Network threat automatic identification and response method for identity authentication

Abstract

The invention relates to the field of identity authentication, in particular to a network threat automatic identification and response method for identity authentication, which comprises the following steps: inputting contextual information into a threat evaluation module, and according to a preset rule and algorithm in the threat evaluation module, combining historical behavior information of a user to obtain a threat evaluation result; evaluating a threat level of the login request of the user; determining a response strategy for the login request according to the threat level, and obtaining a login authentication result of the user after the user executes the response strategy; and recording the login authentication result, the threat level, the response strategy, the context information and the user behavior into a security log, and inputting the security log into the threat evaluation module. According to the invention, the experience and security of the user in login authentication can be improved at the same time.

Description

Technical Field

[0001] The present application relates to the field of identity authentication, and in particular to a method for automatically identifying and responding to network threats for identity authentication. Background Art

[0002] In the current identity authentication field, traditional authentication mechanisms mainly rely on static authentication methods (account and password login, SMS, email verification, or time-based one-time passwords) as well as secondary authentication and multi-factor authentication (MFA). These technologies improve security by verifying user credentials and one or more independent factors.

[0003] However, although these technologies can enhance security to a certain extent, they have some obvious flaws, especially when dealing with complex and dynamic network threats. Static credentials such as usernames and passwords are the most commonly used authentication method, but this method is very vulnerable to brute force cracking, phishing attacks, and credential leakage by attackers. Once the credentials are stolen, attackers can easily impersonate legitimate users to log in, and the system cannot identify attack behaviors through such static data. Secondary authentication and multi-factor authentication add an additional layer of security to traditional username and password logins, requiring users to provide additional credentials (such as mobile phone verification codes, biometric information, etc.). Although MFA can effectively prevent unauthorized access, its disadvantage is that it is usually fixed and does not dynamically adjust according to the actual context. Regardless of whether the user is in a high-risk environment or not, the system will require the same authentication process, which may lead to a degraded user experience. In addition, if the user's second authentication factor (such as mobile phone or email) is compromised, the entire authentication mechanism will still be compromised.

[0004] Therefore, how to improve both the user experience and security when performing login authentication is an urgent problem to be solved. Summary of the invention

[0005] The present application provides a method for automatically identifying and responding to network threats for identity authentication, which can simultaneously improve the user experience and security when performing login authentication.

[0006] In order to achieve the above object, the present invention adopts the following technical scheme:

[0007] In a first aspect, the present invention provides a method for automatically identifying and responding to network threats for identity authentication, the method comprising:

[0008] After receiving the user's login request, obtain the user's login information from the login request;

[0009] Acquire login context information from the login information;

[0010] Inputting the context information into a threat assessment module, and assessing the threat level of the user's login request according to preset rules and algorithms in the threat assessment module and in combination with the user's historical behavior information;

[0011] Determine a response strategy for the login request according to the threat level, and obtain the user's login authentication result after the user executes the strategy;

[0012] The login authentication result, the threat level, the response strategy, the context information and the user behavior are recorded in a security log, and the security log is input into the threat assessment module.

[0013] In a preferred example of the present application, it can be further configured that the context information includes the user's client IP address, terminal type, system type, browser type and request time.

[0014] In a preferred example of the present application, it can be further configured that the step of determining a response strategy to the login request according to the threat level includes:

[0015] When the threat level is low risk, the user is exempted from secondary authentication.

[0016] In a preferred example of the present application, it can be further configured that the step of determining a response strategy to the login request according to the threat level includes:

[0017] When the threat level is high risk, multi-factor authentication is performed on the user, and the multi-factor authentication includes SMS verification code or email verification.

[0018] In a preferred example of the present application, it can be further configured that the step of determining a response strategy to the login request according to the threat level includes:

[0019] When the threat level is medium risk, a one-time verification code authentication or a light secondary authentication is performed on the user.

[0020] In a preferred example of the present application, it can be further configured to include:

[0021] After obtaining the user's login authentication result, historical user data is obtained from the security log, and combined with the historical user data to determine whether the user's behavior pattern is inconsistent with the user habits analyzed from the historical data. If so, adjust the threat level of the login request to medium risk or high risk, and again determine the response strategy for the login request based on the threat level, and execute this response strategy.

[0022] In a second aspect, the present application provides a network threat automatic identification and response device for identity authentication, the device comprising:

[0023] The information acquisition module is used to obtain the user's login information from the login request after receiving the user's login request; and obtain the context information at the time of login from the login information;

[0024] A threat level module, used to input the context information into a threat assessment module, and assess the threat level of the user's login request according to preset rules and algorithms in the threat assessment module and in combination with the user's historical behavior information;

[0025] A response module, used to determine a response strategy for the login request according to the threat level, and obtain the user's login authentication result after the user executes the strategy;

[0026] A recording module is used to record the login authentication result, the threat level, the response strategy, the context information and the user behavior in a security log, and input the security log into the threat assessment module.

[0027] In a third aspect, the present application provides a computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of the method for automatic identification and response of network threats for identity authentication as described in any one of the above items are implemented.

[0028] In a fourth aspect, the present application provides a computer-readable storage medium having a program stored thereon, wherein when the program is executed by a processor, the method for automatic identification and response of network threats for identity authentication as described in any one of the above items is implemented.

[0029] In a fifth aspect, the present application provides a computer program product, comprising computer instructions, which, when executed by a processor, implement the steps of the method for automatic identification and response of network threats for identity authentication as described in any of the above items.

[0030] In summary, compared with the prior art, the technical solution provided in the embodiment of the present application has at least the following beneficial effects:

[0031] 1. Most existing technologies are based on fixed authentication processes and static credentials, such as passwords and MFA. This application uses contextual data, such as IP address, device type, system type, browser type, request time, etc., to dynamically identify potential threats in real time. This context-based threat identification can significantly improve the intelligence level of the system and help prevent complex attacks such as session hijacking and geolocation spoofing.

[0032] 2. Existing methods usually adopt a one-size-fits-all authentication approach, and the same authentication process is applied regardless of the risk of the user's behavior. In contrast, this application introduces a flexible response strategy that allows the method to dynamically adjust authentication measures based on specific risks. For example, when high-risk behavior is detected, the method can force the user to perform enhanced secondary authentication, while in low-risk scenarios, secondary authentication can be exempted. This flexibility significantly improves the balance between security and user experience.

[0033] 3. This application analyzes multi-dimensional contextual information and analyzes the user's login habits in combination with the user's historical behavior data, which can identify threats more accurately. For example, if a user logs in from an uncommon device or an abnormal geographical location, the system can identify this abnormal behavior and trigger appropriate security measures. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 A flowchart of a method for automatically identifying and responding to network threats for identity authentication is provided in one embodiment of the present application.

[0035] Figure 2 A structural diagram of a network threat automatic identification and response device for identity authentication provided in one embodiment of the present application. DETAILED DESCRIPTION

[0036] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0037] In one embodiment of the present application, a method for automatically identifying and responding to network threats for identity authentication is provided. Figure 1 As shown, the method includes:

[0038] S100: After receiving a login request from a user, the login information of the user is obtained from the login request, and the context information during the login is obtained from the login information.

[0039] Specifically, the user initiates a login request to the system through a terminal device, such as a computer, mobile phone, tablet, etc. In this process, the customer provides login credentials, such as user name and password, and the user's login information is obtained from the user's login request, and context information is extracted from the login information.

[0040] Furthermore, the context information includes the user's client IP address, terminal type, system type, browser type and request time.

[0041] Specifically,

[0042] S200: Input the context information into a threat assessment module, and assess the threat level of the user's login request based on preset rules and algorithms in the threat assessment module and in combination with the user's historical behavior information.

[0043] Specifically, the threat assessment module may be a risk assessment system.

[0044] S300: Determine a response strategy for the login request according to the threat level, and obtain the user's login authentication result after the user executes the strategy.

[0045] Specifically, after determining the response strategy, a corresponding response request is sent to the user, waiting for the user to perform a specific login authentication action on the login page, such as secondary authentication, verification code verification, and forced access blocking.

[0046] S400: Record the login authentication result, the threat level, the response strategy, the context information and the user behavior into a security log, and input the security log into the threat assessment module.

[0047] Specifically, the threat assessment module can record and analyze the user's historical behavior data to obtain the user's login behavior habits.

[0048] In this embodiment, the beneficial effects include:

[0049] 1. Most existing technologies are based on fixed authentication processes and static credentials, such as passwords and MFA. This application uses contextual data, such as IP address, device type, system type, browser type, request time, etc., to dynamically identify potential threats in real time. This context-based threat identification can significantly improve the intelligence level of the system and help prevent complex attacks such as session hijacking and geolocation spoofing.

[0050] 2. Existing methods usually adopt a one-size-fits-all authentication approach, and the same authentication process is applied regardless of the risk of the user's behavior. In contrast, this application introduces a flexible response strategy that allows the method to dynamically adjust authentication measures based on specific risks. For example, when high-risk behavior is detected, the method can force the user to perform enhanced secondary authentication, while in low-risk scenarios, secondary authentication can be exempted. This flexibility significantly improves the balance between security and user experience.

[0051] 3. This application analyzes multi-dimensional contextual information and analyzes the user's login habits in combination with the user's historical behavior data, which can identify threats more accurately. For example, if a user logs in from an uncommon device or an abnormal geographical location, the system can identify this abnormal behavior and trigger appropriate security measures.

[0052] In some embodiments, determining a response strategy to the login request according to the threat level includes:

[0053] When the threat level is low risk, the user is exempted from secondary authentication.

[0054] In this embodiment, low-risk users can avoid having to perform cumbersome secondary authentication, thereby improving the user's login experience.

[0055] In some embodiments, determining a response strategy to the login request according to the threat level includes:

[0056] When the threat level is high risk, multi-factor authentication is performed on the user, and the multi-factor authentication includes SMS verification code or email verification.

[0057] In this embodiment, the security of user login can be improved.

[0058] In some embodiments, determining a response strategy to the login request according to the threat level includes:

[0059] When the threat level is medium risk, a one-time verification code authentication or a light secondary authentication is performed on the user.

[0060] In this embodiment, it is possible to avoid medium-risk users having to undergo tedious authentication, thereby improving the user's login experience.

[0061] In some embodiments, it also includes:

[0062] After obtaining the user's login authentication result, historical user data is obtained from the security log, and combined with the historical user data to determine whether the user's behavior pattern is inconsistent with the user habits analyzed from the historical data. If so, adjust the threat level of the login request to medium risk or high risk, and again determine the response strategy for the login request based on the threat level, and execute this response strategy.

[0063] This application also provides a network threat automatic identification and response device for identity authentication, see Figure 2 As shown, the device comprises:

[0064] The information acquisition module 100 is used to obtain the user's login information from the login request after receiving the user's login request; and obtain the context information during the login from the login information;

[0065] The threat level module 200 is used to input the context information into the threat assessment module, and assess the threat level of the user's login request according to the rules and algorithms preset in the threat assessment module and in combination with the user's historical behavior information;

[0066] A response module 300 is used to determine a response strategy for the login request according to the threat level, and obtain a login authentication result of the user after the user executes the strategy;

[0067] The recording module 400 is used to record the login authentication result, the threat level, the response strategy, the context information and the user behavior in a security log, and input the security log into the threat assessment module.

[0068] The functional implementation of each module in the above-mentioned network threat automatic identification and response device for identity authentication corresponds to the steps in the above-mentioned network threat automatic identification and response method embodiment for identity authentication, and its functions and implementation processes are not repeated here one by one.

[0069] The present application also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of the method for automatic identification and response of network threats for identity authentication as described in any of the above embodiments are implemented.

[0070] The present application also provides a computer-readable storage medium, on which a program is stored, wherein the computer-readable storage medium refers to a carrier for storing data, which may include but is not limited to a floppy disk, an optical disk, a hard disk, a flash memory, a USB flash drive and / or a memory stick, etc., and the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The working process, working details and technical effects of the computer-readable storage medium provided in this embodiment can be found in the above embodiment of a method for automatically identifying and responding to network threats for identity authentication, which will not be repeated here.

[0071] The application also provides a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the method for automatic identification and response of network threats for identity authentication as described in any of the above embodiments.

[0072] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0073] The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification. The above-mentioned embodiments only express several implementation methods of the present application, and their descriptions are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that for ordinary technicians in this field, without departing from the concept of the present application, several deformations and improvements can be made, which all belong to the protection scope of the present application. Therefore, the protection scope of the patent of this application shall be based on the attached claims.

Claims

1. A method for automatically identifying and responding to network threats for identity authentication, characterized in that: include: After receiving the user's login request, obtain the user's login information from the login request; Acquire login context information from the login information; Inputting the context information into a threat assessment module, and assessing the threat level of the user's login request according to preset rules and algorithms in the threat assessment module and in combination with the user's historical behavior information; Determine a response strategy for the login request according to the threat level, and obtain the user's login authentication result after the user executes the strategy; The login authentication result, the threat level, the response strategy, the context information and the user behavior are recorded in a security log, and the security log is input into the threat assessment module.

2. The method for automatic identification and response of network threats for identity authentication according to claim 1, characterized in that: The context information includes the user's client IP address, terminal type, system type, browser type and request time.

3. The method for automatic identification and response of network threats for identity authentication according to claim 2, characterized in that: The determining a response strategy to the login request according to the threat level includes: When the threat level is low risk, the user is exempted from secondary authentication.

4. The method for automatic identification and response of network threats for identity authentication according to claim 3, characterized in that: The determining a response strategy to the login request according to the threat level includes: When the threat level is high risk, multi-factor authentication is performed on the user, and the multi-factor authentication includes SMS verification code or email verification.

5. The method for automatic identification and response of network threats for identity authentication according to claim 4, characterized in that: The determining a response strategy to the login request according to the threat level includes: When the threat level is medium risk, a one-time verification code authentication or a light secondary authentication is performed on the user.

6. The method for automatic identification and response of network threats for identity authentication according to claim 5, characterized in that: Also includes: After obtaining the user's login authentication result, historical user data is obtained from the security log, and combined with the historical user data to determine whether the user's behavior pattern is inconsistent with the user habits analyzed from the historical data. If so, adjust the threat level of the login request to medium risk or high risk, and again determine the response strategy for the login request based on the threat level, and execute this response strategy.

7. A network threat automatic identification and response device for identity authentication, characterized in that: include: The information acquisition module is used to obtain the user's login information from the login request after receiving the user's login request; Acquire login context information from the login information; A threat level module, used to input the context information into a threat assessment module, and assess the threat level of the user's login request according to preset rules and algorithms in the threat assessment module and in combination with the user's historical behavior information; A response module, used to determine a response strategy for the login request according to the threat level, and obtain the user's login authentication result after the user executes the strategy; A recording module is used to record the login authentication result, the threat level, the response strategy, the context information and the user behavior in a security log, and input the security log into the threat assessment module.

8. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method for automatic identification and response of network threats for identity authentication according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a program, wherein when the program is executed by the processor, the method for automatic identification and response of network threats for identity authentication according to any one of claims 1 to 6 is implemented.

10. A computer program product comprising computer instructions, characterized in that When executed by a processor, the computer instructions implement the steps of the method for automatic identification and response of network threats for identity authentication described in claims 1 to 6.

Images