Unified portal identity authentication method in credential environment

Abstract

The invention aims to provide a unified portal identity authentication method in a credential environment, and the method comprises the steps: detecting whether an intrusion event occurs in a current working condition or not when a user inputs identity information; if the intrusion event exists, judging the danger level of the intrusion event; generating a deception ciphertext according to the danger level; and sending the deception ciphertext to an intrusion end. According to the method, a positive and active elastic defense strategy can be adopted, and network security threats can be reduced and even eliminated by deploying measures such as accurate early warning, timely blocking and sufficient repairing before an attack behavior causes adverse effects on the system. The active defense has the advantages that prevention measures can be taken and potential network risks can be dealt with before attacks occur, so that safety accidents are reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of cryptography, and in particular to a unified portal identity authentication method in a trusted innovation environment. Background Art

[0002] The trusted innovation environment refers to an environment for information technology application innovation, which aims to build a safe and controllable information technology support to avoid core technology being controlled by others. Trust innovation (information technology application innovation) is a comprehensive concept, which involves the independent research and development of core technology products in the IT industry chain such as hardware and cloud infrastructure, basic software, application software, network security, etc. The specific applications of the trusted innovation environment include but are not limited to: Basic hardware: including domestic CPUs, servers, storage devices, switches, routers, etc. Basic software: such as databases, operating systems, middleware, etc. Application software: such as OA (office automation), ERP (enterprise resource planning), office software, government applications, etc. Information security products: such as boundary security products, terminal security products, etc.

[0003] Considering the serious threat posed by intrusion events to data security and the increasing intelligence and complexity of attack methods, many data security studies currently focus on threat detection and attack blocking in the system and network aspects, but rarely touch on the data itself. Encryption-centric data security solutions limit the availability of data, which makes it difficult for data encryption technology to be applied on a large scale. The disadvantages of existing data security solutions can be summarized into the following two aspects. First, unknown threats (such as zero-day vulnerabilities, intrusion events) and persistent threats (such as distributed denial of service attacks, advanced persistent threat attacks) put defenders in a passive position. Second, deterministic data content, static data structure and single data access method provide a larger attack surface for network attacks. Given that encrypted data from intrusion events is difficult to crack, traditional passive defense strategies such as malware detection and data recovery are no longer sufficient, and active defense strategies are urgently needed. Summary of the invention

[0004] The purpose of the present invention is to provide a unified portal identity authentication method in a trusted innovation environment, which can adopt an active and flexible defense strategy, and can reduce or even eliminate network security threats by deploying precise early warning, timely blocking and full repair measures before the attack behavior has an adverse impact on the system. The advantage of active defense is that it can take preventive measures and respond to potential network risks before the attack occurs, thereby reducing the occurrence of security incidents.

[0005] A unified portal identity authentication method in a trusted innovation environment, comprising:

[0006] When the user enters identity information, detect whether an intrusion event occurs in the current working condition;

[0007] If there is an intrusion event, determine the danger level of the intrusion event;

[0008] generating a spoof ciphertext according to the risk level;

[0009] The deceptive ciphertext is sent to the intruder end.

[0010] Preferably, generating the original ciphertext data block according to the original ciphertext includes:

[0011] Assume that the participant P A and P B The exchangeable encryption keys are k A and k B , the public and private key pairs of homomorphic encryption are (pkA, skA) and (pkB, skB) respectively;

[0012] Participant P A and P B Each uses a commutative encryption algorithm to process the identity ID, then D A The i-th (i∈[nA]) ID is encrypted as [IDA,i]k A , D B The jth (j∈[nB]) ID in is encrypted as [IDB,j]k B .

[0013] Preferably, the determination of the danger level of the intrusion event includes:

[0014] Obtain the value coefficient of stored identity information and the threat of invaded viruses;

[0015] The value coefficient of stored identity information and the threat of the invaded virus are expressed as vectors, and the factor weight vector W f and G f They are:

[0016] W f =[w1,w2];

[0017] G f =[G1,G2];

[0018] Among them, w i =[w i1 ,w i2 ],

[0019] G i =[G i1 ,G i2 ,],

[0020] The calculation formula for evaluating the risk level of intrusion events is expressed as:

[0021]

[0022] Preferably, the value coefficient of the stored identity information is

[0023] Assuming that there are m hosts storing identity information in the local area network, and the security attribute values ​​of the assets of the i-th host are the secret index Ci and the validity index Ei, then the estimated value of the value coefficient of the stored identity information at time t is G i1 as follows:

[0024]

[0025] k is the attacker's proficiency in knowledge, and k∈[0,1], Ni is the total number of vulnerabilities.

[0026] Preferably, the threat of the invaded virus is:

[0027]

[0028] Among them, p k is the probability that the kth ciphertext is deciphered, β k is the probability that the kth ciphertext changes from a healthy state to an infected state, μ k is the probability that the kth ciphertext becomes immune after being infected, σ k is the probability that the kth ciphertext changes from an infected state to a healthy state, α k is the probability that the kth ciphertext changes from the immune state to the healthy state.

[0029] Preferably, generating a spoof ciphertext according to the risk level includes:

[0030] Generate an original ciphertext data block according to the original ciphertext;

[0031] Using a greedy algorithm to generate a dynamic ciphertext according to the original ciphertext data block;

[0032] The dynamic ciphertext includes some original ciphertext data blocks and spoofed ciphertext data blocks.

[0033] Preferably, the step of generating dynamic ciphertext according to the original ciphertext data block using a greedy algorithm comprises:

[0034] Calculate risk level;

[0035] If the risk level is 0, the data block index of the original file is returned;

[0036] Otherwise, check whether the dynamic file generated according to the risk level exists;

[0037] If the dynamic file exists, the corresponding dynamic file is returned;

[0038] Otherwise, a corresponding dynamic file data block index is generated according to the risk level and access attribute;

[0039] Generate a new dynamic file according to the dynamic file data block index and the original file data block index, and return it to the intrusion event;

[0040] Record the time when intrusion events access dynamic files and check them regularly;

[0041] If the access time interval exceeds a certain threshold, the corresponding dynamic file is released.

[0042] Preferably, otherwise generating a corresponding dynamic file data block index according to the risk level and the access attribute includes:

[0043] Generate deception data using a unified standard data format;

[0044] The real data blocks and spoofed data blocks of the file are stored;

[0045] The dynamic data file generated by setting a file to contain m real data blocks and k deceptive data blocks is:

[0046] When restricting the access rights of intrusion events to certain files, only partial contents of the files are allowed to be accessed. Intrusion events can only access the file contents contained in three real data blocks.

[0047] The intrusion event obtains a file containing real and deceptive data blocks, and obtains m real data blocks and multiple deceptive data blocks;

[0048] The intrusion event obtained a completely deceptive file and multiple deceptive data blocks.

[0049] A unified portal identity authentication system in a trusted innovation environment, comprising:

[0050] The detection module is used to detect whether an intrusion event occurs in the current working condition when the user inputs identity information;

[0051] A judgment module is used to judge the danger level of an intrusion event if there is one;

[0052] A data processing module, used for generating a deceptive ciphertext according to the risk level;

[0053] The data transmission module is used to send the deceptive ciphertext to the intruder end.

[0054] An electronic device includes: a chip, a processor and a memory, wherein the memory is used to store computer program code, and the computer program code includes computer instructions. When the chip executes the computer instructions, the electronic device executes a unified portal identity authentication method in a trusted innovation environment.

[0055] The beneficial effects of the present invention are as follows: 1. The present invention adopts an active and flexible defense strategy, which can reduce or even eliminate network security threats by deploying precise early warning, timely blocking and full repair measures before the attack behavior has an adverse impact on the system. The advantage of active defense is that it can take preventive measures and respond to potential network risks before the attack occurs, thereby reducing the occurrence of security incidents. 2. The present invention is based on basic cryptographic primitives such as commutative encryption, homomorphic encryption, and secret sharing to protect the privacy of users and distribute it to participants in the form of secret sharing. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0057] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0058] Figure 1 It is a flow chart of a unified portal identity authentication method in a trusted innovation environment of the present invention;

[0059] Figure 2 A schematic diagram of the process of generating a deceptive ciphertext according to a risk level of the present invention;

[0060] Figure 3 The figure is a schematic diagram of the hardware structure of an electronic device of the present invention. DETAILED DESCRIPTION

[0061] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0062] Considering the serious threat posed by intrusion events to data security and the increasing intelligence and complexity of attack methods, many data security studies currently focus on threat detection and attack blocking in the system and network aspects, but rarely touch on the data itself. Encryption-centric data security solutions limit the availability of data, which makes it difficult for data encryption technology to be applied on a large scale. The disadvantages of existing data security solutions can be summarized into the following two aspects. First, unknown threats (such as zero-day vulnerabilities, intrusion events) and persistent threats (such as distributed denial of service attacks, advanced persistent threat attacks) put defenders in a passive position. Second, deterministic data content, static data structure and single data access method provide a larger attack surface for network attacks. Given that encrypted data from intrusion events is difficult to crack, traditional passive defense strategies such as malware detection and data recovery are no longer sufficient, and active defense strategies are urgently needed.

[0063] The present invention adopts an active and flexible defense strategy, which can reduce or even eliminate network security threats by deploying precise early warning, timely blocking and full repair measures before the attack behavior has an adverse impact on the system. The advantage of active defense is that it can take preventive measures and respond to potential network risks before the attack occurs, thereby reducing the occurrence of security incidents. The present invention is based on basic cryptographic primitives such as commutative encryption, homomorphic encryption, and secret sharing to protect the privacy of users and distribute it to participants in the form of secret sharing.

[0064] Example 1

[0065] A unified portal identity authentication method in a trusted environment, reference Figure 1 , including the steps of:

[0066] Step S100, when the user inputs identity information, detecting whether an intrusion event occurs in the current working condition;

[0067] An intrusion incident refers to an unauthorized access or attack that threatens the data security of a computer system, network or database. These incidents usually involve malicious attackers using vulnerabilities, viruses, Trojans, phishing attacks and other means to illegally obtain, modify or destroy sensitive data, including personal information, financial information, trade secrets, etc. Data intrusion incidents may not only lead to the leakage of personal privacy, but also pose a serious threat to corporate and national security. In recent years, with the rapid development of network technology, data intrusion incidents have occurred frequently, involving more and more industries and fields. For example, in a cyber attack incident suffered by an enterprise, the intruder stole a large amount of high-value data through specific cyber attack methods, resulting in the leakage of user data. In order to deal with data intrusion incidents, enterprises and individuals need to take a series of security measures, including but not limited to strengthening network security awareness education, regularly updating and patching software vulnerabilities, using strong passwords and multi-factor authentication, etc.

[0068] Step S200, if there is an intrusion event, determine the danger level of the intrusion event;

[0069] The danger level of data intrusion incidents can be determined by the definition of intrusion detection incident levels. The definition of intrusion detection incident levels involves multiple aspects, including but not limited to network attacks, the use of malware, and the classification and grading of information security incidents. These definitions are intended to evaluate and classify different types of security threats so that corresponding prevention and response measures can be taken. Specifically, the definition of intrusion detection incident levels may include the following key points: Network attacks: This includes various malicious activities conducted through the network, such as phishing, exploiting configuration defects or security vulnerabilities in information systems, SQL injection attacks, implanted spyware, etc., which are used to illegally invade other people's systems to steal data. Use of malware: including computer viruses, worms, Trojan horse programs, botnets, etc. These malicious programs are designed to destroy system functions, destroy data, affect computer use, and may self-replicate and spread. Classification and grading of information security incidents: According to the nature, scope of impact and potential harm of the incident, information security incidents are divided into different levels so that corresponding response measures can be taken according to different levels. Through these definitions, the danger level of data intrusion incidents can be more accurately assessed, so that appropriate prevention and response measures can be taken to reduce potential security risks.

[0070] Step S300, generating a spoof ciphertext according to the risk level;

[0071] Data deception defense is another active defense method, which improves data security by misleading and confusing information and effectively interferes with attackers' actions. This method covers tools such as honeypots and baits, which open up a new path for intrusion event defense with low cost and easy deployment. By pre-deploying baits, early identification and early warning of intrusion event attacks can be achieved. Bait data can be used to hinder attackers from stealing identity information. Bait files are also often used to prevent intrusion event attacks. At present, the existing technology studies the use of bait files for detecting disguised attacks, and automatically distributes baits to increase the chance of detecting crimes committed by internal personnel of the organization. Or use honey pages to induce malicious behavior. However, the attack surface conversion frequency of the existing technology is low, resulting in a longer data exposure cycle and a lack of sufficient dynamics of the data, which provides attackers with ample opportunities to access and manipulate the data. In addition, the attack surface conversion also causes a certain degree of interference to the normal operation of the system and has a negative impact on performance.

[0072] Step S400, sending the spoofed ciphertext to the intruder end.

[0073] The embodiment of the present invention introduces the concept of active deception and establishes a dynamic file security model, dynamically generates deception files, confuses attackers to the maximum extent and increases their attack costs and difficulty. The present invention adopts different strategies to generate dynamic files for intrusion events of different risk levels, transforms files from two aspects: file attributes and content, increases the dynamicity and unpredictability of data, and prevents files from being damaged by intrusion events. The present invention can also use heuristic algorithms to deploy deception files in the file system, ensure the coverage of deception files, and dynamically add deception files based on the risk determination results of intrusion events, further improving the deception efficiency and trapping effect.

[0074] Preferably, step S300, referring to Figure 2 , generating deceptive ciphertexts according to the danger level includes:

[0075] Step S310, generating an original ciphertext data block according to the original ciphertext;

[0076] Information encryption technology is an effective means to ensure information security. It generates ciphertext by encrypting the plaintext (original information) to prevent unauthorized access and tampering. The encryption process usually involves applying some kind of disguise or transformation to the plaintext, making the ciphertext incomprehensible unless restored by a specific decryption algorithm and key. This encryption can be based on methods such as shift ciphers (by rearranging the order of elements in the plaintext) or substitution ciphers (one-to-one correspondence between the alphabet and itself, replacing each element in the plaintext with its corresponding element). The specific steps to generate ciphertext include: selecting a suitable encryption algorithm, such as AES, DES, etc., which provide different levels of security. Determine the encryption key, which is a necessary condition for the decryption process, and its length and complexity directly affect the strength of encryption. Encrypt the plaintext, which can be achieved through professional encryption software or encryption libraries of programming languages. The generated ciphertext can be sent to the recipient through a secure transmission method, and the recipient uses the corresponding decryption algorithm and key to restore it to plaintext.

[0077] Step S320, using a greedy algorithm to generate dynamic ciphertext according to the original ciphertext data block;

[0078] Dynamic data can dynamically change the form, encoding, and arrangement of files according to the risk level of the intrusion event, so that the file content seen by each intrusion event is different. For low-risk intrusion events, the file content may be similar to the original file; for intrusion events with a higher risk level, the file content will be greatly distorted, and deceptive information will be injected into it, which will increase the difficulty and cost of attackers to obtain and use data. In addition, the size of virtual files generated for different intrusion events is also very different, which will increase the cost of attackers to analyze and steal data. However, it should be noted that the system itself will minimize the impact on legitimate access to avoid distortion of the file content they see. Therefore, when adopting a dynamic data strategy, it is necessary to balance the overall security and ease of use of the system.

[0079] Step S330: The dynamic ciphertext includes a portion of the original ciphertext data blocks and the spoofed ciphertext data blocks.

[0080] Dynamic ciphertext means that at the file system level, not only can various information about files be obtained, but also information about processes and users accessing these files can be obtained, so that very powerful document security products can be developed. Specifically, some file systems themselves support dynamic encryption and decryption of files, such as the NTFS file system in Windows, which itself provides EFS support. However, as a general system, although it provides fine-grained control capabilities (such as being able to control each file), in actual applications, its encryption objects are generally based on partitions or directories, which makes it difficult to meet the personalized requirements of various users, such as automatically encrypting certain types of files. Despite these shortcomings, file systems that support dynamic encryption can, to some extent, provide security that rivals disk-level encryption technology.

[0081] Preferably, step S310, generating an original ciphertext data block according to the original ciphertext includes:

[0082] Step S311, suppose that the participant P A and P B The exchangeable encryption keys are k A and k B , the public and private key pairs of homomorphic encryption are (pkA, skA) and (pkB, skB) respectively;

[0083] Step S312: Participant P A and P B Each uses a commutative encryption algorithm to process the identity ID, then D A The i-th (i∈[nA]) ID is encrypted as [IDA,i]k A , D B The jth (j∈[nB]) ID in is encrypted as [IDB,j]k B .

[0084] Specifically, suppose there are two participants PA and PB, and their original data sets are DA = {(IDA,i,XA,i)}i∈[nA] and DB = {(IDB,j,XB,j)}j∈[nB], where IDA, IDB are the names of the two parties, XA, XB are the sets of identity features of the two parties, and the identity features can be iris features, fingerprint features, voiceprint features and other identity authentication features; nA, nB are the number of identity features of the two parties. Let the intersection of the sample IDs of the two parties be Int = IDA∩IDB.

[0085] Suppose the features corresponding to the IDs in the intersection are concatenated to be X′={x′m=(XA,i,XB,j)|IDA,i=IDB,j∈Int}. The goal of data alignment is to allow PA and PB to each obtain the secret sharing of X′ without destroying the privacy of the name ID and identity features, and both parties cannot obtain other relevant information about Int except the size of the intersection.

[0086] Preferably, the value coefficient of the stored identity information and the threat of the invaded virus are obtained;

[0087] The value coefficient of stored identity information and the threat of the invaded virus are expressed as vectors, and the factor weight vector W f and G f They are:

[0088] W f =[w1,w2];

[0089] G f =[G1,G2];

[0090] Among them, w i =[w i1 ,w i2 ],

[0091] G i =[G i1 ,G i2 ,],

[0092] The calculation formula for evaluating the risk level of intrusion events is expressed as:

[0093]

[0094] In an embodiment of the present invention,

[0095] The value coefficient of stored identity information and the threat of the invaded virus are used to evaluate the risk level of the intrusion incident. The factor weight indicates the influence of each factor on the risk level of the intrusion incident. The factor score indicates the specific evaluation result of each factor. The factor weight and score are assigned according to the knowledge and experience of experts.

[0096] Finally, the risk level is divided into 3 different levels, with level 1 representing no risk and level 3 representing the highest level of risk. If a legitimate user access accidentally triggers a risk alert, such as using a large number of files, the user can apply to the administrator for file access permissions and use a specific recovery method to obtain the real data. The attacker has no privileges and does not know the location of the deceptive file and the permission recovery process. The risk level assessment will also continuously optimize each indicator and weight based on the relevant false positive information to reduce the false positive rate.

[0097] The value coefficient of stored identity information is: Assuming that there are m hosts storing identity information in the local area network, and the security attribute values ​​of the assets of the i-th host are the secret index Ci and the validity index Ei, then the estimated value Gi(t) of the value coefficient of the stored identity information at time t is as follows:

[0098]

[0099] k is the attacker’s proficiency in knowledge, and k∈[0,1], Ni is the total number of vulnerabilities;

[0100] Preferably, the threat assessment of the invaded virus is expressed as:

[0101]

[0102] Among them, p k is the probability that the kth ciphertext is deciphered, β k is the probability that the kth ciphertext changes from a healthy state to an infected state, μ k is the probability that the kth ciphertext becomes immune after being infected, σ k is the probability that the kth ciphertext changes from an infected state to a healthy state, α k is the probability that the kth ciphertext changes from the immune state to the healthy state.

[0103] In the embodiment of the present invention, if the attack form of the intrusion event is mainly virus attack, then the basic characteristic of the rapid spread of network viruses poses a huge potential threat to network security, making the threat level an important indicator in the security threat situation assessment.

[0104] Preferably, step S320, using a greedy algorithm to generate a dynamic ciphertext according to the original ciphertext data block includes:

[0105] Step S321, calculating the risk level;

[0106] Step S322, if the risk level is 0, return the data block index of the original file;

[0107] Step S323, otherwise, query whether the dynamic file generated according to the risk level exists;

[0108] Step S324, if the dynamic file exists, then return the corresponding dynamic file;

[0109] Step S325, otherwise, generating a corresponding dynamic file data block index according to the risk level and access attribute;

[0110] Step S326, generating a new dynamic file according to the dynamic file data block index and the data block index of the original file, and returning it to the intrusion event;

[0111] Step S327, record the time when the intrusion event accesses the dynamic file and check it regularly;

[0112] Step S328: If the access time interval exceeds a certain threshold, the corresponding dynamic file is released.

[0113] Sparse file technology can be applied to create a dynamic file generation strategy. This technology allows the creation of sparse files that are logically the same size as the original file, but in fact only non-zero data blocks are stored on the disk, and blank data blocks do not occupy physical storage space. This method can use the space in the file system more efficiently. When the system needs to access the original file, it is replaced with a sparse file. This sparse file may contain the following contents: all real data, some real data, some real data and some deceptive data, and all deceptive data. Faced with the access request of ransomware, the system can generate a file of the corresponding form to respond to the ransomware according to the identified ransomware risk level. When modifying the file content to improve accessibility, the system will also update the file size and other related attributes displayed in the file system accordingly. The deception level in the dynamic file generation strategy is determined according to the risk level assessed by the ransomware risk identification component, and different levels of deception correspond to different file generation strategies.

[0114] Preferably, reference Figure 3 , step S325, otherwise generating a corresponding dynamic file data block index according to the risk level and the access attribute includes:

[0115] Generate deception data using a unified standard data format;

[0116] The real data blocks and spoofed data blocks of the file are stored;

[0117] The dynamic data file generated by setting a file to contain m real data blocks and k deceptive data blocks is:

[0118] When restricting the access rights of intrusion events to certain files, only partial contents of the files are allowed to be accessed. Intrusion events can only access the file contents contained in three real data blocks.

[0119] The intrusion event obtains a file containing real and deceptive data blocks, and obtains m real data blocks and multiple deceptive data blocks;

[0120] The intrusion event obtained a completely deceptive file and multiple deceptive data blocks.

[0121] Compared with creating multiple different data formats, it is easier to generate deceptive data using a unified standard data format. These deceptive data must be consistent with the environment or context, easy to attract intruders, and can be updated transparently. The system stores the real data blocks and deceptive data blocks of the file, making it impossible for intruders to directly determine whether the information obtained is the real ciphertext.

[0122] Example 2

[0123] A unified portal identity authentication system in a trusted innovation environment, comprising:

[0124] The detection module is used to detect whether an intrusion event occurs in the current working condition when the user inputs identity information;

[0125] A judgment module is used to judge the danger level of an intrusion event if there is one;

[0126] A data processing module, used for generating a deceptive ciphertext according to the danger level;

[0127] The data transmission module is used to send the deceptive ciphertext to the intruder.

[0128] Example 3

[0129] An electronic device includes: a chip, a processor and a memory, the memory is used to store computer program code, the computer program code includes computer instructions, and when the chip executes the computer instructions, the electronic device executes a unified portal identity authentication method in a trusted innovation environment.

[0130] refer to Figure 3 , the electronic device 2 includes a processor 21, a memory 22, an input device 23, and an output device 24. The processor 21, the memory 22, the input device 23, and the output device 24 are coupled via a connector, and the connector includes various interfaces, transmission lines, or buses, etc., which are not limited in the embodiments of the present invention. It should be understood that in various embodiments of the present invention, coupling refers to mutual connection in a specific manner, including direct connection or indirect connection through other devices, for example, through various interfaces, transmission lines, buses, etc.

[0131] The processor 21 may be one or more graphics processing units (GPUs). When the processor 21 is a GPU, the GPU may be a single-core GPU or a multi-core GPU. Optionally, the processor 21 may be a processor group consisting of multiple GPUs, and the multiple processors are coupled to each other via one or more buses. Optionally, the processor may also be other types of processors, etc., which are not limited in the embodiments of the present invention.

[0132] The memory 22 can be used to store computer program instructions and various computer program codes including program codes for executing the scheme of the present invention. Optionally, the memory includes but is not limited to random access memory (RAM), read-only memory (ROM), erasable programmable read only memory (EPROM), or portable read only memory (CD-ROM), which is used for related instructions and data.

[0133] The input device 23 is used to input data and / or signals, and the output device 24 is used to output data and / or signals. The output device 24 and the input device 23 may be independent devices or an integrated device.

[0134] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A unified portal identity authentication method in a trusted innovation environment, characterized in that: include: When the user enters identity information, detect whether an intrusion event occurs in the current working condition; If there is an intrusion event, determine the danger level of the intrusion event; generating a spoof ciphertext according to the risk level; The deceptive ciphertext is sent to the intruder end.

2. According to a unified portal identity authentication method in a trusted innovation environment according to claim 1, it is characterized in that: Generating the original ciphertext data block according to the original ciphertext comprises: Assume that the participant P A and P B The exchangeable encryption keys are k A and k B , the public and private key pairs of homomorphic encryption are (pkA, skA) and (pkB, skB) respectively; Participant P A and P B Each uses a commutative encryption algorithm to process the identity ID, then D A The i-th (i∈[nA]) ID is encrypted as [IDA,i]k A , D B The jth (j∈[nB]) ID in is encrypted as [IDB,j]k B .

3. According to a unified portal identity authentication method in a trusted innovation environment according to claim 1, it is characterized in that: The risk level of the intrusion event is determined as follows: Obtain the value coefficient of stored identity information and the threat of invaded viruses; The value coefficient of stored identity information and the threat of the invaded virus are expressed as vectors, and the factor weight vector W f and G f They are: IN f =[w1,w2]; G f =[G1,G2]; Among them, w i =[w i1 ,w i2 ], G i =[G i1 ,G i2 ,], The calculation formula for evaluating the risk level of intrusion events is expressed as:

4. According to a unified portal identity authentication method in a trusted innovation environment according to claim 3, it is characterized in that: The value coefficient of the stored identity information is: Assuming that there are m hosts storing identity information in the local area network, and the security attribute values ​​of the assets of the i-th host are the secret index Ci and the validity index Ei, then the estimated value of the value coefficient of the stored identity information at time t is G i1 as follows: k is the attacker's proficiency in knowledge, and k∈[0,1], Ni is the total number of vulnerabilities.

5. According to a unified portal identity authentication method in a trusted innovation environment as described in claim 3, it is characterized in that: The threat posed by the invaded virus is: Among them, p k is the probability that the kth ciphertext is deciphered, β k is the probability that the kth ciphertext changes from a healthy state to an infected state, μ k is the probability that the kth ciphertext becomes immune after being infected, σ k is the probability that the kth ciphertext changes from an infected state to a healthy state, α k is the probability that the kth ciphertext changes from the immune state to the healthy state.

6. According to a unified portal identity authentication method in a trusted innovation environment according to claim 1, it is characterized in that: The generating of the spoofed ciphertext according to the risk level comprises: Generate an original ciphertext data block according to the original ciphertext; Using a greedy algorithm to generate a dynamic ciphertext according to the original ciphertext data block; The dynamic ciphertext includes some original ciphertext data blocks and spoofed ciphertext data blocks.

7. According to the unified portal identity authentication method in a trusted innovation environment according to claim 6, it is characterized in that: The step of using a greedy algorithm to generate a dynamic ciphertext according to the original ciphertext data block includes: Calculate risk level; If the risk level is 0, the data block index of the original file is returned; Otherwise, check whether the dynamic file generated according to the risk level exists; If the dynamic file exists, the corresponding dynamic file is returned; Otherwise, a corresponding dynamic file data block index is generated according to the risk level and access attribute; Generate a new dynamic file according to the dynamic file data block index and the data block index of the original file, and return it to the intrusion event; Record the time when intrusion events access dynamic files and check them regularly; If the access time interval exceeds a certain threshold, the corresponding dynamic file is released.

8. According to a unified portal identity authentication method in a trusted innovation environment according to claim 7, it is characterized in that: Otherwise, generating a corresponding dynamic file data block index according to the risk level and the access attribute includes: Generate deception data using a unified standard data format; The real data blocks and spoofed data blocks of the file are stored; The dynamic data file generated by setting a file to contain m real data blocks and k deceptive data blocks is: When restricting the access rights of intrusion events to certain files, only partial contents of the files are allowed to be accessed. Intrusion events can only access the file contents contained in three real data blocks. The intrusion event obtains a file containing real and deceptive data blocks, and obtains m real data blocks and multiple deceptive data blocks; The intrusion event obtained a completely deceptive file and multiple deceptive data blocks.

9. A unified portal identity authentication system in a trusted innovation environment, characterized in that: include: The detection module is used to detect whether an intrusion event occurs in the current working condition when the user inputs identity information; A judgment module is used to judge the danger level of an intrusion event if there is one; A data processing module, used for generating a deceptive ciphertext according to the risk level; The data transmission module is used to send the deceptive ciphertext to the intruder end.

10. An electronic device, characterized in that: include: A chip, a processor and a memory, wherein the memory is used to store computer program code, and the computer program code includes computer instructions. When the chip executes the computer instructions, the electronic device executes a unified portal identity authentication method in an information and communication environment as described in any one of claims 1 to 8.

Images