Multi-channel dynamic identity protection method and device

Abstract

The embodiment of the present invention provides a multi-channel dynamic identity protection method, device and electronic device, belonging to the field of data security technology, the method includes: based on the initial credential set Cf and the metadata set Mf, generating a first security assessment value Rf; based on the encryption key KM, establishing a secure transmission protocol TA between the client and the target server; selecting m verification channels from the first channel set V to form a second channel set V'; by calculating the similarity value Sm between the user behavior parameter set B and the standard behavior parameter set L={L1, L2, ...Lp}, judging whether the user behavior of the user U is abnormal; when it is judged that the session SH is abnormal, disconnecting the session between the client user and the target server. The present invention improves the security in the identity authentication process.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a multi-channel dynamic identity protection method, device and electronic equipment. Background Art

[0002] In today's digital age, with the rapid development of information technology and the increasing richness of network applications and services, the protection of user identities has become extremely important. Whether it is an internal enterprise system, online financial services, or various Internet applications, it is necessary to ensure that only legitimate users can access the corresponding resources and functions, while preventing the leakage and abuse of user identity information.

[0003] Currently, common identity authentication methods mainly include username and password combinations, SMS verification codes, email verification, biometric technology, and hardware tokens.

[0004] The existing technology has the following defects in the identity authentication process:

[0005] 1. Multi-channel synchronization and compatibility issues

[0006] The multi-channel dynamic identity protection system relies on the synchronization of multiple channels, involving different devices, platforms and applications. If there are compatibility issues between these channels, it may cause errors in the authentication process or inconsistent user experience. For example, the time synchronization between different devices may cause the one-time password (OTP) to fail, or some old devices may not support the latest authentication applications.

[0007] 2. Dependence on network connection and equipment

[0008] This system usually relies on a stable network connection, because mobile text messages, emails, and authentication applications all need to receive information in real time. If the user is in a poor network environment, identity verification may not be completed. In addition, when the user's device (such as a mobile phone) is lost, damaged, or infected with malware, attackers may exploit these vulnerabilities to obtain verification information and threaten system security.

[0009] 3. Social Engineering Attacks

[0010] Although multi-channel systems can improve security through multiple authentication methods, they still cannot completely prevent social engineering attacks. Attackers may trick users into providing authentication information from multiple channels through phishing, vishing, or other means. Once attackers have access to multiple authentication channels for users, the security of the system will be severely weakened.

[0011] 4. Complex User Experience

[0012] The multi-channel dynamic identity protection system requires users to go through multiple identity authentication steps, increasing the complexity of the operation. For example, users may need to enter a password, receive a text message verification code, confirm an email, use an identity authentication app, etc., resulting in a lengthy authentication process, which may be troublesome for users who are not familiar with technology or need to log in frequently.

[0013] 5. Balance between security and ease of use

[0014] Although the multi-channel verification system improves security, it may also affect user convenience. In order to reduce the risk of being hacked, the system may force users to frequently use multiple verifications, which will damage the user experience and may prompt users to find ways to bypass security measures, such as disabling certain verification functions or choosing weak passwords.

[0015] 6. Cost and complexity

[0016] Implementing a multi-channel dynamic identity protection system requires enterprises to invest more resources and costs, especially when developing, maintaining and supporting multiple verification channels. This not only increases the complexity of the system, but may also lead to rising maintenance and operating costs. For example, managing the security of different devices, applications and channels is a complex task, and enterprises need to constantly update and patch to deal with new security threats.

[0017] 7. Privacy and data security issues

[0018] Multi-channel authentication systems rely on a variety of personal data of users (such as phone number, email, device information, etc.), which may bring privacy issues. If this sensitive data is obtained by malicious attackers or intercepted during transmission, it will lead to serious privacy breaches. In addition, verification methods that rely on multiple channels may require the collection of a large amount of user data, which may face challenges under compliance and data protection regulations (such as GDPR).

[0019] 8. Captcha interception and man-in-the-middle attacks

[0020] Some channels in the multi-channel system, such as SMS or email verification codes, may be subject to the risk of man-in-the-middle attacks or interception. Attackers can obtain verification codes through SIM card swapping, hijacking email accounts, etc., thereby bypassing multi-channel authentication. In this case, the multi-channel nature of the system may become the target of attackers.

[0021] 9. Complexity of the user recovery process

[0022] When users lose their authentication device (such as a mobile phone) or cannot access their email account, the process of recovering their account can be very complicated. If the recovery process still relies on other channels, it may not solve the problem, but increase user confusion and the burden on technical support. If the recovery process is not secure enough, it may also give attackers an opportunity to exploit it.

[0023] 10. Dynamically adjusted security risks

[0024] A feature of the multi-channel dynamic identity protection system is that it dynamically adjusts the verification method according to changes in user behavior or environment. However, this dynamic nature sometimes brings risks. For example, the system may mistakenly believe that some normal user behaviors are abnormal behaviors, thereby frequently triggering additional verification steps and affecting the user experience; conversely, attackers may bypass dynamic security detection mechanisms by forging normal behaviors.

[0025] The above problems become technical problems that need to be solved. Summary of the invention

[0026] In view of this, the embodiments of the present invention provide a multi-channel dynamic identity protection method, device and electronic device, which at least partially solve the problems existing in the prior art.

[0027] In a first aspect, an embodiment of the present invention provides a multi-channel dynamic identity protection method, comprising:

[0028] Obtain an initial credential set Cf and a metadata set Mf required for a client user U to log in to a target server, and after completing the verification of the initial credential set Cf through a first verification function, generate a first security assessment value Rf based on the initial credential set Cf and the metadata set Mf;

[0029] When the first security assessment value Rf is greater than a preset value R0, an encryption key KM is generated based on the metadata set Mf, and a secure transmission protocol TA is established between the client and the target server based on the encryption key KM, wherein an encryption function FY and a content encapsulation warehouse CT are provided in the secure transmission protocol TA, and the encryption function FY is used to perform an encryption operation on the information in the content encapsulation warehouse;

[0030] Obtain a first channel set V={V1, V2, ... Vn} including n verification channels, select m verification channels from the first channel set V based on a first security assessment value Rf to form a second channel set V'={V'1, V'2, ... V'm}, set m security transmission layers including an encryption function FY and a content encapsulation warehouse CT in the second channel set V' based on the security transmission protocol TA, encrypt the verification information Mc through the encryption function FY, and send it to the user U of the client through the content encapsulation warehouse CT;

[0031] Obtain feedback information Mk returned by user U for the verification information Mc through the second channel set V', form a user behavior parameter set B={b1, b2, ...bp} based on the feedback information Mk, and determine whether the user behavior of user U is abnormal by calculating the similarity value Sm between the user behavior parameter set B and the standard behavior parameter set L={L1, L2, ...Lp};

[0032] When it is determined that there is no abnormality in the user behavior of user U, a session SH is established between the client user and the target server through an encryption protocol, and the user's session record Ah during the session is recorded in real time. Based on the session record Ah, it is determined whether there is an abnormality in the current session SH. When it is determined that the session SH is abnormal, the session between the client user and the target server is disconnected.

[0033] According to a specific implementation of an embodiment of the present invention, the obtaining of an initial credential set Cf and a metadata set Mf required for a client user U to log in to a target server includes:

[0034] After the user enters the initial credentials on the client, the initial credentials entered by the user are formed into an initial credential set Cf and sent to the target server;

[0035] The target server calls the first verification function and verifies the initial credential set Cf according to the preset verification rules;

[0036] After the first verification function is executed, the verification result is output.

[0037] According to a specific implementation of an embodiment of the present invention, after completing the verification of the initial credential set Cf through the first verification function, generating a first security assessment value Rf based on the initial credential set Cf and the metadata set Mf, further comprising:

[0038] Extract key information from the verified initial credential set Cf, evaluate the extracted key information, and determine the risk level F1 of the initial credential set Cf based on the evaluation result of the key information;

[0039] Parse the metadata set Mf to obtain the login device information, login location information, login time and network environment of the user U. According to the login device information, judge the security of the device, analyze the login location information, judge whether the login location is consistent with the user's regular activity area, evaluate the security of the network environment, and then determine the risk level F2 of the metadata set Mf;

[0040] Weights are set for the initial credential set Cf and the metadata set Mf respectively. The weight of the initial credential set Cf is set to w1, and the weight of the metadata set Mf is set to w2. According to the set weights, the first security assessment value Rf=w1*F1+w2*Mf is calculated by the formula.

[0041] According to a specific implementation of the embodiment of the present invention, the establishing of a secure transmission protocol TA between the client and the target server based on the encryption key KM includes:

[0042] Distribute the generated encryption key KM between the client and the target server in a secure manner;

[0043] Based on the selected encryption algorithm and protocol framework, as well as the shared encryption key KM, the parameters of the secure transmission protocol TA are configured. In the secure transmission protocol TA, the encryption function FY and the content encapsulation warehouse CT are set. The encryption function FY is responsible for encrypting the information to be transmitted, and the content encapsulation warehouse CT is used to encapsulate the encrypted information and add header information and verification information.

[0044] According to a specific implementation of the embodiment of the present invention, based on the first security assessment value Rf, m verification channels are selected from the first channel set V to form a second channel set V'={V'1, V'2, ... V'm}, including:

[0045] Determine the correspondence between risk level and channel selection strategy, set different risk level ranges and the number of verification channels m corresponding to each range and the corresponding selection rules;

[0046] Determine the risk level range to which the first security assessment value Rf belongs, and determine the m verification channels to be selected according to the selection rule corresponding to the risk level range;

[0047] Select m verification channels that meet the requirements from the first channel set V, and arrange the selected m verification channels in order to form a second channel set V'.

[0048] According to a specific implementation of an embodiment of the present invention, the process of determining whether the user behavior of the user U is abnormal by calculating the similarity value Sm between the user behavior parameter set B and the standard behavior parameter set L={L1, L2, ...Lp} includes:

[0049] The behavior pattern similarity function Sm(B,L) is defined as:

[0050]

[0051] γ and σ are correction parameters;

[0052] Set a similarity threshold θ. When Sm(B,L)<θ, the user behavior is judged to be abnormal.

[0053] According to a specific implementation of an embodiment of the present invention, judging whether there is an abnormality in the current session SH based on the session record Ah includes:

[0054] Analyze the user's operation sequence based on the session record Ah , q is the number of operations;

[0055] Combine operation sequence A with the normal operation mode Compare and get the matching value QD:

[0056]

[0057] and are the maximum and minimum of the jth operation in the normal operation mode, respectively;

[0058] The operation mode matching threshold β is set. When QD(A,E)≥β, it is considered that the user operation conforms to the normal behavior mode and there is no abnormality in the current session SH.

[0059] According to a specific implementation of the embodiment of the present invention, when it is determined that the session SH is abnormal, after disconnecting the session between the client user and the target server, the method further includes:

[0060] The alternate authentication channel is presented to the user, and the user resumes the current session SH through the alternate authentication channel.

[0061] In a second aspect, an embodiment of the present invention further provides a multi-channel dynamic identity protection device, comprising:

[0062] An acquisition module is configured to acquire an initial credential set Cf and a metadata set Mf required for a client user U to log in to a target server, and after verifying the initial credential set Cf through a first verification function, generate a first security assessment value Rf based on the initial credential set Cf and the metadata set Mf;

[0063] An establishing module, when the first security assessment value Rf is greater than a preset value R0, generates an encryption key KM based on the metadata set Mf, and establishes a secure transmission protocol TA between the client and the target server based on the encryption key KM, wherein the secure transmission protocol TA is provided with an encryption function FY and a content encapsulation warehouse CT, and the encryption function FY is used to perform an encryption operation on the information in the content encapsulation warehouse;

[0064] A module is formed, a first channel set V={V1, V2, ... Vn} including n verification channels is obtained, m verification channels are selected from the first channel set V based on a first security assessment value Rf to form a second channel set V'={V'1, V'2, ... V'm}, m security transmission layers including an encryption function FY and a content encapsulation warehouse CT are set in the second channel set V' based on the security transmission protocol TA, and verification information Mc is encrypted by the encryption function FY and then sent to a user U of a client through the content encapsulation warehouse CT;

[0065] A judgment module, which obtains feedback information Mk returned by the user U for the verification information Mc through the second channel set V', forms a user behavior parameter set B={b1, b2, ...bp} based on the feedback information Mk, and judges whether the user behavior of the user U is abnormal by calculating a similarity value Sm between the user behavior parameter set B and the standard behavior parameter set L={L1, L2, ...Lp};

[0066] The execution module, when it is determined that there is no abnormality in the user behavior of the user U, establishes a session SH between the client user and the target server through an encryption protocol, records the user's session record Ah during the session in real time, and determines whether there is an abnormality in the current session SH based on the session record Ah. When it is determined that the session SH is abnormal, the session between the client user and the target server is disconnected.

[0067] In a third aspect, an embodiment of the present invention further provides an electronic device, the electronic device comprising:

[0068] at least one processor; and,

[0069] a memory communicatively connected to the at least one processor; wherein,

[0070] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the method described in any of the first aspects or any of the implementations of the first aspect.

[0071] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable the computer to execute the method described in the first aspect or any implementation of the first aspect.

[0072] In the fifth aspect, an embodiment of the present invention further provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the method described in the first aspect or any implementation of the first aspect.

[0073] The scheme in the embodiment of the present invention includes: obtaining an initial credential set Cf and a metadata set Mf required for a client user U to log in to a target server, and after completing the verification of the initial credential set Cf through a first verification function, generating a first security assessment value Rf based on the initial credential set Cf and the metadata set Mf; when the first security assessment value Rf is greater than a preset value R0, generating an encryption key KM based on the metadata set Mf, and establishing a secure transmission protocol TA between the client and the target server based on the encryption key KM, wherein an encryption function FY and a content encapsulation warehouse CT are provided in the secure transmission protocol TA, and the encryption function FY is used to perform encryption operations on information in the content encapsulation warehouse; obtaining a first channel set V={V1, V2, ... Vn} containing n verification channels, and selecting m verification channels from the first channel set V based on the first security assessment value Rf to form a second channel set V'={V'1, V'2, ... V'm}, and generating an encryption key KM based on the metadata set Mf when the first security assessment value Rf is greater than a preset value R0, and establishing a secure transmission protocol TA between the client and the target server based on the encryption key KM, wherein an encryption function FY and a content encapsulation warehouse CT are provided in the secure transmission protocol TA, and the encryption function FY is used to perform encryption operations on information in the content encapsulation warehouse; obtaining a first channel set V={V1, V2, ... Vn} containing n verification channels, and selecting m verification channels from the first channel set V based on the first security assessment value Rf to form a second channel set V'={V'1, V'2, ... V'm}, and generating an encryption key KM based on the encryption key KM. The full transmission protocol TA sets m security transmission layers including encryption function FY and content encapsulation warehouse CT in the second channel set V', encrypts the verification information Mc through the encryption function FY, and sends it to the user U of the client through the content encapsulation warehouse CT; obtains the feedback information Mk returned by the user U for the verification information Mc through the second channel set V', forms a user behavior parameter set B={b1,b2,…bp} based on the feedback information Mk, and determines whether the user behavior of the user U is abnormal by calculating the similarity value Sm between the user behavior parameter set B and the standard behavior parameter set L={L1,L2,…Lp}; when it is determined that the user behavior of the user U is not abnormal, establishes a session SH between the client user and the target server through the encryption protocol, records the user's session record Ah during the session in real time, determines whether the current session SH is abnormal based on the session record Ah, and disconnects the session between the client user and the target server when it is determined that the session SH is abnormal. This scheme has the following beneficial effects:

[0074] 1. Significantly improve security

[0075] Multi-factor authentication is achieved by combining multiple verification methods, such as passwords, SMS verification codes, emails, authentication apps, biometrics, and hardware tokens. Compared with a single verification method, this method greatly increases the difficulty for attackers to impersonate identities because they need to break through multiple verification links at the same time, reducing the risk of identity theft.

[0076] 2. Dynamically adjust verification strategies

[0077] Monitor user behavior and environment in real time, and dynamically adjust verification policies based on risk levels. Once abnormal login behavior is detected, such as frequent failed attempts, remote logins, or logins from abnormal devices, the system will automatically adjust the verification policy and require users to perform additional verification, such as adding biometrics or hardware token verification. This dynamic security mechanism can respond to various potential security threats in a timely manner and effectively prevent unauthorized access.

[0078] 3. Multi-layer encryption protection

[0079] Multi-layer encryption technology is used, and strong encryption algorithms (such as AES-256, TLS) are used in all communication channels to ensure the confidentiality and integrity of verification data during transmission, and prevent data from being intercepted, tampered with or leaked. This provides a solid security barrier for user identity information and the verification process, protecting user privacy and data security.

[0080] 4. Anomaly detection and response

[0081] The built-in intelligent anomaly detection module continuously analyzes users' login behaviors and operation patterns through machine learning and big data analysis technology to identify potential threats in a timely manner. Once suspicious behavior or potential risks are detected, the system will trigger a security alert or take appropriate protective measures, such as locking the account and requiring re-verification, further enhancing the security of the system.

[0082] 5. Flexible verification methods

[0083] The risk level is dynamically assessed based on the user's login behavior, device type, geographic location, network environment and other information, and the appropriate verification channel is selected and triggered. For low-risk environments, a simple SMS verification code or email verification may be required, reducing the user's operation steps; while for high-risk environments, more stringent verification methods are added, ensuring security while maximizing user convenience.

[0084] 6. Simplify the recovery process

[0085] Provide users with a secure account recovery process. When users lose their verification devices or cannot pass the regular verification channel, they can restore account access rights through alternative channels or additional verification steps. This mechanism not only ensures the security of the account, but also avoids the trouble caused by the user's inability to access the account, and improves the user's satisfaction with the system.

[0086] 7. Resource integration and optimization

[0087] The solution achieves effective use of identity protection resources by integrating multiple authentication methods and dynamically adjusting strategies. Enterprises do not need to develop and maintain complex systems for each security requirement, which reduces the cost of developing, maintaining and supporting multiple authentication channels and improves resource utilization efficiency.

[0088] 8. Automated Management

[0089] Intelligent anomaly detection and dynamic verification adjustment functions automate security management and reduce the need for manual intervention. Enterprises can manage the user authentication process more efficiently, reduce security risks caused by human error or negligence, and reduce the workload of technical support personnel.

[0090] 9. Improved data security

[0091] The system's multi-layer encryption and security mechanisms ensure the security and integrity of user data, meet the company's compliance needs in data security management, help the company establish a good brand image, and enhance user trust in the company. BRIEF DESCRIPTION OF THE DRAWINGS

[0092] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0093] Figure 1 A schematic diagram of a multi-channel dynamic identity protection method provided by an embodiment of the present invention;

[0094] Figure 2 A schematic diagram of another multi-channel dynamic identity protection method flow provided by an embodiment of the present invention;

[0095] Figure 3 A schematic diagram of the structure of a multi-channel dynamic identity protection device provided by an embodiment of the present invention;

[0096] Figure 4 A schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0097] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0098] The following describes the embodiments of the present disclosure through specific examples, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all of the embodiments. The present disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present disclosure.

[0099] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of aspects described herein may be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein may be used to implement this device and / or practice this method.

[0100] It should also be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present disclosure. The drawings only show components related to the present disclosure rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0101] Additionally, in the following description, specific details are provided to facilitate a thorough understanding of the examples. However, it will be understood by those skilled in the art that the aspects described may be practiced without these specific details.

[0102] The embodiment of the present disclosure provides a multi-channel dynamic identity protection method. The multi-channel dynamic identity protection method provided in this embodiment can be executed by a computing device, which can be implemented as software, or as a combination of software and hardware, and the computing device can be integrated in a server, terminal device, etc.

[0103] See also Figure 1 and Figure 2 The embodiment of the present disclosure provides a multi-channel dynamic identity protection method, including:

[0104] S101, obtain the initial credential set Cf and metadata set Mf required for the client user U to log in to the target server, after completing the verification of the initial credential set Cf through the first verification function, generate a first security assessment value Rf based on the initial credential set Cf and the metadata set Mf.

[0105] On the client side, user U enters the initial credentials required to log in to the target server, such as user name, password, etc., which constitute the initial credential set Cf. The client sends Cf to the target server. At the same time, the client collects metadata related to this login, including the type of login device, operating system, IP address, login time, etc., to form a metadata set Mf, and sends it to the target server.

[0106] After receiving Cf, the target server calls the first verification function. This function compares the username in Cf with the user list stored in the server to verify the existence of the username. For the password in Cf, the input password is hashed using an encrypted hash algorithm (such as SHA256), and then the calculation result is compared with the hashed password of the user stored in the server to verify the correctness of the password. If the username and password match, the first verification function returns a verification pass result; otherwise, it returns a verification fail result. If the verification fails, the subsequent process is terminated and the user is prompted to re-enter.

[0107] A risk assessment model can be established, which takes the initial credential set Cf and the metadata set Mf as input. For the initial credential set Cf, factors such as the complexity of the password (such as password length, character types included, etc.) and whether the user name has a weak format (such as a simple dictionary word) are evaluated, and corresponding weights and scoring criteria are set for each factor to calculate the risk score of the initial credential. For the metadata set Mf, factors such as the security of the login device (such as whether it is a known security device, whether there is a security vulnerability), the abnormality of the login location (difference from the user's usual login location), and the regularity of the login time are analyzed. Similarly, weights and scoring criteria are set for each factor to calculate the risk score of the metadata.

[0108] The risk score of the initial credential and the risk score of the metadata are weighted and summed according to certain weights (for example, 50% each) to obtain a first security assessment value Rf.

[0109] S102: When the first security assessment value Rf is greater than a preset value R0, an encryption key KM is generated based on the metadata set Mf, and a secure transmission protocol TA is established between the client and the target server based on the encryption key KM. The secure transmission protocol TA is provided with an encryption function FY and a content encapsulation warehouse CT, and the encryption function FY is used to perform encryption operations on the information in the content encapsulation warehouse.

[0110] A key generation algorithm (such as the AES key generation algorithm) can be used, with certain key information in the metadata set Mf (such as the IP address, the hash value of the login time) as seed data. The seed data is input into the key generation algorithm to generate a high-strength encryption key KM.

[0111] Select a secure transmission protocol framework (such as TLS protocol) as the basis. Apply the generated encryption key KM to the selected protocol framework, and configure various parameters of the protocol, such as encryption algorithm (select a suitable encryption algorithm based on the encryption key KM, such as AES256), authentication method (such as digital certificate authentication), etc. Define the encryption function FY in the secure transmission protocol TA, which encrypts the input information based on the selected encryption algorithm. At the same time, define the content encapsulation bin CT, which is used to encapsulate the encrypted information and add necessary header information (such as message type, length, sender and receiver identification) and verification information (such as message digest).

[0112] S103, obtain a first channel set V={V1,V2,…Vn} including n verification channels, select m verification channels from the first channel set V based on a first security assessment value Rf to form a second channel set V'={V'1,V'2,…V'm}, and based on the secure transmission protocol TA, set m secure transmission layers including an encryption function FY and a content encapsulation warehouse CT in the second channel set V', encrypt the verification information Mc through the encryption function FY, and send it to the user U of the client through the content encapsulation warehouse CT.

[0113] Predefine the correspondence between different risk level ranges and the number of verification channels m and selection rules. According to the first security assessment value Rf, determine the risk level range to which it belongs. According to the selection rules corresponding to the risk level range, select m verification channels from the first channel set V={V1,V2,...,Vn} and arrange them in a certain order to form a second channel set V'={V'1,V'2,...,V'm}. For example, for low risk levels, two channels, SMS verification code and email verification, may be selected; for high risk levels, channels such as biometrics and hardware token verification may be added.

[0114] For each verification channel in the second channel set V', based on the secure transmission protocol TA, a secure transmission layer including the encryption function FY and the content encapsulation bin CT is set on each channel. The verification information Mc is generated, for example, including content such as one-time verification codes and verification links. The encryption function FY is used to encrypt the verification information Mc, and the encrypted information is placed in the content encapsulation bin CT for encapsulation. Through each channel in the second channel set V', the encapsulated verification information is sent to the user U of the client.

[0115] S104. Obtain the feedback information Mk returned by the user U for the verification information Mc through the second channel set V'. Based on the feedback information Mk, form the user behavior parameter set B = {b1, b2, …, bp}. By calculating the similarity value Sm between the user behavior parameter set B and the standard behavior parameter set L = {L1, L2, …, Lp}, determine whether there is an abnormality in the user behavior of the user U.

[0116] After receiving the verification information Mc on the client, the user U performs corresponding operations as required (such as entering the verification code, clicking the verification link, etc.). The client sends the operation result of the user as the feedback information Mk back to the target server.

[0117] After receiving the feedback information Mk, the target server extracts the parameters related to the user behavior from it, such as the operation time, operation sequence, characteristics of the input information, etc., to form the user behavior parameter set B = {b1, b2, ..., bp}.

[0118] The standard behavior parameter set L = {L1, L2, ..., Lp} is preset in advance, and this set represents the parameter range and characteristics of normal user behavior.

[0119] Adopt a similarity calculation algorithm (such as cosine similarity algorithm, Euclidean distance algorithm, etc.) to calculate the similarity value Sm between the user behavior parameter set B and the standard behavior parameter set L.

[0120] A similarity threshold S0 can be set. If Sm ≥ S0, it is determined that there is no abnormality in the user behavior of the user U; if Sm < S0, it is determined that there is an abnormality in the user behavior, terminate the subsequent process and take corresponding measures (such as prompting the user to re-verify, locking the account, etc.).

[0121] S105. When it is determined that there is no abnormality in the user behavior of the user U, establish a session SH between the client user and the target server through the encryption protocol, and record the session record Ah of the user during the session in real time. Based on the session record Ah, determine whether there is an abnormality in the current session SH. When it is determined that the session SH has an abnormality, disconnect the session between the client user and the target server.

[0122] When it is determined that there is no abnormality in the user behavior of user U, the target server establishes a session SH between the client user and the target server through an encryption protocol (such as an encryption mechanism based on a secure transmission protocol TA). A unique session identifier is assigned to the session SH for identifying and managing the session in subsequent processes.

[0123] During the session SH, the server records the user's operation behavior in real time, including each user's request, request parameters, response results and other information, forming a session record Ah.

[0124] A session anomaly detection model is established, which takes the session record Ah as input. The model analyzes the operation frequency, operation type, data flow and other characteristics in the session record, and compares them with the preset normal session behavior pattern. If it is detected that the behavior characteristics in the session record are significantly different from the normal pattern, it is judged that the session SH is abnormal, and the server immediately disconnects the session between the client user and the target server to prevent possible security threats from further expanding. At the same time, the abnormal information is recorded for subsequent security audits and analysis.

[0125] See also Figure 2 The present invention also provides another multi-channel dynamic identity protection method, comprising the following steps:

[0126] Step 1. Initialize user authentication

[0127] When a user attempts to access a system or resource, the system first initiates the authentication process. The user needs to provide initial credentials (such as username and password), which is the traditional knowledge factor authentication method. The system will perform basic authentication at this stage and capture relevant metadata (such as device type, IP address, geographic location, etc.) for subsequent analysis.

[0128] • Step 1.1: Enter initial credentials

[0129] The user enters a username and password, and the system verifies that the credentials are correct through a local or remote server.

[0130] • Step 1.2: Initial risk assessment

[0131] The system performs a preliminary risk assessment by checking the metadata of the user's login request (such as login location, device type, previous login mode, etc.). If the assessment determines that the login environment has a high risk, subsequent multi-channel verification will be enabled.

[0132] Step 2. Multi-channel verification trigger

[0133] Based on the initial risk assessment, the system will choose to trigger different verification channels. Multi-channel verification combines different types of authentication factors, including but not limited to the following:

[0134] • Ownership factor (e.g. mobile phone, hardware token): The system will send a one-time password (OTP) to the user’s mobile phone or email, or require the user to verify through a mobile app.

[0135] •Biometric factors: If the user’s device supports biometric features (e.g., fingerprint, facial recognition), the system will enable these factors as an additional verification step.

[0136] •Device or location authentication: If the device the user logs in from is different from the previous device, or the login geographical location is abnormal, the system will require additional verification.

[0137] • Step 2.1: Multi-channel verification selection

[0138] The system automatically selects multiple verification channels based on the risk level of the initial assessment. For low-risk environments, SMS verification code or email verification may be sufficient; for high-risk environments, the system will add biometric or hardware token verification.

[0139] •Step 2.2: Send OTP or verification request

[0140] The system sends an OTP or verification request through a preset channel, and the user needs to respond within the set time.

[0141] Step 3. Multi-layer encrypted communication transmission

[0142] In order to ensure the security of data transmission in multi-channel authentication, the system adopts multi-layer encryption technology. Strong encryption algorithms (such as AES-256 and TLS) are used in all communication channels (including SMS, email, and authentication applications) to ensure that any authentication information (such as OTP, authentication token, etc.) is not intercepted or tampered by a third party during the transmission process.

[0143] •Step 3.1: Data Encryption

[0144] When the system sends any verification information, it first processes it through an encryption algorithm to ensure the integrity and confidentiality of the data in the communication link.

[0145] •Step 3.2: Channel Encryption Protocol

[0146] System communication uses secure transport layer protocols (such as TLS 1.3) to ensure that all communication processes from source to destination are secure and reliable, preventing man-in-the-middle attacks.

[0147] Step 4. Dynamic verification adjustment

[0148] During the identity verification process, the system monitors changes in user behavior and environment in real time. Once abnormal behavior or potential risks are detected (such as abnormal devices, sudden changes in geographic location, etc.), the system will automatically adjust the verification method and trigger additional verification steps.

[0149] •Step 4.1: Risk Behavior Monitoring

[0150] The system analyzes the time, location, device and other parameters of the user's operation to evaluate in real time whether the current login behavior conforms to the user's normal habits. Once an abnormality occurs (such as frequent failed login attempts by the user), the system will automatically increase the security verification level.

[0151] • Step 4.2: Dynamically trigger additional validation

[0152] If potential risks are detected, the system will automatically trigger a new verification method, such as requiring users to use biometrics, secondary OTP verification, or manual identity confirmation.

[0153] Step 5. Verification and access authorization

[0154] When the user passes all the required verification steps, the system will finally confirm the user's identity and grant the corresponding access rights. This step is not just a simple verification, but also involves the system's continuous monitoring and protection of the user's session to prevent attackers from hijacking the session after verification.

[0155] •Step 5.1: Session encryption and protection

[0156] After the user successfully logs in, the system protects the user's session through encryption protocols to prevent session hijacking. During the entire session, the system will continue to monitor to ensure that the user's operations are in line with normal behavior patterns.

[0157] Step 6. Anomaly detection and risk response

[0158] The system's built-in anomaly detection module uses machine learning and big data analysis technology to continuously analyze users' login behaviors and operation patterns to identify potential threats in a timely manner. Once suspicious behavior or potential risks are detected, the system will trigger a security alert or take appropriate protective measures (such as locking the account, requiring re-verification).

[0159] • Step 6.1: Intelligent Anomaly Detection

[0160] The system analyzes the user's historical login data, combines machine learning algorithms to identify abnormal behaviors (such as sudden geographic location changes, frequent login failures, etc.), and takes different response measures based on the risk level.

[0161] • Step 6.2: Real-time security response

[0162] When serious anomalies are detected, the system can take immediate action, such as forcing users to log off, freezing accounts, or requiring them to re-pass multi-factor verification.

[0163] Step 7. Account recovery and security processing

[0164] In case a user is unable to complete identity verification due to device loss or unavailable verification channels, the system provides a secure account recovery process. Users can restore access to their accounts through alternative verification channels (such as backup emails, security questions) or other identity verification methods (such as manual verification).

[0165] • Step 7.1: Alternate channel verification

[0166] The system allows users to preset multiple alternative channels (such as additional emails, alternative mobile phone numbers, etc.) to complete verification through these alternative channels when the regular verification channel is unavailable.

[0167] • Step 7.2: Emergency Account Recovery Mechanism

[0168] When a user is unable to verify his or her identity through all verification channels, the system provides an emergency recovery mechanism, such as contacting customer support for manual identity verification, to ensure the security and availability of the user account.

[0169] According to a specific implementation of an embodiment of the present invention, the obtaining of an initial credential set Cf and a metadata set Mf required for a client user U to log in to a target server includes:

[0170] After the user enters the initial credentials on the client, the initial credentials entered by the user are formed into an initial credential set Cf and sent to the target server; the target server calls the first verification function and verifies the initial credential set Cf according to the preset verification rules; after the first verification function is executed, the verification result is output.

[0171] After the user enters the initial credentials on the client, the initial credentials entered by the user are formed into an initial credential set Cf. Suppose the initial credentials entered by the user are a vector containing multiple elements ,in represents the i-th initial credential element. Then the initial credential set Cf can be expressed as:

[0172] }

[0173] and sends it to the target server.

[0174] The target server calls the first verification function to verify the initial credential set Cf according to the preset verification rules. The preset verification rules are based on a series of logical judgments and mathematical operations. Assume that there are s verification rules, each of which corresponds to a verification function , the output of the verification function is a Boolean value, indicating whether the rule passes the verification. Then the first verification function It can be expressed as:

[0175]

[0176] in Represents a logical AND operation.

[0177] After the first verification function is executed, the verification result is output. , it means that the initial credential set Cf has passed the verification; if , it means that the verification has not passed.

[0178] According to a specific implementation of an embodiment of the present invention, after completing the verification of the initial credential set Cf through the first verification function, generating a first security assessment value Rf based on the initial credential set Cf and the metadata set Mf, further comprising:

[0179] Extract key information from the verified initial credential set Cf, evaluate the extracted key information, and determine the risk level F1 of the initial credential set Cf based on the evaluation result of the key information; parse the metadata set Mf to obtain the login device information, login location information, login time and network environment of the user U, judge the security of the device based on the login device information, analyze the login location information, judge whether the login location matches the user's regular activity area, evaluate the security of the network environment, and then determine the risk level F2 of the metadata set Mf; set weights for the initial credential set Cf and the metadata set Mf respectively, the weight of the initial credential set Cf is set to w1, and the weight of the metadata set Mf is set to w2, and according to the set weights, calculate the first security assessment value Rf=w1*F1+w2*Mf by the formula.

[0180] Extract key information from the verified initial credential set Cf, and set the extracted key information to be a vector ,in Denotes the i-th key information element. Evaluate the extracted key information, and determine the risk level F1 of the initial credential set Cf based on the evaluation results of the key information. Assume that the function for evaluating key information is , its output is a real number, indicating the risk level, and the risk level is inversely proportional to the safety, then:

[0181]

[0182] Parse the metadata set Mf and assume that the metadata set Mf can be represented as a multi-tuple , where D represents the login device information of user U, L represents the login location information, T represents the login time, and N represents the network environment.

[0183] The security of the device is determined based on the logged-in device information D. Assume that the function for determining the security of the device is S1(D), and the output is a real number between 0 and 1, which represents the security factor of the device, and 1 represents the safest.

[0184] Analyze the login location information L and determine whether the login location matches the user's regular activity area. Assume that there is a function S2(L) whose output is a Boolean value, indicating whether the login location matches. If it matches, it is True, and if it does not match, it is False. In order to incorporate it into a unified evaluation system, a conversion function f(S2(L)) is defined. When S2(L) = True, f(S2(L)) = 1; when S2(L) = False, f(S2(L)) = 0.

[0185] Evaluate the security of the network environment N. Assume that the function for evaluating the security of the network environment is S3(N), and the output is a real number between 0 and 1, which represents the security factor of the network environment.

[0186] Then the risk level F2 of the metadata set Mf can be determined by the following formula:

[0187]

[0188] in is the weight coefficient.

[0189] According to a specific implementation of the embodiment of the present invention, the establishing of a secure transmission protocol TA between the client and the target server based on the encryption key KM includes:

[0190] The generated encryption key KM is distributed between the client and the target server in a secure manner; based on the selected encryption algorithm and protocol framework, as well as the shared encryption key KM, the parameters of the secure transmission protocol TA are configured. In the secure transmission protocol TA, the encryption function FY and the content encapsulation warehouse CT are set. The encryption function FY is responsible for encrypting the information to be transmitted, and the content encapsulation warehouse CT is used to encapsulate the encrypted information and add header information and verification information.

[0191] The generated encryption key KM is distributed between the client and the target server in a secure way. Assuming that an asymmetric encryption algorithm is used for key distribution, the client's public key is PKc, the private key is SKc, the target server's public key is PKs, and the private key is SKs. The encryption key KM is first encrypted using the target server's public key PKs to obtain the encrypted key , where E represents the encryption function. Then It is sent to the target server, which decrypts it using its private key SKs to obtain the original encryption key KM, that is, , where D represents the decryption function.

[0192] Based on the selected encryption algorithm and protocol framework, as well as the shared encryption key KM, configure the parameters of the secure transmission protocol TA. Assume that the selected encryption algorithm is the symmetric encryption algorithm AES (Advanced Encryption Standard), and its encryption function is , where M represents the information to be encrypted and KM is the encryption key.

[0193] In the secure transmission protocol TA, an encryption function FY and a content encapsulation bin CT are set. The encryption function FY is responsible for encrypting the information to be transmitted, and the content encapsulation bin CT is used to encapsulate the encrypted information, add header information and verification information. Suppose the information to be transmitted is M, and the encryption function FY can be expressed as:

[0194]

[0195] The content encapsulation warehouse CT encapsulates the encrypted information FY(M). Assuming the header information is H, the verification information is calculated by the function C(FY(M)), where C represents the verification function. The encapsulated information is:

[0196]

[0197] in Represents a bitwise exclusive-or operation.

[0198] According to a specific implementation method of an embodiment of the present invention, based on the first security assessment value Rf, m verification channels are selected from the first channel set V to form a second channel set V'={V'1, V'2, ... V'm}, including: determining the correspondence between risk level and channel selection strategy, setting different risk level ranges and the number of verification channels m corresponding to each range and the corresponding selection rules; judging the risk level range to which the first security assessment value Rf belongs, and determining the m verification channels to be selected according to the selection rules corresponding to the risk level range; selecting m verification channels that meet the requirements from the first channel set V, and arranging the selected m verification channels in order to form a second channel set V'.

[0199] First, the risk level is divided into k intervals, each interval is represented by , and satisfies ,at the same time . Define the risk level judgment function as follows:

[0200]

[0201] in, is the judgment function. When x≥0, δ(x)=1; when x<0, δ(x)=0.

[0202] Next, set the number of verification channels m and selection rules corresponding to different risk level ranges. Suppose the functional relationship between the number of verification channels and risk level is , that is, the number of verification channels corresponding to the jth risk level is The selection rule is implemented by a complex selection function is determined based on the reliability of the channel , Verification efficiency and the matching degree with the risk level The channel is selected based on factors such as:

[0203]

[0204] in, is the weight coefficient

[0205] Calculating risk level , the risk level to which Rf belongs is determined by the risk level judgment function defined above.

[0206] According to the selection rules corresponding to the risk level range, determine the m verification channels to be selected, that is, m= , and by selecting the function Get the verification channel set that should be selected .

[0207] Select from the first channel set V There are m verification channels in , let the selected channel set be In order to arrange these channels in order to form the second channel set V', a sorting index function is defined , which assigns an indicator value to each channel based on factors such as the importance and priority of the channel.

[0208] Channel Collection The mathematical description of sorting is as follows:

[0209] for , after m-1 rounds of comparison and exchange operations, each round For two adjacent channels and (1≤i≤mt) for comparison, if , then exchange and The position is expressed mathematically as:

[0210]

[0211] After m-1 rounds of operations, the sorted second channel set is obtained Through the above steps, a second channel set V' is successfully selected from the first channel set V based on the first safety assessment value Rf.

[0212] According to a specific implementation of an embodiment of the present invention, the process of determining whether the user behavior of the user U is abnormal by calculating the similarity value Sm between the user behavior parameter set B and the standard behavior parameter set L={L1, L2, ...Lp} includes:

[0213] The behavior pattern similarity function Sm(B,L) is defined as:

[0214]

[0215] γ and σ are correction parameters;

[0216] Set a similarity threshold θ. When Sm(B,L)<θ, the user behavior is judged to be abnormal.

[0217] According to a specific implementation of an embodiment of the present invention, judging whether there is an abnormality in the current session SH based on the session record Ah includes:

[0218] Analyze the user's operation sequence based on the session record Ah , q is the number of operations;

[0219] Combine operation sequence A with the normal operation mode Compare and get the matching value QD:

[0220]

[0221] and are the maximum and minimum of the jth operation in the normal operation mode, respectively;

[0222] The operation mode matching threshold β is set. When QD(A,E)≥β, it is considered that the user operation conforms to the normal behavior mode and there is no abnormality in the current session SH.

[0223] According to a specific implementation of the embodiment of the present invention, when it is determined that the session SH is abnormal, after disconnecting the session between the client user and the target server, the method further includes:

[0224] The alternate authentication channel is presented to the user, and the user resumes the current session SH through the alternate authentication channel.

[0225] Corresponding to the above method embodiment, see Figure 3 The embodiment of the present invention further discloses a multi-channel dynamic identity protection device 30, comprising:

[0226] The acquisition module 301 acquires an initial credential set Cf and a metadata set Mf required for a client user U to log in to a target server, and after completing the verification of the initial credential set Cf through a first verification function, generates a first security assessment value Rf based on the initial credential set Cf and the metadata set Mf;

[0227] Establishing module 302, when the first security assessment value Rf is greater than a preset value R0, generating an encryption key KM based on the metadata set Mf, and establishing a secure transmission protocol TA between the client and the target server based on the encryption key KM, wherein the secure transmission protocol TA is provided with an encryption function FY and a content encapsulation warehouse CT, and the encryption function FY is used to perform an encryption operation on the information in the content encapsulation warehouse;

[0228] Forming module 303, obtaining a first channel set V={V1, V2, ... Vn} including n verification channels, selecting m verification channels from the first channel set V based on the first security evaluation value Rf to form a second channel set V'={V'1, V'2, ... V'm}, setting m security transmission layers including an encryption function FY and a content encapsulation warehouse CT in the second channel set V' based on the security transmission protocol TA, encrypting the verification information Mc through the encryption function FY, and sending it to the user U of the client through the content encapsulation warehouse CT;

[0229] The judgment module 304 obtains feedback information Mk returned by the user U for the verification information Mc through the second channel set V', forms a user behavior parameter set B={b1, b2, ...bp} based on the feedback information Mk, and determines whether the user behavior of the user U is abnormal by calculating the similarity value Sm between the user behavior parameter set B and the standard behavior parameter set L={L1, L2, ...Lp};

[0230] Execution module 305, when it is determined that there is no abnormality in the user behavior of user U, establishes a session SH between the client user and the target server through an encryption protocol, records the user's session record Ah during the session in real time, and determines whether there is an abnormality in the current session SH based on the session record Ah. When it is determined that the session SH is abnormal, disconnects the session between the client user and the target server.

[0231] See also Figure 4 The embodiment of the present invention further provides an electronic device 60, the electronic device comprising:

[0232] at least one processor; and,

[0233] a memory communicatively connected to the at least one processor; wherein,

[0234] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the multi-channel dynamic identity protection method in the aforementioned method embodiment.

[0235] An embodiment of the present invention further provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable the computer to execute the aforementioned method embodiment.

[0236] An embodiment of the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the multi-channel dynamic identity protection method in the aforementioned method embodiment.

[0237] Reference below Figure 4 , which shows a schematic diagram of the structure of an electronic device 60 suitable for implementing the embodiment of the present disclosure. The electronic device in the embodiment of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle terminals (such as vehicle navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 4The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0238] like Figure 4 As shown, the electronic device 60 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the electronic device 60 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0239] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, a gage, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 60 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 4 The electronic device 60 is shown with various devices, but it should be understood that it is not required to implement or have all the devices shown. More or fewer devices may be implemented or have instead.

[0240] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0241] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A multi-channel dynamic identity protection method, characterized in that: include: Obtain an initial credential set Cf and a metadata set Mf required for a client user U to log in to a target server, and after completing the verification of the initial credential set Cf through a first verification function, generate a first security assessment value Rf based on the initial credential set Cf and the metadata set Mf; When the first security assessment value Rf is greater than a preset value R0, an encryption key KM is generated based on the metadata set Mf, and a secure transmission protocol TA is established between the client and the target server based on the encryption key KM, wherein an encryption function FY and a content encapsulation warehouse CT are provided in the secure transmission protocol TA, and the encryption function FY is used to perform an encryption operation on the information in the content encapsulation warehouse; Get the first channel set V={V1,V2,…V n }, based on the first security assessment value Rf, m verification channels are selected from the first channel set V to form a second channel set V'={V'1, V'2, ... V' m }, based on the secure transmission protocol TA, m secure transmission layers including an encryption function FY and a content encapsulation warehouse CT are set in the second channel set V', the verification information Mc is encrypted by the encryption function FY, and then sent to the user U of the client through the content encapsulation warehouse CT; The feedback information Mk returned by the user U for the verification information Mc is obtained through the second channel set V', and a user behavior parameter set B={b1, b2, ... b p }, by calculating the user behavior parameter set B and the standard behavior parameter set L={L1,L2,…L p }, to determine whether the user behavior of user U is abnormal; When it is determined that there is no abnormality in the user behavior of the user U, a session SH is established between the client user and the target server through an encryption protocol, and the session record Ah of the user during the session is recorded in real time. Based on the session record Ah, it is determined whether there is an abnormality in the current session SH. When it is determined that the session SH is abnormal, the session between the client user and the target server is disconnected; in The determining whether the current session SH is abnormal based on the session record Ah includes: Analyze the user's operation sequence based on the session record Ah , q is the number of operations; Combine operation sequence A with the normal operation mode Compare and get the matching value QD: and are the maximum and minimum values ​​of the jth operation in the normal operation mode, respectively; The operation mode matching threshold β is set. When QD(A,E)≥β, it is considered that the user operation conforms to the normal behavior mode and there is no abnormality in the current session SH.

2. The method according to claim 1, characterized in that The method of obtaining the initial credential set Cf and metadata set Mf required for the client user U to log in to the target server includes: After user U enters the initial credentials on the client, the initial credentials entered by user U are formed into an initial credential set Cf and sent to the target server; The target server calls the first verification function and verifies the initial credential set Cf according to the preset verification rules; After the first verification function is executed, the verification result is output.

3. The method according to claim 2, characterized in that After the verification of the initial credential set Cf is completed by the first verification function, a first security assessment value Rf is generated based on the initial credential set Cf and the metadata set Mf, further comprising: Extract key information from the verified initial credential set Cf, evaluate the extracted key information, and determine the risk level F1 of the initial credential set Cf based on the evaluation result of the key information; Parse the metadata set Mf to obtain the login device information, login location information, login time and network environment of the user U. According to the login device information, judge the security of the device, analyze the login location information, judge whether the login location is consistent with the user's regular activity area, evaluate the security of the network environment, and then determine the risk level F2 of the metadata set Mf; Weights are set for the initial credential set Cf and the metadata set Mf respectively. The weight of the initial credential set Cf is set to w1, and the weight of the metadata set Mf is set to w2. According to the set weights, the first security assessment value Rf=w1*F1+w2*Mf is calculated by the formula.

4. The method according to claim 3, characterized in that The step of establishing a secure transmission protocol TA between the client and the target server based on the encryption key KM includes: Distribute the generated encryption key KM between the client and the target server in a secure manner; Based on the selected encryption algorithm and protocol framework, as well as the shared encryption key KM, the parameters of the secure transmission protocol TA are configured. In the secure transmission protocol TA, the encryption function FY and the content encapsulation warehouse CT are set. The encryption function FY is responsible for encrypting the information to be transmitted, and the content encapsulation warehouse CT is used to encapsulate the encrypted information and add header information and verification information.

5. The method according to claim 4, characterized in that Based on the first security assessment value Rf, m verification channels are selected from the first channel set V to form a second channel set V'={V'1, V'2, ... V' m },include: Determine the correspondence between risk level and channel selection strategy, set different risk level ranges and the number of verification channels m corresponding to each range and the corresponding selection rules; Determine the risk level range to which the first security assessment value Rf belongs, and determine the m verification channels to be selected according to the selection rule corresponding to the risk level range; Select m verification channels that meet the requirements from the first channel set V, and arrange the selected m verification channels in order to form a second channel set V'.

6. The method according to claim 1, characterized in that When it is determined that the session SH is abnormal, after disconnecting the session between the client user and the target server, the method further includes: The alternate authentication channel is presented to the user, and the user resumes the current session SH through the alternate authentication channel.

7. A multi-channel dynamic identity protection device, characterized in that: include: An acquisition module is configured to acquire an initial credential set Cf and a metadata set Mf required for a client user U to log in to a target server, and after verifying the initial credential set Cf through a first verification function, generate a first security assessment value Rf based on the initial credential set Cf and the metadata set Mf; An establishing module, when the first security assessment value Rf is greater than a preset value R0, generates an encryption key KM based on the metadata set Mf, and establishes a secure transmission protocol TA between the client and the target server based on the encryption key KM, wherein the secure transmission protocol TA is provided with an encryption function FY and a content encapsulation warehouse CT, and the encryption function FY is used to perform an encryption operation on the information in the content encapsulation warehouse; Form a module and obtain the first channel set V={V1,V2,…V n }, based on the first security assessment value Rf, m verification channels are selected from the first channel set V to form a second channel set V'={V'1, V'2, ... V' m }, based on the secure transmission protocol TA, m secure transmission layers including an encryption function FY and a content encapsulation warehouse CT are set in the second channel set V', the verification information Mc is encrypted by the encryption function FY, and then sent to the user U of the client through the content encapsulation warehouse CT; The judgment module obtains the feedback information Mk returned by the user U for the verification information Mc through the second channel set V', and forms a user behavior parameter set B={b1, b2, ... b p }, by calculating the user behavior parameter set B and the standard behavior parameter set L={L1,L2,…L p }, to determine whether the user behavior of user U is abnormal; The execution module, when it is determined that there is no abnormality in the user behavior of the user U, establishes a session SH between the client user and the target server through an encryption protocol, records the user's session record Ah during the session in real time, determines whether there is an abnormality in the current session SH based on the session record Ah, and disconnects the session between the client user and the target server when it is determined that there is an abnormality in the session SH; in The determining whether the current session SH is abnormal based on the session record Ah includes: Analyze the user's operation sequence based on the session record Ah , q is the number of operations; Combine operation sequence A with the normal operation mode Compare and get the matching value QD: and are the maximum and minimum values ​​of the jth operation in the normal operation mode, respectively; The operation mode matching threshold β is set. When QD(A,E)≥β, it is considered that the user operation conforms to the normal behavior mode and there is no abnormality in the current session SH.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the multi-channel dynamic identity protection method according to any one of claims 1 to 6.

Images