User access authentication system and method based on user portrait and equipment fingerprint

Abstract

The invention discloses a user access authentication system and method based on a user portrait and a device fingerprint, belongs to the technical field of network security, and aims to solve the technical problem of how to ensure relatively high security while reducing the use cost for identity authentication of a user. Comprising a user management module used for managing users and user basic information and storing user logs in the form of a block chain; the log analysis module is used for constructing a user feature portrait based on the historical user log and extracting an identification fingerprint of the user logging in and using equipment based on the user logging-in equipment log; the authentication and authorization module is used for carrying out identity authentication on a user logging in the system through the decentralized system and carrying out equipment authentication on equipment used by user login based on an equipment fingerprint; and the access authorization module is used for setting the resource access authority of the user through a rule-based access control model based on the user feature portrait.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a user access authentication system and method based on user portrait and device fingerprint. Background Art

[0002] The common existing identity authentication technologies mainly include static password authentication technology, biometric authentication technology, two-factor identity authentication technology, identity authentication technology based on digital certificates, Kerberos identity authentication technology, etc. Static password authentication technology is simple to implement, does not require additional hardware equipment, and is easy to understand and use, but users tend to use weak passwords that are easy to remember, which makes passwords easy to be cracked by brute force or stolen by phishing websites; biometric authentication technology uses the unique biological characteristics of the human body for authentication, which is difficult to forge and does not require additional identity authentication tools, but involves the collection and storage of personal biological information, which poses a risk of privacy leakage, and has a high implementation cost and requires corresponding equipment and technical support; two-factor identity authentication technology combines multiple authentication methods, increases the difficulty of cracking, and enhances users' trust in the network platform, but requires users to enter verification information multiple times, which reduces user experience, and also requires corresponding hardware equipment support, which is costly; Kerberos identity authentication technology realizes two-way authentication between users and servers, has high security, and reduces the possibility of key theft and the burden on KDC, but also has problems such as weak password risks and time synchronization.

[0003] User identity authentication and how to ensure high security while reducing usage costs are technical issues that need to be solved. Summary of the invention

[0004] The technical task of the present invention is to address the above shortcomings and provide a user access authentication system and method based on user portrait and device fingerprint to solve the technical problems of user identity authentication and how to ensure higher security while reducing the cost of use.

[0005] In a first aspect, the present invention provides a user access authentication system based on user portrait and device fingerprint, including a user management module, an authentication and authorization module, a log analysis module and an access authorization module;

[0006] The user management module is used to manage users and basic user information, and is used to store user logs in the form of blockchain, where the user logs include user resource access logs and user login device logs;

[0007] The log analysis module is used to read the historical user logs from the user management module, construct a user feature portrait based on the historical user logs, extract the identification fingerprint of the user's login device based on the user login device log, and store the user feature portrait and device fingerprint to the local server;

[0008] The authentication and authorization module is used to authenticate the identity of the user who logs into the system through a decentralized system, and for the user who passes the identity authentication, it is used to authenticate the device used by the user to log in based on the device fingerprint;

[0009] The access authorization module is configured with a rule-based access control model, which is used to set the user's resource access rights based on the user feature profile through the rule-based access control model. For resource access requests submitted by the user, it is used to authorize the resources to be accessed specified in the user authentication request based on the user's current resource access rights.

[0010] Preferably, the log analysis module is used to perform the following:

[0011] Obtain historical user logs and perform data cleaning on the historical user logs to remove erroneous, incomplete, and irrelevant data in the historical user logs to obtain cleaned historical user logs;

[0012] Performing data conversion on the cleaned data in the historical user log, converting the data in the historical user log into a predetermined format through data conversion to obtain a pre-processed historical user log;

[0013] Based on the pre-processed historical user access resource logs, the user features are extracted through the constructed user model and the user feature profile is constructed;

[0014] Based on the pre-processed historical user login device logs, the device features and device attributes of the device used by the user to log in are extracted, and the device fingerprint is generated based on the device features and device attributes.

[0015] Preferably, based on the pre-processed historical user access resource logs, extracting user features through the constructed user model and constructing a user feature profile includes the following steps:

[0016] Analyze users based on pre-processed historical user resource access logs and build a user tag library based on the analysis results;

[0017] Perform feature analysis on users based on tags in the tag library and pre-processed historical user access resource logs to obtain user features, which represent user preferences.

[0018] Build a user model based on machine learning algorithms and train the user model based on user tags and user features;

[0019] Analyze users based on their resource access logs and trained user models, and build user feature profiles based on the analysis results.

[0020] Among them, machine learning algorithms include decision trees, random forests, support vector machines, and neural networks.

[0021] Preferably, when generating a device fingerprint based on device features and device attributes, weights are assigned to the device features and device attributes, and a device fingerprint representing the uniqueness of the device is generated based on the device features, the weight of each device feature, the device attributes, and the weight of each device attribute.

[0022] Preferably, for each user, based on the registration application submitted by the user, the decentralized identity authentication system assigns an identity identifier DID to the user based on the user information in the registration application submitted by the user, and creates a DID document of the user's identity. The user receives the identity identifier DID and DID document returned by the decentralized identity authentication system, stores the DID document in a blockchain or distributed ledger, and registers the identity identifier DID and its corresponding DID document in a decentralized DID registry through a smart contract;

[0023] For users who log in to the system, the authentication and authorization module sends an authentication request to the user, which includes verification information. The user signs the verification information based on his private key and sends the signature information to the authentication and authorization module. The authentication and authorization module verifies the validity of the signature information based on the public key in the DID document and checks the authenticity and integrity of the verification information to achieve identity authentication of the user.

[0024] Among them, for users who log in to the system for the first time, the authentication and authorization module authenticates the user and allows the authenticated user to log in to the system;

[0025] For users who have logged into the system multiple times, the authentication and authorization module authenticates the user. For users who pass the authentication, the device used for user login is authenticated based on the device fingerprint. If the authentication passes, the user is allowed to log in to the system. If the authentication fails, a notification is pushed to the user based on the contact information specified by the user information, and the user is allowed to log in to the system based on the user's permission.

[0026] In a second aspect, the present invention provides a user access authentication method based on user portrait and device fingerprint, which is used to implement user access authentication through a user access authentication system based on user portrait and device fingerprint as described in any one of the first aspects, and the method comprises the following steps:

[0027] Authenticate the user who logs into the system. For users who pass the identity authentication, authenticate the device used by the user to log in based on the device fingerprint.

[0028] Manage users and their basic information, and store user logs in the form of blockchain. User logs include user access resource logs and user login device logs;

[0029] Read historical user logs, build user feature portraits based on historical user logs, extract identification fingerprints of user login devices based on user login device logs, and store user feature portraits and device fingerprints on the local server;

[0030] Based on user feature profiling, the user's resource access permissions are set through a rule-based access control model. For resource access requests submitted by users, it is used to authorize the resources to be accessed in the user authentication request based on the user's current resource access permissions.

[0031] As a preferred method, a user feature profile is constructed based on historical user logs, and an identification fingerprint of a user's login device is extracted based on the user's login device log, including the following steps:

[0032] Obtain historical user logs and perform data cleaning on the historical user logs to remove erroneous, incomplete, and irrelevant data in the historical user logs to obtain cleaned historical user logs;

[0033] Performing data conversion on the cleaned data in the historical user log, converting the data in the historical user log into a predetermined format through data conversion to obtain a pre-processed historical user log;

[0034] Based on the pre-processed historical user access resource logs, the user features are extracted through the constructed user model and the user feature profile is constructed;

[0035] Based on the pre-processed historical user login device logs, the device features and device attributes of the device used by the user to log in are extracted, and the device fingerprint is generated based on the device features and device attributes.

[0036] Preferably, based on the pre-processed historical user access resource logs, extracting user features through the constructed user model and constructing a user feature profile includes the following steps:

[0037] Analyze users based on pre-processed historical user resource access logs and build a user tag library based on the analysis results;

[0038] Perform feature analysis on users based on tags in the tag library and pre-processed historical user access resource logs to obtain user features, which represent user preferences.

[0039] Build a user model based on machine learning algorithms and train the user model based on user tags and user features;

[0040] Analyze users based on their resource access logs and trained user models, and build user feature profiles based on the analysis results.

[0041] Among them, machine learning algorithms include decision trees, random forests, support vector machines, and neural networks.

[0042] Preferably, when generating a device fingerprint based on device features and device attributes, weights are assigned to the device features and device attributes, and a device fingerprint representing the uniqueness of the device is generated based on the device features, the weight of each device feature, the device attributes, and the weight of each device attribute.

[0043] Preferably, for each user, based on the registration application submitted by the user, the decentralized identity authentication system assigns an identity identifier DID to the user based on the user information in the registration application submitted by the user, and creates a DID document of the user's identity. The user receives the identity identifier DID and DID document returned by the decentralized identity authentication system, stores the DID document in a blockchain or distributed ledger, and registers the identity identifier DID and its corresponding DID document in a decentralized DID registry through a smart contract;

[0044] For users who log in to the system, an authentication request is sent to the user through the authentication and authorization module. The authentication request includes verification information. The user signs the verification information based on his private key and sends the signature information to the authentication and authorization module. The authentication and authorization module verifies the validity of the signature information based on the public key in the DID document and checks the authenticity and integrity of the verification information to achieve identity authentication of the user.

[0045] Among them, for users who log in to the system for the first time, after the user's identity is authenticated by the authentication and authorization module, the authenticated user is allowed to log in to the system;

[0046] For users who have logged into the system multiple times, after the user's identity is authenticated by the authentication and authorization module, for authenticated users, the device used for user login is authenticated based on the device fingerprint. If the authentication is passed, the user is allowed to log in to the system. If the authentication is not passed, a notification is pushed to the user based on the contact information specified by the user information, and the user is allowed to log in to the system based on the user's permission.

[0047] The user access authentication system and method based on user portrait and device fingerprint of the present invention have the following advantages:

[0048] 1. Using a decentralized identity authentication system and device fingerprint for authentication can effectively prevent criminals from stealing or impersonating user accounts, ensure that only legitimate and correct users can access system resources, effectively prevent unauthorized access, and protect data and resources from theft or malicious operations;

[0049] 2. Using a rule-based access control model and user portraits to authorize access can more accurately identify user roles, behaviors, and permissions, thereby ensuring that only authorized users can access specific system resources. This can not only improve the user experience and facilitate users to access system resources quickly and efficiently, but also ensure the security of resources, greatly reducing the risk of illegal access and unauthorized access;

[0050] 3. Use deep learning models to analyze user data, extract role feature portraits and device fingerprints, and capture more abstract and complex features, thereby improving the accuracy of user portraits and device fingerprints. At the same time, there is no need for manual feature extraction, which greatly reduces the time and human resource costs of manual data processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0052] The present invention is further described below in conjunction with the accompanying drawings.

[0053] Figure 1 This is a structural block diagram of a user access authentication system based on user portrait and device fingerprint in Example 1;

[0054] Figure 2 This is a working block diagram of a user access authentication system based on user portrait and device fingerprint according to Example 1. DETAILED DESCRIPTION

[0055] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments so that those skilled in the art can better understand the present invention and implement it. However, the embodiments are not intended to limit the present invention. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments may be combined with each other.

[0056] The embodiments of the present invention provide a user access authentication system and method based on user portrait and device fingerprint, which are used to solve the technical problems of user identity authentication and how to ensure high security while reducing usage costs.

[0057] Embodiment 1:

[0058] The present invention discloses a user access authentication system based on user portrait and device fingerprint, comprising a user management module, an authentication authorization module, a log analysis module and an access authorization module.

[0059] The user management module is used to manage users and their basic information, and to store user logs in the form of blockchain. User logs include user access resource logs and user login device logs.

[0060] As a specific implementation of the user management module, this module can manage user information data, including user name, user email, user contact information and other user information. In the user management module, user-related operations such as creating users, editing users, deleting users, unlocking users and viewing user logs can be performed. At the same time, the user management module will also store user access resource logs and user login device logs in the form of blockchain. Through the use of the user management module, effective user management, information security protection, data analysis, audit tracking and improved user experience can be achieved.

[0061] The log analysis module is used to read historical user logs from the user management module, build user feature portraits based on historical user logs, extract identification fingerprints of user login devices based on user login device logs, and store user feature portraits and device fingerprints on the local server.

[0062] As a specific implementation of the log analysis module, the module is executed as follows:

[0063] (1) Obtain historical user logs and perform data cleaning on the historical user logs to remove erroneous, incomplete, and irrelevant data in the historical user logs and obtain cleaned historical user logs;

[0064] (2) performing data conversion on the cleaned data in the historical user log, converting the data in the historical user log into a predetermined format through data conversion to obtain a preprocessed historical user log;

[0065] (3) Based on the pre-processed historical user access resource logs, the user features are extracted through the constructed user model and the user feature profile is constructed;

[0066] (4) Based on the pre-processed historical user login device log, the device features and device attributes of the device used by the user to log in are extracted, and the device fingerprint is generated based on the device features and device attributes.

[0067] Among them, based on the pre-processed historical user access resource logs, the user features are extracted through the constructed user model and the user feature portrait is constructed, including the following steps:

[0068] (1) Analyze users based on the preprocessed historical user resource access logs and build a user tag library based on the analysis results;

[0069] (2) Performing feature analysis on users based on the tags in the tag library and the preprocessed historical user access resource logs to obtain user features, which represent user preferences;

[0070] (3) Build a user model based on machine learning algorithms and train the user model based on user tags and user features;

[0071] (4) Analyze users based on their resource access logs and trained user models, and build user feature profiles based on the analysis results;

[0072] Among them, machine learning algorithms include decision trees, random forests, support vector machines, and neural networks.

[0073] When generating a device fingerprint based on device features and device attributes, weights are assigned to the device features and device attributes, and a device fingerprint representing the uniqueness of the device is generated based on the device features, the weight of each device feature, the device attributes, and the weight of each device attribute.

[0074] The authentication and authorization module is used to authenticate the identity of users logging into the system through a decentralized system. For users who have passed the identity authentication, it is used to authenticate the device used by the user to log in based on the device fingerprint.

[0075] In this embodiment, for each user, based on the registration application submitted by the user, the decentralized identity authentication system assigns an identity identifier DID to the user based on the user information in the registration application submitted by the user, and creates a DID document for the user's identity. The user receives the identity identifier DID and DID document returned by the decentralized identity authentication system, stores the DID document in a blockchain or distributed ledger, and registers the identity identifier DID and its corresponding DID document in a decentralized DID registry through a smart contract.

[0076] Correspondingly, for users logging into the system, the authentication and authorization module sends an authentication request to the user, which includes verification information. The user signs the verification information based on his private key and sends the signature information to the authentication and authorization module. The authentication and authorization module verifies the validity of the signature information based on the public key in the DID document, and checks the authenticity and integrity of the verification information to achieve identity authentication of the user.

[0077] Among them, for users who log in to the system for the first time, the authentication and authorization module authenticates the user and allows the authenticated user to log in to the system; for users who have logged in to the system multiple times, the authentication and authorization module authenticates the user and, for authenticated users, performs device authentication on the user's login device based on the device fingerprint. If the authentication passes, the user is allowed to log in to the system; if the authentication fails, a notification is pushed to the user based on the contact information specified by the user information, and the user is allowed to log in to the system based on the user's permission.

[0078] The identity authentication module of this embodiment combines the decentralized identity system (DID) and device fingerprint to authenticate and authorize users. This module will first use DID for identity authentication. When a user logs in to the system for the first time, the user needs to apply for a DID (decentralized identity) from a decentralized identity authentication platform (such as uPort) and upload user information to establish a DID document for his identity. Users need to store digital archives on blockchains or distributed ledgers to ensure that they cannot be tampered with and are publicly verifiable. After that, the user needs to use a smart contract to register the newly created DID and its corresponding DID document in a decentralized DID registry. When the user's identity needs to be verified, the system will send a certification request to the user, including the specific information that needs to be verified. After that, the user uses his private key to sign the specific information in the request to prove that he owns the DID and the corresponding credentials. After the system receives the user's signature information, it verifies the validity of the signature through the public key provided in the DID document, and checks the authenticity and integrity of the relevant information, thereby completing the identity authentication.

[0079] When the user completes identity authentication using DID, the system will use the device fingerprint to perform dual authentication on the user. If the device information used by the user to log in cannot pass the device fingerprint verification, the identity authentication module will notify the user in other ways, such as phone calls or emails, that other users are trying to log in. Only after obtaining the user's permission can the device fingerprint verification be passed. If the device information used by the user to log in can pass the device fingerprint verification, the user can log in successfully.

[0080] The access authorization module is configured with a rule-based access control model, which is used to set the user's resource access rights based on user feature profiling through a rule-based access control model. For resource access requests submitted by users, it is used to authorize the resources to be accessed in the user authentication request based on the user's current resource access rights.

[0081] The access authorization module of this embodiment uses rule-BAC (rule-based access control model) to control access rights. This module can grant users access to resources corresponding to the features based on the user feature portrait obtained by analyzing the user's historical access log records in the log analysis module as a rule. When a user wants to access resources outside the access rights, it is necessary to apply to the access authorization module for permissions for specific resources. For example, if the user feature portrait shows that the user often accesses resources labeled as Class A, this module will automatically grant the user permission to access resources labeled as Class A. When a user needs to access resources labeled as Class B, it is necessary to apply to the access authorization module for permissions to access specific Class B resources. After the user accesses the resource, the access authorization module will record the user's resource access log and save it in the user management module. When the user portrait is updated, the access authorization module also needs to update the user's corresponding resource access rights.

[0082] The operation process of the system in this embodiment is as follows:

[0083] Step 1: Create a user in the user management module. At this time, the user only has default permissions.

[0084] Step 2: After the user has used the system for a period of time, the log analysis module will generate a user feature profile based on the user's historical access log analysis, and generate a device fingerprint based on the user's historical login device data analysis.

[0085] Step 3: After the log analysis module generates the device fingerprint and user feature portrait, the user will first use the decentralized identity authentication system (DID) for authentication when logging in. After the authentication is passed, the device fingerprint of the user's login device will be verified. If the login device cannot pass the device fingerprint verification, the identity authentication module will automatically contact the user for confirmation, and the user can only continue to log in after the confirmation is completed. If the login device can pass the device fingerprint verification, the user can log in to the system to access resources.

[0086] Step 4: After the log analysis module generates and updates the device fingerprint and user feature portrait, the access authorization module will decide which resources the user can access based on the user portrait generated by the log analysis module. When the user wants to access resources beyond his or her authority, he or she needs to submit an application to the access authorization module. Only after the application is approved can the user access the corresponding resources.

[0087] Embodiment 2:

[0088] The present invention provides a user access authentication method based on user portrait and device fingerprint, which implements user access authentication based on the system disclosed in Example 1. The method includes the following steps:

[0089] Step S100: Authenticate the user who logs into the system. For users who pass the identity authentication, authenticate the device used by the user based on the device fingerprint.

[0090] Step S200: Manage users and their basic information, and store user logs in the form of blockchain. User logs include user resource access logs and user login device logs.

[0091] Step S300: read historical user logs, construct user feature portraits based on the historical user logs, extract identification fingerprints of the user's login device based on the user login device logs, and store the user feature portraits and device fingerprints in the local server;

[0092] Step S400, based on the user feature profile, sets the user's resource access rights through a rule-based access control model, and for resource access requests submitted by the user, authorizes the resources to be accessed specified in the user authentication request based on the user's current resource access rights.

[0093] Among them, in step S100, for each user, based on the registration application submitted by the user, the decentralized identity authentication system assigns an identity identifier DID to the user based on the user information in the registration application submitted by the user, and establishes a DID document of the user's identity. The user receives the identity identifier DID and DID document returned by the decentralized identity authentication system, and stores the DID document in a blockchain or distributed ledger, and registers the identity identifier DID and its corresponding DID document in a decentralized DID registry through a smart contract.

[0094] Correspondingly, for users logging into the system, the authentication and authorization module sends an authentication request to the user, which includes verification information. The user signs the verification information based on his private key and sends the signature information to the authentication and authorization module. The authentication and authorization module verifies the validity of the signature information based on the public key in the DID document, and checks the authenticity and integrity of the verification information to achieve identity authentication of the user.

[0095] Among them, for users who log in to the system for the first time, the authentication and authorization module authenticates the user and allows the authenticated user to log in to the system; for users who have logged in to the system multiple times, the authentication and authorization module authenticates the user and, for authenticated users, performs device authentication on the user's login device based on the device fingerprint. If the authentication passes, the user is allowed to log in to the system; if the authentication fails, a notification is pushed to the user based on the contact information specified by the user information, and the user is allowed to log in to the system based on the user's permission.

[0096] In step S200, the user information data is managed through the user management module, including user information such as user name, user email, user contact information, etc. In the user management module, user-related operations such as creating users, editing users, deleting users, unlocking users, and viewing user logs can be performed. At the same time, the user management module will also store user access resource logs and user login device logs in the form of blockchain. Through the use of the user management module, effective user management, information security protection, data analysis, audit tracking, and improved user experience can be achieved.

[0097] In step S300, the user log is analyzed by the log analysis module to construct a user feature profile and device fingerprint. The specific operations are as follows:

[0098] (1) Obtain historical user logs and perform data cleaning on the historical user logs to remove erroneous, incomplete, and irrelevant data in the historical user logs and obtain cleaned historical user logs;

[0099] (2) performing data conversion on the cleaned data in the historical user log, converting the data in the historical user log into a predetermined format through data conversion to obtain a preprocessed historical user log;

[0100] (3) Based on the pre-processed historical user access resource logs, the user features are extracted through the constructed user model and the user feature profile is constructed;

[0101] (4) Based on the pre-processed historical user login device log, the device features and device attributes of the device used by the user to log in are extracted, and the device fingerprint is generated based on the device features and device attributes.

[0102] Among them, based on the pre-processed historical user access resource logs, extracting user features through the constructed user model and building a user feature portrait include the following steps:

[0103] (1) Analyze users based on the preprocessed historical user access resource logs and build a user tag library based on the analysis results;

[0104] (2) Performing feature analysis on users based on the tags in the tag library and the preprocessed historical user access resource logs to obtain user features, which represent user preferences;

[0105] (3) Build a user model based on machine learning algorithms and train the user model based on user tags and user features;

[0106] (4) Analyze users based on their resource access logs and trained user models, and build user feature profiles based on the analysis results;

[0107] Among them, machine learning algorithms include decision trees, random forests, support vector machines, and neural networks.

[0108] When generating a device fingerprint based on device features and device attributes, weights are assigned to the device features and device attributes, and a device fingerprint representing the uniqueness of the device is generated based on the device features, the weight of each device feature, the device attributes, and the weight of each device attribute.

[0109] Step S400 uses rule-BAC (rule-based access control model) to control access rights. This step can grant users access to resources corresponding to the features based on the user feature portrait obtained by analyzing the user's historical access log records in the log analysis module as a rule. When the user wants to access resources outside the access rights, it is necessary to apply to the access authorization module for permission to specific resources. For example, if the user feature portrait shows that the user often accesses resources labeled as Class A, this module will automatically grant the user permission to access resources labeled as Class A. When the user needs to access resources labeled as Class B, it is necessary to apply to the access authorization module for permission to access specific Class B resources. After the user accesses the resource, the access authorization module will record the user's resource access log and save it in the user management module. When the user portrait is updated, the access authorization module also needs to update the user's corresponding resource access rights.

[0110] The method of this embodiment combines a decentralized identity authentication system and device fingerprint authentication. Decentralized identity authentication ensures the security of user identity data through distributed ledger technology, reduces the single point failure and attack risks that may exist in centralized systems, and reduces the risk of user information being abused and leaked. Device fingerprint authentication is unique and stable. Once generated, it will not change due to device upgrades or changes. It can be used effectively for a long time, reducing the need for repeated authentication. The combination of the two can realize cross-device and cross-application identity authentication, improve the interoperability of the system, and provide users with a safer, more convenient and efficient identity authentication experience. It combines a rule-based access control model and user feature portraits. The rule-based access control model realizes flexible and dynamic adjustment of security policies by combining user feature portraits as rules. It can accurately authorize according to user characteristics and needs, reduce the maintenance cost of the system, and ensure that users can only access legal data within their authority, reducing the risk of illegal access and data leakage.

[0111] The present invention has been shown and described in detail above through the accompanying drawings and preferred embodiments. However, the present invention is not limited to these disclosed embodiments. Based on the above multiple embodiments, those skilled in the art can know that the means in the above different embodiments can be combined to obtain more embodiments of the present invention, and these embodiments are also within the protection scope of the present invention.

Claims

1. A user access authentication system based on user portrait and device fingerprint, characterized in that: Including user management module, authentication and authorization module, log analysis module and access authorization module; The user management module is used to manage users and basic user information, and is used to store user logs in the form of blockchain, where the user logs include user resource access logs and user login device logs; The log analysis module is used to read the historical user logs from the user management module, construct a user feature portrait based on the historical user logs, extract the identification fingerprint of the user's login device based on the user login device log, and store the user feature portrait and device fingerprint to the local server; The authentication and authorization module is used to authenticate the identity of the user who logs into the system through a decentralized system, and for the user who passes the identity authentication, it is used to authenticate the device used by the user to log in based on the device fingerprint; The access authorization module is configured with a rule-based access control model, which is used to set the user's resource access rights based on the user feature profile through the rule-based access control model. For resource access requests submitted by the user, it is used to authorize the resources to be accessed specified in the user authentication request based on the user's current resource access rights.

2. The user access authentication device based on user portrait and device fingerprint according to claim 1, characterized in that: The log analysis module is used to perform the following: Obtain historical user logs and perform data cleaning on the historical user logs to remove erroneous, incomplete, and irrelevant data in the historical user logs to obtain cleaned historical user logs; Performing data conversion on the cleaned data in the historical user log, converting the data in the historical user log into a predetermined format through data conversion to obtain a pre-processed historical user log; Based on the pre-processed historical user access resource logs, the user features are extracted through the constructed user model and the user feature profile is constructed; Based on the pre-processed historical user login device logs, the device features and device attributes of the device used by the user to log in are extracted, and the device fingerprint is generated based on the device features and device attributes.

3. The user access authentication device based on user portrait and device fingerprint according to claim 2, characterized in that: Based on the preprocessed historical user access resource logs, the user features are extracted through the constructed user model and the user feature profile is constructed, including the following steps: Analyze users based on pre-processed historical user resource access logs and build a user tag library based on the analysis results; Perform feature analysis on users based on tags in the tag library and pre-processed historical user access resource logs to obtain user features, which represent user preferences. Build a user model based on machine learning algorithms and train the user model based on user tags and user features; Analyze users based on their resource access logs and trained user models, and build user feature profiles based on the analysis results. Among them, machine learning algorithms include decision trees, random forests, support vector machines, and neural networks.

4. The user access authentication device based on user portrait and device fingerprint according to claim 2, characterized in that: When generating a device fingerprint based on device features and device attributes, weights are assigned to the device features and device attributes, and a device fingerprint representing the uniqueness of the device is generated based on the device features, the weight of each device feature, the device attributes, and the weight of each device attribute.

5. The user access authentication device based on user portrait and device fingerprint according to claim 2, characterized in that: For each user, based on the registration application submitted by the user, the decentralized identity authentication system assigns an identity identifier DID to the user based on the user information in the registration application submitted by the user, and creates a DID document of the user's identity. The user receives the identity identifier DID and DID document returned by the decentralized identity authentication system, stores the DID document in the blockchain or distributed ledger, and registers the identity identifier DID and its corresponding DID document in a decentralized DID registry through a smart contract; For users who log in to the system, the authentication and authorization module sends an authentication request to the user, which includes verification information. The user signs the verification information based on his private key and sends the signature information to the authentication and authorization module. The authentication and authorization module verifies the validity of the signature information based on the public key in the DID document and checks the authenticity and integrity of the verification information to achieve identity authentication of the user. Among them, for users who log in to the system for the first time, the authentication and authorization module authenticates the user and allows the authenticated user to log in to the system; For users who have logged into the system multiple times, the authentication and authorization module authenticates the user. For users who pass the authentication, the device used for user login is authenticated based on the device fingerprint. If the authentication passes, the user is allowed to log in to the system. If the authentication fails, a notification is pushed to the user based on the contact information specified by the user information, and the user is allowed to log in to the system based on the user's permission.

6. A user access authentication method based on user portrait and device fingerprint, characterized in that: The method is used to implement user access authentication through a user access authentication system based on user portrait and device fingerprint as described in any one of claims 1 to 5, and the method comprises the following steps: Authenticate the user who logs into the system. For users who pass the identity authentication, authenticate the device used by the user to log in based on the device fingerprint. Manage users and their basic information, and store user logs in the form of blockchain. User logs include user access resource logs and user login device logs; Read historical user logs, build user feature portraits based on historical user logs, extract identification fingerprints of user login devices based on user login device logs, and store user feature portraits and device fingerprints on the local server; Based on user feature profiling, the user's resource access permissions are set through a rule-based access control model. For resource access requests submitted by users, it is used to authorize the resources to be accessed in the user authentication request based on the user's current resource access permissions.

7. The user access authentication method based on user portrait and device fingerprint according to claim 6 is characterized in that: Build a user feature profile based on historical user logs, and extract the identification fingerprint of the user's login device based on the user login device log, including the following steps: Obtain historical user logs and perform data cleaning on the historical user logs to remove erroneous, incomplete, and irrelevant data in the historical user logs to obtain cleaned historical user logs; Performing data conversion on the cleaned data in the historical user log, converting the data in the historical user log into a predetermined format through data conversion to obtain a pre-processed historical user log; Based on the pre-processed historical user access resource logs, the user features are extracted through the constructed user model and the user feature profile is constructed; Based on the pre-processed historical user login device logs, the device features and device attributes of the device used by the user to log in are extracted, and the device fingerprint is generated based on the device features and device attributes.

8. The user access authentication method based on user portrait and device fingerprint according to claim 7 is characterized in that: Based on the preprocessed historical user access resource logs, the user features are extracted through the constructed user model and the user feature profile is constructed, including the following steps: Analyze users based on pre-processed historical user resource access logs and build a user tag library based on the analysis results; Perform feature analysis on users based on tags in the tag library and pre-processed historical user access resource logs to obtain user features, which represent user preferences. Build a user model based on machine learning algorithms and train the user model based on user tags and user features; Analyze users based on their resource access logs and trained user models, and build user feature profiles based on the analysis results. Among them, machine learning algorithms include decision trees, random forests, support vector machines, and neural networks.

9. The user access authentication method based on user portrait and device fingerprint according to claim 7, characterized in that: When generating a device fingerprint based on device features and device attributes, weights are assigned to the device features and device attributes, and a device fingerprint representing the uniqueness of the device is generated based on the device features, the weight of each device feature, the device attributes, and the weight of each device attribute.

10. The user access authentication method based on user portrait and device fingerprint according to claim 7, characterized in that: For each user, based on the registration application submitted by the user, the decentralized identity authentication system assigns an identity identifier DID to the user based on the user information in the registration application submitted by the user, and creates a DID document of the user's identity. The user receives the identity identifier DID and DID document returned by the decentralized identity authentication system, stores the DID document in the blockchain or distributed ledger, and registers the identity identifier DID and its corresponding DID document in a decentralized DID registry through a smart contract; For users who log in to the system, an authentication request is sent to the user through the authentication and authorization module. The authentication request includes verification information. The user signs the verification information based on his private key and sends the signature information to the authentication and authorization module. The authentication and authorization module verifies the validity of the signature information based on the public key in the DID document and checks the authenticity and integrity of the verification information to achieve identity authentication of the user. Among them, for users who log in to the system for the first time, after the user's identity is authenticated by the authentication and authorization module, the authenticated user is allowed to log in to the system; For users who have logged into the system multiple times, after the user's identity is authenticated by the authentication and authorization module, for authenticated users, the device used for user login is authenticated based on the device fingerprint. If the authentication is passed, the user is allowed to log in to the system. If the authentication is not passed, a notification is pushed to the user based on the contact information specified by the user information, and the user is allowed to log in to the system based on the user's permission.

Images