the user, T represents a timestamp, R represents a random number, and ⊕ represents a bitwise exclusive OR operation.

[0088] Validity period limit for temporary password: Set the validity period of the temporary password to W seconds, calculated from the timestamp T, that is, the temporary password is valid before T+W; when the user uses the temporary password for subsequent operations, the single sign-on management platform checks whether the current time is between T and T+W. If not, the temporary password is invalid.

[0089] S3, the single point management platform uses the login information for identity authentication, generates login credentials and sends them to the target user, including the following steps:

[0090] The single sign-on management platform receives the login information package sent by the front end, verifies whether the timestamp is within the current time minus the allowable error; uses the same hash function to recalculate the user's unique identifier, timestamp and random number, obtains a temporary password, and compares it with the received temporary password. If the verification results are consistent, the temporary password is valid; when both the timestamp and the temporary password are valid, identity authentication is performed to obtain the hash value of the login credential; sets a security key, uses the security key to encrypt the login credential, and generates the final login credential; uses the target user's public key to encrypt the final login credential to generate an encrypted login credential; uses the TLS 13 protocol to establish a secure connection, and encrypts and transmits the encrypted login credential to the target user.

[0091] S4, the target user triggers the single point second login instruction containing the login credentials, and the single point management platform sends the second verification information corresponding to the second login instruction to the user end for identity authentication, including the following steps:

[0092] After the target user receives the login credentials, the single point second login instruction is triggered; after the single point management platform receives the second login instruction, it checks the login credentials therein and verifies the validity of the login credentials by calculating the validity score of the login credentials. The expression is:

[0093] ;

[0094] in, To verify the validity score of the login credentials, For login credentials, is the timestamp in the second login instruction received, is the current timestamp, E is the allowable error, and bit(·) is used to obtain the login credentials The number of digits, Represents login credentials The i-th digit of , n is the total number of digits of the login credential, and i is the digit index of the login credential;

[0095] Set the validity threshold of the login credential to θ, if >θ, the login credentials are considered valid and the second verification information is generated, expressed as:

[0096] ;

[0097] in, For the second verification information, is a random number, is a security key;

[0098] The second verification information is encrypted using the target user's public key to generate encrypted second verification information; the encrypted second verification information is sent to the target user via a secure connection, and the target user decrypts it using his or her own private key to obtain the original second verification information; the target user recalculates the second verification information using the same formula and compares it with the received second verification information; if the calculation result is the same as the received second verification information, the verification is successful and the user can continue to access the target system.

[0099] S5. Based on the user identification and the second verification information, using a machine learning algorithm to analyze the user's behavior pattern includes the following steps:

[0100] Collect the user's login time, login frequency, login device type, and login location information over the past period of time; after preliminary processing of the information, integrate it into a feature vector; build a login behavior pattern model, define a prediction function based on the user's current login behavior and verification information, and predict the user's future login behavior. The expression is:

[0101] ;

[0102] in, A vector composed of the user's historical login data, including multiple features, such as login time, login frequency, etc. is the prediction result of the normality of user behavior, j is the feature index variable, is the weight of the jth feature, which is used to measure the influence of this feature on the prediction result. For vector The jth feature in A vector of historical user login data The number of features in In order to adjust the adjustment factor of the influence of the second verification information on the prediction results, To adjust the adjustment factor of the influence of the difference between the current timestamp and the timestamp in the received second login instruction on the prediction result, To adjust the influence of the login credential validity score on the prediction results, A factor that adjusts the exponential decay rate of the validity score of the verified login credentials.

[0103] According to the prediction results of the normality of user behavior, the user's authority level is divided to obtain the user's final authority level ;

[0104] Define the threshold for reducing permissions as , the threshold for escalating privileges , the adjustment process is as follows:

[0105] if > , then increase the user's permission level; if < , then reduce the user's authority level; if ≤ ≤ , the user permission level remains unchanged.

[0106] S6. The user sends a login request according to the corresponding authority level, and the login process after final verification includes the following steps:

[0107] The user checks the current permission level and sends an encrypted login request to the single-point management platform according to the corresponding permission level; the single-point management platform receives the encrypted login request and decrypts it using a security key; calculates the user request credibility score and uses the authorization probability distribution and the request probability distribution to calculate the distance between the two; combines the user request credibility score and the user behavior credibility score to calculate the final verification credibility score; the single-point management platform performs final verification based on the final verification credibility score to determine whether the final verification result meets the login conditions; if the verification passes, the login conditions are met and the user logs in directly; if the verification fails, the login conditions are not met and a login failure is displayed.

[0108] This embodiment also provides a single point management device, including:

[0109] Biometric data collection and first verification module: The user triggers the single-point first login instruction to collect biometric data, and sends it to the single-point login management platform through the communication network for the first verification;

[0110] Login information generation module: Generates a temporary password based on the biometric data that passes the first verification, and generates login information based on the user ID;

[0111] Login credential generation module: The single point management platform uses the login information for identity authentication, generates login credentials and sends them to the target user;

[0112] Login credential verification module: The target user triggers a single-point second login instruction containing the login credential, and the single-point management platform sends the second verification information corresponding to the second login instruction to the user end for identity authentication;

[0113] User behavior analysis module: Based on user identification and secondary verification information, it uses machine learning algorithms to analyze user behavior patterns and intelligently adjust user permission levels;

[0114] Final login verification module: The user sends a login request according to the corresponding permission level and logs in after final verification.

[0115] This embodiment also provides a computer device suitable for the single sign-on method, including: a memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute computer executable instructions to implement the single sign-on method proposed in the above embodiment.

[0116] The computer device may be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device may be a touch layer covered on the display screen, or a key, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse, etc.

[0117] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, the single sign-on method proposed in the above embodiment is implemented; the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read Only Memory, referred to as EPROM), programmable read-only memory (Programmable Red-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0118] In summary, the present invention collects biometric data through an application and transmits it to the single sign-on management platform for the first verification in an encrypted manner, thereby ensuring the security of the data. After successful verification of the biometric data, a temporary password is generated, and login information is generated in combination with the user identification, thereby enhancing the accuracy of identity authentication. After verifying the validity of the login information, the single sign-on management platform generates and securely transmits the login credentials to the target user, further protecting the security of the login credentials. The validity of the login credentials is ensured by calculating the validity score of the login credentials and the secondary verification information. At the same time, the user behavior pattern is analyzed through a machine learning algorithm, and the permission level is intelligently adjusted, thereby enhancing the security and flexibility of the system.

[0119] Example 2

[0120] Referring to Table 1, which is the second embodiment of the present invention, experimental simulation data of the single sign-on method is provided to further verify the advancement of the present invention.

[0121] In this experiment, 100 volunteers were selected to participate in the test. They were randomly divided into two groups, each with 50 people, representing the use of the method of the present invention (experimental group) and the traditional single sign-on method (control group). During the experiment, all participants installed the same application with single sign-on function and completed the login process in a simulated environment. The experimental environment simulated a typical office network environment, including an internal network, a mobile network, and the external Internet.

[0122] Biometric data collection and verification: After the user launches the application, follow the system prompts to complete the biometric data collection, including fingerprint recognition and facial recognition. The system automatically uses the AES algorithm to encrypt the biometric data and send it to the single sign-on management platform for verification.

[0123] Temporary password generation and login information creation: Once the biometric data is successfully verified, the single sign-on management platform will generate a temporary password and generate login information in combination with the user's unique ID. This step ensures the security and timeliness of the login information.

[0124] Login credential generation and transmission: After the single sign-on management platform uses the login information to verify the user's identity, it generates a login credential and transmits it to the target user using the TLS 13 protocol. This step verifies the secure transmission of the login credential.

[0125] Secondary verification and behavior pattern analysis: The target user uses the login credentials for secondary verification, and the user's behavior pattern is analyzed through machine learning algorithms. This step verifies the validity of the login credentials and the ability to dynamically adjust the user's permission level.

[0126] Final verification and login: The user sends a login request based on the permission level, and the single point management platform performs final verification before logging in. This step verifies the security of the final login.

[0127] Records and observations during the experiment: The timestamp, login method (fingerprint / face), login status (success / failure), login credential validity score, login request credibility score, user behavior normality prediction results and final permission level of each login attempt were recorded, as shown in Table 1:

[0128] Table 1 Experimental record table

[0129] Test subjects Login method Login timestamp Biometric data verification results Temporary password validity Login Credentials Validity Score Normality of user behavior Final permission level Login status User001 fingerprint 1692647100 success high 0.95 0.83 high success User002 Face 1692647115 success middle 0.87 0.78 middle success User003 fingerprint 1692647120 success high 0.91 0.92 high success User004 Face 1692647125 fail Low 0.53 0.58 Low fail ... ... ... ... ... ... ... ... ... User100 Face 1692647190 success middle 0.84 0.75 middle success

[0130] Biometric data verification results: From the table data, it can be seen that the biometric data verification success rate of the experimental group is significantly higher than that of the control group, which shows that the biometric data encryption algorithm of the present invention effectively improves the security of the data.

[0131] Temporary password validity: The effectiveness of the temporary password in the experimental group is higher, which shows that the temporary password generated by combining the user ID and timestamp has high security and can effectively prevent the password from being cracked.

[0132] Login credential validity score: The average validity score of the login credentials of the experimental group was 0.85, while that of the control group was only 0.60, which shows that the login credential generation mechanism in the present invention can significantly improve the security of login.

[0133] Normality of user behavior: By analyzing user behavior patterns through machine learning algorithms, the average predicted normality of the experimental group of users is 0.82, while that of the control group is only 0.55. This shows that the present invention can more accurately predict user behavior, thereby dynamically adjusting the user's permission level and improving the security of the system.

[0134] Final permission level: 85% of users in the experimental group had their final permission level adjusted to "high", while only 50% of users in the control group had their final permission level adjusted to "high". This means that the present invention can more effectively manage user permissions and reduce unauthorized access incidents.

[0135] In summary, compared with the existing single sign-on technology, the present invention has higher security and efficiency in biometric data verification, temporary password generation, login credential transmission, etc., and has significant advantages in user behavior pattern analysis and dynamic adjustment of permission levels. These advantages make the present invention a more reliable single sign-on solution.

[0136] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A single sign-on method, characterized in that: include, The user triggers the single sign-on first login instruction to collect biometric data, and sends it to the single sign-on management platform through the communication network for the first verification; The biometric data that passes the first verification generates a temporary password, which is combined with the user ID to generate login information; The single point management platform uses the login information for identity authentication and generates login credentials to send to the target user; The target user triggers a single-point second login instruction containing login credentials, and the single-point management platform sends the second verification information corresponding to the second login instruction to the user end for identity authentication; Based on the user ID and the second verification information, the machine learning algorithm is used to analyze the user's behavior pattern and intelligently adjust the user's permission level; The user sends a login request according to the corresponding permission level and logs in after final verification; The biometric data that passes the first verification generates a temporary password, and the login information is generated by combining the user identification, including the following steps: After receiving the data packet, the single sign-on management platform sends a receipt confirmation message to the user end; uses the RSA algorithm to decrypt the encryption key to obtain the original encryption key; uses the decryption key to decrypt the biometric data to obtain the original biometric data; the single sign-on management platform compares the stored biometric template with the decrypted original biometric data to verify whether the two match. If they match, the biometric data verification is successful; extracts the user's unique identifier from the data packet, obtains the timestamp of the current time and generates a random number; uses a hash function to calculate the user's unique identifier, timestamp and random number, obtains a temporary password and sets the validity period of the temporary password, and generates login information; The expression for generating a temporary password using a hash function is: Among them, P temp represents a temporary password, H(·) represents a hash function, ID represents the unique identifier of the user, T represents a timestamp, R represents a random number, Represents a bitwise exclusive OR operation; The single point management platform uses the login information for identity authentication and generates login credentials to send to the target user. The following steps are included: The single sign-on management platform receives the login information packet sent by the front end and verifies whether the timestamp is within the current time minus the allowable error; Use the same hash function to recalculate the user's unique ID, timestamp, and random number to obtain a temporary password, and compare it with the received temporary password. If the verification results are consistent, the temporary password is valid; When both the timestamp and the temporary password are valid, authentication is performed to obtain the hash value of the login credentials; Set a security key, use the security key to encrypt the login credentials, and generate the final login credentials; Encrypt the final login credentials using the target user's public key to generate encrypted login credentials; Use TLS13 protocol to establish a secure connection and encrypt the transmission of the encrypted login credentials to the target user; The target user triggers a single-point second login instruction containing login credentials. Verifying the validity of the login credentials includes the following steps: After the target user receives the login credentials, a single-point second login instruction is triggered; After receiving the second login instruction, the single point management platform checks the login credentials therein and verifies the validity of the login credentials by calculating the validity score of the login credentials, which is expressed as: Among them, F P is the validity score of the login credentials, P is the login credentials, T r is the timestamp in the second login instruction received, T c is the current timestamp, E is the allowable error, bit(·) is the number of bits used to obtain the login credential P, P i Represents the i-th digit of the login credential P, n is the total number of digits of the login credential, and i is the digit index of the login credential.

2. The single sign-on method according to claim 1, wherein: The user triggers the single sign-on first instruction to collect biometric data, and sends it to the single sign-on management platform through the communication network for the first verification, including the following steps: The user starts an application that includes the single sign-on function and enters the login interface to perform single sign-on; In the biometric data collection interface on the login page, follow the system prompts to collect biometric data; The system selects AES as the encryption algorithm, generates an original key through the AES encryption algorithm for the collected biometric data, and then encrypts the biometric data to generate encrypted biometric data and encryption key; The encrypted biometric data and encryption key are packaged into a data packet and sent to the single sign-on management platform via the HTTPS protocol for the first verification.

3. The single sign-on method according to claim 1, wherein: The single point management platform sends the second verification information corresponding to the second login instruction to the user terminal for identity authentication, including the following steps: Set the validity threshold of the login credential to θ. If F P >θ, the login credentials are considered valid and the second verification information is generated, expressed as: Among them, V is the second verification information, R is a random number, and K is a security key; The second verification information is encrypted using the public key of the target user to generate encrypted second verification information; The encrypted second verification information is sent to the target user through a secure connection. The target user uses his own private key to decrypt the information and obtain the original second verification information. The target user recalculates the second verification information using the same formula and compares it with the second verification information received; If the calculation result is the same as the second verification information received, the verification is successful and the user continues to access the target system.

4. The single sign-on method according to claim 3, wherein: Based on the user identification and the second verification information, the user's behavior pattern is analyzed using a machine learning algorithm, including the following steps: Collect the user's login time, login frequency, login device type, and login location information over a period of time; After preliminary processing of the information, it is integrated into a feature vector; Build a login behavior pattern model, define a prediction function based on the user's current login behavior and verification information, and predict the user's future login behavior. The expression is: Among them, X is a vector composed of the user's historical login data, f(X) is the prediction result of the normality of the user's behavior, j is the feature index variable, and w j is the weight of the jth feature, x j is the jth feature in vector X, m is the number of features in the user's historical login data vector X, α is the adjustment factor for adjusting the influence of the second verification information on the prediction result, β is the adjustment factor for adjusting the influence of the difference between the current timestamp and the timestamp in the received second login instruction on the prediction result, γ is the adjustment factor for adjusting the influence of the login credential validity score on the prediction result, and δ is the adjustment factor for adjusting the exponential decay speed of the validity score of the verified login credential.

5. The single sign-on method according to claim 4, characterized in that: Based on the prediction results, intelligently adjusting the user permission level includes the following steps: According to the prediction results of the normality of user behavior, the user's authority level is divided to obtain the user's final authority level U; Define the threshold for reducing permissions as θ L , the threshold value of increasing privileges θ U , the adjustment process is as follows: If U>θ U , then increase the user authority level; If U < θ L , then reduce the user's authority level; If θ L ≤U≤θ U , the user permission level remains unchanged.

6. The single sign-on method according to claim 1, wherein: The user sends a login request according to the corresponding permission level, and the login process after final verification includes the following steps: The user checks the current permission level and sends an encrypted login request to the single point management platform according to the corresponding permission level; The single point management platform receives the encrypted login request and decrypts it using the security key; Calculate the user request credibility score and use the authorization probability distribution and request probability distribution to calculate the distance between the two; Combine the user request credibility score and the user behavior credibility score to calculate the final verification credibility score; The single-point management platform performs final verification based on the final verification credibility score to determine whether the final verification result meets the login conditions; If the verification is successful, the login conditions are met and you can log in directly; If the verification fails, the login conditions are not met and a login failure message is displayed.

7. A single sign-on management device, based on the single sign-on method according to any one of claims 1 to 6, characterized in that: include, Biometric data collection and first verification module: The user triggers the single-point first login instruction to collect biometric data, and sends it to the single-point login management platform through the communication network for the first verification; Login information generation module: Generates a temporary password based on the biometric data that passes the first verification, and generates login information based on the user ID; Login credential generation module: The single point management platform uses the login information for identity authentication, generates login credentials and sends them to the target user; Login credential verification module: The target user triggers a single-point second login instruction containing the login credential, and the single-point management platform sends the second verification information corresponding to the second login instruction to the user end for identity authentication; User behavior analysis module: Based on user identification and secondary verification information, it uses machine learning algorithms to analyze user behavior patterns and intelligently adjust user permission levels; Final login verification module: The user sends a login request according to the corresponding permission level and logs in after final verification.

Images