Computer software access identity verification method

Abstract

A computer software access identity verification method relates to the technical field of access identity verification, and comprises the following steps: constructing a software access control platform, collecting data information of each Internet of Things node, and carrying out identity verification operation on an access request of an access subject; constructing an access trend heat map of the main body ID, obtaining an identity verification layer number of the main body ID, performing multi-layer identity verification on the main body ID according to the identity verification layer number of the main body ID, and performing access request permission verification of the access main body when the multi-layer identity verification of the access main body is passed; and when the access request permission verification of the access subject is passed, setting an access monitoring item, performing dynamic verification monitoring on the access process of the access subject according to the access monitoring item, and controlling the access process of the access subject according to a dynamic verification monitoring result. The security, the flexibility, the user experience and the like are remarkably improved, and the method can better adapt to a complex Internet of Things environment.

Description

Technical Field

[0001] The present invention relates to the technical field of access identity verification, in particular to an access identity verification method for computer software. Background Art

[0002] The prior art CN113285808A "A method, device, equipment and storage medium for identity information verification" includes: the identity verification server obtains the identity information forwarded by the business side server, generates an access token based on the identity information and sends it to the business side server for forwarding to the client; the identity verification server receives the identity verification request initiated by the client and carrying the access token, and determines the type of operating system to which the client belongs; through the identity verification server, calls the verification service unit corresponding to the operating system type, processes the verification request and determines the verification result, and then feeds back the identity verification result to the client.

[0003] The prior art CN112231667A "Identity verification method, apparatus, storage medium, system and equipment" includes obtaining a first login state of a first application; if the first login state of the first application is valid, obtaining a user's access request to a second application, and the second application uses the first application as a host application; if the second login state of the user account in the second application is valid, determining the target sensitive category corresponding to the second application according to the access request; obtaining the identity trust level of the user account in the second application; determining whether identity verification service needs to be provided according to the identity trust level and the target sensitive category; if so, calling the identity verification interface corresponding to the identity trust level for identity verification, and if the identity verification passes, updating the identity trust level of the user account.

[0004] Since most IoT devices do not have strong computing power, sufficient storage space and durable batteries, it is impossible to directly integrate security functions such as identity authentication and access control into the IoT device chips, which will seriously affect the efficiency of data collection and processing. It is precisely because of this defect of IoT devices that many malicious users have the opportunity to steal data information collected by IoT devices through various means, or cause the IoT device resources to be exhausted and unable to continue collecting data, thereby causing a large number of security problems. Summary of the invention

[0005] In order to solve the above technical problems, the object of the present invention is to provide a method for verifying the access identity of computer software, comprising the following steps:

[0006] Step s1: Build a software access control platform, collect data information of each IoT node, and perform identity verification operations on access requests from access subjects;

[0007] Step s2: construct an access trend heat map of the subject ID based on the historical access log of the subject ID, obtain the identity authentication layer number of the subject ID based on the access trend heat map, perform multi-layer identity verification on the subject ID based on the identity authentication layer number of the subject ID, and when the multi-layer identity verification of the access subject passes, perform access request authority verification on the access subject;

[0008] Step s3: When the access request authority of the access subject is verified, the access monitoring item is set according to the access request of the access subject and the data information of the object IoT node, and the access process of the access subject is dynamically verified and monitored according to the access monitoring item, and the access process of the access subject is controlled according to the dynamic verification and monitoring results.

[0009] Furthermore, the process of building a software access control platform, collecting data information of each IoT node, and performing identity verification operations on access requests of access subjects includes:

[0010] Building a software access control platform based on blockchain technology, wherein the software access control platform is communicatively connected to a number of blockchain nodes, the blockchain nodes are interconnected to form a blockchain network, the blockchain nodes are communicatively linked to the IoT terminals, and the blockchain nodes are used to collect data information of the IoT terminals and mark the collection time, and set the collection cycle;

[0011] The access subject logs in to the IoT terminal by entering the subject ID and password, marks the IoT terminal as the subject IoT terminal, and inputs an access request to the subject IoT terminal. The access request includes the object IoT terminal, object data information, and operation type. The IoT terminal packages the subject ID and the access request into a data packet and uploads it to the blockchain node. The software access control platform performs identity verification operations on the data packets received by the blockchain node.

[0012] Furthermore, an access trend heat map of the subject ID is constructed according to the historical access log of the subject ID. The process of obtaining the number of identity authentication layers of the subject ID according to the access trend heat map includes:

[0013] Obtain historical access logs of the subject ID in the data packet, perform statistical analysis on the historical access logs, and construct an access trend heat map of the access subject, wherein the access trend heat map includes the access probability, operation type probability, object data information probability, and access result probability of the access subject to all IoT terminals at different timestamps;

[0014] According to the access trend heat map, the access probability of the object IoT terminal, the object data information probability, the operation type probability and the access probability of the subject IoT terminal in the current timestamp data packet are obtained, and the access probability of the object IoT terminal, the object data information probability, the operation type probability and the access probability of the subject IoT terminal are used as evaluation indicators, and the indicator weight matrix and the trend fit level of the evaluation indicator are set, and the membership matrix of the evaluation indicator to the trend fit level is judged by fuzzy comprehensive evaluation;

[0015] The trend matching level of the subject ID is obtained according to the membership matrix and the indicator weight matrix, the number of identity authentication levels of the subject ID is determined according to the trend matching level, and multi-layer identity verification is performed on the subject ID according to the number of identity authentication levels.

[0016] Furthermore, the process of the software access control platform performing multi-layer identity verification on the subject ID according to the number of subject ID identity verification layers includes:

[0017] The software access control platform pre-builds an ID identity recognition database, which includes identity recognition data corresponding to several identity recognition types of each ID;

[0018] The number k of identity authentication types of the subject ID is determined according to the number of identity authentication layers of the subject ID, several identity authentication types of the ID consistent with the subject ID are obtained from the ID identity recognition database, k identity authentication types are randomly selected from the several identity authentication types, the identity authentication data corresponding to the k identity authentication types are used as the data to be compared, and a multi-factor identity authentication instruction is constructed according to the k identity authentication types, and the multi-factor identity authentication instruction is sent to the Internet of Things terminal logged in by the subject ID. The subject ID sends the identity authentication data to be verified corresponding to the k identity authentication types to the Internet of Things terminal according to the multi-factor identity authentication instruction, and the Internet of Things terminal packages the identity authentication data to be verified into a data packet to be verified and sends it to the blockchain node, and the identity authentication data to be verified corresponding to the k identity authentication types in the data packet to be verified received by the blockchain node are matched with the data to be compared for consistency. If the identity authentication data to be verified corresponding to the k identity authentication types are consistent with the data to be compared, the multi-layer identity of the access subject is verified, and the access request authority of the access subject is verified. If the identity authentication data to be verified corresponding to the k identity authentication types are inconsistent with the data to be compared, the multi-layer identity verification of the access subject fails, and the access request of the access subject is rejected.

[0019] Furthermore, when the multi-layer identity verification of the access subject is passed, the process of verifying the access request authority of the access subject includes:

[0020] The permission level of each ID and the permission requirement level of each object data information of each IoT terminal corresponding to different operation types are preset, the permission level of the subject ID in the data packet and the permission requirement level of the operation type corresponding to the object data information of the object IoT terminal are obtained, the permission level is compared with the permission requirement level, if the permission requirement level is greater than or equal to the permission requirement level, the access request of the access subject is allowed, and the dynamic process verification operation of the access subject is performed, if the permission requirement level is less than the permission requirement level, the access subject submits a manual review application document to the software access control platform, and the administrator of the software access control platform determines whether to grant access rights based on the manual review application document.

[0021] Further, when the access request authority of the access subject is verified, an access monitoring item is set according to the access request of the access subject and the data information of the object IoT node, and the access process of the access subject is dynamically verified and monitored according to the access monitoring item. The process of controlling the access process of the access subject according to the dynamic verification and monitoring result includes:

[0022] Obtain the level difference between the authority level and the authority requirement level of the subject ID, obtain the initial access credibility of the access subject according to the level difference of the subject ID, the trend matching level and the access result probability, and simultaneously obtain the predicted data information trend within the current acquisition cycle of the object Internet of Things node, use the predicted information trend as the judgment data, use the access request of the access subject and the data information of the object Internet of Things node as the access monitoring items, monitor the access process of the access subject in real time according to the access monitoring items, reduce the initial access credibility of the access subject in real time according to the real-time monitoring results, and stop the access process of the access subject when the initial access credibility of the access subject is zero.

[0023] Furthermore, the process of monitoring the access process of the access subject in real time according to the access monitoring items and reducing the initial access reputation value of the access subject in real time according to the real-time monitoring results includes:

[0024] When the object IoT terminal, object data information and operation type accessed by the access subject during the access process are inconsistent with the object IoT terminal, object data information and operation type in the access monitoring item, the initial access reputation value of the access subject is cleared;

[0025] When the object Internet of Things terminal, object data information and operation type accessed by the access subject during the access process are consistent with the object Internet of Things terminal, object data information and operation type in the access monitoring item, the deviation rate information between the data information of the object Internet of Things node and the judgment data is obtained at the same time, a deviation rate threshold is preset, and it is determined whether the deviation rate information is greater than the deviation rate threshold. If greater than, the cumulative time when the deviation rate information is greater than the deviation rate threshold and the deviation rate amplitude between the deviation rate information and the deviation rate threshold are extracted, and a negative reputation value is obtained according to the cumulative time and the deviation rate amplitude, and the initial access reputation value of the access subject is updated in real time according to the negative reputation value.

[0026] Furthermore, the process of obtaining the predicted data information trend within the current collection period of the object IoT node includes:

[0027] Construct a data information trend prediction model based on deep learning, obtain data information within several historical collection cycles of each IoT node, use the data information as a training set and a test set, input the training set into the data information trend prediction model for training until the loss function training is stable, save the model parameters, test the data information trend prediction model with the test set until it meets the preset requirements, and output the data information trend prediction model;

[0028] According to the data information trend prediction model, the predicted data information trend of the current collection cycle of the object Internet of Things node is output.

[0029] Compared with the prior art, the present invention has the following beneficial effects:

[0030] 1. Multi-layer identity authentication increases the difficulty for attackers to illegally access the system because they need to pass multiple verification points. Dynamic verification monitoring can detect abnormal behavior in a timely manner and take corresponding measures, reducing the possibility of security vulnerabilities being exploited and significantly improving security.

[0031] 2. The access trend heat map can adjust the authentication strategy according to the historical access pattern, so that the software access control platform can better adapt to the ever-changing security environment. Dynamic verification monitoring can flexibly adjust the monitoring strategy according to the behavior of the access subject and the status of the IoT node, significantly improving flexibility.

[0032] 3. Multi-layer identity authentication can be automatically adjusted based on the historical behavior of the access subject, reducing disturbances to low-risk users. Access request permission verification ensures that legitimate users can quickly obtain the required permissions while maintaining a high level of security, significantly improving the user experience.

[0033] 4. The combination of access trend heat map and dynamic verification monitoring can more accurately identify the difference between normal access behavior and abnormal behavior, reduce the false alarm rate, and at the same time, through refined access control, it can reduce the occurrence of false alarms caused by excessive restrictions.

[0034] 5. Automated access control decisions reduce the need for manual intervention, improve the system's response speed and overall efficiency, and enhance the system's intelligence and automation level. Compared with traditional static access control methods, there are significant improvements in security, flexibility, user experience, etc., and it can better adapt to complex IoT environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 A schematic diagram of a method for verifying the access identity of computer software according to an embodiment of the present application. DETAILED DESCRIPTION

[0036] The following is a clear and complete description of the technical solutions in the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0037] like Figure 1 As shown, a method for verifying the access identity of computer software includes the following steps:

[0038] Step s1: Build a software access control platform, collect data information of each IoT node, and perform identity verification operations on access requests from access subjects;

[0039] Step s2: construct an access trend heat map of the subject ID based on the historical access log of the subject ID, obtain the identity authentication layer number of the subject ID based on the access trend heat map, perform multi-layer identity verification on the subject ID based on the identity authentication layer number of the subject ID, and when the multi-layer identity verification of the access subject passes, perform access request authority verification on the access subject;

[0040] Step s3: When the access request authority of the access subject is verified, the access monitoring item is set according to the access request of the access subject and the data information of the object IoT node, and the access process of the access subject is dynamically verified and monitored according to the access monitoring item, and the access process of the access subject is controlled according to the dynamic verification and monitoring results.

[0041] It should be further explained that, in the specific implementation process, the process of building a software access control platform, collecting data information of each IoT node, and performing identity verification operations on the access request of the access subject includes:

[0042] Building a software access control platform based on blockchain technology, wherein the software access control platform is communicatively connected to a number of blockchain nodes, the blockchain nodes are interconnected to form a blockchain network, the blockchain nodes are communicatively linked to the IoT terminals, and the blockchain nodes are used to collect data information of the IoT terminals and mark the collection time, and set the collection cycle;

[0043] The access subject logs in to the IoT terminal by entering the subject ID and password, marks the IoT terminal as the subject IoT terminal, and inputs an access request to the subject IoT terminal. The access request includes the object IoT terminal, object data information, and operation type. The IoT terminal packages the subject ID and the access request into a data packet and uploads it to the blockchain node. The software access control platform performs identity verification operations on the data packets received by the blockchain node.

[0044] It should be further explained that, in a specific implementation process, an access trend heat map of the subject ID is constructed based on the historical access log of the subject ID. The process of obtaining the number of identity authentication layers of the subject ID based on the access trend heat map includes:

[0045] Obtain a historical access log of the subject ID in the data packet, wherein the historical access log includes an access timestamp, access frequency and duration of each IoT terminal, operation type (including read: obtaining the status or data of the IoT terminal, write: changing the status or configuration of the IoT terminal, control: sending a command to the IoT terminal, such as turning on or off a certain function, query: requesting specific information of the subject IoT terminal or the object IoT terminal, configuration: modifying the basic settings or advanced settings of the IoT terminal, diagnosis: performing troubleshooting or maintenance tasks, etc.), object data information (including the name, path or identifier of the accessed data, etc.) and access results (including identity verification results, access request authority verification results and dynamic verification monitoring results), perform statistical analysis on the historical access logs, and construct an access trend heat map of the access subject, wherein the access trend heat map includes the access probability, operation type probability, object data information probability and access result probability of the access subject to all IoT terminals within different timestamps;

[0046] It should be further explained that, in the specific implementation process, the historical access logs are statistically analyzed to obtain the calculation formula of the access probability, operation type probability, object data information probability and access result probability of the access subject to all IoT terminals at different timestamps:

[0047]

[0048] Among them, C (a,b) represents the access probability of IoT terminal a to IoT terminal b at timestamp t, nt(a,b) represents the cumulative number of visits from IoT terminal a to IoT terminal b at timestamp t, NT (a,b) represents the total cumulative number of visits from IoT terminal a to IoT terminal b, SE (a,b,i) represents the probability that IoT terminal a performs operation type i on IoT terminal b at timestamp t, nti (a,b) NTI represents the cumulative number of times that IoT terminal a performs operation type i on IoT terminal b at timestamp t. (a,b) represents the total cumulative number of times that IoT terminal a performs all types of operations on IoT terminal b at timestamp t, FV (a,b,j) represents the probability that IoT terminal a accesses object data information j at timestamp t for IoT terminal b, ntj (a,b) It represents the cumulative number of times IoT terminal a accesses object data information j to IoT terminal b at timestamp t, NTJ (a,b) UD represents the total cumulative number of times that IoT terminal a accesses all object data information of IoT terminal b at timestamp t. (a,b,k) represents the probability that the access result of IoT terminal a to IoT terminal b at timestamp t is k, ntk (a,b) NTK represents the cumulative number of times that IoT terminal a accesses IoT terminal b at timestamp t with result k. (a,b) It represents the total cumulative number of all access results of IoT terminal a to IoT terminal b at timestamp t, and α, β, δ, and θ represent conversion coefficients.

[0049] According to the access trend heat map, the access probability of the object IoT terminal, the object data information probability, the operation type probability and the access probability of the subject IoT terminal in the current timestamp data packet are obtained, and the access probability of the object IoT terminal, the object data information probability, the operation type probability and the access probability of the subject IoT terminal are used as evaluation indicators, and the indicator weight matrix and the trend fit level of the evaluation indicator are set, and the membership matrix of the evaluation indicator to the trend fit level is judged by fuzzy comprehensive evaluation;

[0050] The trend matching level of the subject ID is obtained according to the membership matrix and the indicator weight matrix, the number of identity authentication levels of the subject ID is determined according to the trend matching level, and multi-layer identity verification is performed on the subject ID according to the number of identity authentication levels.

[0051] It should be further explained that, in the specific implementation process, the process of obtaining the trend fit level of the subject ID according to the membership matrix and the indicator weight matrix includes:

[0052] The indicator weight matrix and the membership matrix of the evaluation indicator are integrated through a formula to obtain a fuzzy comprehensive evaluation matrix of the evaluation indicator, and the membership of the subject ID for different trend fit levels is obtained according to the fuzzy comprehensive evaluation matrix, and the trend fit level with the highest membership corresponding to the subject ID is screened out, and the trend fit level with the highest membership corresponding to the subject ID is used as the trend fit level of the subject ID;

[0053] Wherein, the formula is:

[0054] M=a1M1×a2M2;

[0055] Among them, M is the fuzzy comprehensive evaluation matrix of the evaluation index, M1 is the indicator weight matrix of the evaluation index, M2 is the membership matrix, "×" represents the multiplication of the elements at corresponding positions of the weight matrix of the evaluation index and the membership matrix, and a1 and a2 are weighting parameters for controlling the balance between the weight matrix and the membership matrix in the fuzzy comprehensive evaluation matrix of the evaluation index.

[0056] It should be further explained that, in the specific implementation process, the software access control platform performs multi-layer identity verification on the subject ID according to the number of subject ID identity verification layers, including:

[0057] The software access control platform pre-builds an ID identification database, which includes identity authentication data corresponding to several identity authentication types of each ID, including email addresses, biometric data, hardware tokens, software tokens, etc.;

[0058] The number k of identity authentication types of the subject ID is determined according to the number of identity authentication layers of the subject ID, several identity authentication types of the ID consistent with the subject ID are obtained from the ID identity recognition database, k identity authentication types are randomly selected from the several identity authentication types, the identity authentication data corresponding to the k identity authentication types are used as the data to be compared, and a multi-factor identity authentication instruction is constructed according to the k identity authentication types, and the multi-factor identity authentication instruction is sent to the Internet of Things terminal logged in by the subject ID. The subject ID sends the identity authentication data to be verified corresponding to the k identity authentication types to the Internet of Things terminal according to the multi-factor identity authentication instruction, and the Internet of Things terminal packages the identity authentication data to be verified into a data packet to be verified and sends it to the blockchain node, and the identity authentication data to be verified corresponding to the k identity authentication types in the data packet to be verified received by the blockchain node are matched with the data to be compared for consistency. If the identity authentication data to be verified corresponding to the k identity authentication types are consistent with the data to be compared, the multi-layer identity of the access subject is verified, and the access request authority of the access subject is verified. If the identity authentication data to be verified corresponding to the k identity authentication types are inconsistent with the data to be compared, the multi-layer identity verification of the access subject fails, and the access request of the access subject is rejected.

[0059] It should be further explained that, in the specific implementation process, when the multi-layer identity verification of the access subject is passed, the process of verifying the access request authority of the access subject includes:

[0060] The permission level of each ID and the permission requirement level of each object data information of each IoT terminal corresponding to different operation types are preset, the permission level of the subject ID in the data packet and the permission requirement level of the operation type corresponding to the object data information of the object IoT terminal are obtained, the permission level is compared with the permission requirement level, if the permission requirement level is greater than or equal to the permission requirement level, the access request of the access subject is allowed, and the dynamic process verification operation of the access subject is performed, if the permission requirement level is less than the permission requirement level, the access subject submits a manual review application document to the software access control platform, and the administrator of the software access control platform determines whether to grant access rights based on the manual review application document.

[0061] It should be further explained that, in the specific implementation process, when the access request authority of the access subject is verified, an access monitoring item is set according to the access request of the access subject and the data information of the object IoT node, and the access process of the access subject is dynamically verified and monitored according to the access monitoring item. The process of controlling the access process of the access subject according to the dynamic verification and monitoring results includes:

[0062] Obtain the level difference between the authority level of the subject ID and the authority requirement level, obtain the initial access credit value of the access subject according to the level difference of the subject ID, the trend matching level and the access result probability, and simultaneously obtain the predicted data information trend within the current acquisition cycle of the object Internet of Things node, the predicted data information trend includes the predicted data type and the predicted data traffic of each type, use the predicted information trend as the judgment data, use the access request of the access subject and the data information of the object Internet of Things node as the access monitoring items, monitor the access process of the access subject in real time according to the access monitoring items, reduce the initial access credit value of the access subject in real time according to the real-time monitoring results, and stop the access process of the access subject when the initial access credit value of the access subject is zero.

[0063] It should be further explained that, in the specific implementation process, the calculation formula for obtaining the initial access reputation value of the access subject according to the level difference of the subject ID, the trend matching level and the access result probability is:

[0064] DVE=γ*exp(a3×WXP+a4×QXP+a5×RSC);

[0065] Among them, DVE represents the initial access reputation value, γ represents the conversion coefficient, WXP represents the level difference, QXP represents the trend fit level, and RSC represents the access result probability.

[0066] It should be further explained that, in the specific implementation process, the access process of the access subject is monitored in real time according to the access monitoring items, and the process of reducing the initial access reputation value of the access subject in real time according to the real-time monitoring results includes:

[0067] When the object IoT terminal, object data information and operation type accessed by the access subject during the access process are inconsistent with the object IoT terminal, object data information and operation type in the access monitoring item, the initial access reputation value of the access subject is cleared;

[0068] When the object Internet of Things terminal, object data information and operation type accessed by the access subject during the access process are consistent with the object Internet of Things terminal, object data information and operation type in the access monitoring item, the deviation rate information between the data information of the object Internet of Things node and the judgment data is obtained at the same time, a deviation rate threshold is preset, and it is determined whether the deviation rate information is greater than the deviation rate threshold. If greater than, the cumulative time when the deviation rate information is greater than the deviation rate threshold and the deviation rate amplitude between the deviation rate information and the deviation rate threshold are extracted, and a negative reputation value is obtained according to the cumulative time and the deviation rate amplitude, and the initial access reputation value of the access subject is updated in real time according to the negative reputation value.

[0069] It should be further explained that, in the specific implementation process, the calculation process of obtaining the deviation rate information between the data information of the object IoT node and the judgment data is as follows:

[0070]

[0071] Where DFA represents the deviation rate information, ns represents the number of identical data types between the data information of the object IoT node and the judgment data, NSD represents the total number of data types between the data information of the object IoT node and the judgment data, and IF pt The data flow corresponding to the data type p of the object IoT node at the tth moment, IFS pt It represents the data flow corresponding to the data type p at the tth moment of the judged data, n1 represents the length of the acquisition cycle, and a6 and a7 represent weight factors.

[0072] It should be further explained that, in the specific implementation process, the calculation formula for obtaining the negative reputation value based on the cumulative time and the deviation rate is:

[0073] DECS=σ*(a8×DT+a9×(DFA-DFAS));

[0074] Among them, σ represents the conversion coefficient, DT represents the accumulation time, DFAS represents the deviation rate threshold, and a8 and a9 represent weight factors.

[0075] It should be further explained that, in the specific implementation process, the process of obtaining the forecast data information trend within the current collection cycle of the object IoT node includes:

[0076] Construct a data information trend prediction model based on deep learning, obtain data information within several historical collection cycles of each IoT node, use the data information as a training set and a test set, input the training set into the data information trend prediction model for training until the loss function training is stable, save the model parameters, test the data information trend prediction model with the test set until it meets the preset requirements, and output the data information trend prediction model;

[0077] According to the data information trend prediction model, the predicted data information trend of the current collection cycle of the object Internet of Things node is output.

[0078] The above embodiments are only used to illustrate the technical method of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A method for verifying the access identity of computer software, characterized in that: The following steps are involved: Step s1: Build a software access control platform, collect data information of each IoT node, and perform identity verification operations on access requests from access subjects; Step s2: construct an access trend heat map of the subject ID based on the historical access log of the subject ID, obtain the identity authentication layer number of the subject ID based on the access trend heat map, perform multi-layer identity verification on the subject ID based on the identity authentication layer number of the subject ID, and when the multi-layer identity verification of the access subject passes, perform access request authority verification on the access subject; Step s3: When the access request authority of the access subject is verified, the access monitoring item is set according to the access request of the access subject and the data information of the object IoT node, and the access process of the access subject is dynamically verified and monitored according to the access monitoring item, and the access process of the access subject is controlled according to the dynamic verification and monitoring results.

2. A method for verifying the access identity of computer software according to claim 1, characterized in that: The process of building a software access control platform, collecting data information from each IoT node, and performing identity verification operations on access requests from access subjects includes: Building a software access control platform based on blockchain technology, wherein the software access control platform is communicatively connected to a number of blockchain nodes, the blockchain nodes are interconnected to form a blockchain network, the blockchain nodes are communicatively linked to the IoT terminals, and the blockchain nodes are used to collect data information of the IoT terminals and mark the collection time, and set the collection cycle; The access subject logs in to the IoT terminal by entering the subject ID and password, marks the IoT terminal as the subject IoT terminal, and inputs an access request to the subject IoT terminal. The access request includes the object IoT terminal, object data information, and operation type. The IoT terminal packages the subject ID and the access request into a data packet and uploads it to the blockchain node. The software access control platform performs identity verification operations on the data packets received by the blockchain node.

3. A method for verifying the access identity of computer software according to claim 2, characterized in that: The process of constructing an access trend heat map of the subject ID based on the historical access logs of the subject ID and obtaining the number of authentication layers of the subject ID based on the access trend heat map includes: Obtain historical access logs of the subject ID in the data packet, perform statistical analysis on the historical access logs, and construct an access trend heat map of the access subject, wherein the access trend heat map includes the access probability, operation type probability, object data information probability, and access result probability of the access subject to all IoT terminals at different timestamps; According to the access trend heat map, the access probability of the object IoT terminal, the object data information probability, the operation type probability and the access probability of the subject IoT terminal in the current timestamp data packet are obtained, and the access probability of the object IoT terminal, the object data information probability, the operation type probability and the access probability of the subject IoT terminal are used as evaluation indicators, and the indicator weight matrix and the trend fit level of the evaluation indicator are set, and the membership matrix of the evaluation indicator to the trend fit level is judged by fuzzy comprehensive evaluation; The trend matching level of the subject ID is obtained according to the membership matrix and the indicator weight matrix, the number of identity authentication levels of the subject ID is determined according to the trend matching level, and multi-layer identity verification is performed on the subject ID according to the number of identity authentication levels.

4. A method for verifying the access identity of computer software according to claim 3, characterized in that: The process of the software access control platform performing multi-layer identity verification on the subject ID according to the number of subject ID authentication layers includes: The software access control platform pre-builds an ID identity recognition database, which includes identity recognition data corresponding to several identity recognition types of each ID; The number k of identity authentication types of the subject ID is determined according to the number of identity authentication layers of the subject ID, several identity authentication types of the ID consistent with the subject ID are obtained from the ID identity recognition database, k identity authentication types are randomly selected from the several identity authentication types, the identity authentication data corresponding to the k identity authentication types are used as the data to be compared, and a multi-factor identity authentication instruction is constructed according to the k identity authentication types, and the multi-factor identity authentication instruction is sent to the Internet of Things terminal logged in by the subject ID. The subject ID sends the identity authentication data to be verified corresponding to the k identity authentication types to the Internet of Things terminal according to the multi-factor identity authentication instruction, and the Internet of Things terminal packages the identity authentication data to be verified into a data packet to be verified and sends it to the blockchain node, and the identity authentication data to be verified corresponding to the k identity authentication types in the data packet to be verified received by the blockchain node are matched with the data to be compared for consistency. If the identity authentication data to be verified corresponding to the k identity authentication types are consistent with the data to be compared, the multi-layer identity of the access subject is verified, and the access request authority of the access subject is verified. If the identity authentication data to be verified corresponding to the k identity authentication types are inconsistent with the data to be compared, the multi-layer identity verification of the access subject fails, and the access request of the access subject is rejected.

5. A method for verifying access identity of computer software according to claim 4, characterized in that: When the multi-layer identity verification of the access subject is passed, the process of verifying the access request permission of the access subject includes: The permission level of each ID and the permission requirement level of each object data information of each IoT terminal corresponding to different operation types are preset, the permission level of the subject ID in the data packet and the permission requirement level of the operation type corresponding to the object data information of the object IoT terminal are obtained, the permission level is compared with the permission requirement level, if the permission requirement level is greater than or equal to the permission requirement level, the access request of the access subject is allowed, and the dynamic process verification operation of the access subject is performed, if the permission requirement level is less than the permission requirement level, the access subject submits a manual review application document to the software access control platform, and the administrator of the software access control platform determines whether to grant access rights based on the manual review application document.

6. A method for verifying the access identity of computer software according to claim 5, characterized in that: When the access request authority of the access subject is verified, an access monitoring item is set according to the access request of the access subject and the data information of the object IoT node, and the access process of the access subject is dynamically verified and monitored according to the access monitoring item. The process of controlling the access process of the access subject according to the dynamic verification and monitoring results includes: Obtain the level difference between the authority level and the authority requirement level of the subject ID, obtain the initial access credibility of the access subject according to the level difference of the subject ID, the trend matching level and the access result probability, and simultaneously obtain the predicted data information trend within the current acquisition cycle of the object Internet of Things node, use the predicted information trend as the judgment data, use the access request of the access subject and the data information of the object Internet of Things node as the access monitoring items, monitor the access process of the access subject in real time according to the access monitoring items, reduce the initial access credibility of the access subject in real time according to the real-time monitoring results, and stop the access process of the access subject when the initial access credibility of the access subject is zero.

7. A method for verifying the access identity of computer software according to claim 6, characterized in that: The process of monitoring the access process of the access subject in real time according to the access monitoring items and reducing the initial access reputation value of the access subject in real time according to the real-time monitoring results includes: When the object IoT terminal, object data information and operation type accessed by the access subject during the access process are inconsistent with the object IoT terminal, object data information and operation type in the access monitoring item, the initial access reputation value of the access subject is cleared; When the object Internet of Things terminal, object data information and operation type accessed by the access subject during the access process are consistent with the object Internet of Things terminal, object data information and operation type in the access monitoring item, the deviation rate information between the data information of the object Internet of Things node and the judgment data is obtained at the same time, a deviation rate threshold is preset, and it is determined whether the deviation rate information is greater than the deviation rate threshold. If greater than, the cumulative time when the deviation rate information is greater than the deviation rate threshold and the deviation rate amplitude between the deviation rate information and the deviation rate threshold are extracted, and a negative reputation value is obtained according to the cumulative time and the deviation rate amplitude, and the initial access reputation value of the access subject is updated in real time according to the negative reputation value.

8. A method for verifying the access identity of computer software according to claim 7, characterized in that: The process of obtaining the forecast data information trend within the current collection cycle of the object IoT node includes: Construct a data information trend prediction model based on deep learning, obtain data information within several historical collection cycles of each IoT node, use the data information as a training set and a test set, input the training set into the data information trend prediction model for training until the loss function training is stable, save the model parameters, test the data information trend prediction model with the test set until it meets the preset requirements, and output the data information trend prediction model; According to the data information trend prediction model, the predicted data information trend of the current collection cycle of the object Internet of Things node is output.

Images