User access authentication system and method based on user profile and device fingerprint

Abstract

The application discloses a user access authentication system and method based on user portrait and device fingerprint, belongs to the technical field of network security, and aims to solve the technical problems of user identity authentication and how to reduce use cost while ensuring high security. The system comprises a user management module, a log analysis module, an authentication and authorization module and an access authorization module. The user management module is used for managing users and user basic information and storing user logs in the form of blockchains. The log analysis module is used for constructing a user feature portrait based on historical user logs and extracting a recognition fingerprint of a user login use device based on user login device logs. The authentication and authorization module is used for performing identity authentication on users logging into a system through a decentralized system and performing device authentication on user login use devices based on device fingerprints. The access authorization module is used for setting resource access permissions of users based on the user feature portrait through a rule-based access control model.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a user access authentication system and method based on user portraits and device fingerprints. Background Art

[0002] Common existing authentication technologies include static password authentication, biometric authentication, two-factor authentication, digital certificate-based authentication, and Kerberos authentication. Static password authentication is simple to implement, requires no additional hardware, and is easy to understand and use. However, users tend to use weak, memorable passwords, making them vulnerable to brute force attacks or theft via phishing websites. Biometric authentication utilizes unique biological characteristics of the human body for authentication, making them difficult to forge and eliminating the need for additional authentication tools. However, it involves the collection and storage of personal biometric information, posing privacy risks. It is also costly to implement and requires appropriate equipment and technical support. Two-factor authentication combines multiple authentication methods, increasing the difficulty of cracking and enhancing user trust in the network platform. However, it requires users to enter verification information multiple times, reducing the user experience and requiring appropriate hardware support, resulting in high costs. Kerberos authentication implements two-way authentication between users and servers, offering high security and reducing the possibility of key theft and the burden on the KDC. However, it also presents issues such as weak passwords and time synchronization.

[0003] User identity authentication and how to ensure high security while reducing usage costs are technical issues that need to be solved. Summary of the Invention

[0004] The technical task of the present invention is to address the above shortcomings and provide a user access authentication system and method based on user portraits and device fingerprints to solve the technical problems of user identity authentication and how to ensure higher security while reducing usage costs.

[0005] In a first aspect, the present invention provides a user access authentication system based on user portrait and device fingerprint, comprising a user management module, an authentication and authorization module, a log analysis module, and an access authorization module;

[0006] The user management module is used to manage users and their basic information, and to store user logs in the form of blockchain, including user resource access logs and user login device logs;

[0007] The log analysis module is used to read historical user logs from the user management module, construct a user feature profile based on the historical user logs, extract the identification fingerprint of the user's login device based on the user login device log, and store the user feature profile and device fingerprint to the local server;

[0008] The authentication authorization module is configured to authenticate the identity of a user logging into a system through a decentralized system, and for a user who passes the identity authentication, to perform device authentication on a device used by the user for logging in based on a device fingerprint.

[0009] The access authorization module is configured with a rule-based access control model, which is used to set the resource access rights of a user based on a user feature profile through the rule-based access control model, and for a resource access request submitted by a user, to authorize the resource specified in the user authentication request to be accessed based on the current resource access rights of the user.

[0010] Preferably, the log analysis module is configured to perform the following:

[0011] Obtain historical user logs and perform data cleaning on the historical user logs to remove errors, incomplete and irrelevant data in the historical user logs through data cleaning to obtain cleaned historical user logs;

[0012] Perform data conversion on the data in the cleaned historical user logs to convert the data in the historical user logs into a predetermined format through data conversion to obtain preprocessed historical user logs;

[0013] Based on the preprocessed historical user access resource logs, extract user features and build a user feature profile through the built user model;

[0014] Based on the preprocessed historical user login device logs, extract device features and device attributes of the device used by the user for logging in, and generate a device fingerprint based on the device features and device attributes.

[0015] Preferably, based on the preprocessed historical user access resource logs, extract user features and build a user feature profile through the built user model, including the following steps:

[0016] Analyze the user based on the preprocessed historical user access resource logs, and build a user tag library according to the analysis result;

[0017] Based on the tags in the tag library, analyze the user features based on the preprocessed historical user access resource logs to obtain user features, which represent user preferences;

[0018] Build a user model based on a machine learning algorithm, and train the user model based on user tags and user features;

[0019] Based on the user access resource logs of each user, analyze the user through the trained user model, and build a user feature profile based on the analysis result;

[0020] Among them, machine learning algorithms include decision trees, random forests, support vector machines, and neural networks.

[0021] Preferably, when generating a device fingerprint based on device features and device attributes, weights are assigned to the device features and device attributes, and a device fingerprint representing the uniqueness of the device is generated based on the device features, the weight of each device feature, the device attributes, and the weight of each device attribute.

[0022] Preferably, for each user, based on the registration application submitted by the user, the decentralized identity authentication system assigns an identity identifier (DID) to the user based on the user information in the registration application submitted by the user, and creates a DID document for the user's identity. The user receives the identity identifier (DID) and DID document returned by the decentralized identity authentication system, stores the DID document in a blockchain or distributed ledger, and registers the identity identifier (DID) and its corresponding DID document in a decentralized DID registry through a smart contract.

[0023] For users logging into the system, the authentication and authorization module sends an authentication request to the user, which includes verification information. The user signs the verification information based on his or her private key and sends the signature information to the authentication and authorization module. The authentication and authorization module verifies the validity of the signature information based on the public key in the DID document and checks the authenticity and integrity of the verification information to authenticate the user.

[0024] Among them, for users who log in to the system for the first time, the authentication and authorization module authenticates the user and allows the authenticated user to log in to the system;

[0025] For users who have logged into the system multiple times, the authentication and authorization module authenticates the user. For users who pass the authentication, the device used for user login is authenticated based on the device fingerprint. If the authentication is passed, the user is allowed to log in to the system. If the authentication is not passed, a notification is pushed to the user based on the contact information specified by the user information, and the user is allowed to log in to the system based on the user's permission.

[0026] In a second aspect, the present invention provides a user access authentication method based on user portrait and device fingerprint, which is used to implement user access authentication using a user access authentication system based on user portrait and device fingerprint as described in any one of the first aspects, the method comprising the following steps:

[0027] Authenticate the user who logs into the system. For users who pass the identity authentication, authenticate the device used by the user to log in based on the device fingerprint.

[0028] Manage users and their basic information, and store user logs in the form of blockchain. User logs include user access resource logs and user login device logs.

[0029] reading a historical user log, constructing a user feature portrait based on the historical user log, extracting a recognition fingerprint of a device used by the user to log in based on a user login device log, and storing the user feature portrait and the device fingerprint to a local server;

[0030] setting a resource access permission of the user based on the user feature portrait through a rule-based access control model, and authorizing a resource specified to be accessed in a user authentication request based on a current resource access permission of the user for a resource access request submitted by the user.

[0031] Preferably, constructing the user feature portrait based on the historical user log and extracting the recognition fingerprint of the device used by the user to log in based on the user login device log comprises the following steps:

[0032] obtaining a historical user log, and performing data cleaning on the historical user log to remove errors, incomplete data and irrelevant data in the historical user log, and obtaining a cleaned historical user log;

[0033] performing data conversion on data in the cleaned historical user log to convert the data in the historical user log into a predetermined format, and obtaining a preprocessed historical user log;

[0034] extracting a user feature and constructing a user feature portrait based on the preprocessed historical user access resource log and the constructed user model;

[0035] extracting a device feature and a device attribute of a device used by the user to log in based on the preprocessed historical user login device log, and generating a device fingerprint based on the device feature and the device attribute.

[0036] Preferably, extracting the user feature and constructing the user feature portrait based on the preprocessed historical user access resource log and the constructed user model comprises the following steps:

[0037] analyzing the user based on the preprocessed historical user access resource log, and constructing a user label library according to an analysis result;

[0038] performing feature analysis on the user based on a label in the label library and the preprocessed historical user access resource log, obtaining a user feature, and the user feature representing a user preference;

[0039] constructing a user model based on a machine learning algorithm, and training the user model based on a user label and a user feature;

[0040] analyzing the user based on a user access resource log of each user through the trained user model, and constructing a user feature portrait based on an analysis result;

[0041] The machine learning algorithm includes a decision tree, a random forest, a support vector machine, and a neural network.

[0042] Preferably, when generating the device fingerprint based on the device features and the device attributes, weights are assigned to the device features and the device attributes, and a device fingerprint representing the uniqueness of the device is generated based on the device features, the weight of each device feature, the device attributes, and the weight of each device attribute.

[0043] Preferably, for each user, based on the registration application submitted by the user, the decentralized identity authentication system assigns an identity identifier DID to the user based on the user information in the registration application submitted by the user and establishes a DID document of the user identity, the user receives the identity identifier DID and the DID document returned by the decentralized identity authentication system, stores the DID document in a blockchain or a distributed ledger, and registers the identity identifier DID and the corresponding DID document in a decentralized DID registry through a smart contract.

[0044] For a user logging into the system, the authentication and authorization module sends an authentication request to the user, the authentication request including verification information, the user signs the verification information based on a private key and sends the signed information to the authentication and authorization module, the authentication and authorization module verifies the validity of the signed information based on the public key in the DID document and checks the authenticity and integrity of the verification information to achieve identity authentication of the user.

[0045] For a user logging into the system, the authentication and authorization module sends an authentication request to the user, the authentication request including verification information, the user signs the verification information based on a private key and sends the signed information to the authentication and authorization module, the authentication and authorization module verifies the validity of the signed information based on the public key in the DID document and checks the authenticity and integrity of the verification information to achieve identity authentication of the user.

[0046] For a user who has logged into the system multiple times, after identity authentication by the authentication and authorization module, for a user who passes the authentication, the user's login device is authenticated based on the device fingerprint, if the authentication is passed, the user is allowed to log into the system, if the authentication is not passed, a notification is pushed to the user based on the contact information specified by the user information, and the user is allowed to log into the system based on the user's permission.

[0047] The user access authentication system and method based on user portraits and device fingerprints have the following advantages:

[0048] 1. Using a decentralized identity authentication system and device fingerprint combination for authentication can effectively prevent illegal users from stealing or misusing user accounts, ensure that only legitimate and correct users can access system resources, effectively prevent unauthorized access, and protect data and resources from theft or malicious operations.

[0049] 2. Using a rule-based access control model combined with user profiling for access authorization can more accurately identify user roles, behaviors, and permissions, ensuring that only authorized users can access specific system resources. This not only improves the user experience and facilitates fast and efficient access to system resources, but also ensures resource security, significantly reducing the risk of illegal and unauthorized access.

[0050] 3. Using deep learning models to analyze user data and extract persona profiles and device fingerprints can capture more abstract and complex features, thereby improving the accuracy of user profiles and device fingerprints. This also eliminates the need for manual feature extraction, significantly reducing the time and human resource costs of manual data processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments or descriptions of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0052] The present invention will be further described below with reference to the accompanying drawings.

[0053] Figure 1 This is a structural block diagram of a user access authentication system based on user portrait and device fingerprint according to Example 1;

[0054] Figure 2 This is a working block diagram of a user access authentication system based on user portrait and device fingerprint in Example 1. DETAILED DESCRIPTION

[0055] The present invention will be further described below with reference to the accompanying drawings and specific embodiments so that those skilled in the art can better understand the present invention and implement it. However, the embodiments given are not intended to limit the present invention. Unless there is a conflict, the embodiments of the present invention and the technical features in the embodiments may be combined with each other.

[0056] The embodiments of the present invention provide a user access authentication system and method based on user portraits and device fingerprints, which are used to solve the technical problems of user identity authentication and how to ensure high security while reducing usage costs.

[0057] Example 1:

[0058] The present invention provides a user access authentication system based on user portrait and device fingerprint, comprising a user management module, an authentication authorization module, a log analysis module and an access authorization module.

[0059] The user management module is used to manage users and their basic information, and to store user logs in the form of blockchain. User logs include user access resource logs and user login device logs.

[0060] As a specific implementation of the user management module, this module manages user information, including name, email, and contact information. Within the user management module, user-related operations such as creating, editing, deleting, and unlocking users can be performed, as well as viewing user logs. Furthermore, the user management module stores user resource access logs and device login logs in a blockchain-based manner. Through the use of the user management module, effective user management, information security assurance, data analysis, audit tracking, and an enhanced user experience can be achieved.

[0061] The log analysis module is used to read historical user logs from the user management module, build user feature portraits based on historical user logs, extract identification fingerprints of user login devices based on user login device logs, and store user feature portraits and device fingerprints on the local server.

[0062] As a specific implementation of the log analysis module, the module is executed as follows:

[0063] (1) Obtain historical user logs and perform data cleaning on the historical user logs, thereby removing erroneous, incomplete, and irrelevant data from the historical user logs to obtain cleaned historical user logs;

[0064] (2) performing data conversion on the cleaned data in the historical user log, converting the data in the historical user log into a predetermined format through data conversion to obtain a preprocessed historical user log;

[0065] (3) Based on the pre-processed historical user access resource logs, the constructed user model is used to extract user features and construct a user feature profile;

[0066] (4) Based on the pre-processed historical user login device logs, the device features and device attributes of the user's login device are extracted, and the device fingerprint is generated based on the device features and device attributes.

[0067] The following steps are involved in extracting user features and building a user profile based on the pre-processed historical user access resource logs and the constructed user model:

[0068] (1) Analyze users based on pre-processed historical user access resource logs and build a user tag library based on the analysis results;

[0069] (2) Performing feature analysis on users based on the tags in the tag library and the pre-processed historical user access resource logs to obtain user features, which represent user preferences;

[0070] (3) Build a user model based on machine learning algorithms and train the user model based on user tags and user features;

[0071] (4) Analyze users based on their resource access logs and trained user models, and construct user profiles based on the analysis results;

[0072] Among them, machine learning algorithms include decision trees, random forests, support vector machines, and neural networks.

[0073] When generating a device fingerprint based on device features and device attributes, weights are assigned to the device features and device attributes, and a device fingerprint representing the uniqueness of the device is generated based on the device features, the weight of each device feature, the device attributes, and the weight of each device attribute.

[0074] The authentication and authorization module is used to authenticate the identity of users logging into the system through a decentralized system. For users who have passed the identity authentication, it is used to authenticate the device used by the user to log in based on the device fingerprint.

[0075] In this embodiment, for each user, based on the registration application submitted by the user, the decentralized identity authentication system assigns an identity identifier DID to the user based on the user information in the registration application submitted by the user, and creates a DID document for the user's identity. The user receives the identity identifier DID and DID document returned by the decentralized identity authentication system, stores the DID document in a blockchain or distributed ledger, and registers the identity identifier DID and its corresponding DID document in a decentralized DID registry through a smart contract.

[0076] Correspondingly, for users logging into the system, the authentication and authorization module sends an authentication request to the user, which includes verification information. The user signs the verification information based on his or her private key and sends the signature information to the authentication and authorization module. The authentication and authorization module verifies the validity of the signature information based on the public key in the DID document, and checks the authenticity and integrity of the verification information to achieve user identity authentication.

[0077] Among them, for users who log in to the system for the first time, the authentication and authorization module authenticates the user and allows the authenticated user to log in to the system; for users who have logged in to the system multiple times, the authentication and authorization module authenticates the user and, for users who have passed the authentication, performs device authentication on the user's login device based on the device fingerprint. If the authentication is passed, the user is allowed to log in to the system. If the authentication is not passed, a notification is pushed to the user based on the contact information specified by the user information, and the user is allowed to log in to the system based on the user's permission.

[0078] The identity authentication module of this embodiment combines a decentralized identity system (DID) and device fingerprints to authenticate and authorize users. This module will first use DID for identity authentication. When a user logs in to the system for the first time, the user needs to apply for a DID (decentralized identity) from a decentralized identity authentication platform (such as uPort) and upload user information to create a DID document for their identity. The user needs to store the digital profile on a blockchain or distributed ledger to ensure that it is tamper-proof and publicly verifiable. The user then needs to use a smart contract to register the newly created DID and its corresponding DID document in a decentralized DID registry. When the user's identity needs to be verified, the system will send an authentication request to the user, including the specific information that needs to be verified. The user then uses their private key to sign the specific information in the request to prove that they own the DID and the corresponding credentials. After receiving the user's signature information, the system verifies the validity of the signature using the public key provided in the DID document and checks the authenticity and integrity of the relevant information, thereby completing the identity authentication.

[0079] After a user completes identity authentication using a DID, the system uses the device's fingerprint to perform two-factor authentication. If the device information used by the user to log in cannot pass the device fingerprint verification, the identity authentication module will notify the user through other means, such as phone calls or emails, that another user is attempting to log in. Only after obtaining the user's permission can the device fingerprint verification be passed. If the device information used by the user to log in can pass the device fingerprint verification, the user can successfully log in.

[0080] The access authorization module is configured with a rule-based access control model, which is used to set the user's resource access rights based on user feature profiling through a rule-based access control model. For resource access requests submitted by users, it is used to authorize the resources to be accessed in the user authentication request based on the user's current resource access rights.

[0081] The access authorization module of this embodiment uses rule-BAC (rule-based access control model) to perform access permission control. This module can grant users permission to access resources corresponding to the characteristics based on the user feature profile obtained by analyzing the user's historical access log records in the log analysis module as a rule. When a user wants to access resources outside of the access permission, it is necessary to apply to the access authorization module for permission to specific resources. For example, if the user feature profile shows that the user often accesses resources labeled as Class A, this module will automatically grant the user permission to access resources labeled as Class A. When the user needs to access resources labeled as Class B, it is necessary to apply to the access authorization module for permission to access specific Class B resources. After the user accesses the resource, the access authorization module will record the user's resource access log and save it to the user management module. When the user profile is updated, the access authorization module also needs to update the user's corresponding resource access rights.

[0082] The system operation process of this embodiment is as follows:

[0083] Step 1: Create a user in the user management module. At this time, the user only has the default permissions.

[0084] Step 2: After a period of use, the log analysis module will generate a user profile based on the user's historical access logs, and generate a device fingerprint based on the user's historical login device data.

[0085] Step 3: After the log analysis module generates the device fingerprint and user profile, the user will first be authenticated using the decentralized identity authentication system (DID) when logging in. Once authenticated, the device fingerprint of the user's login device will be verified. If the login device fails the device fingerprint verification, the identity authentication module will automatically contact the user for confirmation. Only after confirmation is completed can the user continue to log in. If the login device passes the device fingerprint verification, the user can log in to the system and access resources.

[0086] Step 4: After the log analysis module generates and updates the device fingerprint and user feature portrait, the access authorization module will determine which resources the user can access based on the user portrait generated by the log analysis module. When the user wants to access resources beyond their own permissions, they need to submit an application to the access authorization module. Only after the application is approved can they access the corresponding resources.

[0087] Example 2:

[0088] The present invention provides a user access authentication method based on user portrait and device fingerprint, which implements user access authentication based on the system disclosed in Example 1. The method includes the following steps:

[0089] Step S100: Authenticate the user who logs into the system. For users who pass the identity authentication, authenticate the device used by the user based on the device fingerprint.

[0090] Step S200: Manage users and their basic information, and store user logs in the form of blockchain. User logs include user resource access logs and user device login logs.

[0091] Step S300: Read historical user logs, construct a user feature profile based on the historical user logs, extract the identification fingerprint of the user's login device based on the user login device log, and store the user feature profile and device fingerprint to the local server;

[0092] Step S400: Based on the user's feature profile, the user's resource access rights are set through a rule-based access control model. For resource access requests submitted by the user, the resource to be accessed is authorized based on the user's current resource access rights in the user authentication request.

[0093] In step S100, for each user, based on the registration application submitted by the user, the decentralized identity authentication system assigns an identity identifier DID to the user based on the user information in the registration application submitted by the user, and creates a DID document for the user's identity. The user receives the identity identifier DID and DID document returned by the decentralized identity authentication system, stores the DID document in a blockchain or distributed ledger, and registers the identity identifier DID and its corresponding DID document in a decentralized DID registry through a smart contract.

[0094] Correspondingly, for users logging into the system, the authentication and authorization module sends an authentication request to the user, which includes verification information. The user signs the verification information based on his or her private key and sends the signature information to the authentication and authorization module. The authentication and authorization module verifies the validity of the signature information based on the public key in the DID document, and checks the authenticity and integrity of the verification information to achieve user identity authentication.

[0095] Among them, for users who log in to the system for the first time, the authentication and authorization module authenticates the user and allows the authenticated user to log in to the system; for users who have logged in to the system multiple times, the authentication and authorization module authenticates the user and, for users who have passed the authentication, performs device authentication on the user's login device based on the device fingerprint. If the authentication is passed, the user is allowed to log in to the system. If the authentication is not passed, a notification is pushed to the user based on the contact information specified by the user information, and the user is allowed to log in to the system based on the user's permission.

[0096] In step S200, the user management module manages user information, including name, email address, and contact information. This module allows for user-related operations such as creating, editing, deleting, and unlocking users, as well as viewing user logs. The module also stores user resource access logs and device login logs in a blockchain-based manner. The user management module facilitates effective user management, information security, data analysis, audit tracking, and an enhanced user experience.

[0097] In step S300, the user log is analyzed by the log analysis module to construct a user feature profile and device fingerprint. The specific operations are as follows:

[0098] (1) Obtain historical user logs and perform data cleaning on the historical user logs, thereby removing erroneous, incomplete, and irrelevant data from the historical user logs to obtain cleaned historical user logs;

[0099] (2) performing data conversion on the cleaned data in the historical user log, converting the data in the historical user log into a predetermined format through data conversion to obtain a preprocessed historical user log;

[0100] (3) Based on the pre-processed historical user access resource logs, the constructed user model is used to extract user features and construct a user feature profile;

[0101] (4) Based on the pre-processed historical user login device logs, the device features and device attributes of the user's login device are extracted, and the device fingerprint is generated based on the device features and device attributes.

[0102] The following steps are involved in extracting user features and building a user profile based on the pre-processed historical user access resource logs and the constructed user model:

[0103] (1) Analyze users based on pre-processed historical user access resource logs and build a user tag library based on the analysis results;

[0104] (2) Performing feature analysis on users based on the tags in the tag library and the pre-processed historical user access resource logs to obtain user features, which represent user preferences;

[0105] (3) Build a user model based on machine learning algorithms and train the user model based on user tags and user features;

[0106] (4) Analyze users based on their resource access logs and trained user models, and construct user profiles based on the analysis results;

[0107] Among them, machine learning algorithms include decision trees, random forests, support vector machines, and neural networks.

[0108] When generating a device fingerprint based on device features and device attributes, weights are assigned to the device features and device attributes, and a device fingerprint representing the uniqueness of the device is generated based on the device features, the weight of each device feature, the device attributes, and the weight of each device attribute.

[0109] Step S400 uses rule-BAC (rule-based access control model) to control access rights. This step can grant users access to resources corresponding to the features based on the user feature profile obtained by analyzing the user's historical access log records in the log analysis module as a rule. When a user wants to access resources outside of the access rights, it is necessary to apply to the access authorization module for permission to specific resources. For example, if the user feature profile shows that the user often accesses resources labeled as Class A, this module will automatically grant the user permission to access resources labeled as Class A. When the user needs to access resources labeled as Class B, it is necessary to apply to the access authorization module for permission to access specific Class B resources. After the user accesses the resource, the access authorization module will record the user's resource access log and save it to the user management module. When the user portrait is updated, the access authorization module also needs to update the user's corresponding resource access rights.

[0110] The method of this embodiment combines a decentralized identity authentication system and device fingerprint authentication. Decentralized identity authentication ensures the security of user identity data through distributed ledger technology, reduces the single point failure and attack risks that may exist in centralized systems, and reduces the risk of user information being abused and leaked. Device fingerprint authentication is unique and stable. Once generated, it will not change due to device upgrades or changes. It can be used effectively for a long time, reducing the need for repeated authentication. The combination of the two can realize cross-device and cross-application identity authentication, improve the interoperability of the system, and provide users with a safer, more convenient and efficient identity authentication experience. It combines a rule-based access control model and user feature profiles. The rule-based access control model realizes flexible and dynamic adjustment of security policies by combining user feature profiles as rules. It can accurately authorize according to user characteristics and needs, reduce the maintenance cost of the system, ensure that users can only access legal data within their own authority, and reduce the risk of illegal access and data leakage.

[0111] The present invention has been shown and described in detail above through the accompanying drawings and preferred embodiments. However, the present invention is not limited to these disclosed embodiments. Based on the above multiple embodiments, those skilled in the art can know that the means in the above different embodiments can be combined to obtain more embodiments of the present invention, and these embodiments are also within the scope of protection of the present invention.

Claims

1. A user access authentication system based on user portrait and device fingerprint, characterized in that: Including user management module, authentication and authorization module, log analysis module and access authorization module; The user management module is used to manage users and their basic information, and to store user logs in the form of blockchain, including user resource access logs and user login device logs; The log analysis module is configured to perform the following operations: obtaining historical user logs and performing data cleaning on the historical user logs, removing erroneous, incomplete, and irrelevant data in the historical user logs through data cleaning to obtain cleaned historical user logs; performing data conversion on the data in the cleaned historical user logs, converting the data in the historical user logs into a predetermined format through data conversion to obtain pre-processed historical user logs; extracting user features based on the pre-processed historical user resource access logs and the constructed user model, and constructing a user feature profile; Extract the device characteristics and device attributes of the device used by the user login based on the user login device log, generate the device fingerprint based on the device characteristics and device attributes, and store the user feature profile and device fingerprint to the local server; The authentication and authorization module is used to authenticate the identity of the user who logs into the system through a decentralized system. For users who pass the identity authentication, it is used to authenticate the device used by the user to log in based on the device fingerprint; The access authorization module is configured with a rule-based access control model, which is used to set the user's resource access rights based on the user's feature profile through the rule-based access control model. For resource access requests submitted by the user, it is used to authorize the resources to be accessed specified in the user authentication request based on the user's current resource access rights; The following steps are involved in extracting user features and building a user profile based on the pre-processed historical user access resource logs and the constructed user model: Analyze users based on pre-processed historical user access resource logs and build a user tag library based on the analysis results; Perform feature analysis on users based on tags in the tag library and pre-processed historical user access resource logs to obtain user features, which represent user preferences. Build a user model based on machine learning algorithms and train the user model based on user tags and user features; Analyze users based on their resource access logs and trained user models, and build user profiles based on the analysis results. Among them, machine learning algorithms include decision trees, random forests, support vector machines, and neural networks.

2. The user access authentication system based on user portrait and device fingerprint according to claim 1 is characterized in that: The log analysis module is further configured to perform the following: Based on the pre-processed historical user login device logs, the device features and device attributes of the device used by the user are extracted, and the device fingerprint is generated based on the device features and device attributes.

3. The user access authentication system based on user portrait and device fingerprint according to claim 2 is characterized in that: When generating a device fingerprint based on device features and device attributes, weights are assigned to the device features and device attributes, and a device fingerprint representing the uniqueness of the device is generated based on the device features, the weight of each device feature, the device attributes, and the weight of each device attribute.

4. The user access authentication system based on user portrait and device fingerprint according to claim 2, characterized in that: For each user, based on the registration application submitted by the user, the decentralized identity authentication system assigns an identity identifier (DID) to the user based on the user information in the registration application and creates a DID document for the user's identity. The user receives the identity identifier (DID) and DID document returned by the decentralized identity authentication system, stores the DID document in a blockchain or distributed ledger, and registers the identity identifier (DID) and its corresponding DID document in a decentralized DID registry through a smart contract. For users logging into the system, the authentication and authorization module sends an authentication request to the user, which includes verification information. The user signs the verification information based on his or her private key and sends the signature information to the authentication and authorization module. The authentication and authorization module verifies the validity of the signature information based on the public key in the DID document and checks the authenticity and integrity of the verification information to authenticate the user. Among them, for users who log in to the system for the first time, the authentication and authorization module authenticates the user and allows the authenticated user to log in to the system; For users who have logged into the system multiple times, the authentication and authorization module authenticates the user. For users who pass the authentication, the device used for user login is authenticated based on the device fingerprint. If the authentication is passed, the user is allowed to log in to the system. If the authentication is not passed, a notification is pushed to the user based on the contact information specified by the user information, and the user is allowed to log in to the system based on the user's permission.

5. A user access authentication method based on user portrait and device fingerprint, characterized in that: The method for implementing user access authentication by using a user access authentication system based on user portrait and device fingerprint according to any one of claims 1 to 4 comprises the following steps: Authenticate the user who logs into the system. For users who pass the identity authentication, authenticate the device used by the user to log in based on the device fingerprint. Manage users and their basic information, and store user logs in the form of blockchain. User logs include user access resource logs and user login device logs. Obtain historical user logs and perform data cleaning on the historical user logs to remove erroneous, incomplete, and irrelevant data in the historical user logs to obtain cleaned historical user logs; Performing data conversion on the cleaned data in the historical user logs, converting the data in the historical user logs into a predetermined format through data conversion to obtain pre-processed historical user logs; extracting user features based on the pre-processed historical user resource access logs and the constructed user model, and constructing a user feature profile; Extract the device characteristics and device attributes of the device used by the user login based on the user login device log, generate the device fingerprint based on the device characteristics and device attributes, and store the user feature profile and device fingerprint to the local server; Based on user profiles and a rule-based access control model, the user's resource access permissions are set. For resource access requests submitted by users, the system is used to authorize the resources specified in the user authentication request based on the user's current resource access permissions. The following steps are involved in extracting user features and building a user profile based on the pre-processed historical user access resource logs and the constructed user model: Analyze users based on pre-processed historical user access resource logs and build a user tag library based on the analysis results; Perform feature analysis on users based on tags in the tag library and pre-processed historical user access resource logs to obtain user features, which represent user preferences. Build a user model based on machine learning algorithms and train the user model based on user tags and user features; Analyze users based on their resource access logs and trained user models, and build user profiles based on the analysis results. Among them, machine learning algorithms include decision trees, random forests, support vector machines, and neural networks.

6. The user access authentication method based on user portrait and device fingerprint according to claim 5, characterized in that: Extracting identification fingerprints of devices used by users when they log in based on user login device logs includes the following steps: extracting device features and device attributes of devices used by users when they log in based on preprocessed historical user login device logs, and generating device fingerprints based on the device features and device attributes.

7. The user access authentication method based on user portrait and device fingerprint according to claim 6, characterized in that: When generating a device fingerprint based on device features and device attributes, weights are assigned to the device features and device attributes, and a device fingerprint representing the uniqueness of the device is generated based on the device features, the weight of each device feature, the device attributes, and the weight of each device attribute.

8. The user access authentication method based on user portrait and device fingerprint according to claim 6, characterized in that: For each user, based on the registration application submitted by the user, the decentralized identity authentication system assigns an identity identifier (DID) to the user based on the user information in the registration application and creates a DID document for the user's identity. The user receives the identity identifier (DID) and DID document returned by the decentralized identity authentication system, stores the DID document in a blockchain or distributed ledger, and registers the identity identifier (DID) and its corresponding DID document in a decentralized DID registry through a smart contract. For users logging into the system, the authentication and authorization module sends an authentication request to the user, which includes verification information. The user signs the verification information based on his or her private key and sends the signature information to the authentication and authorization module. The authentication and authorization module verifies the validity of the signature information based on the public key in the DID document and checks the authenticity and integrity of the verification information to achieve user identity authentication. Among them, for users who log in to the system for the first time, after the user's identity is authenticated by the authentication and authorization module, the authenticated user is allowed to log in to the system; For users who have logged into the system multiple times, after the user's identity is authenticated by the authentication and authorization module, the device used for user login is authenticated based on the device fingerprint. If the authentication is successful, the user is allowed to log in to the system. If the authentication is not successful, a notification is pushed to the user based on the contact information specified by the user information, and the user is allowed to log in to the system based on the user's permission.

Images