Security controllable method and system based on strong identity authentication and data access

Abstract

The invention discloses a data access security controllable method and system based on strong identity authentication, and relates to the technical field of information security, and the method comprises the steps: employing an elliptic curve cryptographic algorithm in combination with a multi-factor identity authentication mechanism, and carrying out the authentication of each login request; according to the user information, a fine-grained access control strategy is formulated and implemented, and an ECC encryption control strategy is used; collecting user behavior data, and performing ECC encryption storage; constructing a user behavior model by using a machine learning algorithm, and identifying normal behaviors and abnormal behaviors; user behaviors are monitored in real time, and early warning and safety measure triggering are carried out for abnormal behaviors. According to the invention, an elliptic curve cryptographic algorithm (ECC) is combined with a multi-factor identity authentication mechanism, so that the security and speed of identity authentication are improved. And the user access authority is dynamically adjusted to prevent data leakage and authority abuse. The network security protection capability of the hydropower station computer monitoring system is improved, and stable operation of power production is guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method and system based on strong identity authentication and data access security control. Background Art

[0002] The computer monitoring system of a hydropower station is an important information system that uses electronic computers to monitor and control the entire process of the power production business of the hydropower station in real time, ensuring the safe, stable and efficient operation of the hydropower station. It is of great significance to ensure the reliable supply of electricity. With the continuous development of modern industry, information systems play an increasingly important role in the operation and management of hydropower stations. However, in recent years, the network security situation of information systems has become increasingly severe. Network attacks on the computer monitoring system of hydropower stations are fast-acting, have a wide range of impact, and cause great social damage. The computer monitoring system of a hydropower station often becomes the focus of network attacks. Therefore, how to effectively improve the network security protection capabilities of the computer monitoring system of a hydropower station has become a major issue that needs to be solved urgently. As an important means in the field of information security, the application of commercial cryptographic technology plays a key role in ensuring the security of information systems.

[0003] Although commercial cryptography plays an important role in information security protection, the existing related technologies still have many shortcomings in practical applications. First, the traditional single-factor authentication method, such as relying solely on passwords for authentication, is vulnerable to brute force cracking and social engineering attacks, and it is difficult to provide sufficient security. Secondly, even multi-factor authentication, due to its complexity and user experience issues, often leads to cumbersome user operations and slow login process, which in turn affects the overall efficiency of the system and user satisfaction. In addition, the existing access control strategy is relatively rough and cannot perform fine-grained access control based on the user's dynamic behavior and real-time environment, resulting in an increased risk of data leakage and abuse of authority. In the process of data storage and transmission, although the existing technology adopts certain encryption measures, due to the complexity of the encryption algorithm and the difficulty of key management, there are still hidden dangers of being cracked and data being stolen. Especially in the computer monitoring system of hydropower stations, due to the involvement of a large amount of real-time data and critical operations, the existing security protection measures are difficult to meet the dual needs of high security and high efficiency.

[0004] In summary, existing information security technologies still have many shortcomings in identity authentication, data access control and user behavior monitoring, especially the traditional single-factor identity authentication is easy to crack, the access control strategy is rough, and the data encryption storage is not secure enough. Summary of the invention

[0005] In view of the above-mentioned problems, the present invention is proposed.

[0006] Therefore, the technical problem solved by the present invention is: in view of the deficiencies in the existing hydropower station computer monitoring system in identity authentication, data access control and user behavior monitoring, how to ensure the security and reliability of the system, reduce the risk of network attacks, and ensure the stable operation of power production.

[0007] To solve the above technical problems, the present invention provides the following technical solutions: A method based on strong identity authentication and data access security control, comprising: using the elliptic curve cryptography algorithm ECC combined with a multi-factor identity authentication mechanism to authenticate each login request;

[0008] Develop and implement fine-grained access control policies based on user information, and use ECC encryption control policies;

[0009] Collect user behavior data and store it in ECC encrypted form;

[0010] Use machine learning algorithms to build user behavior models and identify normal and abnormal behaviors;

[0011] Monitor user behavior in real time, issue warnings and trigger security measures for abnormal behavior.

[0012] As a preferred solution of the method based on strong identity authentication and data access security controllable according to the present invention, wherein: the authentication of each login request includes generating a public key and a private key pair of the user through an ECC algorithm, and the private key k is generated by the system through integration according to a random number generator, which is expressed as:

[0013]

[0014] Among them, ∈(t) represents the time function, which is specifically defined as:

[0015]

[0016] The public key P is derived from the private key through elliptic curve point multiplication, expressed as:

[0017]

[0018] Among them, η(t) is used to introduce corrections in the public key generation process and is defined as:

[0019] η(t)=αt 3 +βln(t+1)+γ1e -μt +δ1sin(ξt)

[0020] Among them, ζ(τ) represents the secondary correction term, which is defined as:

[0021] ζ(τ)=στ 2 +ρcosh(vτ)+K

[0022] Wherein, T represents the upper limit of integration, ∈(t) represents the function of the time variable t, G represents the base point of the elliptic curve, A represents the amplitude of the sine function, ω represents the angular frequency of the sine function, ψ represents the phase of the sine function, B represents the coefficient of the exponential decay term, λ represents the decay constant of the exponential decay term, C represents the amplitude of the cosine function, γ represents the angular frequency of the cosine function, D represents the coefficient of the square root term, E represents the coefficient of the hyperbolic tangent function, δ represents the parameter of the hyperbolic tangent function, F represents the coefficient of the inverse tangent function, and θ represents the parameter of the inverse tangent function; α represents the coefficient of the polynomial term, β represents the coefficient of the logarithmic function term, γ1 represents the coefficient of the exponential decay term, μ represents the parameter of the exponential decay term, δ1 represents the coefficient of the sine function term, and ξ represents the angular frequency of the sine function; σ represents the coefficient of the quadratic term, ρ represents the coefficient of the hyperbolic cosine function term, v represents the parameter of the hyperbolic cosine function term, and K represents the constant term; τ represents the intermediate time variable, which is used as the independent variable in the secondary corrected integral and is the time point before time t;

[0023] When a user registers for the first time, the system generates a public key and a private key pair, and stores the public key in the authentication server and the private key in the user's device;

[0024] When the user logs in, the private key k is used to sign the randomly generated challenge message C1. The challenge message C1 is expressed as:

[0025]

[0026] Where j represents the sum index, ranging from 1 to m; α j and β j represents the coefficients and variables in the challenge message generation process;

[0027] The signature generation process is:

[0028] r=(kG) x

[0029] s=k -1 (H(m)+rd A )mod q

[0030] Where r and s represent signatures, x represents the horizontal coordinate of a point on the elliptic curve, H(m) represents the hash value of the message, and d A represents the user's private key, and q represents the order of the elliptic curve;

[0031] The authentication server uses the stored public key P to verify the validity of the signature. The verification process is as follows:

[0032] u1=s -1 H(m)mod q

[0033] u2=s -1 r mod q

[0034] Among them, u1 and u2 represent intermediate variables in the signature verification process;

[0035] Calculate the verification point R, expressed as:

[0036] R=u1G+u2Q

[0037] Among them, Q represents the user's public key;

[0038] And verify: R x ≡r mod q;

[0039] When the horizontal coordinate R of the verification point R x When the signature r satisfies the congruence relationship, it indicates that the signature calculation and public key verification are consistent, the signature is valid, the user identity is confirmed, and the subsequent verification continues;

[0040] When the horizontal coordinate R of the verification point R x When the signature r does not satisfy the congruence relationship, it indicates that the signature calculation and public key verification are inconsistent, the signature is invalid, the user identity is not confirmed, the user's access request is rejected, and the failed login attempt is recorded.

[0041] As a preferred solution of the method based on strong identity authentication and data access security controllable according to the present invention, wherein: the authentication of each login request also includes further verifying the user identity using biometrics, and realizing multi-factor authentication in combination with a dynamic verification code, and the multi-factor authentication result M is expressed as:

[0042]

[0043] Where i represents the index of the product, ranging from 1 to n; b i represents the weight coefficient of the i-th factor, f i represents the function used for the authentication of the i-th factor, v i represents the input variable of the i-th factor;

[0044] f i (v i ) is specifically expressed as:

[0045]

[0046] Among them, a i represents the amplitude coefficient of the sine function, b i represents the frequency coefficient of the sine function, c i Represents the phase shift of the sine function, d i represents the coefficient of the exponential function, e irepresents the exponential coefficient of the exponential function, g i represents the coefficient of the logarithmic function, h i Represents the cardinality coefficient of the logarithmic function;

[0047] Perform comprehensive authentication and confirm the authentication results, expressed as:

[0048]

[0049] Wherein, A represents the result of the comprehensive authentication formula. If A>1, it means that the authentication is successful and data access is allowed; if A≤1, it means that the authentication fails, the user's access request is rejected, and the failed login attempt is recorded.

[0050] 5. As a preferred solution of the method based on strong identity authentication and data access security control described in the present invention, the formulation and implementation of fine-grained access control strategy includes defining corresponding access rights according to the user's role in the system;

[0051] Assign different permission levels according to different user roles, and determine the resources and operation permissions that each role can access;

[0052] Match the corresponding permissions based on the user's specific access needs to ensure that the user can only access the resources required for their work;

[0053] Generate the original access control policy S based on user roles, permission levels and access requirements.

[0054] As a preferred solution of the method based on strong identity authentication and data access security control described in the present invention, wherein: the use of the ECC encryption control strategy includes using the ECC algorithm to encrypt the generated access control strategy S to generate an encryption strategy E S , the formula is:

[0055] E S =Encrypt ECC (S, k)

[0056] Among them, Encrypt ECC Indicates that the ECC algorithm is used for encryption;

[0057] The encrypted access control policy E S Stored in the authentication server;

[0058] When the user issues an access request, the authentication server sends the encrypted access control policy E S Transmitted to the system components that require verification;

[0059] The system component receives the encrypted access control policy E SAfter that, the ECC decryption algorithm is used to decrypt and obtain the original access control policy S, which is expressed as:

[0060] S=Decrypt ECC (E S , k)

[0061] Among them, Decrypt ECC Indicates that the ECC algorithm is used for decryption;

[0062] The system verifies and processes the user's access request based on the decrypted original access control policy S to ensure that the user can only access the resources he or she is authorized to access.

[0063] As a preferred solution of the method based on strong identity authentication and data access security controllable according to the present invention, wherein: the collected user behavior data includes login time, accessed resources, operation frequency, operation commands, device information, geographic location and login IP address;

[0064] Pre-process the collected user behavior data, including data cleaning, format conversion, and deduplication;

[0065] The ECC encrypted storage includes encrypting the pre-processed user behavior data D using an elliptic curve cryptographic algorithm and storing the encrypted user behavior data E D Stored in the system's database;

[0066] When you need to access and analyze user behavior data, use the corresponding decryption key to encrypt the data E D Decrypt and obtain the original data D.

[0067] 8. As a preferred solution of the method based on strong identity authentication and data access security and controllability described in the present invention, wherein: the use of a machine learning algorithm to construct a user behavior model includes using a neural network model to process user behavior data and an integrated learning model to combine the outputs of multiple base learners to construct a user behavior model;

[0068] The neural network model f NN (x u ) is expressed as:

[0069]

[0070] Among them, x u represents the input feature vector, P represents the number of neural networks, p represents the index of the neural network, Q represents the length of the time window, q represents the time index, σ1 represents the activation function, U represents the number of input features, u represents the index of the input feature, L represents the dimension of the feature, and l represents the index of the feature dimension; w purepresents the u-th input feature of the p-th neural network, x uwq represents the lth dimension of the uth feature at the qth time; b p represents the bias of the pth neural network;

[0071] The integrated learning model f EL (x u ) is expressed as:

[0072]

[0073] Where V represents the number of base learners, v represents the index of the base learner, and α v represents the weight of the vth base learner, μ represents the decay factor; K(x v , x p ) represents the kernel function, which measures the input feature x v and x p Similarity of x v represents the input feature of the vth base learner, x p represents the input features at time q;

[0074] The user behavior model U(x u ) is expressed as:

[0075] U(x u )=f NN (x u )+f EL (x u )

[0076] Convert real-time data into feature vector X real , as the input feature vector;

[0077] Use the trained model to predict the feature vector and identify the behavior category y predict :

[0078] y predict =U(X real )

[0079] The warning and triggering of safety measures for abnormal behavior include setting an abnormal behavior judgment threshold θ. predict >θ, the current user behavior is judged to be abnormal, the data information of the abnormal behavior is recorded in the system log, an early warning notification is immediately sent to the security management personnel, and the subsequent operations of the current user are restricted;

[0080] When predict When ≤θ, the current user behavior is judged to be normal, and the current user is allowed to continue his current operation and access resources without intervention.

[0081] A secure and controllable system based on strong identity authentication and data access, characterized by: including:

[0082] Identity authentication module: uses the elliptic curve cryptography algorithm ECC combined with a multi-factor identity authentication mechanism to authenticate each login request;

[0083] Fine-grained access control module: formulates and implements fine-grained access control policies based on user information, and uses ECC encryption control policies;

[0084] User behavior data collection module: collects user behavior data and performs ECC encryption storage;

[0085] User behavior modeling module: Use machine learning algorithms to build user behavior models and identify normal and abnormal behaviors;

[0086] Real-time monitoring and security response module: monitor user behavior in real time, issue early warnings and trigger security measures for abnormal behavior.

[0087] Beneficial effects of the invention: The invention adopts elliptic curve cryptography (ECC) combined with a multi-factor identity authentication mechanism to improve the security and speed of identity authentication. Dynamically adjust user access rights to prevent data leakage and abuse of rights. Use ECC to encrypt and store user behavior data to ensure data privacy and security. Use machine learning to identify normal and abnormal behaviors in real time, provide early warning and security response. Improve the network security protection capability of the hydropower station computer monitoring system to ensure stable operation of power production. BRIEF DESCRIPTION OF THE DRAWINGS

[0088] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the figures required for use in the description of the embodiments will be briefly introduced below. Obviously, the figures described below are only some embodiments of the present invention. For ordinary technicians in this field, other figures can be obtained based on these figures without paying creative work.

[0089] Figure 1 A flowchart of a method for secure and controllable data access based on strong identity authentication is provided for the first embodiment of the present invention. DETAILED DESCRIPTION

[0090] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the specification drawings. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0091] Example 1, reference Figure 1 , is an embodiment of the present invention, providing a controllable method based on strong identity authentication and data access security, including:

[0092] S1: The elliptic curve cryptography algorithm ECC is combined with a multi-factor identity authentication mechanism to authenticate each login request.

[0093] The user's public key and private key pair are generated by the ECC algorithm. The private key k is generated by the system through integration based on the random number generator, expressed as:

[0094]

[0095] Among them, ∈(t) is specifically defined as:

[0096]

[0097] The public key P is derived from the private key through elliptic curve point multiplication, expressed as:

[0098]

[0099] Among them, η(t) is used to introduce corrections in the public key generation process and is defined as:

[0100] η(t)=αt 3 +βln(t+1)+γ1e -μt +δsin(ξt)

[0101] ζ(τ) represents the secondary correction term, which is defined as:

[0102] ζ(τ)=στ 2 +ρcosh(vτ)+K

[0103] Wherein, T represents the upper limit of integration, ∈(t) represents the function of the time variable t, G represents the base point of the elliptic curve, A represents the amplitude of the sine function, ω represents the angular frequency of the sine function, ψ represents the phase of the sine function, B represents the coefficient of the exponential decay term, λ represents the decay constant of the exponential decay term, C represents the amplitude of the cosine function, γ represents the angular frequency of the cosine function, D represents the coefficient of the square root term, E represents the coefficient of the hyperbolic tangent function, δ represents the parameter of the hyperbolic tangent function, F represents the coefficient of the inverse tangent function, and θ represents the parameter of the inverse tangent function; α represents the coefficient of the polynomial term, β represents the coefficient of the logarithmic function term, γ1 represents the coefficient of the exponential decay term, μ represents the parameter of the exponential decay term, δ1 represents the coefficient of the sine function term, and ξ represents the angular frequency of the sine function; σ represents the coefficient of the quadratic term, ρ represents the coefficient of the hyperbolic cosine function term, v represents the parameter of the hyperbolic cosine function term, and K represents the constant term; τ represents the intermediate time variable, which is used as the independent variable in the secondary corrected integral and is the time point before time t.

[0104] When a user registers for the first time, the system generates a public key and a private key pair, stores the public key in the authentication server, and the private key in the user's device.

[0105] When the user logs in, the private key k is used to sign the randomly generated challenge message C1. The challenge message C1 is expressed as:

[0106]

[0107] Where j represents the sum index, ranging from 1 to m; α j and β j Represents the coefficients and variables in the challenge message generation process.

[0108] The signature generation process is:

[0109] r=(kG) x

[0110] s=k -1 (H(m)+rd A )mod q

[0111] Where r and s represent signatures, x represents the horizontal coordinate of a point on the elliptic curve, H(m) represents the hash value of the message, and d A represents the user's private key, and q represents the order of the elliptic curve.

[0112] The authentication server uses the stored public key P to verify the validity of the signature. The verification process is as follows:

[0113] u1=s -1 H(m)mod q

[0114] u2=s -1 r mod q

[0115] Among them, u1 and u2 represent intermediate variables in the signature verification process.

[0116] Calculate the verification point R, expressed as:

[0117] R=u1G+u2Q

[0118] Among them, Q represents the user's public key.

[0119] And verify: R x ≡r mod q; when the horizontal coordinate R of the verification point R x When the signature r satisfies the congruence relationship, it indicates that the signature calculation and public key verification are consistent, the signature is valid, the user identity is confirmed, and the subsequent verification continues; when the horizontal coordinate R of the verification point R xWhen the signature r does not satisfy the congruence relationship, it indicates that the signature calculation and public key verification are inconsistent, the signature is invalid, the user identity is not confirmed, the user's access request is rejected, and the failed login attempt is recorded.

[0120] It should be noted that when a user logs in, the randomly generated challenge message is signed with a private key, and the authentication server uses the public key to verify the validity of the signature to ensure the legitimacy of the login request. The complexity of the mathematical operations in the signature generation and verification process increases the difficulty of forgery and ensures the security of the login process.

[0121] Biometrics are used to further verify the user's identity, and multi-factor authentication is achieved in combination with dynamic verification codes. The multi-factor authentication result M is expressed as:

[0122]

[0123] Where i represents the index of the product, ranging from 1 to n; b i represents the weight coefficient of the i-th factor, f i represents the function used for the authentication of the i-th factor, v i Represents the input variable of the i-th factor.

[0124] f i (v i ) is specifically expressed as:

[0125]

[0126] Among them, a i represents the amplitude coefficient of the sine function, b i represents the frequency coefficient of the sine function, c i Represents the phase shift of the sine function, d i represents the coefficient of the exponential function, e i represents the exponential coefficient of the exponential function, g i represents the coefficient of the logarithmic function, h i Represents the cardinality coefficient of the logarithmic function.

[0127] Perform comprehensive authentication and confirm the authentication results, expressed as:

[0128]

[0129] Wherein, A represents the result of the comprehensive authentication formula. If A>1, it means that the authentication is successful and data access is allowed; if A≤1, it means that the authentication fails, the user's access request is rejected, and the failed login attempt is recorded.

[0130] Furthermore, the user's public key and private key pair are generated through the ECC algorithm, so that each authentication request has high-strength encryption protection. Compared with the traditional RSA algorithm, the ECC algorithm can provide equal or even higher security with a shorter key length, thereby improving the overall security level of the system. While providing high security, the ECC algorithm has high computing efficiency, reducing the computing time during the login authentication process and improving the user experience.

[0131] Furthermore, by combining biometrics (such as fingerprints and facial recognition) and dynamic verification codes, multi-factor identity authentication is achieved, which significantly improves the system's protection level. Even if one authentication factor is compromised, the attacker still needs to pass other authentication factors, which increases the difficulty of the attack.

[0132] S2: Develop and implement fine-grained access control policies based on user information and use ECC encryption control policies.

[0133] Define corresponding access rights according to the user's role in the system.

[0134] Assign different permission levels according to different user roles, and determine the resources and operation permissions that each role can access.

[0135] Based on the user's specific access needs, match the corresponding permissions to ensure that the user can only access the resources required for their work.

[0136] Generate the original access control policy S based on user roles, permission levels and access requirements.

[0137] Use the ECC algorithm to encrypt the generated access control policy S to generate the encrypted policy E S , the formula is:

[0138] E S =Encrypt ECC (S, k)

[0139] Among them, Encrypt ECC Indicates that the ECC algorithm is used for encryption.

[0140] The encrypted access control policy E S Stored in the authentication server.

[0141] When the user issues an access request, the authentication server sends the encrypted access control policy E S Transmitted to system components that require authentication.

[0142] The system component receives the encrypted access control policy E S After that, the ECC decryption algorithm is used to decrypt and obtain the original access control policy S, which is expressed as:

[0143] S=Decrypt ECC (E S , k)

[0144] Among them, Decrypt ECC Indicates that the ECC algorithm is used for decryption.

[0145] The system verifies and processes the user's access request based on the decrypted original access control policy S to ensure that the user can only access the resources he or she is authorized to access.

[0146] It should be noted that by formulating fine-grained access control policies based on user roles, permission levels, and specific access requirements, we ensure that each user can only access the resources required for their work and avoid unnecessary abuse of permissions. The generated access control policies are encrypted using the ECC algorithm to ensure that the policies are not stolen or tampered with during storage and transmission. The efficiency and security of the ECC algorithm ensure the reliability of the encrypted policies. Dynamically generate and adjust access control policies based on user roles and access requirements to ensure the flexibility and adaptability of the system and to respond to changes in permissions in a timely manner.

[0147] S3: Collects user behavior data and stores it in an ECC encrypted format.

[0148] User behavior data collected includes login time, resources accessed, operation frequency, operation commands, device information, geographic location and login IP address.

[0149] Preprocess the collected user behavior data, including data cleaning, format conversion, and deduplication.

[0150] The pre-processed user behavior data D is encrypted using the elliptic curve cryptography algorithm, and the encrypted user behavior data E is D Stored in the system's database.

[0151] When you need to access and analyze user behavior data, use the corresponding decryption key to encrypt the data E D Decrypt and obtain the original data D.

[0152] Furthermore, feature extraction is performed on the decrypted user behavior data to extract feature vectors related to the user behavior, including but not limited to the following:

[0153] Time characteristics: such as login time, operation frequency, time interval between each operation, etc.

[0154] Spatial features: such as login IP address, geographic location information, etc.

[0155] Device characteristics: such as device ID, operating system type, browser type, etc.

[0156] Operation characteristics: such as the type of resource accessed, operation command, number of operations, etc.

[0157] It should be noted that the pre-processed user behavior data is encrypted using the ECC algorithm to ensure the security of the data during storage and prevent the data from being stolen or tampered with. The efficiency and security of the ECC algorithm make the encryption and decryption process faster and more reliable. Through data preprocessing, including data cleaning, format conversion and deduplication, the accuracy and standardization of the data are ensured, and the efficiency and accuracy of subsequent data analysis are improved. When it is necessary to access and analyze user behavior data, decrypting the original data and performing feature extraction will help build a user behavior model and identify normal and abnormal behaviors, thereby improving the security monitoring capabilities of the system.

[0158] S4: Use machine learning algorithms to build user behavior models and identify normal and abnormal behaviors.

[0159] The user behavior model is constructed by using a neural network model to process user behavior data and an ensemble learning model to combine the outputs of multiple base learners.

[0160] Neural network model f NN (x u ) is expressed as:

[0161]

[0162] Among them, x u represents the input feature vector, P represents the number of neural networks, p represents the index of the neural network, Q represents the length of the time window, q represents the time index, σ1 represents the activation function, U represents the number of input features, u represents the index of the input feature, L represents the dimension of the feature, and l represents the index of the feature dimension; w pu represents the u-th input feature of the p-th neural network, x uwq represents the lth dimension of the uth feature at the qth time; b p represents the bias of the p-th neural network.

[0163] Ensemble learning model f EL (x u ) is expressed as:

[0164]

[0165] Where V represents the number of base learners, v represents the index of the base learner, and α v represents the weight of the vth base learner, μ represents the decay factor; K(x v , x p ) represents the kernel function, which measures the input feature x v and xp Similarity of x v represents the input feature of the vth base learner, x p Represents the input features at time q.

[0166] User behavior model U(x u ) is expressed as:

[0167] U(x u )=f NN (x u )+f EL (x u )

[0168] Convert real-time data into feature vector X real , as the input feature vector; use the trained model to predict the feature vector and identify the behavior category y predict :

[0169] y predict =U(X real )

[0170] It should be noted that the neural network model can capture the complex relationship and interaction effects between input features through multi-layer nonlinear transformation and feature multiplication. For example, features such as login time and operation frequency can be processed by the neural network model to identify the normal operation mode of the user. The ensemble learning model enhances the robustness and generalization ability of the model by combining the outputs of multiple base learners. For example, different base learners can process different types of user behavior data respectively, and finally obtain more accurate behavior prediction results through weight combination. Convert real-time data into feature vectors, use the trained model to predict the feature vectors, and identify the behavior category. This process can be applied to various security monitoring scenarios, such as identifying abnormal logins, detecting suspicious operations, etc., to improve the overall security of the system.

[0171] S5: Monitor user behavior in real time, issue warnings and trigger security measures for abnormal behavior.

[0172] Set the abnormal behavior judgment threshold θ, when ypredi c When t>θ, the current user behavior is judged to be abnormal behavior, the data information of the abnormal behavior is recorded in the system log, an early warning notification is immediately sent to the security management personnel, and the subsequent operations of the current user are restricted.

[0173] When predict When ≤θ, the current user behavior is judged to be normal, and the current user is allowed to continue his current operation and access resources without intervention.

[0174] Furthermore, for users who are judged to have abnormal behavior, the system restricts their subsequent operations to prevent further threats. At the same time, the detailed information of abnormal behavior is recorded in the system log for subsequent security analysis and audit. The log record includes information such as the time, type, user ID, and specific operation of the abnormal behavior, providing detailed security event tracking.

[0175] The above embodiments also include a system based on strong identity authentication and data access security control, specifically:

[0176] Identity authentication module: The elliptic curve cryptography algorithm ECC is combined with a multi-factor identity authentication mechanism to authenticate each login request.

[0177] Fine-grained access control module: Develop and implement fine-grained access control policies based on user information, and use ECC encryption control policies.

[0178] User behavior data collection module: collects user behavior data and stores it in ECC encrypted form.

[0179] User behavior modeling module: Use machine learning algorithms to build user behavior models and identify normal and abnormal behaviors.

[0180] Real-time monitoring and security response module: monitor user behavior in real time, issue early warnings and trigger security measures for abnormal behavior.

[0181] The computer device may be a server. The computer device includes a processor, a memory, an input / output interface (I / O for short) and a communication interface. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data cluster data of a power monitoring system. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a secure and controllable method based on strong identity authentication and data access is implemented.

[0182] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0183] Example 2 is an embodiment of the present invention, which provides a secure and controllable method based on strong identity authentication and data access. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation / comparative experiments.

[0184] The test objects include: a system adopting the technical solution of the present invention (system A) and a system adopting traditional identity authentication and access control strategies (system B).

[0185] The test steps are as follows:

[0186] The two systems are deployed in the same hardware environment and installed with the same operating system and basic software to ensure the consistency of the experimental environment.

[0187] Set up 100 users to log in and authenticate in the two systems respectively, and record the authentication time and success rate of each login. System A uses ECC combined with multi-factor identity authentication mechanism, and system B uses traditional password authentication.

[0188] According to different user roles, 10 different permission levels are set, access rights are allocated, and the response time and accuracy of each system to permission control are recorded. System A uses fine-grained access control strategy and ECC encryption, while system B uses traditional access control strategy.

[0189] The daily operation behaviors of users are simulated in the two systems, including login time, access resources, operation frequency, operation commands, device information, geographic location and login IP address, etc., and the time of data collection and storage as well as data security are recorded. System A stores data with ECC encryption, while system B uses traditional encryption.

[0190] The user behavior data of the two systems were modeled using machine learning algorithms to evaluate the model building time and accuracy. System A used neural networks and ensemble learning models, while System B used traditional statistical models.

[0191] The two systems are monitored in real time, the same abnormal behavior judgment threshold is set, and the abnormal behavior detection time and false alarm rate are recorded. System A extracts features and warns based on real-time data, while system B uses fixed rules to detect abnormal behavior. The specific data is shown in Table 1.

[0192] Table 1 Experimental data comparison table

[0193]

[0194] Through the comparative analysis of the above experimental data, we can clearly see the performance differences between System A and System B in each key step.

[0195] The average authentication time of system A is 1.5 seconds, while that of system B is 4.2 seconds. System A uses ECC combined with a multi-factor authentication mechanism to significantly improve the authentication speed, while the authentication success rate reaches 99.8%, which is higher than the 96.5% of system B. This result shows that the use of the ECC algorithm not only improves the authentication efficiency, but also enhances the reliability of authentication and reduces the probability of authentication failure.

[0196] The access control response time of system A is 45 milliseconds, which is much lower than the 250 milliseconds of system B. This shows that the fine-grained access control policy can respond to user permission requests more quickly. At the same time, the permission control accuracy of system A reaches 100%, which is significantly higher than the 88% of system B. This result proves the efficiency and accuracy of the ECC encryption control policy in permission allocation and adjustment.

[0197] The data collection and storage time of system A is 0.6 seconds, which is significantly faster than the 2.3 seconds of system B. System A uses the ECC algorithm to encrypt and store data, ensuring the security and privacy of the data. Its data security score is 100%, which is higher than the 87% of system B. This verifies the advantages of the ECC algorithm in data security storage and can more effectively protect user behavior data.

[0198] The model building time of system A is 55 seconds, while that of system B is 165 seconds. The accuracy of system A also reaches 98.7%, which is better than the 91.2% of system B. Through the combination of neural network and ensemble learning model, system A can build a high-precision user behavior model more quickly, effectively improving the accuracy of behavior analysis.

[0199] The abnormal behavior detection time of system A is 28 milliseconds, which is significantly shorter than the 135 milliseconds of system B, and the false alarm rate of system A is 1.1%, which is lower than the 4.8% of system B. System A achieves more timely and accurate abnormal behavior warnings through feature extraction of real-time data and machine learning algorithms, effectively reducing the false alarm rate.

[0200] In summary, the technical solution of the present invention has shown significant performance advantages and innovations in all key steps. By adopting the ECC algorithm, multi-factor identity authentication mechanism, fine-grained access control strategy, encrypted storage of user behavior data and machine learning algorithm to build a user behavior model and real-time monitoring and early warning system, the security, efficiency and reliability of the system are effectively improved, overcoming many deficiencies in the prior art. These improvements have not only been verified in experimental data, but also reflect the broad prospects and important value of the present invention in practical applications.

[0201] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method based on strong identity authentication and data access security controllable method, characterized in that: include: The elliptic curve cryptography algorithm ECC is used in combination with a multi-factor identity authentication mechanism to authenticate each login request; Develop and implement fine-grained access control policies based on user information, and use ECC encryption control policies; Collect user behavior data and store it in ECC encrypted form; Use machine learning algorithms to build user behavior models and identify normal and abnormal behaviors; Monitor user behavior in real time, issue warnings and trigger security measures for abnormal behavior.

2. The method for secure and controllable data access based on strong identity authentication as claimed in claim 1, characterized in that: The authentication of each login request includes generating a public key and a private key pair of the user through an ECC algorithm, and the private key k is generated by the system through integration according to a random number generator, which is expressed as: Among them, ∈(t) represents the time function, which is specifically defined as: The public key P is derived from the private key through elliptic curve point multiplication, expressed as: Among them, η(t) is used to introduce corrections in the public key generation process and is defined as: n(t)=αt 3 +βln(t+1)+γ1e -μt +δ1sin(ζt) Among them, ζ(τ) represents the secondary correction term, which is defined as: g(t)=f 2 +pcosh(vτ)+k Wherein, T represents the upper limit of integration, ∈(t) represents the function of the time variable t, G represents the base point of the elliptic curve, A represents the amplitude of the sine function, ω represents the angular frequency of the sine function, ψ represents the phase of the sine function, B represents the coefficient of the exponential decay term, λ represents the decay constant of the exponential decay term, C represents the amplitude of the cosine function, γ represents the angular frequency of the cosine function, D represents the coefficient of the square root term, E represents the coefficient of the hyperbolic tangent function, δ represents the parameter of the hyperbolic tangent function, F represents the coefficient of the inverse tangent function, and θ represents the parameter of the inverse tangent function; α represents the coefficient of the polynomial term, β represents the coefficient of the logarithmic function term, γ1 represents the coefficient of the exponential decay term, μ represents the parameter of the exponential decay term, δ1 represents the coefficient of the sine function term, and ξ represents the angular frequency of the sine function; σ represents the coefficient of the quadratic term, ρ represents the coefficient of the hyperbolic cosine function term, v represents the parameter of the hyperbolic cosine function term, and κ represents the constant term; τ represents the intermediate time variable, which is used as the independent variable in the secondary corrected integral and is the time point before time t; When a user registers for the first time, the system generates a public key and a private key pair, and stores the public key in the authentication server and the private key in the user's device; When the user logs in, the private key k is used to sign the randomly generated challenge message C1. The challenge message C1 is expressed as: Where j represents the sum index, ranging from 1 to m; α j and β j represents the coefficients and variables in the challenge message generation process; The signature generation process is: r=(kG) x s=k -1 (H(m)+rd A )mod q Where r and s represent signatures, x represents the horizontal coordinate of a point on the elliptic curve, H(m) represents the hash value of the message, and d A represents the user's private key, and q represents the order of the elliptic curve; The authentication server uses the stored public key P to verify the validity of the signature. The verification process is as follows: u1=s -1 H(m)mod q u2=s -1 r mod q Among them, u1 and u2 represent intermediate variables in the signature verification process; Calculate the verification point R, expressed as: R=u1G+u2Q Among them, Q represents the user's public key; And verify: R x ≡r mod q; When the horizontal coordinate R of the verification point R x When the signature r satisfies the congruence relationship, it indicates that the signature calculation and public key verification are consistent, the signature is valid, the user identity is confirmed, and the subsequent verification continues; When the horizontal coordinate R of the verification point R x When the signature r does not satisfy the congruence relationship, it indicates that the signature calculation and public key verification are inconsistent, the signature is invalid, the user identity is not confirmed, the user's access request is rejected, and the failed login attempt is recorded.

3. The method for secure and controllable data access based on strong identity authentication as claimed in claim 2, characterized in that: The authentication of each login request also includes using biometrics to further verify the user's identity, and combining dynamic verification codes to implement multi-factor authentication. The multi-factor authentication result M is expressed as: Where i represents the index of the product, ranging from 1 to n; b i represents the weight coefficient of the i-th factor, f i represents the function used for the authentication of the i-th factor, v i represents the input variable of the i-th factor; f i (v i ) is specifically expressed as: Among them, a i represents the amplitude coefficient of the sine function, b i represents the frequency coefficient of the sine function, c i Represents the phase shift of the sine function, d i represents the coefficient of the exponential function, e i represents the exponential coefficient of the exponential function, g i represents the coefficient of the logarithmic function, h i Represents the cardinality coefficient of the logarithmic function; Perform comprehensive authentication and confirm the authentication results, expressed as: Wherein, A represents the result of the comprehensive authentication formula. If A>1, it means that the authentication is successful and data access is allowed; if A≤1, it means that the authentication fails, the user's access request is rejected, and the failed login attempt is recorded.

4. The method for secure and controllable data access based on strong identity authentication as claimed in claim 3, characterized in that: The formulation and implementation of fine-grained access control strategies include defining corresponding access rights according to the user's role in the system; Assign different permission levels according to different user roles, and determine the resources and operation permissions that each role can access; Match the corresponding permissions based on the user's specific access needs to ensure that the user can only access the resources required for their work; Generate the original access control policy S based on user roles, permission levels and access requirements.

5. The method for secure and controllable data access based on strong identity authentication as claimed in claim 4, characterized in that: The use of the ECC encryption control strategy includes using the ECC algorithm to encrypt the generated access control strategy S to generate an encryption strategy E S , the formula is: E S =Encrypt ECC (S,k) Among them, Encrypt ECC Indicates that the ECC algorithm is used for encryption; The encrypted access control policy E S Stored in the authentication server; When the user issues an access request, the authentication server sends the encrypted access control policy E S Transmitted to the system components that require verification; The system component receives the encrypted access control policy E S After that, the ECC decryption algorithm is used to decrypt and obtain the original access control policy S, which is expressed as: S=Decrypt ECC (E S ,k) Among them, Decrypt ECC Indicates that the ECC algorithm is used for decryption; The system verifies and processes the user's access request based on the decrypted original access control policy S to ensure that the user can only access the resources he or she is authorized to access.

6. The method for secure and controllable data access based on strong identity authentication as claimed in claim 5, characterized in that: The collected user behavior data includes login time, resources accessed, operation frequency, operation commands, device information, geographic location and login IP address; Pre-process the collected user behavior data, including data cleaning, format conversion, and deduplication; The ECC encrypted storage includes encrypting the pre-processed user behavior data D using an elliptic curve cryptographic algorithm and storing the encrypted user behavior data E D Stored in the system's database; When you need to access and analyze user behavior data, use the corresponding decryption key to encrypt the data E D Decrypt and obtain the original data D.

7. The method for secure and controllable data access based on strong identity authentication as claimed in claim 6, characterized in that: The use of a machine learning algorithm to construct a user behavior model includes using a neural network model to process user behavior data and an integrated learning model to combine outputs of multiple base learners to construct a user behavior model; The neural network model f NN (x u ) is expressed as: Among them, x u represents the input feature vector, P represents the number of neural networks, p represents the index of the neural network, Q represents the length of the time window, q represents the time index, σ1 represents the activation function, U represents the number of input features, u represents the index of the input feature, L represents the dimension of the feature, and l represents the index of the feature dimension; w pu represents the u-th input feature of the p-th neural network, x uwq represents the lth dimension of the uth feature at the qth time; b p represents the bias of the pth neural network; The integrated learning model f EL (x u ) is expressed as: Where V represents the number of base learners, v represents the index of the base learner, and α v represents the weight of the vth base learner, μ represents the decay factor; K(x v ,x p ) represents the kernel function, which measures the input feature x v and x p Similarity of x v represents the input feature of the vth base learner, x p represents the input features at time q; The user behavior model U(x u ) is expressed as: U(x u )=f NN (x u )+f EL (x u ) Convert real-time data into feature vector X real , as the input feature vector; Use the trained model to predict the feature vector and identify the behavior category y predict : y predict =U(X real ) The warning and triggering of safety measures for abnormal behavior include setting an abnormal behavior judgment threshold θ. predict >θ, the current user behavior is judged to be abnormal, the data information of the abnormal behavior is recorded in the system log, an early warning notification is immediately sent to the security management personnel, and the subsequent operations of the current user are restricted; When predict When ≤θ, the current user behavior is judged to be normal, and the current user is allowed to continue his current operation and access resources without intervention.

8. A system based on strong identity authentication and data access security control using the method as claimed in any one of claims 1 to 7, characterized in that: Identity authentication module: uses the elliptic curve cryptography algorithm ECC combined with a multi-factor identity authentication mechanism to authenticate each login request; Fine-grained access control module: formulates and implements fine-grained access control policies based on user information, and uses ECC encryption control policies; User behavior data collection module: collects user behavior data and performs ECC encryption storage; User behavior modeling module: Use machine learning algorithms to build user behavior models and identify normal and abnormal behaviors; Real-time monitoring and security response module: monitor user behavior in real time, issue early warnings and trigger security measures for abnormal behavior.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images