Multi-factor dynamic identity verification and access control system

Abstract

The invention discloses a multi-factor dynamic identity verification and access control system, which comprises a user management module, a biological recognition module, a strategy-level authorization module, a dynamic evaluation module and an interface module, and is characterized in that the user management module is used for user registration, information management and logout; the biological recognition module adopts a biological recognition technology to collect, process and compare biological characteristics of a user; the strategy-level authorization module is used for accessing sensitivity levels of applications and terminal type factors according to user identities; the dynamic evaluation module is responsible for monitoring and evaluating the user access process in real time; and the interface module is used for providing an interactive interface between the system and other systems or applications. By integrating various advanced technologies, efficient, safe and flexible access control management is realized, and the safety and user experience of the whole system are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of identity authentication, and in particular to a multi-factor dynamic identity authentication and access control system. Background Art

[0002] With the rapid development of information technology, network security issues are becoming increasingly severe. Traditional single-factor authentication methods, such as relying solely on usernames and passwords, can no longer meet the security needs of modern network environments. Therefore, multi-factor dynamic authentication and access control systems have emerged. By combining multiple authentication factors and dynamic evaluation mechanisms, the security and reliability of the system can be significantly improved. This solution aims to introduce in detail a new type of multi-factor dynamic authentication and access control system, which integrates multiple technologies such as identity and access control, biometrics, and policy-level authorization (PBAC), and realizes comprehensive monitoring and real-time protection of the user access process. Summary of the invention

[0003] The purpose of the present invention is to provide a multi-factor dynamic identity authentication and access control system to achieve comprehensive monitoring and real-time protection of the user access process.

[0004] To achieve the above objectives, the present invention provides the following technical solutions: a multi-factor dynamic identity authentication and access control system, including a user management module, a biometric recognition module, a policy-level authorization module, a dynamic evaluation module and an interface module.

[0005] The user management module is used for user registration, information management and logout. When registering, users need to submit basic identity information and at least one biomass factor information. The system encrypts the above information and stores it in a secure database. The user information management module allows users to modify personal information and reset passwords. When a user logs out, the system will clear all login status and session information of the user to ensure the safe exit of the user's identity.

[0006] The biometric module uses biometric technology to collect, process and compare the user's biometric characteristics. The biometric module is linked to the biometric authentication platform to push the user's basic information and biometric information to the biometric authentication platform for unified management and verification. When the user requests access, the system collects the user's biometric information in real time through the biometric module, and compares it with the pre-stored biometric information to verify the user's true identity.

[0007] The policy-level authorization module is used to dynamically generate and apply different access control policies based on user identity, sensitivity level of accessed applications, and terminal type factors. The IAM platform compares the process vector of the user's request with the preset rule vector to determine the user's access rights and the required authentication method. The policy-level authorization module supports flexible authentication policy configuration to meet security requirements in different scenarios.

[0008] The dynamic assessment module is responsible for real-time monitoring and assessment of the user access process. When a user requests access to application resources, the dynamic assessment module will comprehensively assess the user's access risk based on the user's authentication results, access behavior and system security status factors. If the assessment results show that there are abnormalities or potential risks in user access, the system will automatically trigger the security response mechanism. In addition, the dynamic assessment module also supports continuous verification and evaluation, that is, continuously collecting new authentication factors and behavior data during the user access process, and dynamically adjusting the user's access rights.

[0009] The interface module is used to provide an interactive interface between the system and other systems or applications. Through the interface module, the system can receive authentication requests and access requests from other systems or applications, and return corresponding authentication results and access permission information. The interface module supports multiple communication protocols and data formats to ensure that the system can be seamlessly integrated with other systems or applications.

[0010] As a preferred embodiment of the present invention, the biometric factor information includes at least one of fingerprints, irises, voiceprints or facial features.

[0011] As a preferred solution of the present invention, the biometric recognition technology includes at least one of face recognition technology, fingerprint recognition technology, iris recognition technology or voiceprint recognition technology.

[0012] As a preferred solution of the present invention, the vector includes at least a user ID, an application system ID, and a terminal type.

[0013] As a further solution of the present invention, the authentication policy configuration includes a time-based access control authentication policy configuration, a geographic location-based access control authentication policy configuration, and a behavior-based access control authentication policy configuration.

[0014] As a preferred solution of the present invention, the security response mechanism includes an enhanced authentication mechanism, a restricted access mechanism or a trigger alarm mechanism.

[0015] As a preferred solution of the present invention, the communication protocol includes a transport layer protocol, a network layer protocol, an application layer protocol, a data link layer protocol and a physical layer protocol, and the data format includes a text format, a binary format, JSON and XML.

[0016] As a preferred solution of the present invention, the system adopts a multi-authentication factor fusion algorithm to verify the user identity. The algorithm takes the authentication algorithm as the core and integrates multiple authentication factors such as user name, password, dynamic verification code, mobile phone verification code, biomass factor, geographic location, network location and user habit operation. The algorithm first performs a preliminary verification on the basic authentication information submitted by the user; then combines the verification result of the biometric module; finally, a comprehensive evaluation is performed based on the user's geographic location, network location and historical access behavior information. The multi-authentication factor fusion algorithm fuses the results of multiple authentication factors through weighted summation or fuzzy logic method to obtain the final verification result.

[0017] As a further solution of the present invention, the system adopts a dynamic assessment model to achieve continuous verification and evaluation. The dynamic assessment model is constructed based on machine learning algorithms and big data analysis technology, and can analyze users' access behavior and system security status information in real time. The dynamic assessment model improves the prediction accuracy and risk assessment ability of user access behavior by continuously learning and optimizing algorithm parameters. When a user requests to access application resources, the dynamic assessment model will perform an assessment based on the user's current status and historical behavior data information; if the evaluation result shows that there is an abnormality or potential risk in user access, the corresponding security response mechanism will be automatically triggered.

[0018] As a further solution of the present invention, the system adopts policy-level authorization policy configuration to achieve flexible access control, and uses the IAM platform to provide rich policy configuration options and flexible policy combination methods, allowing administrators to customize different access control policies according to the sensitivity level of the application and the user's role permission information. The policy-level authorization policy configuration includes time-based access control policy, geographic location-based access control policy and behavior-based access control policy.

[0019] Compared with the prior art, the multi-factor dynamic identity authentication and access control system of the present invention realizes efficient, secure and flexible access control management by integrating multiple advanced technologies, improves the security of the overall system and user experience, and the multi-factor dynamic identity authentication mechanism effectively resists the security risks brought by single-factor authentication. The real-time dynamic evaluation and monitoring mechanism can timely discover and respond to potential security threats. Flexible policy-level authorization policies can dynamically adjust access control policies according to security requirements in different scenarios. Biometric technology provides a convenient and fast authentication method, reducing the burden of users remembering complex passwords. The system supports multiple communication protocols and data formats to ensure compatibility and ease of use with other systems or applications. The user management module realizes centralized management and efficient maintenance of user information. The IAM platform provides rich policy configuration options and flexible policy combination methods to facilitate administrators to perform customized access control management. The application of technologies such as multi-authentication factor fusion algorithms and dynamic evaluation models promotes technological innovation in the field of identity authentication and access control. The design of the system architecture provides a good foundation for subsequent functional expansion and performance optimization. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. Obviously, the drawings described below are only examples of the embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 It is a schematic diagram of the architecture of an embodiment of the present invention;

[0022] Figure 2 The following is a flowchart of an embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the embodiments of the present invention more clear, the embodiments of the present invention are further described in detail in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0024] like Figure 1 As shown, an embodiment of the present invention provides a multi-factor dynamic identity authentication and access control system, including a user management module, a biometric recognition module, a policy-level authorization module, a dynamic evaluation module and an interface module.

[0025] The user management module is used for user registration, information management and logout. When registering, users need to submit basic identity information and at least one biometric factor information, such as fingerprints, irises, voiceprints or facial features. The system encrypts the above information and stores it in a secure database. User information management allows users to modify personal information and reset passwords. When a user logs out, the system will clear all login status and session information of the user to ensure the safe exit of the user's identity.

[0026] The biometric module uses biometric technologies, such as face recognition, fingerprint recognition, iris recognition and voiceprint recognition, to collect, process and compare the user's biometric characteristics. The biometric module is linked to the biometric authentication platform to push the user's basic information and biometric information to the biometric authentication platform for unified management and verification. When the user requests access, the system collects the user's biometric information in real time through the biometric module, and compares it with the pre-stored biometric information to verify the user's true identity.

[0027] The Policy Level Authorization Module (PBAC) is one of the core components of this system. It dynamically generates and applies different access control policies based on factors such as user identity, sensitivity level of accessed applications, and terminal type. The IAM (Unified Identity Management) platform compares the process vector (including user ID, application system ID, terminal type, etc.) requested by the user with the preset rule vector to determine the user's access rights and the required authentication method. The PBAC module supports flexible authentication policy configuration, such as time-based access control, location-based access control, and behavior-based access control, to meet security requirements in different scenarios.

[0028] The dynamic assessment module is responsible for real-time monitoring and assessment of the user access process. When a user requests to access application resources, the dynamic assessment module will comprehensively assess the user's access risk based on factors such as the user's authentication results, access behavior, and system security status. If the assessment results show that the user's access is abnormal or has potential risks, the system will automatically trigger a security response mechanism, such as strengthening authentication, restricting access, or triggering an alarm. In addition, the dynamic assessment module also supports continuous verification and assessment functions, that is, continuously collecting new authentication factors and behavior data during the user access process, and dynamically adjusting the user's access rights.

[0029] The interface module provides an interactive interface between the system and other systems or applications. Through the interface module, the system can receive authentication requests and access requests from other systems or applications, and return the corresponding authentication results and access rights information. The interface module supports multiple communication protocols and data formats to ensure that the system can be seamlessly integrated with other systems or applications.

[0030] The factors of identity authentication, namely authentication factors or authentication elements, are the basis for verifying the authenticity of the user's identity. These factors can be roughly divided into the following categories:

[0031] Knowledge Factor (Something You Know):

[0032] Password: The most common authentication method. Users need to remember and enter the correct password to verify their identity. The password can be set to a complex string to increase security.

[0033] PIN: A personal identification number, usually a short string of numbers, used to access a specific device or service.

[0034] Security questions: Private questions preset by users and their answers, used to assist in identity verification.

[0035] Something You Have:

[0036] Physical token: such as smart card, USB key, etc., the user must have the physical device to access the system.

[0037] Mobile verification code: A one-time password (OTP) sent to the user via SMS or mobile app, which the user needs to enter for verification.

[0038] Hardware Security Module (HSM): A security chip embedded in a device that stores and manages sensitive information such as cryptographic keys.

[0039] Biometric Factors (Something You Are):

[0040] Fingerprint: Verify the user's identity through fingerprint recognition technology.

[0041] Facial recognition: Use the camera to capture the user's facial features for comparison and verification.

[0042] Iris recognition: Scans the user's iris pattern for identity verification with a high degree of accuracy.

[0043] Voiceprint recognition: Analyze the user's voice characteristics to verify identity.

[0044] Vein recognition: Utilizes the vein patterns inside your palm or fingers for identity verification.

[0045] Where You Are, How You Behave:

[0046] Geolocation: Verify that a user is in an expected location based on their IP address, GPS location, or other location-based technologies.

[0047] Device information: such as device model, operating system, browser type, etc., can be used as an auxiliary verification factor.

[0048] User behavior analysis: By analyzing the user's login habits, operation patterns and other behavioral characteristics, abnormal behavior can be identified and security responses can be triggered.

[0049] Time Factor (When You Access):

[0050] Time-based access control: restricts users to access systems or resources only during specific time periods.

[0051] Social Factors (Who You Know):

[0052] Social network authentication: Utilize the user’s relationship chain on social networks to authenticate identity, such as inviting friends to verify identity.

[0053] In actual applications, multiple authentication factors are usually combined to improve the security and reliability of identity authentication. For example, a banking system may require users to enter a password, use a mobile phone verification code for secondary verification, and may further confirm the user's identity through facial recognition technology. This multi-factor authentication method can significantly reduce the risk of unauthorized access.

[0054] Among them, various communication protocols and data formats are important components for data transmission and exchange in computer networks. The following is a detailed introduction to some common communication protocols and data formats:

[0055] 1. Communication protocol:

[0056] Communication protocols are standards used to specify data exchange formats and transmission rules in computer networks. They can be divided into different types according to different classification standards. The following are some common communication protocols:

[0057] Transport layer protocol:

[0058] TCP (Transmission Control Protocol): Provides reliable, connection-oriented data transmission services. A three-way handshake is used to establish a connection, ensuring the integrity and reliability of data transmission.

[0059] UDP (User Datagram Protocol): A connectionless transport layer protocol that provides simple, unreliable data transmission services. It is suitable for application scenarios that have high real-time requirements and can tolerate a certain amount of data loss.

[0060] Network layer protocol:

[0061] IP (Internet Protocol): Responsible for sending data packets from the source host to the destination host. It is one of the core protocols in the TCP / IP protocol suite.

[0062] ICMP (Internet Control Message Protocol): Used to transmit control messages between IP hosts and routers, such as destination unreachable, time exceeded, etc.

[0063] Application layer protocol:

[0064] HTTP (Hypertext Transfer Protocol): used to transfer data between web browsers and servers. It is the most widely used network protocol on the Internet.

[0065] HTTPS (HTTP Secure): A secure version of HTTP that provides data encryption, integrity verification, and identity authentication through the SSL / TLS protocol. It is mainly used to protect the security of network communications.

[0066] FTP (File Transfer Protocol): used to transfer files between the client and the server, supports binary format transmission, and is suitable for moving large amounts of data.

[0067] SMTP (Simple Mail Transfer Protocol): used to transfer emails between email clients and servers, and is the basic protocol for sending emails.

[0068] IMAP (Internet Message Access Protocol): used to receive and manage emails from a mail server, supporting synchronization and real-time access to emails.

[0069] POP3 (Post Office Protocol version 3): Another protocol for receiving mail from a mail server, but not as powerful as IMAP.

[0070] WebSocket: Provides a full-duplex communication channel, allowing the server to actively send messages to the client, and is suitable for applications that require real-time data transmission.

[0071] Data link layer protocol:

[0072] Ethernet protocol: The most commonly used data link layer protocol in local area networks, which defines the structure and transmission method of data frames.

[0073] PPP (Point-to-Point Protocol): A protocol for transmitting data packets over a point-to-point link, widely used in areas such as dial-up Internet access and VPN.

[0074] Physical layer protocol:

[0075] RS-232: A serial communications standard that defines the electrical and mechanical characteristics for data transmission.

[0076] USB (Universal Serial Bus): A widely used serial communication interface standard that supports plug-and-play and hot-swap capabilities.

[0077] HDMI (High-Definition Multimedia Interface): A digital video / audio interface technology suitable for the transmission of high-definition video and audio.

[0078] 2. Data format:

[0079] Data format refers to the representation of data in a computer. Different communication protocols may use different data formats. The following are some common data formats:

[0080] Text formats: such as HTML and XML, which represent data in text form and are easy for humans to read and edit.

[0081] Binary format: such as JPEG, MP3, etc., which represents data in binary form, is suitable for storing and transmitting large amounts of data and has a high compression rate.

[0082] JSON (JavaScript Object Notation): A lightweight data exchange format that is easy for humans to read and write, and easy for machines to parse and generate.

[0083] XML (Extensible Markup Language): A markup language used to define the structure and content of data that is self-descriptive and extensible.

[0084] In short, communication protocols and data formats are indispensable parts of computer networks. Together, they ensure that data can be transmitted and exchanged correctly, efficiently and reliably in the network.

[0085] In an embodiment of the present invention, the system uses a multi-authentication factor fusion algorithm to verify the user's identity. The algorithm takes the authentication algorithm as the core and integrates multiple authentication factors such as user name, password, dynamic verification code, mobile phone verification code, biomass factor, geographic location, network location and user habitual operation. The algorithm first performs a preliminary verification of the basic authentication information submitted by the user; then combines the verification results of the biometric module; and finally performs a comprehensive evaluation based on information such as the user's geographic location, network location and historical access behavior. The multi-authentication factor fusion algorithm fuses the results of multiple authentication factors through methods such as weighted summation or fuzzy logic to obtain the final verification result.

[0086] In the embodiment of the present invention, the dynamic assessment model is one of the key technologies for the system to achieve continuous verification and evaluation. The model is built based on machine learning algorithms and big data analysis technology, and can analyze information such as user access behavior and system security status in real time. The dynamic assessment model improves the prediction accuracy and risk assessment capabilities of user access behavior by continuously learning and optimizing algorithm parameters. When a user requests access to an application resource, the dynamic assessment model will perform an assessment based on information such as the user's current status and historical behavior data; if the assessment result shows that the user's access is abnormal or has potential risks, the corresponding security response mechanism will be automatically triggered.

[0087] In the embodiment of the present invention, policy-level authorization policy configuration is one of the important means for the system to achieve flexible access control. The IAM platform provides a wealth of policy configuration options and flexible policy combinations, allowing administrators to customize different access control policies based on information such as the sensitivity level of the application and the role permissions of the user. Policy-level authorization policy configuration includes time-based access control policies (such as limiting users to access application resources only within a specific time period), geographic location-based access control policies (such as limiting users to access application resources only within a specific geographic location range) and behavior-based access control policies (such as dynamically adjusting access rights based on the user's historical access behavior).

[0088] Workflow, such as Figure 2 As shown:

[0089] S1: User registration and information management:

[0090] S11. The user submits basic identity information and at least one biometric factor information (such as fingerprint, iris, etc.) through the user management module.

[0091] S12. The system encrypts the above information and stores it in a secure database.

[0092] S13. The user can subsequently modify personal information and reset passwords through the user management module.

[0093] S14. When the user logs out, the system clears all login status and session information.

[0094] S2: Identity Authentication:

[0095] S21. When a user requests access, the system collects the user's biometric information in real time through the biometric recognition module.

[0096] S22: Compare the collected biometric information with the pre-stored biometric information to verify the user's identity.

[0097] S23. Integrate other authentication factors (such as user name, password, dynamic verification code, mobile phone verification code, etc.) to perform multi-factor identity authentication.

[0098] S3: Policy-level authorization:

[0099] S31. The process vector (user ID, application system ID, terminal type, etc.) of the IAM platform receiving the user request.

[0100] S32: Compare the process vector with the preset rule vector to determine the user's access rights and the required authentication method.

[0101] S33. Dynamically generate access control policies based on the sensitivity level of the application, user role permissions and custom policies (such as time, geographic location, behavior, etc.).

[0102] S4: Dynamic evaluation and monitoring:

[0103] S41. The dynamic assessment module monitors the user's access behavior and system security status in real time.

[0104] S42. Evaluate user access risks based on machine learning algorithms and big data analysis technology.

[0105] S43. If anomalies or potential risks are detected, the security response mechanism will be automatically triggered (such as strengthening authentication, restricting access, triggering alarms, etc.).

[0106] S5: System Interaction and Integration:

[0107] S51. The interface module provides an interactive interface with other systems or applications.

[0108] S52: Receive an authentication request and an access request, and return corresponding authentication results and access permission information.

[0109] S53, supports multiple communication protocols and data formats to ensure seamless system integration.

[0110] The technical effects of the embodiments of the present invention are as follows:

[0111] Improved security:

[0112] The multi-factor dynamic authentication mechanism effectively resists the security risks brought by single-factor authentication.

[0113] Real-time dynamic assessment and monitoring mechanisms can detect and respond to potential security threats in a timely manner.

[0114] Flexible policy-level authorization strategies can dynamically adjust access control policies based on security requirements in different scenarios.

[0115] Enhanced User Experience:

[0116] Biometric technology provides a convenient and fast authentication method, reducing the burden on users to remember complex passwords.

[0117] The system supports multiple communication protocols and data formats to ensure compatibility and ease of use with other systems or applications.

[0118] Improve management efficiency:

[0119] The user management module realizes centralized management and efficient maintenance of user information.

[0120] The IAM platform provides a wealth of policy configuration options and flexible policy combinations to facilitate administrators to perform customized access control management.

[0121] Promoting technological innovation:

[0122] The application of technologies such as multi-authentication factor fusion algorithms and dynamic evaluation models has promoted technological innovation in the field of identity authentication and access control.

[0123] The design of the system architecture provides a good foundation for subsequent functional expansion and performance optimization.

[0124] In summary, the multi-factor dynamic identity authentication and access control system provided by the embodiment of the present invention integrates multiple advanced technologies to achieve efficient, secure and flexible access control management, thereby improving the security of the overall system and user experience.

[0125] The above shows and describes the basic principles of the present invention. The above are only preferred embodiments of the present invention and are not intended to limit the present invention. The above embodiments and descriptions in the specification are only intended to illustrate the principles of the present invention. Without departing from the scope of the present invention, any modifications, equivalent substitutions and improvements made within the spirit and scope of the present invention should be included in the protection scope of the present invention.

Claims

1. A multi-factor dynamic identity authentication and access control system, characterized in that: It includes user management module, biometric module, policy-level authorization module, dynamic assessment module and interface module; The user management module is used for user registration, information management and logout. When a user registers, basic identity information and at least one biomass factor information are required to be submitted. The system encrypts the above information and stores it in a secure database. The user information management module allows the user to modify personal information and reset passwords. When a user logs out, the system clears all login status and session information of the user to ensure the safe exit of the user identity. The biometric recognition module uses biometric recognition technology to collect, process and compare the user's biometric characteristics. The biometric recognition module is linked to the biometric authentication platform to push the user's basic information and biometric information to the biometric authentication platform for unified management and verification. When the user requests access, the system collects the user's biometric information in real time through the biometric recognition module and compares it with the pre-stored biometric information to verify the user's true identity; The policy-level authorization module is used to dynamically generate and apply different access control policies based on user identity, sensitivity level of access applications, and terminal type factors. The IAM platform compares the process vector of the user's request with the preset rule vector to determine the user's access rights and the required authentication method. The policy-level authorization module supports flexible authentication policy configuration to meet security requirements in different scenarios; The dynamic assessment module is responsible for real-time monitoring and assessment of the user access process. When a user requests to access application resources, the dynamic assessment module will comprehensively assess the user's access risk based on the user's authentication results, access behavior and system security status factors. If the assessment results show that the user's access is abnormal or has potential risks, the system will automatically trigger the security response mechanism. In addition, the dynamic assessment module also supports continuous verification and assessment, that is, continuously collecting new authentication factors and behavior data during the user's access process, and dynamically adjusting the user's access rights; The interface module is used to provide an interactive interface between the system and other systems or applications. Through the interface module, the system can receive authentication requests and access requests from other systems or applications, and return corresponding authentication results and access permission information. The interface module supports multiple communication protocols and data formats to ensure that the system can be seamlessly integrated with other systems or applications.

2. The multi-factor dynamic identity authentication and access control system according to claim 1, characterized in that: The biometric factor information includes at least one of fingerprint, iris, voiceprint or facial feature.

3. The multi-factor dynamic identity authentication and access control system according to claim 1, characterized in that: The biometric recognition technology includes at least one of face recognition technology, fingerprint recognition technology, iris recognition technology or voiceprint recognition technology.

4. The multi-factor dynamic identity authentication and access control system according to claim 1, characterized in that: The vector includes at least a user ID, an application system ID, and a terminal type.

5. The multi-factor dynamic identity authentication and access control system according to claim 4, characterized in that: The authentication policy configuration includes a time-based access control authentication policy configuration, a geographic location-based access control authentication policy configuration, and a behavior-based access control authentication policy configuration.

6. The multi-factor dynamic identity authentication and access control system according to claim 1, characterized in that: The security response mechanism includes an enhanced authentication mechanism, an access restriction mechanism or an alarm triggering mechanism.

7. The multi-factor dynamic identity authentication and access control system according to claim 1, characterized in that: The communication protocols include a transport layer protocol, a network layer protocol, an application layer protocol, a data link layer protocol and a physical layer protocol, and the data formats include a text format, a binary format, JSON and XML.

8. The multi-factor dynamic identity authentication and access control system according to claim 1, characterized in that: The system uses a multi-authentication factor fusion algorithm to verify the user's identity. The algorithm is centered on the authentication algorithm and integrates multiple authentication factors such as user name, password, dynamic verification code, mobile phone verification code, biomass factor, geographic location, network location and user habit operation. The algorithm first performs a preliminary verification of the basic authentication information submitted by the user; then combines the verification results of the biometric module; finally, a comprehensive evaluation is performed based on the user's geographic location, network location and historical access behavior information. The multi-authentication factor fusion algorithm uses weighted summation or fuzzy logic methods to fuse the results of multiple authentication factors to obtain the final verification result.

9. The multi-factor dynamic identity authentication and access control system according to claim 8, characterized in that: The system uses a dynamic assessment model to achieve continuous verification and evaluation. The dynamic assessment model is built based on machine learning algorithms and big data analysis technology. It can analyze user access behavior and system security status information in real time. The dynamic assessment model improves the prediction accuracy and risk assessment capabilities of user access behavior by continuously learning and optimizing algorithm parameters. When a user requests access to application resources, the dynamic assessment model will evaluate based on the user's current status and historical behavior data information; if the evaluation results show that there are abnormalities or potential risks in user access, the corresponding security response mechanism will be automatically triggered.

10. The multi-factor dynamic identity authentication and access control system according to claim 9, characterized in that: The system adopts policy-level authorization policy configuration to achieve flexible access control, and uses the IAM platform to provide rich policy configuration options and flexible policy combinations, allowing administrators to customize different access control policies based on the sensitivity level of the application and the user's role permission information. The policy-level authorization policy configuration includes time-based access control policy, location-based access control policy and behavior-based access control policy.

Images