A browser authentication method and system based on user behavior

Abstract

This invention discloses a browser authentication method and system based on user behavior, comprising: collecting users' historical usage information and constructing a user data operation database based on the historical usage information; obtaining the browser's current usage information and determining the current user's identification status based on the current usage information and the data operation database; marking operations related to user privacy as confidential operations and setting confidentiality levels according to the importance of confidential operations to user privacy; setting security levels for confidential operations according to the identification status and setting security verification questions corresponding to the security levels according to user identity information; and performing security verification on the operation information in the current usage information by combining the security verification questions and confidential operations to obtain the user's verification result. This invention can better protect the original user's privacy, effectively prevent unauthorized access, increase system security, effectively reduce the possibility of malicious attackers intruding, and improve the level of user privacy protection.

Description

Technical Field

[0001] This invention relates to the field of identity authentication technology, and more specifically, to a browser authentication method and system based on user behavior. Background Technology

[0002] With the development of the internet, more and more services and applications require user authentication. Patent application CN202410497901X discloses a browser-integrated customer authentication method. This invention preprocesses and extracts features from collected user behavior data, calculates user feature vectors based on failed authentication attempts, determines the success of user authentication using the calculated deviation coefficient, predicts unknown authentications based on authentication security assessment coefficients, evaluates the existence of risks to user authentication security, classifies user authentication security risks into different levels, provides risk warnings to users, and adopts corresponding risk response strategies for users with different risk levels. When acquiring user identity, this invention calculates the deviation coefficient by selecting failed authentication attempts and assesses the risk level used for authentication. If a malicious attacker steals authentication information, the system may not be able to effectively prevent intrusion and protect user privacy. Summary of the Invention

[0003] This invention proposes a browser authentication method and system based on user behavior to solve the problem of how to authenticate users.

[0004] To address the aforementioned problems, according to one aspect of the present invention, a browser authentication method based on user behavior is provided, the method comprising:

[0005] Collect users' historical usage information and construct a user data operation database based on the historical usage information;

[0006] Obtain the browser's current usage information, and determine the current user's identification status based on the current usage information and the data operation library;

[0007] Mark operations related to user privacy as confidential operations, and set the confidentiality level according to the importance of confidential operations to user privacy;

[0008] Set a security level for confidential operations based on the identification status, and set corresponding security verification questions based on the user's identity information;

[0009] By combining security verification issues and confidentiality operations, the operational information in the currently used information is security verified to obtain the user's verification result.

[0010] Preferably, the process of constructing a user's data operation database based on the historical usage information includes:

[0011] Based on the historical usage information, first key behavioral features are extracted, and a proportional coefficient is set for each first key behavioral feature to construct a user data operation library based on the first key behavioral features and the proportional coefficient; wherein, the sum of the proportional coefficients corresponding to all first key behavioral features is 1.

[0012] Preferably, determining the current user's identification status based on the current usage information and data operation library includes:

[0013] Based on the information currently in use, extract the second key behavioral feature, compare the second key behavioral feature with the first key behavioral feature, determine the proportion coefficient corresponding to the key behavioral feature that is successfully compared as the success proportion coefficient, and determine the proportion coefficient corresponding to the key behavioral feature that is not successfully compared as the failure proportion coefficient.

[0014] Calculate the ratio of the sum of success rate coefficients to the sum of failure rate coefficients to determine the comparison coefficient;

[0015] The comparison coefficients are compared with a preset comparison coefficient threshold, and the current user's identification status is determined based on the comparison result.

[0016] Preferably, the step of comparing the comparison coefficients with a preset comparison coefficient threshold and determining the current user's identification status based on the comparison result includes:

[0017] Determine whether the comparison coefficient is greater than or equal to a first comparison coefficient threshold; if it is, mark the current user's identification status as a matching status; otherwise, determine whether the comparison coefficient is greater than or equal to a second preset comparison coefficient threshold; if it is, mark the current user's identification status as a sub-matching status; otherwise, mark the current user's identification status as a non-matching status.

[0018] Preferably, setting a security level for confidential operations based on the identification status includes:

[0019] Extract the confidentiality level corresponding to the confidential operation; the confidentiality level includes three levels: A, B, and C;

[0020] The identification level of the conforming state is marked as level 1, the identification level of the sub-conforming state is marked as level 2, and the identification level of the non-conforming state is marked as level 3.

[0021] The security level is obtained based on the identification level and the confidentiality level; the security level includes: A1, A2, A3, B1, B2, B3, C1, C2 and C3.

[0022] Preferably, the security verification question corresponding to the security level based on the user's identity information includes:

[0023] Extract user identity information; wherein, the user identity information includes: user name, bound mobile phone number, bound personal information and account password;

[0024] The evaluation results are obtained by assessing the sub-data in the user identity information. Based on the evaluation results, the sub-data are arranged and combined and matched one-to-one with the security level to obtain the security verification answer. The security verification question is set based on the security verification answer.

[0025] Preferably, the evaluation of the sub-data in the user identity information to obtain the evaluation result includes:

[0026] Extract sub-data from user identity information;

[0027] The frequency of occurrence of each sub-data in the historical usage data is statistically analyzed, and the frequency of occurrence of each sub-data is marked as Pi, where i is the sub-data number;

[0028] Through formula The entropy HXi of sub-data numbered i is calculated, and the entropy of the sub-data is used as the evaluation result of the sub-data; where n is the number of sub-data.

[0029] Preferably, the step of arranging and combining sub-data according to the evaluation results and corresponding them one-to-one with security levels to obtain the security verification answer includes:

[0030] Evaluation results and security levels of extracted sub-data;

[0031] The sub-data are sorted from largest to smallest according to the size of the evaluation results, and then sorted in pairs according to the size order to obtain a double answer sequence. Each sub-data is combined to obtain a single answer sequence. The single answer sequence and the double answer sequence are combined to obtain the answer sequence. The answer sequences are then mapped to the security level according to the size order to obtain the answer sequence corresponding to the security level. The answer sequence corresponding to the security level is marked as the security verification answer.

[0032] Preferably, the method of combining security verification questions and confidentiality operations to perform security verification on the operation information in the currently used information to obtain the user's verification result includes:

[0033] Extract operation information and confidential operations from the currently used information;

[0034] Determine if the operation information is the same as the confidential operation; if yes, provide the corresponding authentication question according to the security level of the confidential operation, and the user needs to answer the authentication question; if no, do not provide an authentication question, but continue to compare and obtain the user's identification status.

[0035] Set an error count threshold; the error count threshold is a manually set number of allowed incorrect answers to authentication questions;

[0036] Determine if the user's response to the authentication question is correct; if yes, grant the current user confidential operation permissions; otherwise, increment the user's incorrect response count by one.

[0037] When a user's number of incorrect responses equals the error count threshold, the authentication question interface is closed, the current user is marked as an abnormal user, and access to all confidential operations is revoked.

[0038] According to another aspect of the present invention, a browser authentication system based on user behavior is provided, the system comprising:

[0039] A data operation library construction unit is used to collect users' historical usage information and construct users' data operation library based on the historical usage information;

[0040] The identification status determination unit is used to obtain the current usage information of the browser and determine the identification status of the current user based on the current usage information and the data operation library;

[0041] The confidentiality level setting unit is used to mark operations related to user privacy as confidential operations and set the confidentiality level according to the importance of the confidential operations to user privacy.

[0042] The verification question setting unit is used to set the security level for confidential operations based on the identification status, and to set the security verification question corresponding to the security level based on the user's identity information.

[0043] The verification unit is used to perform security verification on the operational information in the currently used information by combining security verification questions and confidentiality operations to obtain the user's verification result.

[0044] Preferably, the data operation library construction unit, which constructs a user's data operation library based on the historical usage information, includes:

[0045] Based on the historical usage information, first key behavioral features are extracted, and a proportional coefficient is set for each first key behavioral feature to construct a user data operation library based on the first key behavioral features and the proportional coefficient; wherein, the sum of the proportional coefficients corresponding to all first key behavioral features is 1.

[0046] Preferably, the identification status determination unit determines the current user's identification status based on the current usage information and the data operation library, including:

[0047] Based on the information currently in use, extract the second key behavioral feature, compare the second key behavioral feature with the first key behavioral feature, determine the proportion coefficient corresponding to the key behavioral feature that is successfully compared as the success proportion coefficient, and determine the proportion coefficient corresponding to the key behavioral feature that is not successfully compared as the failure proportion coefficient.

[0048] Calculate the ratio of the sum of success rate coefficients to the sum of failure rate coefficients to determine the comparison coefficient;

[0049] The comparison coefficients are compared with a preset comparison coefficient threshold, and the current user's identification status is determined based on the comparison result.

[0050] Preferably, the identification status determination unit compares the comparison coefficient with a preset comparison coefficient threshold and determines the current user's identification status based on the comparison result, including:

[0051] Determine whether the comparison coefficient is greater than or equal to a first comparison coefficient threshold; if it is, mark the current user's identification status as a matching status; otherwise, determine whether the comparison coefficient is greater than or equal to a second preset comparison coefficient threshold; if it is, mark the current user's identification status as a sub-matching status; otherwise, mark the current user's identification status as a non-matching status.

[0052] Preferably, the verification question setting unit sets a security level for the confidential operation based on the identification status, including:

[0053] Extract the confidentiality level corresponding to the confidential operation; the confidentiality level includes three levels: A, B, and C;

[0054] The identification level of the conforming state is marked as level 1, the identification level of the sub-conforming state is marked as level 2, and the identification level of the non-conforming state is marked as level 3.

[0055] The security level is obtained based on the identification level and the confidentiality level; the security level includes: A1, A2, A3, B1, B2, B3, C1, C2 and C3.

[0056] Preferably, the verification question setting unit sets security verification questions corresponding to the security level based on the user's identity information, including:

[0057] Extract user identity information; wherein, the user identity information includes: user name, bound mobile phone number, bound personal information and account password;

[0058] The evaluation results are obtained by assessing the sub-data in the user identity information. Based on the evaluation results, the sub-data are arranged and combined and matched one-to-one with the security level to obtain the security verification answer. The security verification question is set based on the security verification answer.

[0059] Preferably, the verification question setting unit evaluates the sub-data in the user identity information to obtain an evaluation result, including:

[0060] Extract sub-data from user identity information;

[0061] The frequency of occurrence of each sub-data in the historical usage data is statistically analyzed, and the frequency of occurrence of each sub-data is marked as Pi, where i is the sub-data number;

[0062] Through formula The entropy HXi of sub-data numbered i is calculated, and the entropy of the sub-data is used as the evaluation result of the sub-data; where n is the number of sub-data.

[0063] Preferably, the verification question setting unit, based on the evaluation results, arranges and combines sub-data and maps them one-to-one with security levels to obtain security verification answers, including:

[0064] Evaluation results and security levels of extracted sub-data;

[0065] The sub-data are sorted from largest to smallest according to the size of the evaluation results, and then sorted in pairs according to the size order to obtain a double answer sequence. Each sub-data is combined to obtain a single answer sequence. The single answer sequence and the double answer sequence are combined to obtain the answer sequence. The answer sequences are then mapped to the security level according to the size order to obtain the answer sequence corresponding to the security level. The answer sequence corresponding to the security level is marked as the security verification answer.

[0066] Preferably, the verification unit performs security verification on the operation information in the currently used information by combining security verification questions and confidentiality operations to obtain the user's verification result, including:

[0067] Extract operation information and confidential operations from the currently used information;

[0068] Determine if the operation information is the same as the confidential operation; if yes, provide the corresponding authentication question according to the security level of the confidential operation, and the user needs to answer the authentication question; if no, do not provide an authentication question, but continue to compare and obtain the user's identification status.

[0069] Set an error count threshold; the error count threshold is a manually set number of allowed incorrect answers to authentication questions;

[0070] Determine if the user's response to the authentication question is correct; if yes, grant the current user confidential operation permissions; otherwise, increment the user's incorrect response count by one.

[0071] When a user's number of incorrect responses equals the error count threshold, the authentication question interface is closed, the current user is marked as an abnormal user, and access to all confidential operations is revoked.

[0072] According to another aspect of the present invention, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any one of the steps of a browser authentication method based on user behavior.

[0073] According to another aspect of the present invention, the present invention provides an electronic device, comprising:

[0074] The aforementioned computer-readable storage medium; and

[0075] One or more processors for executing a program in the computer-readable storage medium.

[0076] This invention provides a browser authentication method and system based on user behavior, comprising: collecting users' historical usage information and constructing a user data operation database based on the historical usage information; obtaining the browser's current usage information and determining the current user's identification status based on the current usage information and the data operation database; marking operations related to user privacy as confidential operations and setting confidentiality levels according to the importance of confidential operations to user privacy; setting security levels for confidential operations according to the identification status and setting security verification questions corresponding to the security levels according to user identity information; and performing security verification on the operation information in the current usage information by combining the security verification questions and confidential operations to obtain the user's verification result. This invention can better protect the original user's privacy, effectively prevent unauthorized access, increase system security, effectively reduce the possibility of malicious attackers intruding, and improve the level of user privacy protection. Attached Figure Description

[0077] Exemplary embodiments of the present invention can be more fully understood by referring to the following figures:

[0078] Figure 1 A flowchart of a browser authentication method 100 based on user behavior according to an embodiment of the present invention;

[0079] Figure 2 This is a flowchart illustrating the process of determining a user's identification status according to an embodiment of the present invention;

[0080] Figure 3 This is a schematic diagram of the structure of a browser authentication system 300 based on user behavior according to an embodiment of the present invention. Detailed Implementation

[0081] Exemplary embodiments of the invention will now be described with reference to the accompanying drawings. However, the invention may be embodied in many different forms and is not limited to the embodiments described herein. These embodiments are provided to fully and completely disclose the invention and to fully convey its scope to those skilled in the art. The terminology used in the exemplary embodiments illustrated in the drawings is not intended to limit the invention. In the drawings, the same units / elements are referred to by the same reference numerals.

[0082] Unless otherwise stated, the terms used herein (including technical terms) have their common meaning as understood by one of ordinary skill in the art. Furthermore, it is understood that terms defined in commonly used dictionaries should be understood to have a meaning consistent with the context of their relevant field, and not to be interpreted as having an idealized or overly formal meaning.

[0083] The purpose of this invention is to provide a browser authentication method and system based on user behavior. This method collects the historical usage information and user identity information of the original user, and monitors and collects the current user's current usage information in real time. After preprocessing the historical usage information, key behavioral features are extracted and an operation database is constructed. Proportion coefficients are set for each key behavioral feature. The current usage information is compared with the operation database, and a comparison coefficient is obtained based on the comparison result and the proportion coefficients. The comparison coefficient is then compared with a preset comparison threshold to obtain the current user's identification status. Operations related to user privacy in the browser are marked as confidential operations, and corresponding confidentiality levels are set. The sub-data in the user identity information is evaluated based on the identification status and the security level corresponding to the confidentiality level. The sub-data is then arranged and combined according to the evaluation results and correlated with the security level to obtain the security verification answer and corresponding security verification question. This effectively reduces the possibility of malicious attackers intruding, improves the level of user privacy protection, and solves the problem in existing technologies where the identity authentication method is relatively simple and cannot effectively protect user privacy when malicious attacks occur.

[0084] Figure 1 This is a flowchart of a browser authentication method 100 based on user behavior according to an embodiment of the present invention. Figure 1 As shown, the browser authentication method based on user behavior provided by the embodiments of the present invention can better protect the privacy of the original user, effectively prevent unauthorized access, increase system security, effectively reduce the possibility of malicious attackers intruding, and improve the level of user privacy protection. The browser authentication method 100 based on user behavior provided by the embodiments of the present invention begins at step 101. In step 101, the user's historical usage information is collected, and a user data operation database is constructed based on the historical usage information.

[0085] Preferably, the process of constructing a user's data operation database based on the historical usage information includes:

[0086] Based on the historical usage information, first key behavioral features are extracted, and a proportional coefficient is set for each first key behavioral feature to construct a user data operation library based on the first key behavioral features and the proportional coefficient; wherein, the sum of the proportional coefficients corresponding to all first key behavioral features is 1.

[0087] In this invention, it is necessary to collect users' historical usage information and current usage information.

[0088] For example, an identity registration form is created on the registration interface. When the original user registers, they fill in their user identity information, including username, bound mobile phone number, bound personal information and account password. After the original user completes the form and submits it, the identity registration form is stored in the browser client. During the use of the browser, the user's historical usage information is recorded, including historical browsing history and historical operation history. During the current use, the current user's current usage information, including current browsing history and current operation, is monitored and recorded in real time.

[0089] After obtaining historical usage information, a user operation database is constructed based on this information. Specifically, constructing the operation database includes: extracting historical usage information, which includes historical browsing records and historical operation records; preprocessing the historical usage information to obtain historical usage data; constructing an initial operation library, extracting key behavioral features from the historical usage data, and storing these key behavioral features in the initial operation library to obtain the operation database.

[0090] Preferably, historical usage information is preprocessed to obtain historical usage data, including: extracting historical usage information; sequentially performing data cleaning, outlier detection and removal, and data standardization on the historical usage information, converting the data to a unified format, and marking the preprocessed historical usage information as historical usage data.

[0091] For example, the extracted historical usage information is sequentially cleaned, outliers are detected and removed, and data is standardized to normalize the data in the historical usage information into a unified format. The preprocessed historical usage information is marked as historical usage data. An initial operation library is constructed to extract key behavioral features from the historical usage data. Key behavioral features may include search keywords, login time, dwell time on different types of pages, and habitual operation order. The key behavioral features are stored in the initial operation library to obtain the operation database. In this embodiment, four key behavioral features are extracted: search keywords, login time, dwell time on different types of pages, and habitual operation order.

[0092] It should be noted that the key behavioral characteristics in the database refer to several major categories of behavioral characteristics, which can be further divided into many detailed behavioral characteristics. For example, the habitual operation sequence can specifically include the order in which pages are clicked, typing speed, typing habits, and frequently viewed pages, which can be specifically set according to the original user's operating habits.

[0093] In step 102, the current usage information of the browser is obtained, and the current user's identification status is determined based on the current usage information and the data operation library.

[0094] Preferably, determining the current user's identification status based on the current usage information and data operation library includes:

[0095] Based on the information currently in use, extract the second key behavioral feature, compare the second key behavioral feature with the first key behavioral feature, determine the proportion coefficient corresponding to the key behavioral feature that is successfully compared as the success proportion coefficient, and determine the proportion coefficient corresponding to the key behavioral feature that is not successfully compared as the failure proportion coefficient.

[0096] Calculate the ratio of the sum of success rate coefficients to the sum of failure rate coefficients to determine the comparison coefficient;

[0097] The comparison coefficients are compared with a preset comparison coefficient threshold, and the current user's identification status is determined based on the comparison result.

[0098] Preferably, the step of comparing the comparison coefficients with a preset comparison coefficient threshold and determining the current user's identification status based on the comparison result includes:

[0099] Determine whether the comparison coefficient is greater than or equal to a first comparison coefficient threshold; if it is, mark the current user's identification status as a matching status; otherwise, determine whether the comparison coefficient is greater than or equal to a second preset comparison coefficient threshold; if it is, mark the current user's identification status as a sub-matching status; otherwise, mark the current user's identification status as a non-matching status.

[0100] Combination Figure 2 As shown, in this invention, current usage information is collected, and the current usage information is compared with an operation database to obtain the identification status. Specifically, this includes:

[0101] A1: Extract the operation database and current usage information; assign a proportional coefficient to each key behavioral feature in the operation database, and sum all proportional coefficients to one; compare the current usage information with the operation database one by one; mark the proportional coefficients corresponding to the key behavioral features that are successfully compared as successful proportional coefficients, and mark the proportional coefficients corresponding to the key behavioral features that are not successfully compared as failure proportional coefficients.

[0102] A2: The ratio of the sum of the success rate coefficients to the sum of the failure rate coefficients is marked as the comparison coefficient; a comparison threshold is set; the comparison threshold is set according to the comparison coefficient used to determine whether the user's behavior habits conform to historical behavior habits; the comparison threshold includes a first preset comparison coefficient threshold and a second preset comparison coefficient threshold.

[0103] A3: Determine whether the comparison coefficient is greater than or equal to the first preset comparison coefficient threshold; if yes, mark the current user's identification status as compliant; otherwise, proceed to A4.

[0104] A4: Determine whether the comparison coefficient is greater than or equal to the second preset comparison coefficient threshold; if yes, mark the current user's identification status as sub-compliant; if no, mark the current user's identification status as non-compliant.

[0105] For example, in this invention, the proportional coefficients assigned to search keywords are 0.2, login time points are 0.2, dwell time on different types of pages is 0.2, and the proportional coefficient for the habitual operation order is 0.4. The current usage information is compared with the operation database. The specific comparison process is to determine whether the sub-data in the current usage information is the same as the corresponding sub-data in the operation database, or whether the corresponding sub-data in the operation database accounts for a larger proportion. If the comparison result is the same or the proportion is larger, the comparison can be considered successful. In this embodiment, the comparison result of login time point and habitual operation order is successful, while the comparison result of search keywords and dwell time on different types of liquid surfaces is unsuccessful. Therefore, the proportional coefficient of login time point and habitual operation order is the success proportional coefficient, and the proportional coefficient of search keywords and dwell time on different types of liquid surfaces is the failure proportional coefficient.

[0106] The present invention obtains a comparison coefficient of 2 / 3. In this embodiment, the first preset comparison coefficient threshold is set to 3 / 2, and the second comparison threshold is set to 1 / 4. It is determined whether the comparison coefficient is greater than or equal to the first preset comparison coefficient threshold. If the comparison coefficient is less than the first preset comparison coefficient threshold, it is further determined whether the comparison coefficient is greater than or equal to the second preset comparison coefficient threshold. If the comparison coefficient is greater than the first preset comparison coefficient threshold, the current user's identification status is marked as a sub-matching state.

[0107] In step 103, operations related to user privacy are marked as confidential operations, and the confidentiality level is set according to the importance of the confidential operations to user privacy.

[0108] In step 104, a security level is set for the confidential operation based on the identification status, and a security verification question corresponding to the security level is set based on the user's identity information.

[0109] Preferably, setting a security level for confidential operations based on the identification status includes:

[0110] Extract the confidentiality level corresponding to the confidential operation; the confidentiality level includes three levels: A, B, and C;

[0111] The identification level of the conforming state is marked as level 1, the identification level of the sub-conforming state is marked as level 2, and the identification level of the non-conforming state is marked as level 3.

[0112] The security level is obtained based on the identification level and the confidentiality level; the security level includes: A1, A2, A3, B1, B2, B3, C1, C2 and C3.

[0113] Preferably, the security verification question corresponding to the security level based on the user's identity information includes:

[0114] Extract user identity information; wherein, the user identity information includes: user name, bound mobile phone number, bound personal information and account password;

[0115] The evaluation results are obtained by assessing the sub-data in the user identity information. Based on the evaluation results, the sub-data are arranged and combined and matched one-to-one with the security level to obtain the security verification answer. The security verification question is set based on the security verification answer.

[0116] Preferably, the evaluation of the sub-data in the user identity information to obtain the evaluation result includes:

[0117] Extract sub-data from user identity information;

[0118] The frequency of occurrence of each sub-data in the historical usage data is statistically analyzed, and the frequency of occurrence of each sub-data is marked as Pi, where i is the sub-data number;

[0119] Through formula The entropy HXi of sub-data numbered i is calculated, and the entropy of the sub-data is used as the evaluation result of the sub-data; where n is the number of sub-data.

[0120] Preferably, the step of arranging and combining sub-data according to the evaluation results and corresponding them one-to-one with security levels to obtain the security verification answer includes:

[0121] Evaluation results and security levels of extracted sub-data;

[0122] The sub-data are sorted from largest to smallest according to the size of the evaluation results, and then sorted in pairs according to the size order to obtain a double answer sequence. Each sub-data is combined to obtain a single answer sequence. The single answer sequence and the double answer sequence are combined to obtain the answer sequence. The answer sequences are then mapped to the security level according to the size order to obtain the answer sequence corresponding to the security level. The answer sequence corresponding to the security level is marked as the security verification answer.

[0123] In step 105, the operation information in the current usage information is security verified by combining the security verification question and the confidentiality operation to obtain the user's verification result.

[0124] Preferably, the method of combining security verification questions and confidentiality operations to perform security verification on the operation information in the currently used information to obtain the user's verification result includes:

[0125] Extract operation information and confidential operations from the currently used information;

[0126] Determine if the operation information is the same as the confidential operation; if yes, provide the corresponding authentication question according to the security level of the confidential operation, and the user needs to answer the authentication question; if no, do not provide an authentication question, but continue to compare and obtain the user's identification status.

[0127] Set an error count threshold; the error count threshold is a manually set number of allowed incorrect answers to authentication questions;

[0128] Determine if the user's response to the authentication question is correct; if yes, grant the current user confidential operation permissions; otherwise, increment the user's incorrect response count by one.

[0129] When a user's number of incorrect responses equals the error count threshold, the authentication question interface is closed, the current user is marked as an abnormal user, and access to all confidential operations is revoked.

[0130] In this invention, based on the security verification module, operations related to user privacy are marked as confidential operations, and a confidentiality level is set according to the importance of the confidential operation to user privacy; a security level is set for the confidential operation according to the identification status; a security verification question corresponding to the security level is set according to the user's identity information; and the operation information in the current usage information is security verified by combining the security verification question and the confidential operation to obtain the user's verification result.

[0131] The method of setting a security level for a confidential operation based on the identification status includes: extracting the identification status and the corresponding confidentiality level for the confidential operation; the confidentiality level includes three levels: A, B, and C; marking the identification level of the conforming status as level 1, the identification level of the partially conforming status as level 2, and the identification level of the non-conforming status as level 3; and combining the identification level and the confidentiality level to obtain the security level; the security level includes A1, A2, A3, B1, B2, B3, C1, C2, and C3.

[0132] Among them, the security verification questions corresponding to the security level set based on user identity information include:

[0133] Extract user identity information; the user identity information includes user name, bound mobile phone number, bound personal information and account password;

[0134] The evaluation results are obtained by assessing the sub-data in the user identity information. Based on the evaluation results, the sub-data are arranged and combined and matched one-to-one with the security level to obtain the security verification answer. The security verification question is set based on the security verification answer.

[0135] The evaluation results are obtained by evaluating the sub-data in the user identity information, including:

[0136] Extract sub-data from user identity information;

[0137] The frequency of occurrence of each sub-data in the historical usage data is statistically analyzed, and the frequency of occurrence of each sub-data is marked as Pi, where i is the sub-data number;

[0138] Through formula The entropy HXi of sub-data numbered i is calculated, and the entropy of the sub-data is used as the evaluation result of the sub-data.

[0139] The process involves arranging and combining sub-data based on the evaluation results and mapping them one-to-one with security levels to obtain security verification answers, including:

[0140] Evaluation results and security levels of extracted sub-data;

[0141] The sub-data are sorted from largest to smallest according to the size of the evaluation results, and then sorted in pairs according to the size order to obtain a double answer sequence. Each sub-data is combined to obtain a single answer sequence. The single answer sequence and the double answer sequence are combined to obtain the answer sequence. The answer sequences are then mapped to the security level according to the size order to obtain the answer sequence corresponding to the security level. The answer sequence corresponding to the security level is marked as the security verification answer.

[0142] Specifically, by combining security verification questions with confidentiality operations, the user's verification result is obtained by performing security verification on the operational information in the currently used information, including:

[0143] Extract operation information and confidential operations from the currently used information;

[0144] Determine if the operation information is the same as the confidential operation; if yes, provide the corresponding authentication question according to the security level of the confidential operation, and the user needs to answer the authentication question; if no, do not provide an authentication question, but continue to compare and obtain the user's identification status.

[0145] Set an error count threshold; the error count threshold is a manually set number of allowed incorrect answers to authentication questions;

[0146] Determine if the user's response to the authentication question is correct; if yes, grant the current user confidential operation permissions; otherwise, increment the user's incorrect response count by one.

[0147] When a user's number of incorrect responses equals the error count threshold, the authentication question interface is closed, the current user is marked as an abnormal user, and access to all confidential operations is revoked.

[0148] For example, the identification level of the conforming state in the identification status is marked as level 1, the identification level of the sub-conforming state is marked as level 2, and the identification level of the non-conforming state is marked as level 3; the confidentiality levels are three levels: A, B, and C. Combining the confidentiality level and the identification level, nine security levels are obtained, including A1, A2, A3, B1, B2, B3, C1, C2, and C3.

[0149] By analyzing the frequency of occurrence of sub-data in each user's identity information within historical usage data, we find that the frequency of the username is 15%, the username is number one, the frequency of the bound mobile phone number is 30%, the bound mobile phone number is number two, the frequency of the bound personal information is 10%, the bound personal information is number three, the frequency of the account password is 45%, and the account password is number four. Then, using the formula... The entropy of the username (number 1) is calculated to be HX1 = 0.41, the entropy of the bound mobile phone number (number 2) is HX2 = 0.52, the entropy of the bound personal information (number 3) is HX3 = 0.33, and the entropy of the bound account password (number 4) is HX4 = 0.67. The entropy of all sub-data is used as the evaluation result of the sub-data.

[0150] Based on the entropy magnitude in the evaluation results, the sub-data are sorted, resulting in 4 > 2 > 1 > 3. These sub-data are then paired according to their numerical order to obtain the double-answer sequences: 4-2, 4-1, 4-3, 2-1, 2-3, and 1-3. The single-answer sequences are 4, 2, 1, and 3. Combining the single-answer sequences with the double-answer sequences yields the answer sequences. These answer sequences are then mapped to security levels according to their size, resulting in the answer sequences corresponding to each security level. In this embodiment, the answer sequences corresponding to the security levels are: A1 corresponds to 4, A2 to 2, A3 to 1, B1 to 3, B2 to 4-2, B3 to 4-1, C1 to 4-3, C2 to 2-1, and C3 to 2-3.

[0151] It should be noted that the number of security levels set in this invention is limited. More security levels can be obtained by setting more confidentiality levels. More combinations can also be made by sorting the sub-data, such as a three-answer sequence or more obtained by combining three threes.

[0152] Each security verification answer has a corresponding security verification question. For example, A1 corresponds to four, and the security verification answer is the account password. The corresponding security verification question is "What is the account password?", and so on. If it is a double answer sequence, then two corresponding security verification questions are set. For example, B2 corresponds to four and two, and the security verification answer is the account password and the bound mobile phone number. The corresponding security verification questions are "What is the account password?" and "Mobile phone number verification?".

[0153] For different users, a more personalized security level can be obtained by combining the confidentiality level. While ensuring security, unnecessary verification steps are reduced, improving the user experience. Customized security strategies can provide more personalized protection measures, making the system more secure while also ensuring personalization and user experience.

[0154] The system monitors the current user's operation information in real time and determines whether the operation information is the same as the confidential operation. If it is determined that the current user is performing an A2-level confidential operation, the identity verification interface is displayed to verify the bound mobile phone number. In this embodiment, the error count threshold is set to three. The system determines whether the user's response to the identity verification question is correct. If the user's first response to the identity verification question is incorrect and the second response is correct, the error count is one, and the user's identity verification is successful, granting A2-level confidential operation privileges.

[0155] In another embodiment, if a user responds incorrectly three times, the authentication question interface is closed, the current user is marked as an abnormal user, all access to confidential operations is disabled, and the abnormal user's identity must be unlocked by answering a complete security verification question.

[0156] This invention collects historical usage information, user identity information, and current usage information, and extracts key behavioral features from historical usage information to construct an operation database. Through a deeper understanding of user behavior, it can better balance privacy protection and functional usability. The operation database serves as a comparison template with current operation information, making the distinction between the current user and the previous user more accurate. Comparing current usage information with the operation database yields an identification status, determining whether the current usage information matches the previous user's habits, effectively identifying abnormal behavior and enhancing system security. Operations related to user privacy are marked as confidential operations, and corresponding confidentiality levels are set. Combining the identification status and confidentiality level yields the security level of confidential operations for the current user. Setting different security levels for different users allows for better... To protect user privacy, customized security strategies based on different user behavior patterns and privacy needs can provide more personalized protection measures. By providing users with appropriate security levels, unnecessary verification steps can be reduced while ensuring security, thus improving user experience. Security verification questions are set according to the user's identity information, and the difficulty of the verification questions is dynamically adjusted based on user usage and security level. If the current user is performing a confidential operation, a security verification interface will pop up to verify the user's identity through security verification questions. If the verification is successful, the confidential operation permission is granted; if the verification fails, the current user is marked as an abnormal user, and all confidential operation permissions are revoked. This better protects the original user's privacy, effectively prevents unauthorized access, and increases system security.

[0157] This invention obtains the current user's identification status by comparing the current usage information with the operation database. By assigning a proportional coefficient to the key behavioral features in the operation database and obtaining a comparison coefficient based on the comparison result, and comparing the comparison coefficient with a set comparison threshold, the identification status obtained by comparison can be more accurate, reducing misjudgments and improving identification accuracy.

[0158] Figure 3 This is a schematic diagram of the structure of a browser authentication system 300 based on user behavior according to an embodiment of the present invention. Figure 3 As shown, the browser authentication system 300 based on user behavior provided in this embodiment of the invention includes: a data operation library construction unit 301, an identification status determination unit 302, a confidentiality level setting unit 303, a verification question setting unit 304, and a verification unit 305.

[0159] Preferably, the data operation library construction unit 301 is used to collect the user's historical usage information and construct the user's data operation library based on the historical usage information.

[0160] Preferably, the data operation library construction unit 301, which constructs a user's data operation library based on the historical usage information, includes:

[0161] Based on the historical usage information, first key behavioral features are extracted, and a proportional coefficient is set for each first key behavioral feature to construct a user data operation library based on the first key behavioral features and the proportional coefficient; wherein, the sum of the proportional coefficients corresponding to all first key behavioral features is 1.

[0162] Preferably, the identification status determination unit 302 is used to obtain the current usage information of the browser and determine the identification status of the current user based on the current usage information and the data operation library.

[0163] Preferably, the identification status determination unit 302 determines the current user's identification status based on the current usage information and the data operation library, including:

[0164] Based on the information currently in use, extract the second key behavioral feature, compare the second key behavioral feature with the first key behavioral feature, determine the proportion coefficient corresponding to the key behavioral feature that is successfully compared as the success proportion coefficient, and determine the proportion coefficient corresponding to the key behavioral feature that is not successfully compared as the failure proportion coefficient.

[0165] Calculate the ratio of the sum of success rate coefficients to the sum of failure rate coefficients to determine the comparison coefficient;

[0166] The comparison coefficients are compared with a preset comparison coefficient threshold, and the current user's identification status is determined based on the comparison result.

[0167] Preferably, the identification status determination unit 302 compares the comparison coefficient with a preset comparison coefficient threshold and determines the current user's identification status based on the comparison result, including:

[0168] Determine whether the comparison coefficient is greater than or equal to a first comparison coefficient threshold; if it is, mark the current user's identification status as a matching status; otherwise, determine whether the comparison coefficient is greater than or equal to a second preset comparison coefficient threshold; if it is, mark the current user's identification status as a sub-matching status; otherwise, mark the current user's identification status as a non-matching status.

[0169] Preferably, the confidentiality level setting unit 303 is used to mark operations related to user privacy as confidential operations, and to set the confidentiality level according to the importance of the confidential operations to user privacy.

[0170] Preferably, the verification question setting unit 304 is used to set a security level for the confidential operation based on the identification status, and to set a security verification question corresponding to the security level based on the user's identity information.

[0171] Preferably, the verification question setting unit 304 sets a security level for the confidential operation based on the identification status, including:

[0172] Extract the confidentiality level corresponding to the confidential operation; the confidentiality level includes three levels: A, B, and C;

[0173] The identification level of the conforming state is marked as level 1, the identification level of the sub-conforming state is marked as level 2, and the identification level of the non-conforming state is marked as level 3.

[0174] The security level is obtained based on the identification level and the confidentiality level; the security level includes: A1, A2, A3, B1, B2, B3, C1, C2 and C3.

[0175] Preferably, the verification question setting unit 304 sets a security verification question corresponding to the security level based on the user's identity information, including:

[0176] Extract user identity information; wherein, the user identity information includes: user name, bound mobile phone number, bound personal information and account password;

[0177] The evaluation results are obtained by assessing the sub-data in the user identity information. Based on the evaluation results, the sub-data are arranged and combined and matched one-to-one with the security level to obtain the security verification answer. The security verification question is set based on the security verification answer.

[0178] Preferably, the verification question setting unit 304 evaluates the sub-data in the user identity information to obtain an evaluation result, including:

[0179] Extract sub-data from user identity information;

[0180] The frequency of occurrence of each sub-data in the historical usage data is statistically analyzed, and the frequency of occurrence of each sub-data is marked as Pi, where i is the sub-data number;

[0181] Through formula The entropy HXi of sub-data numbered i is calculated, and the entropy of the sub-data is used as the evaluation result of the sub-data; where n is the number of sub-data.

[0182] Preferably, the verification question setting unit 304, based on the evaluation results, arranges and combines sub-data and maps them one-to-one with security levels to obtain security verification answers, including:

[0183] Evaluation results and security levels of extracted sub-data;

[0184] The sub-data are sorted from largest to smallest according to the size of the evaluation results, and then sorted in pairs according to the size order to obtain a double answer sequence. Each sub-data is combined to obtain a single answer sequence. The single answer sequence and the double answer sequence are combined to obtain the answer sequence. The answer sequences are then mapped to the security level according to the size order to obtain the answer sequence corresponding to the security level. The answer sequence corresponding to the security level is marked as the security verification answer.

[0185] Preferably, the verification unit 305 is used to perform security verification on the operation information in the current usage information by combining security verification questions and confidentiality operations to obtain the user's verification result.

[0186] Preferably, the verification unit 305 combines a security verification question with a confidentiality operation to perform security verification on the operation information in the current usage information to obtain the user's verification result, including:

[0187] Extract operation information and confidential operations from the currently used information;

[0188] Determine if the operation information is the same as the confidential operation; if yes, provide the corresponding authentication question according to the security level of the confidential operation, and the user needs to answer the authentication question; if no, do not provide an authentication question, but continue to compare and obtain the user's identification status.

[0189] Set an error count threshold; the error count threshold is a manually set number of allowed incorrect answers to authentication questions;

[0190] Determine if the user's response to the authentication question is correct; if yes, grant the current user confidential operation permissions; otherwise, increment the user's incorrect response count by one.

[0191] When a user's number of incorrect responses equals the error count threshold, the authentication question interface is closed, the current user is marked as an abnormal user, and access to all confidential operations is revoked.

[0192] The browser authentication system 300 based on user behavior in this embodiment corresponds to the browser authentication method 100 based on user behavior in another embodiment of this invention, and will not be described again here.

[0193] According to another aspect of the present invention, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any one of a browser authentication method based on user behavior.

[0194] According to another aspect of the present invention, the present invention provides an electronic device, comprising:

[0195] The aforementioned computer-readable storage medium; and

[0196] One or more processors for executing a program in the computer-readable storage medium.

[0197] The invention has been described with reference to a few embodiments. However, as will be known to those skilled in the art, and as defined in the appended claims, other embodiments besides those disclosed above fall equivalently within the scope of the invention.

[0198] Generally, all terms used in the claims are to be interpreted according to their ordinary meaning in the art, unless otherwise expressly defined herein. All references to “a / the / the [device, component, etc.]” ​​are openly interpreted as at least one instance of said device, component, etc., unless otherwise expressly stated. The steps of any method disclosed herein need not be performed in the exact order disclosed unless explicitly stated otherwise.

[0199] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0200] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0201] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0202] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0203] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A user behavior based browser authentication method, characterized in that, The method comprises: collecting historical use information of a user, and constructing a data operation library of the user based on the historical use information; obtaining current use information of a browser, and determining an identification state of a current user based on the current use information and the data operation library; marking an operation behavior related to user privacy as a confidential operation, and setting a confidentiality level according to the importance of the confidential operation to user privacy; setting a security level for the confidential operation according to the identification state, and setting a security verification question corresponding to the security level according to user identity information; combining the security verification question and the confidential operation to perform security verification on operation information in the current use information to obtain a verification result of the user; wherein the setting of the security verification question corresponding to the security level according to the user identity information comprises: extracting user identity information; wherein the user identity information comprises a user name, a bound mobile phone number, bound personal information, and an account password; evaluating sub-data in the user identity information to obtain an evaluation result, arranging and combining the sub-data according to the evaluation result, and obtaining a security verification answer by one-to-one correspondence with the security level, and setting a security verification question according to the security verification answer; wherein the evaluation of the sub-data in the user identity information to obtain the evaluation result comprises: extracting the sub-data in the user identity information; counting the occurrence frequency of each sub-data in historical use data, and marking the occurrence frequency of each sub-data as Pi, wherein i is the number of the sub-data; The entropy HXi of the sub-data numbered i is calculated by the formula and the entropy of the sub-data is taken as the evaluation result of the sub-data; wherein n is the number of sub-data. wherein the arrangement and combination of the sub-data according to the evaluation result to obtain the security verification answer comprises: extracting the evaluation result of the sub-data and the security level; sorting the sub-data from large to small according to the size of the evaluation result, and combining and sorting them in pairs according to the size order to obtain a double answer sequence, obtaining a single answer sequence from each combination of sub-data, combining the single answer sequence and the double answer sequence to obtain an answer sequence, and corresponding the answer sequence to the security level according to the size order to obtain an answer sequence corresponding to the security level, and marking the answer sequence corresponding to the security level as the security verification answer.

2. The method of claim 1, wherein, The construction of the data operation library of the user based on the historical use information comprises: extracting first key behavior features based on the historical use information, setting a proportion coefficient corresponding to each first key behavior feature, and constructing the data operation library of the user based on the first key behavior features and the proportion coefficient; wherein the sum of the proportion coefficients corresponding to all the first key behavior features is 1.

3. The method of claim 2, wherein, The determination of the identification state of the current user based on the current use information and the data operation library comprises: extracting second key behavior features based on the current use information, and comparing the second key behavior features with the first key behavior features to determine the proportion coefficient corresponding to the key behavior features that pass the comparison as a success proportion coefficient, and the proportion coefficient corresponding to the key behavior features that fail the comparison as a failure proportion coefficient; calculating the ratio of the sum of the success proportion coefficients to the sum of the failure proportion coefficients to determine a comparison coefficient; comparing the comparison coefficient with a preset comparison coefficient threshold, and determining the identification state of the current user according to the comparison result.

4. The method of claim 3, wherein, The comparing the comparison coefficient with a preset comparison coefficient threshold value and determining the identification state of the current user according to a comparison result comprises: determining whether the comparison coefficient satisfies a first comparison coefficient threshold value; if yes, marking the identification state of the current user as a compliance state; otherwise, determining whether the comparison coefficient satisfies a second preset comparison coefficient threshold value; if yes, marking the identification state of the current user as a sub-compliance state; otherwise, marking the identification state of the current user as a non-compliance state.

5. The method of claim 1, wherein, setting a security level for a secret operation according to the identification state comprises: extracting a secret level corresponding to the secret operation; the secret level comprises three levels A, B and C; marking the identification level of the compliance state in the identification state as level 1, marking the identification level of the sub-compliance state as level 2, and marking the identification level of the non-compliance state as level 3; obtaining a security level based on the identification level and the secret level; the security level comprises A1, A2, A3, B1, B2, B3, C1, C2 and C3.

6. The method of claim 1, wherein, The security verification question and the secret operation are combined to perform security verification on operation information in the current use information to obtain a verification result of the user, which comprises: extracting the operation information and the secret operation in the current use information; determining whether the operation information and the secret operation are the same; if yes, providing a corresponding identity verification question according to the security level corresponding to the secret operation, and the user needs to reply to the identity verification question; otherwise, not providing the identity verification question, but continuing to compare to obtain the identification state of the user; setting an error number threshold value; the error number threshold value is a number of allowed errors in replying to the identity verification question set by a human being; determining whether the user's reply to the identity verification question is correct; if yes, opening the secret operation permission for the current user; otherwise, increasing the number of errors in replying to the identity verification question by one; when the number of errors in replying to the identity verification question of the user is equal to the error number threshold value, closing the identity verification question interface, marking the current user as an abnormal user, and closing the use permission of all secret operations.

7. A user behavior based browser authentication system, characterized in that, The system comprises: a data operation library construction unit configured to collect historical use information of a user, and construct a data operation library of the user based on the historical use information; an identification state determination unit configured to obtain current use information of a browser, and determine an identification state of the current user based on the current use information and the data operation library; a secret level setting unit configured to mark an operation behavior related to user privacy as a secret operation, and set a secret level according to the importance of the secret operation to the user privacy; a verification question setting unit configured to set a security level for the secret operation according to the identification state, and set a security verification question corresponding to the security level according to user identity information; a verification unit configured to combine the security verification question and the secret operation to perform security verification on operation information in the current use information to obtain a verification result of the user; The verification question setting unit sets a security verification question corresponding to a security level according to user identity information, which comprises: extracting user identity information; the user identity information comprises a user name, a bound mobile phone number, bound personal information and an account password. The sub-data in the user identity information is evaluated to obtain an evaluation result, the sub-data is arranged and combined according to the evaluation result, and the security verification answer is obtained by one-to-one correspondence with the security level; and the security verification question is set according to the security verification answer; The verification question setting unit evaluates the sub-data in the user identity information to obtain an evaluation result, and includes: extracting the sub-data in the user identity information; counting the occurrence frequency of each sub-data in the historical use data, and marking the occurrence frequency of each sub-data as Pi, wherein i is the number of the sub-data; The entropy HXi of the sub-data numbered i is calculated by the formula and the entropy of the sub-data is taken as the evaluation result of the sub-data; wherein n is the number of sub-data. The verification question setting unit arranges and combines the sub-data according to the evaluation result, and obtains the security verification answer by one-to-one correspondence with the security level, and includes: extracting the evaluation result of the sub-data and the security level; sorting the sub-data from large to small according to the size of the evaluation result, and combining and sorting two by two according to the size order to obtain a double answer sequence, obtaining a single answer sequence from each sub-data combination, combining the single answer sequence and the double answer sequence to obtain an answer sequence, corresponding the answer sequence to the security level according to the size order to obtain an answer sequence corresponding to the security level, and marking the answer sequence corresponding to the security level as the security verification answer.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the steps of the method of any one of claims 1-6.

9. An electronic device, comprising: comprises: the computer readable storage medium of claim 8; and one or more processors for executing the program in the computer readable storage medium.

Images