Multilayer certificate verification method and system based on digital certificate

Abstract

The invention provides a multi-layer certificate verification method and system based on a digital certificate. The method comprises the following steps: carrying out first-layer verification on basic information of a certificate; if the first-layer verification is passed, carrying out second-layer verification on the sensitive information in the certificate; if the second-layer verification is passed, access is allowed, current user behaviors are analyzed in real time through a behavior analysis model so as to identify potential abnormal behaviors and modes thereof, the behavior analysis model takes Transform as a basic framework and is combined with a graph neural network so as to be used for capturing a global dependency relationship in a behavior sequence, and the potential abnormal behaviors and modes thereof can be identified; analyzing a local structure and a relation mode in the user behavior; if the abnormal behavior is recognized, the access permission is terminated or an alarm is triggered according to the abnormal behavior mode. According to the method, the user behaviors are analyzed in real time by adopting the behavior analysis model fusing Transform and the graph neural network so as to identify potential abnormal behaviors, and the potential access risk problem in a complex application scene can be well identified.

Description

Technical Field

[0001] The present invention relates to the technical field of digital certificate verification, and in particular to a multi-layer certificate verification method and system based on digital certificates. Background Art

[0002] As an important means of ensuring network security, digital certificates have been widely used in various fields. Especially in complex application scenarios such as enterprise-level security systems, financial institutions, cloud computing environments, the Internet of Things, and advanced persistent threat detection, the verification of digital certificates is particularly important.

[0003] In these complex application scenarios, user behaviors, device interactions, and network environments are highly complex and diverse. Traditional digital certificate verification methods mainly rely on checking basic certificate information (such as signature, validity period, issuer, etc.) and possible certificate chain verification. However, this traditional verification method often seems powerless in the face of complex attack methods and cannot effectively identify and prevent potential security threats. Summary of the invention

[0004] Based on this, the purpose of the present invention is to propose a multi-layer certificate verification method and system based on digital certificates to solve the above-mentioned problems.

[0005] A multi-layer certificate verification method based on digital certificates is proposed according to the present invention, the method comprising:

[0006] Perform the first level of verification on the basic information of the certificate;

[0007] If the first level of verification passes, the second level of verification is performed on the sensitive information in the certificate;

[0008] If the second-level verification passes, access is allowed, and the current user behavior is analyzed in real time through the behavior analysis model to identify potential abnormal behaviors and their patterns. The behavior analysis model uses Transformer as the basic architecture and combines graph neural networks to capture global dependencies in behavior sequences and analyze local structures and relationship patterns in user behaviors.

[0009] If abnormal behavior is identified, access rights are terminated or an alarm is triggered based on the abnormal behavior pattern.

[0010] Furthermore, the current user behavior is analyzed in real time through the behavior analysis model to identify potential abnormal behaviors and their patterns, including:

[0011] Collect user behavior data on the network platform in real time;

[0012] Preprocess behavioral data;

[0013] Extract key behavioral features from the preprocessed behavioral data, including the timestamp of the user's behavior, the type of behavior, the object of the behavior, the frequency of the behavior, the user's social relationships in the network, the geographic location, and the device usage habits;

[0014] Convert key behavioral features into behavioral sequences to reflect the user's behavioral trajectory;

[0015] The behavior sequence is deeply analyzed through the Transformer layer to capture the global dependencies across time steps and extract the global representation;

[0016] Analyze the local structure and association patterns in the behavior sequence through the graph neural network layer to deeply explore the complex relationships and interaction patterns between nodes and obtain node representations of all nodes;

[0017] The global representation and the node representation are organically integrated to integrate global context information and local details to extract comprehensive user behavior features;

[0018] The user's comprehensive behavior features are further processed through a fully connected layer, and the category of abnormal behavior patterns is output using a softmax function.

[0019] Furthermore, the behavior sequence is deeply analyzed through the Transformer layer to capture the global dependencies across time steps and extract a global representation, including:

[0020] Convert each behavior vector in the behavior sequence into a high-dimensional dense real number vector, setting it as an embedding vector;

[0021] In the Transformer layer, for each embedding vector in the behavior sequence, calculate the attention score between it and all other embedding vectors;

[0022] The output processed by the self-attention mechanism is passed through a feedforward neural network for further nonlinear transformation;

[0023] The encoder of the Transformer layer performs multi-level self-attention processing on the behavior sequence, extracts global context information, and outputs a global representation of the behavior sequence, which contains the global dependencies in the behavior sequence and the behavior characteristics of the user at different time steps.

[0024] Furthermore, the graph neural network layer is used to analyze the local structure and association patterns in the behavior sequence to deeply explore the complex relationships and interaction patterns between nodes and obtain node representations of all nodes, including:

[0025] defining each behavior or entity in the behavior sequence as a node in a graph, wherein the nodes include users, devices, applications, and web pages;

[0026] Define edges based on relationships between behaviors or entities;

[0027] Assign initial attributes to each node, including the type, characteristics and status of the node;

[0028] For each node in the graph, the graph neural network layer receives and aggregates information from all its neighboring nodes;

[0029] Update the representation of the current node based on the aggregated neighbor information;

[0030] Through multi-layer graph convolution operations, information from distant neighbors is gradually integrated to obtain the final embedded representation of the node, which includes the characteristics of the node itself, information of neighboring nodes, and structural information of the entire graph.

[0031] Furthermore, the user comprehensive behavior features are further processed by the fully connected layer, and the category of abnormal behavior pattern is output by using the softmax function, including:

[0032] Performing a linear transformation on the user's comprehensive behavior features through a fully connected layer to extract a feature combination that is sensitive to abnormal behavior patterns;

[0033] Apply the softmax function to perform exponential operation on the output of the fully connected layer and normalize it to obtain the probability distribution of each abnormal behavior pattern category;

[0034] Traverse the probability distribution and find the highest probability value and its corresponding category;

[0035] comparing the highest probability value to a preset threshold;

[0036] If the highest probability value exceeds the preset threshold and the corresponding category is marked as an abnormal behavior pattern, the user's behavior is determined to be abnormal, and the category with the highest probability is used as the predicted user abnormal behavior pattern category;

[0037] If the highest probability value does not exceed the preset threshold, or the category corresponding to the highest probability value is marked as normal behavior, the user's behavior is determined to be normal behavior.

[0038] Furthermore, the second level verification of the sensitive information in the certificate includes:

[0039] If there is only one verification participant, a public-private key pair is generated;

[0040] Define a verification function according to the verification requirements;

[0041] Write a smart contract that contains verification logic;

[0042] Extract sensitive information to be verified from digital certificates;

[0043] Use the public key to homomorphically encrypt the sensitive information to obtain the encrypted ciphertext of the sensitive information;

[0044] Use the private key and homomorphic encryption operations to decrypt or calculate the encrypted sensitive information ciphertext to execute the verification function and obtain the verification result;

[0045] The smart contract determines whether the sensitive information in the certificate meets the expected verification standards based on the verification results.

[0046] Furthermore, the second level verification of the sensitive information in the certificate also includes:

[0047] If there is more than one verification participant, generate a public-private key pair for each participant;

[0048] Each participant keeps their own private key, divides the private key into multiple shares, distributes each share to other participants or third parties, and discloses the public key to all other participants;

[0049] Define a verification function according to the verification requirements;

[0050] Write a smart contract that contains the verification logic and the reconstruction logic of secret sharing;

[0051] Extract sensitive information to be verified from digital certificates;

[0052] Use their respective public keys to homomorphically encrypt sensitive information to obtain encrypted sensitive information ciphertext, and send the encrypted sensitive information ciphertext to all other participants;

[0053] When verification is required, for other parties, the private key is rebuilt according to the reconstruction logic of secret sharing;

[0054] Using the reconstructed private key share and homomorphic encryption operations, partially decrypt or calculate the encrypted sensitive information ciphertext to perform part of the verification function;

[0055] After multiple rounds of partial calculations, in each round, different participants use their private key shares to perform partial calculations and pass the results to the participants of the next round, and finally obtain the verification results;

[0056] The final verification result is used by the smart contract to determine whether the sensitive information in the certificate meets the expected verification standards.

[0057] Furthermore, the first level verification of the basic information of the certificate includes:

[0058] Extract basic information from the digital certificate provided by the user, including the issuing authority, validity period, certificate serial number, holder information and digital signature of the digital certificate;

[0059] The issuing authority, validity period, certificate serial number, holder information and digital signature of the digital certificate are verified separately.

[0060] The present invention also proposes a multi-layer certificate verification system based on digital certificates, the system comprising:

[0061] The first verification module: used to perform the first level verification on the basic information of the certificate;

[0062] Second verification module: used to perform second-level verification on sensitive information in the certificate using homomorphic encryption if the first-level verification passes;

[0063] Behavior analysis module: used to allow access if the second-layer verification passes, and to analyze the current user behavior in real time through the behavior analysis model to identify potential abnormal behaviors and their patterns. The behavior analysis model uses Transformer as the basic architecture and combines graph neural networks to capture global dependencies in behavior sequences and analyze local structures and relationship patterns in user behaviors.

[0064] Decision-making module: used to terminate access rights or trigger an alarm based on abnormal behavior patterns if abnormal behavior is identified.

[0065] In summary, the multi-layer certificate verification method based on digital certificates of the present invention uses a behavioral analysis model that integrates Transformer and graph neural network to perform real-time analysis of user behavior to identify potential abnormal behaviors and their patterns, so as to identify potential access risk issues in complex application scenarios. Specifically, through the efficient sequence modeling capability of Transformer, the subtle changes and potential patterns in time series data such as user behavior and device interaction are accurately captured and analyzed; at the same time, the deep parsing ability of GNN for graph structure data is used to deeply analyze the complex association network and dependency relationships between nodes (such as users, devices and applications). The digital certificate verification method of the present invention achieves efficient identification and rapid response to potential security threats while ensuring data privacy and security, and also has adaptability and robustness to different application scenarios.

[0066] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description or will be learned through embodiments of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] The above and / or additional aspects and advantages of the present invention will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0068] Figure 1 This is a flowchart of a multi-layer certificate verification method based on digital certificates according to the first embodiment of the present invention;

[0069] Figure 2 This is a system block diagram of a multi-layer certificate verification system based on digital certificates according to the second embodiment of the present invention. DETAILED DESCRIPTION

[0070] In order to facilitate the understanding of the present invention, the present invention will be described more fully below with reference to the relevant drawings. Several embodiments of the present invention are given in the drawings. However, the present invention can be implemented in many different forms and is not limited to the embodiments described herein. On the contrary, the purpose of providing these embodiments is to make the disclosure of the present invention more thorough and comprehensive.

[0071] It should be noted that when an element is referred to as being "fixed to" another element, it may be directly on the other element or there may be a central element. When an element is considered to be "connected to" another element, it may be directly connected to the other element or there may be a central element at the same time. The terms "vertical", "horizontal", "left", "right" and similar expressions used herein are for illustrative purposes only.

[0072] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used herein in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The term "and / or" used herein includes any and all combinations of one or more related listed items.

[0073] Embodiment 1

[0074] See also Figure 1 The present invention proposes a multi-layer certificate verification method based on digital certificates, the method comprising steps S101 to S104:

[0075] S101, performing a first level verification on the basic information of the certificate.

[0076] It should be noted that the first level of verification of the basic information of the certificate is to quickly screen out certificates that are obviously non-compliant or invalid, and provide a basis for subsequent more in-depth verification. By verifying the basic information of the certificate, it can be ensured that the certificate meets the requirements of legality and validity on the surface, thereby avoiding communication with untrusted entities. In the first level of verification, the focus is on the basic information of the certificate, including but not limited to the issuing authority of the digital certificate, validity period, certificate serial number, holder information, and digital signature.

[0077] During the verification process, after receiving the certificate, the browser or client will first read the basic information in the certificate. This information is usually in plain text, which is convenient for quick reading and verification.

[0078] When verifying the issuing authority, the browser or client looks for an entry in the built-in trusted CA list that matches the issuer CA in the certificate. If a matching CA is found, verification succeeds; otherwise, verification fails.

[0079] When checking the validity period of a certificate, the browser or client obtains the current time and compares it with the validity period field in the certificate. If the current time is within the validity period, the verification succeeds; otherwise, the verification fails.

[0080] When verifying the certificate holder, the owner information in the certificate is compared with the expected owner. If the information is consistent, the verification passes, otherwise, the verification fails.

[0081] When verifying the certificate serial number, it is necessary to verify whether the certificate serial number is consistent with the serial number of the issuer's certificate. This is to prevent the certificate from being forged or tampered with. The specific operation usually involves checking whether the AuthorityKeyIdentifier extension Cert Serial Number (serial number of the issuing certificate) in the certificate matches the CertificateSerial Number (certificate serial number) in the CA certificate.

[0082] When verifying a digital signature, you can use the public key of the issuing authority (CA) to decrypt and verify the digital signature in the certificate. If the decryption is successful and the decrypted content is consistent with the certificate content, it means that the certificate has not been tampered with after issuance.

[0083] When performing the first level of verification, you should ensure that the browser or client you use is secure and reliable to avoid being tampered with or bypassing the verification process by malware.

[0084] S102: If the first level verification is passed, a second level verification is performed on the sensitive information in the certificate.

[0085] It should be noted that in a multi-layer verification system based on digital certificates, after the first layer of verification (preliminary verification of the basic information of the certificate such as the issuing authority, validity period, certificate subject, etc.) is passed, the second layer of verification of sensitive information in the certificate will be entered to further ensure the authenticity and integrity of the certificate, especially for those sensitive data involving security, privacy or high value.

[0086] First, the sensitive information that needs to be verified is accurately extracted from the certificate. This information may include but is not limited to the public key, private key, certificate extension fields, specific attributes, etc. Then the extracted sensitive information is encrypted and verified. Specifically, the characteristics of homomorphic encryption can be used to calculate or compare the encrypted sensitive information without decryption to verify its validity. The verification logic is embedded in the smart contract, the verification process is automatically executed through the smart contract, and the validity of the certificate is judged based on the verification results.

[0087] In the case of multiple verification parties, sensitive information can be divided into multiple parts through a secret sharing mechanism, and reconstructed through multi-party cooperation when necessary to ensure the security and reliability of verification. For example, in financial transactions involving multiple financial institutions or payment platforms, the certificates and sensitive information of both parties to the transaction (such as account balances, transaction records, etc.) need to be verified to ensure the legality and security of the transaction. In the case where sensitive data (such as census data, medical data, etc.) need to be shared between government departments for policy formulation and analysis, but personal privacy needs to be protected at the same time. In cross-enterprise cooperation projects, different companies need to exchange sensitive data for collaborative work, but are worried about the risk of data leakage.

[0088] The second layer of verification in the embodiment of the present invention, as a supplement and reinforcement to the first layer of verification, can further improve the overall security of the certificate and reduce potential security vulnerabilities. Performing a second layer of verification on sensitive information in the certificate can achieve in-depth verification and comprehensive protection of sensitive information, providing higher security for the use of the certificate. In some industries or scenarios, performing a second layer of verification on sensitive information in the certificate is a necessary condition to meet compliance requirements.

[0089] S103: If the second-level verification passes, access is allowed, and the current user behavior is analyzed in real time through the behavior analysis model to identify potential abnormal behaviors and their patterns. The behavior analysis model uses Transformer as the basic architecture and combines it with a graph neural network to capture the global dependencies in the behavior sequence and analyze the local structure and relationship patterns in the user behavior.

[0090] It should be noted that in the security mechanism based on the multi-level verification system of this embodiment, after the second-level verification is passed, artificial intelligence technology (Transformer combined with graph neural network) is used to perform real-time analysis of user behavior to further ensure the security of the system.

[0091] In complex application scenarios such as enterprise-level security systems, financial institutions, cloud computing environments, the Internet of Things, and advanced persistent threat detection, user behavior, device interaction, and network environment are highly complex and diverse. The first and second layers of preliminary verification are not enough to fully assess the authenticity of the user, and cannot effectively identify and prevent potential security threats in the face of complex attack methods. By analyzing user behavior in real time, any abnormal or suspicious activity patterns can be identified, so that timely decisions can be made to prevent unauthorized access or potential security threats.

[0092] The behavior analysis model is based on the Transformer architecture. Transformer is good at processing sequence data. It not only focuses on the current behavior data, but also combines the previous behavior data to capture the global dependencies in the behavior sequence, that is, the long-distance relationship between user behaviors. It is combined with the graph neural network. The graph neural network (GNN) is used to analyze the local structure and relationship patterns in user behavior. This means that the behavior analysis model not only focuses on the behavior sequence itself, but also focuses on the correlation and pattern between behaviors, such as the frequency and order of users accessing specific resources. The behavior analysis model monitors and analyzes user behavior in real time to ensure that any abnormal behavior can be discovered in a timely manner.

[0093] The Transformer captures global dependencies and the graph neural network analyzes local structures and relationship patterns. The combination of the two provides a comprehensive understanding of user behavior. Based on the learned behavior patterns, the system can identify abnormal behaviors and make access decisions based on the results of user behavior analysis.

[0094] For example, in an enterprise-level security system, the behavioral analysis model can collect employee Internet records, email communications, file access and other behavioral data to identify abnormal behavior patterns, such as unauthorized data access, malware propagation, etc. Once abnormal behavior is detected, the system can immediately trigger an alarm mechanism to notify the security team for further investigation and processing.

[0095] In financial institutions, by analyzing customers' transaction behaviors, fund flows and other behavioral data, behavioral analysis models can identify potential fraudulent behaviors, such as abnormally large transactions, frequent fund transfers, etc. These abnormal behaviors are often signs of fraudulent activities, and financial institutions can take timely measures, such as freezing accounts, contacting customers to confirm transactions, etc., to prevent potential losses.

[0096] In government service websites or apps, behavioral analysis models can monitor and analyze user behavior patterns in real time, such as access paths, dwell time, number of clicks, etc., to detect potential security threats, such as unauthorized access, malicious attacks, etc. Once abnormal behavior is detected, the system can immediately trigger an alarm mechanism and take corresponding security measures, such as blocking access and recording logs.

[0097] Through real-time behavioral analysis, the system can more accurately identify potential security threats, and the model can be updated as user behavior changes to maintain its effectiveness.

[0098] By combining Transformer and graph neural networks to analyze user behavior in real time, additional security is provided for the multi-layer verification system. By comprehensively capturing and analyzing the global and local characteristics of user behavior, the system can more accurately identify abnormal behavior and make timely and effective access decisions accordingly.

[0099] S104: If abnormal behavior is identified, the access permission is terminated or an alarm is triggered according to the abnormal behavior pattern.

[0100] It should be noted that if abnormal behavior is identified, decisions will be made quickly and measures will be taken based on the abnormal behavior pattern to minimize potential losses. For example, when abnormal behavior is determined to be a potential security threat or illegal operation, such as unauthorized access, data leakage attempts, malware activities, etc., the user's access rights will be terminated immediately, which may include logging off the session, blocking the IP address, etc., to prevent the continuation of abnormal behavior and protect system resources and data security. When abnormal behavior reaches or exceeds the preset threshold, or is considered a serious security incident, an alarm message will be sent, which may include a detailed description of the abnormal behavior, the time of occurrence, the users or devices involved, etc., through email, SMS, system logs, etc.

[0101] Based on steps S101 to S104, the present invention uses a behavioral analysis model that integrates Transformer and graph neural network to perform real-time analysis of user behavior to identify potential abnormal behaviors and their patterns, so as to be able to well identify potential access risk issues in complex application scenarios. Specifically, through the efficient sequence modeling capabilities of Transformer, the subtle changes and potential patterns in time series data such as user behavior and device interaction are accurately captured and analyzed; at the same time, the deep parsing ability of GNN for graph structure data is used to deeply analyze the complex association networks and dependencies between nodes (such as users, devices and applications). The digital certificate verification method of the present invention achieves efficient identification and rapid response to potential security threats while ensuring data privacy and security, and also has adaptability and robustness to different application scenarios.

[0102] The following is a further detailed introduction to a multi-layer certificate verification method based on a digital certificate according to an embodiment of the present invention:

[0103] Further optionally, in step S103, the current user behavior is analyzed in real time by the behavior analysis model to identify potential abnormal behaviors and patterns, including:

[0104] Collect user behavior data on the network platform in real time;

[0105] Preprocess behavioral data;

[0106] Extract key behavior features from preprocessed behavior data, including complex information such as user behavior timestamp, behavior type, behavior object, behavior frequency, user's social relationships in the network, geographic location, and device usage habits;

[0107] Convert key behavioral features into behavioral sequences to reflect the user's behavioral trajectory;

[0108] The behavior sequence is deeply analyzed through the Transformer layer to capture the global dependencies across time steps and extract the global representation;

[0109] Analyze the local structure and association patterns in the behavior sequence through the graph neural network layer to deeply explore the complex relationships and interaction patterns between nodes and obtain node representations of all nodes;

[0110] The global representation and the node representation are organically integrated to integrate global context information and local details to extract comprehensive user behavior features;

[0111] The user's comprehensive behavior features are further processed through a fully connected layer, and the category of abnormal behavior patterns is output using a softmax function.

[0112] Understandably, the user's behavior data on the network platform is collected in real time, and the behavior data is preprocessed, including data cleaning, data filling, data conversion, etc., to deal with data noise (such as invalid data, wrong data, etc.), missing values ​​(such as users not filling in certain information), heterogeneity (such as data format differences generated by different devices and applications). And extract key behavior features from the preprocessed data. The behavior feature types include timestamp, behavior type (such as click, purchase, comment, etc.), behavior object (such as goods, articles, users, etc.), behavior frequency (such as the number of behaviors in a certain period of time), social relationships (such as following, being followed, etc.), geographic location (such as the user's region), device usage habits (such as common device types, operating systems, etc.), etc.

[0113] The key behavior features within the preset time period are converted into a behavior sequence to organize the user's behavior data in chronological order to form a behavior trajectory. Each behavior can be represented as a vector, and these vectors are arranged in chronological order to form a behavior sequence. The behavior sequence is input into the Transformer layer, and the behavior sequence is deeply analyzed through the Transformer layer to capture the global dependencies across time steps, understand the overall behavior pattern of the user in the network environment, and output the global representation, that is, the overall behavior characteristics of the user in the entire behavior sequence. The local structure and association pattern in the behavior sequence are then carefully analyzed through the graph neural network layer, and the complex relationships and interaction patterns between nodes (such as between users and devices, applications, and other users) are deeply explored, and detailed node representations of all nodes are output, such as the specific characteristics and relationships of each user, device, application, etc. in the network.

[0114] The global representation and the node representation are then organically integrated. The global representation and the node representation can be integrated together by splicing, weighted summation, etc., to integrate global context information and local details, and extract the user's comprehensive behavior characteristics. The comprehensive behavior characteristics can comprehensively reflect the user's overall behavior patterns and local interaction relationships on the network platform.

[0115] The user's comprehensive behavior characteristics are further processed through the fully connected layer, and the category of abnormal behavior patterns is output using the softmax function to achieve accurate evaluation and classification of user behavior, especially in complex and changing network environments. The fully connected layer can perform nonlinear transformation and classification on the user's comprehensive behavior characteristics. The softmax function can convert the output into a probability distribution, representing the possibility of each abnormal behavior pattern, and output the category of abnormal behavior patterns, such as fraud, malicious attacks, etc.

[0116] Further optionally, the behavior sequence is deeply analyzed through the Transformer layer to capture the global dependencies across time steps and extract a global representation, including:

[0117] Convert each behavior vector in the behavior sequence into a high-dimensional dense real number vector, setting it as an embedding vector;

[0118] In the Transformer layer, for each embedding vector in the behavior sequence, the attention score between it and all other embedding vectors is calculated as follows:

[0119] Among them, Q, K, and V represent query, key, and value matrices, respectively. They are usually obtained by linear transformation of the input embedding vector. k is the dimension of the bond matrix;

[0120] The output processed by the self-attention mechanism is passed through a feedforward neural network for further nonlinear transformation;

[0121] The encoder of the Transformer layer performs multi-level self-attention processing on the behavior sequence, extracts global context information, and outputs a global representation of the behavior sequence, which contains the global dependencies in the behavior sequence and the behavior characteristics of the user at different time steps.

[0122] Understandably, the Transformer layer is used to deeply analyze the behavior sequence to capture the global dependencies across time steps and extract the global representation. First, each behavior vector in the behavior sequence is converted into a high-dimensional dense real vector, namely an embedding vector. This is because the original behavior vector may be sparse or low-dimensional and cannot fully represent the complexity of the behavior. By converting it to a high-dimensional dense vector, the associations and features between behaviors can be better captured. This conversion can be done using an embedding layer or a pre-trained embedding model (such as Word2Vec, BERT, etc.).

[0123] In the Transformer layer, for each embedding vector in the behavior sequence, the attention score between it and all other embedding vectors is calculated to capture the global dependencies between behaviors, that is, a behavior may be associated with multiple other behaviors in the sequence. The output processed by the self-attention mechanism is then passed through a feedforward neural network for further nonlinear transformation to increase the expressive power of the model and enable it to capture more complex features. A feedforward neural network can be constructed using a fully connected layer and an activation function.

[0124] In the Transformer layer, in order to alleviate the gradient vanishing and gradient exploding problems during deep network training, residual connections and layer normalization can be used to add the input embedding vector to the output of the self-attention mechanism and the feedforward neural network, and then normalize it to ensure that the network remains stable during training and accelerate convergence.

[0125] In order to capture more complex global dependencies, multiple Transformer layers can be stacked. Each layer receives the output of the previous layer as input and outputs a higher-level global representation. Multiple Transformer layers are connected in series to form a deep network. By extracting features layer by layer, higher-level global dependencies and behavioral features can be captured. The encoder of the Transformer layer performs multi-level self-attention processing on the behavior sequence, extracts global context information, and outputs a global representation of the behavior sequence. This global representation includes the global dependencies in the behavior sequence and the behavioral features of the user at different time steps.

[0126] Through the Transformer layer, the behavior sequence is deeply analyzed, which effectively captures the global dependencies across time steps and extracts a global representation containing rich information, which facilitates the understanding of user behavior and improves the accuracy of the system in detecting abnormal behavior.

[0127] Further optionally, the local structure and association pattern in the behavior sequence is analyzed by the graph neural network layer to deeply explore the complex relationship and interaction pattern between nodes and obtain node representations of all nodes, including:

[0128] Each behavior or entity in the behavior sequence is defined as a node in the graph. For example, a user, a device, an application, a web page, etc. can all be nodes.

[0129] Define edges based on relationships between behaviors or entities;

[0130] Assign initial attributes to each node, including the type, characteristics and status of the node;

[0131] For each node in the graph, the graph neural network layer receives and aggregates information from all its neighboring nodes;

[0132] Update the representation of the current node based on the aggregated neighbor information;

[0133] Through multi-layer graph convolution operations, information from more distant neighbors is gradually integrated to obtain the final embedded representation of the node, which includes the characteristics of the node itself, information of neighboring nodes, and structural information of the entire graph.

[0134] Understandably, the behavior sequence is analyzed by graph neural network (GNN) to deeply explore the complex relationships and interaction patterns between nodes (such as users, devices, applications, web pages, etc.) and obtain the representation of all nodes. First, each behavior or entity in the behavior sequence is defined as a node in the graph to ensure that all important elements (such as users, devices, applications, web pages, etc.) are included in the graph and serve as the basic unit for subsequent analysis. Edges are defined based on the relationship between behaviors or entities to determine the connection mode and information flow path between nodes. The definition of edges should be based on actual behavior logic, such as users visiting web pages, users using devices, etc. These relationships reflect the interaction and dependency between nodes. And each node is given initial attributes, including the type, characteristics and status of the node, etc. These attributes are the basic information of the node and provide the initial input data for the graph neural network.

[0135] The information of all neighboring nodes of each node is received and aggregated through the graph neural network layer to allow the node to obtain more extensive information through its neighbors. The aggregation method can adopt the graph convolution operation to update the representation of the current node by weighted averaging the information of neighboring nodes. This can be achieved through a neural network layer (such as a fully connected layer), which performs a nonlinear transformation on the aggregated information to generate a new node representation. The updated node representation not only contains the characteristics of the node itself, but also integrates the information of neighboring nodes, thereby more comprehensively reflecting the position and role of the node in the graph.

[0136] Through multi-layer graph convolution operations, information from more distant neighbors is gradually integrated. Each layer of graph convolution further expands the receptive field of the node, enabling it to capture a wider range of information. The final node embedding representation contains the characteristics of the node itself, the information of neighboring nodes, and the structural information of the entire graph.

[0137] Further optionally, the user comprehensive behavior features are further processed by a fully connected layer, and the category of abnormal behavior patterns is outputted by a softmax function, including:

[0138] Performing a linear transformation on the comprehensive behavior features of the user through a fully connected layer to extract a feature combination that is sensitive to abnormal behavior patterns;

[0139] Apply the softmax function to perform exponential operation on the output of the fully connected layer and normalize it to obtain the probability distribution of each abnormal behavior pattern category;

[0140] Traverse the probability distribution and find the highest probability value and its corresponding category;

[0141] comparing the highest probability value to a preset threshold;

[0142] If the highest probability value exceeds the preset threshold and the corresponding category is marked as an abnormal behavior pattern, the user's behavior is determined to be abnormal, and the category with the highest probability is used as the predicted user abnormal behavior pattern category;

[0143] If the highest probability value does not exceed the preset threshold, or the category corresponding to the highest probability value is marked as normal behavior, the user's behavior is determined to be normal behavior.

[0144] It can be understood that the user's comprehensive behavior characteristics are linearly transformed through the fully connected layer. The role of the fully connected layer (also called the dense layer) is to linearly combine the input features to extract feature combinations that are sensitive to abnormal behavior patterns. Specifically, the user's comprehensive behavior characteristics are matrix multiplied by the weights, and a bias term is added, which can be expressed as y=Wx+b, where W is the weight matrix, x is the user's comprehensive behavior characteristics, b is the bias term, and y is the output after linear transformation.

[0145] The softmax function is applied to the output of the fully connected layer to perform an exponential operation and normalize it to convert the output of the fully connected layer into a probability distribution so that the sum of the probabilities of all categories is 1. Specifically, the softmax function is applied to the output of the fully connected layer, that is, each element is exponentially operated, and the result is normalized so that the sum of all elements is equal to 1.

[0146] Traverse the probability distribution output by the softmax function, find the element with the largest probability value and its corresponding category to determine the category most likely to be predicted. And compare the highest probability value with a preset threshold, which can be determined based on experience or experiments to balance accuracy and recall, and to determine whether the highest probability value is high enough to be considered reliable.

[0147] If the highest probability value exceeds the preset threshold and the corresponding category is marked as an abnormal behavior pattern, the user's behavior is determined to be abnormal, and the category with the highest probability is used as the predicted user abnormal behavior pattern category.

[0148] If the highest probability value does not exceed the preset threshold, or the category corresponding to the highest probability value is marked as normal behavior, the user's behavior is determined to be normal behavior.

[0149] Further optionally, in step S101, the first level verification of the basic information of the certificate includes:

[0150] Extract basic information from the digital certificate provided by the user, including the issuing authority, validity period, certificate serial number, holder information, and digital signature of the digital certificate;

[0151] The issuing authority, validity period, certificate serial number, holder information and digital signature of the digital certificate are verified separately.

[0152] Further optionally, the performing a second layer of verification on the sensitive information in the certificate includes:

[0153] If there is only one verification participant, a public-private key pair is generated;

[0154] Define a verification function according to the verification requirements;

[0155] Write a smart contract that contains verification logic;

[0156] Extract sensitive information to be verified from digital certificates;

[0157] Use the public key to homomorphically encrypt the sensitive information to obtain the encrypted ciphertext of the sensitive information;

[0158] Use the private key and homomorphic encryption operations to decrypt or calculate the encrypted sensitive information ciphertext to execute the verification function and obtain the verification result;

[0159] The smart contract determines whether the sensitive information in the certificate meets the expected verification standards based on the verification results.

[0160] Understandably, in the case of only one verification participant, a pair of public and private keys is first generated using an encryption algorithm (such as RSA, ECC, etc.). The public key will be made public for subsequent encryption operations, while the private key is strictly confidential and is only used for decryption and specific calculations. At the same time, according to the specific needs of the verification, a verification function is written that will perform calculations based on the encrypted sensitive information to verify the validity of the certificate or check other specific attributes.

[0161] Next, write a smart contract, which is an automated script on the blockchain. The contract contains the verification logic and the conditions that trigger the verification, and can automatically execute the verification process when specific conditions are met. The introduction of smart contracts ensures the automation and transparency of the verification process.

[0162] Then, use the certificate parsing tool or library to extract the sensitive information to be verified from the digital certificate. In order to protect the security and privacy of this information, the sensitive information is homomorphically encrypted using the previously generated public key to obtain the encrypted sensitive information ciphertext. The characteristics of homomorphic encryption allow calculations to be performed on encrypted data without decrypting it first.

[0163] Subsequently, the encrypted sensitive information ciphertext is decrypted or directly calculated on the ciphertext using the private key and the computing characteristics of homomorphic encryption. The result of the decryption or calculation is used as the input of the verification function, and the verification function is executed to obtain the verification result. Finally, the verification result is used as the input of the smart contract to trigger the verification logic in the contract. The smart contract makes a judgment based on the verification result and the preset verification standard to determine whether the sensitive information in the certificate meets expectations. Based on the judgment result of the smart contract, the validity of the certificate is determined, and this conclusion is recorded on the blockchain for subsequent query and use.

[0164] Further optionally, in step S102, the performing a second layer of verification on the sensitive information in the certificate further includes:

[0165] If there is more than one verification participant, generate a public-private key pair for each participant;

[0166] Each participant keeps their own private key, divides the private key into multiple shares, distributes each share to other participants or third parties, and discloses the public key to all other participants;

[0167] Define a verification function according to the verification requirements;

[0168] Write a smart contract that contains the verification logic and the reconstruction logic of secret sharing;

[0169] Extract sensitive information to be verified from digital certificates;

[0170] Use their respective public keys to homomorphically encrypt sensitive information to obtain encrypted sensitive information ciphertext, and send the encrypted sensitive information ciphertext to all other participants;

[0171] When verification is required, for other parties, the private key is rebuilt according to the reconstruction logic of secret sharing;

[0172] Using the reconstructed private key share and homomorphic encryption operations, partially decrypt or calculate the encrypted sensitive information ciphertext to perform part of the verification function;

[0173] After multiple rounds of partial calculations, in each round, different participants use their private key shares to perform partial calculations and pass the results to the participants of the next round, and finally obtain the verification results;

[0174] The final verification result is used by the smart contract to determine whether the sensitive information in the certificate meets the expected verification standards.

[0175] Understandably, in the case of multiple verification participants, first generate an independent public-private key pair for each participant and ensure the safekeeping of the private key. To enhance security, the private key is split into multiple shares and these shares are securely distributed to other participants or trusted third parties, while the public key is made public for subsequent encryption operations. In addition, according to the verification requirements, a verification function is defined, which will be calculated based on the encrypted sensitive information to verify the validity or other specific attributes of the certificate. At the same time, a smart contract is written on the blockchain, which contains the verification logic, the reconstruction logic of the secret sharing, and the conditions that trigger the verification and reconstruction.

[0176] After extracting the sensitive information that needs to be verified from the digital certificate, each participant uses its own public key to homomorphically encrypt the sensitive information to obtain the encrypted sensitive information ciphertext. Subsequently, each participant sends the encrypted sensitive information ciphertext to all other participants to ensure that each participant can calculate the encrypted sensitive information.

[0177] When verification is required, the participants cooperate to reconstruct the private key share or a specific part of the private key according to the reconstruction logic of secret sharing, without fully recovering the entire private key. Through multiple rounds of partial calculations, each participant uses its own reconstructed private key share and the computing characteristics of homomorphic encryption to partially decrypt or calculate the encrypted sensitive information ciphertext to obtain a partial result of the verification function. These partial results are passed to the participants of the next round in each round, and after gradual aggregation, the verification result is finally obtained.

[0178] The final verification result is input into the smart contract, which automatically determines the validity of the certificate based on the preset verification criteria. The verification result can be published to all parties or only to specific authorized parties as needed. If the verification passes, the certificate is considered valid; if the verification fails, the certificate is invalid. This conclusion is recorded on the blockchain for subsequent query and use.

[0179] Embodiment 2

[0180] See also Figure 2 The present invention proposes a multi-layer certificate verification system based on digital certificates, the system comprising:

[0181] The first verification module: used to perform the first level verification on the basic information of the certificate;

[0182] Second verification module: used to perform second-level verification on sensitive information in the certificate using homomorphic encryption if the first-level verification passes;

[0183] Behavior analysis module: used to allow access if the second-layer verification passes, and to analyze the current user behavior in real time through the behavior analysis model to identify potential abnormal behaviors and their patterns. The behavior analysis model uses Transformer as the basic architecture and combines graph neural networks to capture global dependencies in behavior sequences and analyze local structures and relationship patterns in user behaviors.

[0184] Decision-making module: used to terminate access rights or trigger an alarm based on abnormal behavior patterns if abnormal behavior is identified.

[0185] Further optionally, the behavior analysis module is also used for:

[0186] Collect user behavior data on the network platform in real time;

[0187] Preprocess behavioral data;

[0188] Extract key behavioral features from the preprocessed behavioral data, including the timestamp of the user's behavior, the type of behavior, the object of the behavior, the frequency of the behavior, the user's social relationships in the network, the geographic location, and the device usage habits;

[0189] Convert key behavioral features into behavioral sequences to reflect the user's behavioral trajectory;

[0190] The behavior sequence is deeply analyzed through the Transformer layer to capture the global dependencies across time steps and extract the global representation;

[0191] Analyze the local structure and association patterns in the behavior sequence through the graph neural network layer to deeply explore the complex relationships and interaction patterns between nodes and obtain node representations of all nodes;

[0192] The global representation and the node representation are organically integrated to integrate global context information and local details to extract comprehensive user behavior features;

[0193] The user's comprehensive behavior features are further processed through a fully connected layer, and the category of abnormal behavior patterns is output using a softmax function.

[0194] Further optionally, the behavior analysis module is also used for:

[0195] Convert each behavior vector in the behavior sequence into a high-dimensional dense real number vector, setting it as an embedding vector;

[0196] In the Transformer layer, for each embedding vector in the behavior sequence, calculate the attention score between it and all other embedding vectors;

[0197] The output processed by the self-attention mechanism is passed through a feedforward neural network for further nonlinear transformation;

[0198] The encoder of the Transformer layer performs multi-level self-attention processing on the behavior sequence, extracts global context information, and outputs a global representation of the behavior sequence, which contains the global dependencies in the behavior sequence and the behavior characteristics of the user at different time steps.

[0199] Further optionally, the behavior analysis module is also used for:

[0200] defining each behavior or entity in the behavior sequence as a node in a graph, wherein the nodes include users, devices, applications, and web pages;

[0201] Define edges based on relationships between behaviors or entities;

[0202] Assign initial attributes to each node, including the type, characteristics and status of the node;

[0203] For each node in the graph, the graph neural network layer receives and aggregates information from all its neighboring nodes;

[0204] Update the representation of the current node based on the aggregated neighbor information;

[0205] Through multi-layer graph convolution operations, information from distant neighbors is gradually integrated to obtain the final embedded representation of the node, which includes the characteristics of the node itself, information of neighboring nodes, and structural information of the entire graph.

[0206] Further optionally, the behavior analysis module is also used for:

[0207] Performing a linear transformation on the comprehensive behavior features of the user through a fully connected layer to extract a feature combination that is sensitive to abnormal behavior patterns;

[0208] Apply the softmax function to perform exponential operation on the output of the fully connected layer and normalize it to obtain the probability distribution of each abnormal behavior pattern category;

[0209] Traverse the probability distribution and find the highest probability value and its corresponding category;

[0210] comparing the highest probability value to a preset threshold;

[0211] If the highest probability value exceeds the preset threshold and the corresponding category is marked as an abnormal behavior pattern, the user's behavior is determined to be abnormal, and the category with the highest probability is used as the predicted user abnormal behavior pattern category;

[0212] If the highest probability value does not exceed the preset threshold, or the category corresponding to the highest probability value is marked as normal behavior, the user's behavior is determined to be normal behavior.

[0213] Further optionally, the second verification module is further used for:

[0214] If there is only one verification participant, a public-private key pair is generated;

[0215] Define a verification function according to the verification requirements;

[0216] Write a smart contract that contains verification logic;

[0217] Extract sensitive information to be verified from digital certificates;

[0218] Use the public key to homomorphically encrypt the sensitive information to obtain the encrypted ciphertext of the sensitive information;

[0219] Use the private key and homomorphic encryption operations to decrypt or calculate the encrypted sensitive information ciphertext to execute the verification function and obtain the verification result;

[0220] Through smart contracts, it is determined whether the sensitive information in the certificate meets the expected verification standards based on the verification results;

[0221] If the verification passes, the certificate is considered valid; otherwise, the certificate is invalid.

[0222] Further optionally, the second verification module is further used for:

[0223] If there is more than one verification participant, generate a public-private key pair for each participant;

[0224] Each participant keeps their own private key, divides the private key into multiple shares, distributes each share to other participants or third parties, and discloses the public key to all other participants;

[0225] Define a verification function according to the verification requirements;

[0226] Write a smart contract that contains the verification logic and the reconstruction logic of secret sharing;

[0227] Extract sensitive information to be verified from digital certificates;

[0228] Use their respective public keys to homomorphically encrypt sensitive information to obtain encrypted sensitive information ciphertext, and send the encrypted sensitive information ciphertext to all other participants;

[0229] When verification is required, for other parties, the private key is rebuilt according to the reconstruction logic of secret sharing;

[0230] Using the reconstructed private key share and homomorphic encryption operations, partially decrypt or calculate the encrypted sensitive information ciphertext to perform part of the verification function;

[0231] After multiple rounds of partial calculations, in each round, different participants use their private key shares to perform partial calculations and pass the results to the participants of the next round, and finally obtain the verification results;

[0232] Through smart contracts, the final verification results are used to determine whether the sensitive information in the certificate meets the expected verification standards;

[0233] If the verification passes, the certificate is considered valid; otherwise, the certificate is invalid.

[0234] Further optionally, the first verification module is further used for:

[0235] Extract basic information from the digital certificate provided by the user, including the issuing authority, validity period, certificate serial number, holder information and digital signature of the digital certificate;

[0236] The issuing authority, validity period, certificate serial number, holder information and digital signature of the digital certificate are verified separately.

[0237] The above-mentioned embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the patent of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A multi-layer certificate verification method based on digital certificates, characterized in that: The method comprises: Perform the first level of verification on the basic information of the certificate; If the first level of verification passes, the second level of verification is performed on the sensitive information in the certificate; If the second-level verification passes, access is allowed, and the current user behavior is analyzed in real time through the behavior analysis model to identify potential abnormal behaviors and their patterns. The behavior analysis model uses Transformer as the basic architecture and combines graph neural networks to capture global dependencies in behavior sequences and analyze local structures and relationship patterns in user behaviors. If abnormal behavior is identified, access rights are terminated or an alarm is triggered based on the abnormal behavior pattern.

2. The multi-layer certificate verification method based on digital certificates according to claim 1, characterized in that: The current user behavior is analyzed in real time through the behavior analysis model to identify potential abnormal behaviors and their patterns, including: Collect user behavior data on the network platform in real time; Preprocess the behavior data; extract key behavior features from the preprocessed behavior data, including the timestamp of the user's behavior, the behavior type, the behavior object, the behavior frequency, the user's social relationships in the network, the geographic location, and the device usage habits; Convert key behavioral features into behavioral sequences to reflect the user's behavioral trajectory; The behavior sequence is deeply analyzed through the Transformer layer to capture the global dependencies across time steps and extract the global representation; Analyze the local structure and association patterns in the behavior sequence through the graph neural network layer to deeply explore the complex relationships and interaction patterns between nodes and obtain node representations of all nodes; The global representation and the node representation are organically integrated to integrate global context information and local details to extract comprehensive user behavior features; The user's comprehensive behavior features are further processed through a fully connected layer, and the category of abnormal behavior patterns is output using a softmax function.

3. The multi-layer certificate verification method based on digital certificates according to claim 2, characterized in that: The Transformer layer performs a deep analysis on the behavior sequence, captures the global dependencies across time steps, and extracts a global representation, including: Convert each behavior vector in the behavior sequence into a high-dimensional dense real number vector, setting it as an embedding vector; In the Transformer layer, for each embedding vector in the behavior sequence, calculate the attention score between it and all other embedding vectors; The output processed by the self-attention mechanism is passed through a feedforward neural network for further nonlinear transformation; The encoder of the Transformer layer performs multi-level self-attention processing on the behavior sequence, extracts global context information, and outputs a global representation of the behavior sequence, which contains the global dependencies in the behavior sequence and the behavior characteristics of the user at different time steps.

4. The multi-layer certificate verification method based on digital certificates according to claim 2, characterized in that: The local structure and association patterns in the behavior sequence are analyzed through the graph neural network layer to deeply explore the complex relationships and interaction patterns between nodes and obtain node representations of all nodes, including: defining each behavior or entity in the behavior sequence as a node in a graph, wherein the nodes include users, devices, applications, and web pages; Define edges based on relationships between behaviors or entities; Assign initial attributes to each node, including the type, characteristics and status of the node; For each node in the graph, the graph neural network layer receives and aggregates information from all its neighboring nodes; Update the representation of the current node based on the aggregated neighbor information; Through multi-layer graph convolution operations, information from distant neighbors is gradually integrated to obtain the final embedded representation of the node, which includes the characteristics of the node itself, information of neighboring nodes, and structural information of the entire graph.

5. The multi-layer certificate verification method based on digital certificates according to claim 2, characterized in that: The user comprehensive behavior features are further processed by the fully connected layer, and the category of abnormal behavior pattern is output by using the softmax function, including: Performing a linear transformation on the comprehensive behavior features of the user through a fully connected layer to extract a feature combination that is sensitive to abnormal behavior patterns; Apply the softmax function to perform exponential operation on the output of the fully connected layer and normalize it to obtain the probability distribution of each abnormal behavior pattern category; Traverse the probability distribution and find the highest probability value and its corresponding category; comparing the highest probability value to a preset threshold; If the highest probability value exceeds the preset threshold and the corresponding category is marked as an abnormal behavior pattern, the user's behavior is determined to be abnormal, and the category with the highest probability is used as the predicted user abnormal behavior pattern category; If the highest probability value does not exceed the preset threshold, or the category corresponding to the highest probability value is marked as normal behavior, the user's behavior is determined to be normal behavior.

6. The multi-layer certificate verification method based on digital certificates according to claim 1, characterized in that: The second level verification of the sensitive information in the certificate includes: If there is only one verification participant, a public-private key pair is generated; Define a verification function according to the verification requirements; Write a smart contract that contains verification logic; Extract sensitive information to be verified from digital certificates; Use the public key to homomorphically encrypt the sensitive information to obtain the encrypted ciphertext of the sensitive information; Use the private key and homomorphic encryption operations to decrypt or calculate the encrypted sensitive information ciphertext to execute the verification function and obtain the verification result; The smart contract determines whether the sensitive information in the certificate meets the expected verification standards based on the verification results.

7. The multi-layer certificate verification method based on digital certificates according to claim 1, characterized in that: The second level verification of the sensitive information in the certificate also includes: If there is more than one verification participant, generate a public-private key pair for each participant; Each participant keeps their own private key, divides the private key into multiple shares, distributes each share to other participants or third parties, and discloses the public key to all other participants; Define a verification function according to the verification requirements; Write a smart contract that contains the verification logic and the reconstruction logic of secret sharing; Extract sensitive information to be verified from digital certificates; Use their respective public keys to homomorphically encrypt sensitive information to obtain encrypted sensitive information ciphertext, and send the encrypted sensitive information ciphertext to all other participants; When verification is required, for other parties, the private key is rebuilt according to the reconstruction logic of secret sharing; Using the reconstructed private key share and homomorphic encryption operations, partially decrypt or calculate the encrypted sensitive information ciphertext to perform part of the verification function; After multiple rounds of partial calculations, in each round, different participants use their private key shares to perform partial calculations and pass the results to the participants of the next round, and finally obtain the verification results; The final verification result is used by the smart contract to determine whether the sensitive information in the certificate meets the expected verification standards.

8. The multi-layer certificate verification method based on digital certificates according to claim 1, characterized in that: The first level of verification of the basic information of the certificate includes: Extract basic information from the digital certificate provided by the user, including the issuing authority, validity period, certificate serial number, holder information and digital signature of the digital certificate; The issuing authority, validity period, certificate serial number, holder information and digital signature of the digital certificate are verified separately.

9. A multi-layer certificate verification system based on digital certificates, characterized in that: The system comprises: The first verification module: used to perform the first level verification on the basic information of the certificate; Second verification module: used to perform second-level verification on sensitive information in the certificate using homomorphic encryption if the first-level verification passes; Behavior analysis module: used to allow access if the second-layer verification passes, and to analyze the current user behavior in real time through the behavior analysis model to identify potential abnormal behaviors and their patterns. The behavior analysis model uses Transformer as the basic architecture and combines graph neural networks to capture global dependencies in behavior sequences and analyze local structures and relationship patterns in user behaviors. Decision-making module: used to terminate access rights or trigger an alarm based on abnormal behavior patterns if abnormal behavior is identified.

Images