Cloud domain authentication method, device, equipment, medium and program product

Abstract

The invention discloses a cloud domain authentication method, device and equipment, a medium and a program product, and relates to the technical field of cloud computing. The cloud domain authentication method comprises the following steps: acquiring multiple groups of current user behaviors of a user in a target cloud platform in an authentication time period; determining authentication scores of current sensitive behaviors and current non-sensitive behaviors in each group of current user behaviors, and constructing a current relation model of the current sensitive behaviors and the current non-sensitive behaviors of the user in the target cloud platform according to the authentication scores; acquiring an authentication parameter range associated with the user from a third-party database, and judging whether the current user behavior in the authentication time period is credible or not according to the parameters in the current relation model and the authentication parameter range; and under the condition that the current user behavior is not credible, refusing the access request of the user in the target cloud platform. According to the technical scheme of the embodiment of the invention, cloud domain authentication can be carried out based on user behaviors, and the security of an identity confirmation mechanism is ensured.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing technology, and in particular to a cloud domain authentication method, device, equipment, medium and program product. Background Art

[0002] A cloud service platform is a service platform that is based on cloud computing infrastructure and provides users with on-demand resources through the Internet. For example, a cloud service platform can provide users with computing, storage, network, and software resources.

[0003] In the cloud computing model, in order to make full use of the computing power of the cloud, data is often stored in the cloud, and applications and services are also stored in the cloud. Therefore, cloud computing security risks have attracted the attention of users, and terminals need to pass identity authentication to access cloud data.

[0004] Currently, in order to ensure the security of identity recognition mechanisms, key technology and biometrics are often used. Once an intruder enters the system as a legitimate user, the security of the system data cannot be guaranteed. Summary of the invention

[0005] The present invention provides a cloud domain authentication method, device, equipment, medium and program product to ensure the security of the identity confirmation mechanism.

[0006] According to one aspect of the present invention, a cloud domain authentication method is provided, comprising:

[0007] Obtain multiple groups of current user behaviors of users in the target cloud platform during the authentication period;

[0008] Determine the authentication scores of the current sensitive behaviors and the current non-sensitive behaviors in each group of current user behaviors, and construct a current relationship model of the current sensitive behaviors and the current non-sensitive behaviors of the user in the target cloud platform according to the authentication scores;

[0009] Obtaining a user-associated authentication parameter range from a third-party database, and determining whether the current user behavior within the authentication period is credible based on the parameters in the current relationship model and the authentication parameter range;

[0010] In the case that the current user behavior is not trustworthy, the user's access request in the target cloud platform is rejected.

[0011] According to another aspect of the present invention, there is provided a cloud domain authentication device, comprising:

[0012] A user behavior acquisition module is used to acquire multiple groups of current user behaviors of users in the target cloud platform during the authentication period;

[0013] A current model building module, used to determine the authentication scores of the current sensitive behaviors and the current non-sensitive behaviors in each group of current user behaviors, and to build a current relationship model of the current sensitive behaviors and the current non-sensitive behaviors of the user in the target cloud platform according to the authentication scores;

[0014] A behavior determination model, used to obtain the authentication parameter range associated with the user from a third-party database, and determine whether the current user behavior within the authentication period is credible according to the parameters in the current relationship model and the authentication parameter range;

[0015] The request rejection module is used to reject the user's access request in the target cloud platform when the current user behavior is not trustworthy.

[0016] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0017] at least one processor; and

[0018] a memory communicatively connected to the at least one processor; wherein,

[0019] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the cloud domain authentication method described in any embodiment of the present invention.

[0020] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the cloud domain authentication method described in any embodiment of the present invention when executed.

[0021] According to another aspect of the present invention, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the cloud domain authentication method of any embodiment of the present disclosure is implemented.

[0022] The technical solution of the embodiment of the present invention obtains multiple groups of current user behaviors of the user in the target cloud platform within the authentication period, determines the authentication scores of the current sensitive behaviors and the current non-sensitive behaviors in each group of current user behaviors, and constructs the current relationship model of the current sensitive behaviors and the current non-sensitive behaviors of the user in the target cloud platform based on the authentication scores, and then obtains the authentication parameter range associated with the user from a third-party database, and determines whether the current user behavior in the authentication period is credible based on the parameters in the current relationship model and the authentication parameter range. If the current user behavior is not credible, the user's access request in the target cloud platform is rejected. By adding a cloud domain authentication dimension based on user behavior, the security of the identity confirmation mechanism can be guaranteed.

[0023] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 is a flow chart of a cloud domain authentication method provided according to Embodiment 1 of the present invention;

[0026] Figure 2 is a flow chart of a cloud domain authentication method provided according to Embodiment 2 of the present invention;

[0027] Figure 3 is a schematic diagram of the structure of a cloud domain authentication device provided according to Embodiment 3 of the present invention;

[0028] Figure 4 It is a structural diagram of an electronic device that implements the cloud domain authentication method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0031] Embodiment 1

[0032] Figure 1 A flowchart of a cloud domain authentication method is provided for the first embodiment of the present invention. This embodiment is applicable to the case where cloud domain authentication is performed based on user behavior. The method can be executed by a cloud domain authentication device. The cloud domain authentication device can be implemented in the form of hardware and / or software. The cloud domain authentication device can be configured in various general computing devices, such as a user computer. Figure 1 As shown, the method includes:

[0033] S110, obtaining multiple groups of current user behaviors of the user in the target cloud platform during the authentication period.

[0034] In the prior art, cloud domain authentication based on user identity is often used, for example, using secret key technology or biometrics for cloud domain authentication. Once an intruder accesses the cloud platform as a legitimate user, data security cannot be guaranteed. In order to further improve the security of the identity authentication mechanism, after the user accesses the cloud platform with a legitimate identity or logs in to other cloud platforms to associate and access the current cloud platform, they need to perform identity authentication at various levels, which brings inconvenience to the user.

[0035] Based on the above problems, in order to provide convenience for users to use the cloud platform while ensuring the security of the identity authentication mechanism, an embodiment of the present invention provides a cloud domain authentication solution based on user behavior.

[0036] The authentication period is the initial period for users to access the target cloud platform. The credibility of user behavior is determined by collecting user behavior data during the authentication period. The authentication period can be flexibly set according to the actual use of the cloud platform, for example, set to 5 minutes.

[0037] User behavior includes sensitive behavior and non-sensitive behavior, among which non-sensitive behavior can include behavior status (for example, the user's activity status in a specific time period), behavior habits (for example, the user's use of a certain Internet platform), and behavior usage (for example, the functions used by the user when using a certain Internet platform); sensitive behavior includes behavior authentication (for example, changing the password) and behavior contracts (for example, the user's signing of service agreements, privacy terms, etc.).

[0038] In the embodiment of the present invention, starting from the user accessing the target cloud platform, multiple groups of current user behaviors of the user on the target cloud platform are collected during the authentication period. Specifically, the authentication period is divided into multiple unit collection periods, and a group of user behaviors is collected during each unit collection period. Each group of current user behaviors includes current sensitive behaviors and current non-sensitive behaviors.

[0039] In a specific example, the authentication period is 5 minutes. From the time the user accesses the target cloud platform, a set of current user behaviors is collected every minute, and a total of 5 sets of current user behaviors are collected during the authentication period. Each set of current user behaviors is divided into current sensitive behaviors and current non-sensitive behaviors.

[0040] Optionally, non-sensitive behavior includes at least one of behavior status, behavior habit, and behavior usage; sensitive behavior includes at least one of behavior authentication and behavior contract.

[0041] In this optional embodiment, non-sensitive behaviors include at least one of behavior status, behavior habits, and behavior usage; sensitive behaviors include at least one of behavior authentication and behavior contract. Among them, the behavior status includes the activity status of the user at a specific time point or a specific time period, for example, whether online or whether to access a specific Internet platform, etc.; behavior habits include the mode of user use of a certain Internet platform, such as browsing mode and consumption mode, etc.; behavior usage includes the specific behavior of the user using the Internet platform, such as function use or service experience, etc. Behavior authentication includes behaviors used to verify the identity of the user, such as modifying secret key behaviors, etc.; behavior contracts are behaviors of users signing service agreements or privacy terms. By dividing user behaviors into sensitive behaviors and non-sensitive behaviors, it is convenient to subsequently determine whether the user behavior is credible based on the relationship between sensitive behaviors and non-sensitive behaviors, thereby realizing cloud domain authentication of the user behavior dimension.

[0042] S120. Determine the authentication scores of the current sensitive behaviors and the current non-sensitive behaviors in each group of current user behaviors, and construct a current relationship model of the user's current sensitive behaviors and the current non-sensitive behaviors in the target cloud platform based on the authentication scores.

[0043] In the embodiment of the present invention, in order to establish the association relationship between the current sensitive behavior and the current non-sensitive behavior, the authentication scores of the current sensitive behavior and the current non-sensitive behavior in each group of current user behaviors are first calculated. Specifically, the authentication score of the current sensitive behavior can be obtained by weighted summing the behavior authentication score and the behavior contract score. The authentication score of the current non-sensitive behavior can be obtained by weighted summing the behavior state score, the behavior habit score, and the behavior usage score.

[0044] In a specific example, the behavior authentication score can be determined based on the difference between the time when the user currently visits a certain Internet platform and the time when the user habitually visits the Internet platform. The greater the time difference, the higher the behavior authentication score. The behavior habit score is determined based on the difference between the user's current usage mode of a certain Internet platform and the user's habitual usage mode. The greater the difference, the higher the behavior habit score. The behavior usage score is determined based on the difference between the functions used by the user on a certain Internet platform and the functions used by the user on the Internet platform. The greater the difference, the higher the behavior usage score.

[0045] Behavior authentication is determined based on the frequency of sensitive operations performed by users to change passwords. The higher the modification frequency, the higher the behavior authentication score. The behavior contract score is determined by the difference between the service agreement and privacy terms selected by the current user and the service agreement or privacy terms selected by the user in the past. The greater the difference, the higher the behavior contract score.

[0046] Furthermore, according to the authentication scores of multiple groups of current sensitive behaviors and current non-sensitive behaviors, a current relationship model of the user's current sensitive behaviors and current non-sensitive behaviors in the target cloud platform is constructed. Specifically, according to the authentication scores of multiple groups of current sensitive behaviors and current non-sensitive behaviors, a straight line or curve fitting is performed as the current relationship model of the user's current sensitive behaviors and current non-sensitive behaviors in the target cloud platform. For example, the authentication score P of the current non-sensitive behavior is the dependent variable, the authentication score D of the current sensitive behavior is the independent variable, and the fitting straight line D = aP + b.

[0047] S130: Obtain the authentication parameter range associated with the user from a third-party database, and determine whether the current user behavior within the authentication period is credible based on the parameters in the current relationship model and the authentication parameter range.

[0048] The authentication parameter range is used to determine whether the current user behavior is credible. The authentication parameter range includes multiple value ranges, each of which corresponds to a model parameter in the current relationship model.

[0049] In the embodiment of the present invention, the authentication parameter range associated with the user is obtained from the third-party database, and each model parameter in the current relationship model is compared with the corresponding parameter range in the authentication parameter range. If each model parameter is within the corresponding parameter range, it is determined that the current user behavior within the authentication period is credible, otherwise, it is determined that the current user behavior within the authentication period is not credible.

[0050] S140: If the current user behavior is not trustworthy, deny the user's access request in the target cloud platform.

[0051] In an embodiment of the present invention, if the current user behavior is credible, the user can continue to log in to the target cloud platform to access data; if the current user behavior is untrustworthy, the user's access request in the target cloud platform is rejected, thereby ensuring the security of cloud platform data in the user behavior dimension.

[0052] The technical solution of the embodiment of the present invention obtains multiple groups of current user behaviors of the user in the target cloud platform within the authentication period, determines the authentication scores of the current sensitive behaviors and the current non-sensitive behaviors in each group of current user behaviors, and constructs the current relationship model of the current sensitive behaviors and the current non-sensitive behaviors of the user in the target cloud platform based on the authentication scores, and then obtains the authentication parameter range associated with the user from a third-party database, and determines whether the current user behavior in the authentication period is credible based on the parameters in the current relationship model and the authentication parameter range. If the current user behavior is not credible, the user's access request in the target cloud platform is rejected. By adding a cloud domain authentication dimension based on user behavior, the security of the identity confirmation mechanism can be guaranteed.

[0053] Embodiment 2

[0054] Figure 2 This is a flow chart of a cloud domain authentication method provided in the second embodiment of the present invention. This embodiment further refines the above embodiment and provides specific steps for determining whether the current user behavior within the authentication period is credible based on the parameters in the current relationship model and the authentication parameter range, as well as specific steps before obtaining multiple groups of current user behaviors of the user in the target cloud platform within the authentication period. Figure 2 As shown, the method includes:

[0055] S210 , extracting one cloud platform from the cloud platforms associated with the user in turn as the current cloud platform, and obtaining multiple groups of historical user behaviors of the user in the current cloud platform within each unit statistical time.

[0056] When users actually use cloud platforms, they may use multiple different cloud platforms. Therefore, when performing cloud domain authentication based on user behavior, it is necessary to consider the user behavior on different cloud platforms.

[0057] In the embodiment of the present invention, a cloud platform is extracted from the cloud platforms associated with the user in turn as the current cloud platform. For the current cloud platform, multiple groups of historical user behaviors of the user in each unit statistical time need to be obtained. Among them, the historical user behavior includes historical sensitive behavior D and historical non-sensitive behavior P. Non-sensitive behavior P includes at least one of behavior state S, behavior habit H and behavior use C; sensitive behavior D includes at least one of behavior authentication T and behavior contract R.

[0058] In a specific example, the unit statistical time is defined as 1 day. For the current cloud platform, multiple groups of historical user behaviors on the current cloud platform are obtained every day, including the time period when the user visits a certain Internet platform, the user's browsing mode on the Internet platform, the functions used, the user's password change frequency, and the service agreement and privacy terms selected by the user.

[0059] S220: Calculate the authentication scores of historical sensitive behaviors and historical non-sensitive behaviors in each group of historical user behaviors.

[0060] In the embodiment of the present invention, for multiple groups of historical usage behaviors obtained within a unit statistical time, the authentication scores of historical sensitive behaviors and historical non-sensitive behaviors in each group of historical user behaviors are calculated. Specifically, the scores of the behavior authentication T and the behavior contract R in the historical sensitive behavior are calculated respectively, and then the weighted sum is used to obtain the authentication score of the historical sensitive behavior; the scores of the behavior state S, behavior habit H, and behavior usage C in the historical non-sensitive behavior are calculated respectively, and then the weighted sum is used to obtain the authentication score of the historical non-sensitive behavior. Among them, the weights of each item can be flexibly defined by the user according to the actual attention paid to each behavior.

[0061] In a specific example, the behavior authentication score can be determined based on the difference between the time when the user currently visits a certain Internet platform and the time when the user habitually visits the Internet platform, for example, it can be determined based on the product of the time difference and a set coefficient. The greater the time difference, the higher the behavior authentication score. The behavior habit score is determined based on the difference between the user's current mode of using a certain Internet platform and the user's habitual mode of use. For example, it is determined based on the difference in the user's browsing mode. The greater the difference, the higher the behavior habit score. The behavior usage score is determined based on the difference between the functions used by the user on a certain Internet platform and the functions used by the user on the Internet platform. The greater the difference, the higher the behavior usage score.

[0062] Behavior authentication is determined based on the frequency of sensitive operations performed by users to change passwords. The higher the modification frequency, the higher the behavior authentication score. The behavior contract score is determined by the difference between the service agreement and privacy terms selected by the current user and the service agreement or privacy terms selected by the user in the past. The greater the difference, the higher the behavior contract score.

[0063] S230. Build a historical relationship model of the user in the current cloud platform based on the authentication scores of multiple groups of historical sensitive behaviors and historical non-sensitive behaviors within each unit statistical time, and return to execute the operation of extracting one cloud platform from the cloud platforms associated with the user as the current cloud platform in turn until the traversal of the user's associated cloud platforms is completed; the historical relationship model has the same structure as the current relationship model.

[0064] In an embodiment of the present invention, a historical relationship model of the user in the current cloud platform is constructed based on the authentication scores of multiple groups of historical sensitive behaviors and historical non-sensitive behaviors within each unit statistical time. Specifically, a function of a fixed structure can be fitted based on the authentication scores of multiple groups of historical sensitive behaviors and historical non-sensitive behaviors within the unit statistical time. Exemplarily, the authentication score P of the previous non-sensitive behavior is the dependent variable, the authentication score D of the current sensitive behavior is the independent variable, and the fitting function is D=aP+b.

[0065] After fitting a fixed-structure straight line or curve to the authentication scores of multiple groups of historical sensitive behaviors and historical non-sensitive behaviors within multiple unit statistical times, multiple fixed-structure straight lines or curves are fitted into a straight line or curve with the same structure, and the fitted straight line or curve is used as a historical relationship model.

[0066] Further, the operation of extracting one cloud platform from the cloud platforms associated with the user as the current cloud platform is returned to be executed in turn, until the traversal of the cloud platforms associated with the user is completed, and the historical relationship model of the user in each associated cloud platform is obtained. Among them, the historical relationship model has the same structure as the current relationship model, for example, both are in the format of D=aP+b.

[0067] Optionally, a historical relationship model of the user in the current cloud platform is constructed based on the authentication scores of multiple groups of historical sensitive behaviors and historical non-sensitive behaviors within each unit statistical time, including:

[0068] According to the authentication scores of multiple groups of historical sensitive behaviors and historical non-sensitive behaviors in each unit statistical time, the local relationship model of the user in each unit statistical time in the current cloud platform is constructed respectively; the local relationship model in each unit statistical time has the same structure as the current relationship model;

[0069] The local relationship models within each unit statistical time are integrated to obtain the historical relationship model of the user in the current cloud platform.

[0070] In this optional embodiment, a specific method for constructing a historical relationship model of a user in the current cloud platform based on the authentication scores of multiple groups of historical sensitive behaviors and historical non-sensitive behaviors in each unit statistical time is provided: based on the authentication scores of multiple groups of historical sensitive behaviors and historical non-sensitive behaviors in each unit statistical time, a local relationship model of the user in each unit statistical time in the current cloud platform is constructed respectively. Specifically, based on the authentication scores of multiple groups of historical sensitive behaviors and historical non-sensitive behaviors in each unit statistical time, a function of a fixed structure is fitted, and multiple functions with the same function structure can be obtained as a local relationship model. Among them, the local relationship model in each unit statistical time has the same structure as the current relationship model, that is, the current relationship model is also in the format of D=aP+b.

[0071] Finally, the local relationship models in each unit statistical time are fused to obtain the historical relationship model of the user in the current cloud platform. Specifically, the parameters at the same position are extracted in each local relationship model, and the average is calculated, and the average is used as the parameter of the current position in the historical relationship model. For example, for multiple local relationship models in the format of D=aP+b, the average of a is calculated. and the mean of b Finally, we get the historical relationship model of users in the current cloud platform By fusing local relationship models within multiple unit statistical time periods to obtain a historical relationship model, a historical relationship model that accurately represents the current user's usage habits on the current cloud platform can be obtained.

[0072] S240. Determine the authentication parameter range associated with the user based on the historical relationship model of the user on each cloud platform, and store the authentication parameter range in a third-party database.

[0073] In an embodiment of the present invention, the authentication parameter range associated with the user is determined based on the historical relationship model of the user on each cloud platform. Specifically, the parameters of the same position can be extracted from the historical relationship models of multiple cloud platforms, and the maximum parameter value and the minimum parameter value of the position are used as the model parameter range of the position. Finally, the set of model parameter ranges of each position in the historical relationship model is used as the authentication parameter range and stored in a trusted third-party database. Subsequently, it can be quickly determined whether the user behavior is credible based on the authentication parameter range, thereby improving the security of the cloud domain authentication mechanism.

[0074] Optionally, based on the historical relationship model of the user on each cloud platform, determine the range of authentication parameters associated with the user, including:

[0075] Taking each parameter position of the historical relationship model as the current position in turn, and determining the model parameter range of the current position according to the model parameters of the current parameter position in each historical relationship model;

[0076] The set of model parameter ranges at each position in the historical relationship model is used as the authentication parameter range associated with the user.

[0077] In this optional embodiment, a specific method for determining the authentication parameter range associated with the user based on the historical relationship model of the user on each cloud platform is provided: each parameter position of the historical relationship model is taken as the current position in turn, and the model parameter range of the current position is determined based on the model parameters of the current parameter position in each historical relationship model. Specifically, in the model parameters of the current position in each historical relationship model, the maximum parameter value and the minimum parameter value are extracted to form the model parameter range of the current position. Finally, the set of model parameter ranges for each position in the historical relationship model is taken as the authentication parameter range associated with the user. Determining the model parameter range based on the historical relationship models of the user on multiple cloud platforms can accurately reflect the current user's normal behavioral habits in using the cloud platform, and reduce false alarms while confirming the security of cloud data.

[0078] S250. Acquire multiple groups of current user behaviors of the user in the target cloud platform during the authentication period; each group of current user behaviors includes current sensitive behaviors and current non-sensitive behaviors.

[0079] S260. Determine the authentication scores of the current sensitive behaviors and the current non-sensitive behaviors in each group of current user behaviors, and construct a current relationship model of the user's current sensitive behaviors and the current non-sensitive behaviors in the target cloud platform based on the authentication scores.

[0080] S270, obtaining the authentication parameter range associated with the user from the third-party database, extracting the model parameters of each position in the current relationship model, and comparing the model parameters of each position with the model parameter range of the corresponding position in the authentication parameter range.

[0081] In the embodiment of the present invention, after the current relationship model is constructed, the authentication parameter range associated with the user is obtained from the third-party database. Further, the model parameters of each position in the current relationship model are extracted, and the model parameters of each position are compared with the model parameter range of the corresponding position in the authentication parameter range to determine whether the current user behavior is credible.

[0082] S280: If the model parameter of at least one position in the current relationship model is not within the model parameter range of the corresponding position in the authentication parameter range, it is determined that the current user behavior is not credible.

[0083] In an embodiment of the present invention, if the model parameters of at least one position in the current relationship model are not within the model parameter range of the corresponding position in the authentication parameter range, the current user behavior is determined to be untrustworthy; conversely, if the model parameters of each position in the current relationship model are within the model parameter range of the corresponding position in the authentication parameter range, the current user behavior is determined to be credible. Through the above method, it is only necessary to collect user behaviors before users access the cloud platform, and establish the current relationship model of sensitive behaviors and non-sensitive behaviors in user behaviors, and then compare the model parameters with the model parameter range, so as to quickly determine whether the user behavior is credible, and improve the security of cloud platform use through cloud domain authentication based on user behavior under the premise of controllable computing volume.

[0084] S290. If the current user behavior is not trustworthy, deny the user's access request in the target cloud platform.

[0085] The technical solution of the embodiment of the present invention constructs a relationship model between sensitive behaviors and non-sensitive behaviors in user behaviors according to the user's historical behaviors on multiple cloud platforms in advance, and then obtains the model parameter range. In the subsequent authentication process, it is only necessary to collect user behaviors in the early stage of user access to the cloud platform, and establish a current relationship model between sensitive behaviors and non-sensitive behaviors in user behaviors, and then compare the model parameters with the model parameter range, so as to quickly determine whether the user behavior is credible, thereby improving the security of cloud platform use through cloud domain authentication based on user behavior under the premise of controllable computing power.

[0086] Embodiment 3

[0087] Figure 3 This is a schematic diagram of the structure of a cloud domain authentication device provided by Embodiment 3 of the present invention. Figure 3 As shown, the device comprises:

[0088] The user behavior acquisition module 310 is used to acquire multiple groups of current user behaviors of the user in the target cloud platform during the authentication period;

[0089] The current model building module 320 is used to determine the authentication scores of the current sensitive behaviors and the current non-sensitive behaviors in each group of current user behaviors, and to build a current relationship model of the current sensitive behaviors and the current non-sensitive behaviors of the user in the target cloud platform according to the authentication scores;

[0090] The behavior determination model 330 is used to obtain the authentication parameter range associated with the user from the third-party database, and determine whether the current user behavior within the authentication period is credible according to the parameters in the current relationship model and the authentication parameter range;

[0091] The request rejection module 340 is used to reject the user's access request in the target cloud platform when the current user behavior is not trustworthy.

[0092] The technical solution of the embodiment of the present invention obtains multiple groups of current user behaviors of the user in the target cloud platform within the authentication period, determines the authentication scores of the current sensitive behaviors and the current non-sensitive behaviors in each group of current user behaviors, and constructs the current relationship model of the current sensitive behaviors and the current non-sensitive behaviors of the user in the target cloud platform based on the authentication scores, and then obtains the authentication parameter range associated with the user from a third-party database, and determines whether the current user behavior in the authentication period is credible based on the parameters in the current relationship model and the authentication parameter range. If the current user behavior is not credible, the user's access request in the target cloud platform is rejected. By adding a cloud domain authentication dimension based on user behavior, the security of the identity confirmation mechanism can be guaranteed.

[0093] Optionally, the cloud domain authentication device further includes:

[0094] A historical behavior acquisition module is used to extract one cloud platform from the cloud platforms associated with the user as the current cloud platform before acquiring multiple sets of current user behaviors of the user in the target cloud platform during the authentication period, and to acquire multiple sets of historical user behaviors of the user in the current cloud platform during each unit statistical time;

[0095] An authentication score calculation module is used to calculate the authentication scores of historical sensitive behaviors and historical non-sensitive behaviors in each group of historical user behaviors;

[0096] A historical model building module is used to build a historical relationship model of the user in the current cloud platform according to the authentication scores of multiple groups of historical sensitive behaviors and historical non-sensitive behaviors within each unit statistical time, and return to execute the operation of extracting one cloud platform from the cloud platforms associated with the user as the current cloud platform in turn until the traversal of the cloud platforms associated with the user is completed; the historical relationship model has the same structure as the current relationship model;

[0097] The authentication parameter range determination module is used to determine the authentication parameter range associated with the user based on the historical relationship model of the user on each cloud platform, and store the authentication parameter range in a third-party database.

[0098] Optional, historical model building module, specifically for:

[0099] According to the authentication scores of multiple groups of historical sensitive behaviors and historical non-sensitive behaviors in each unit statistical time, a local relationship model of the user in each unit statistical time in the current cloud platform is constructed respectively; the local relationship model in each unit statistical time has the same structure as the current relationship model;

[0100] The local relationship models within each unit statistical time are integrated to obtain the historical relationship model of the user in the current cloud platform.

[0101] Optionally, the authentication parameter range determination module is specifically used to:

[0102] Taking each parameter position of the historical relationship model as the current position in turn, and determining the model parameter range of the current position according to the model parameters of the current parameter position in each historical relationship model;

[0103] The set of model parameter ranges at each position in the historical relationship model is used as the authentication parameter range associated with the user.

[0104] Optionally, the behavior determination model 330 is specifically used for:

[0105] Extracting model parameters of each position in the current relationship model, and comparing the model parameters of each position with the model parameter range of the corresponding position in the authentication parameter range;

[0106] If the model parameter of at least one position in the current relationship model is not within the model parameter range of the corresponding position in the authentication parameter range, it is determined that the current user behavior is not credible.

[0107] Optionally, the non-sensitive behavior includes at least one of behavior status, behavior habit and behavior usage; the sensitive behavior includes at least one of behavior authentication and behavior contract.

[0108] The cloud domain authentication device provided in the embodiment of the present invention can execute the cloud domain authentication method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0109] In the technical solution of the present invention, the collected information is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data comply with the relevant laws, regulations and standards of relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0110] Embodiment 4

[0111] According to an embodiment of the present invention, the present invention also provides an electronic device, a readable storage medium and a computer program product.

[0112] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, applicators, blade applicators, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0113] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0114] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0115] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the cloud domain authentication method.

[0116] In some embodiments, the cloud domain authentication method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the cloud domain authentication method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the cloud domain authentication method in any other appropriate manner (e.g., by means of firmware).

[0117] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0118] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or application.

[0119] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0120] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0121] The systems and techniques described herein may be implemented in a computing system that includes a backend component (e.g., as a data applier), or a computing system that includes a middleware component (e.g., an application applier), or a computing system that includes a frontend component (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0122] A computing system may include a client and an application server. The client and the application server are generally remote from each other and usually interact through a communication network. The relationship between the client and the application server is generated by computer programs running on corresponding computers and having a client-application server relationship with each other. The application server may be a cloud application server, also known as a cloud computing application server or a cloud host, which is a host product in a cloud computing application system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS applications.

[0123] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0124] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A cloud domain authentication method, characterized in that: include: Obtain multiple groups of current user behaviors of users in the target cloud platform during the authentication period; Determine the authentication scores of the current sensitive behaviors and the current non-sensitive behaviors in each group of current user behaviors, and construct a current relationship model of the current sensitive behaviors and the current non-sensitive behaviors of the user in the target cloud platform according to the authentication scores; Obtaining a user-associated authentication parameter range from a third-party database, and determining whether the current user behavior within the authentication period is credible based on the parameters in the current relationship model and the authentication parameter range; In the case that the current user behavior is not trustworthy, the user's access request in the target cloud platform is rejected.

2. The method according to claim 1, characterized in that Before obtaining multiple groups of current user behaviors of the user in the target cloud platform during the authentication period, it also includes: Extract one cloud platform from the cloud platforms associated with the user as the current cloud platform in turn, and obtain multiple groups of historical user behaviors of the user on the current cloud platform in each unit statistical time; Calculate the authentication scores of historical sensitive behaviors and historical non-sensitive behaviors in each group of historical user behaviors; According to the authentication scores of multiple groups of historical sensitive behaviors and historical non-sensitive behaviors within each unit statistical time, a historical relationship model of the user in the current cloud platform is constructed, and the operation of extracting one cloud platform from the cloud platforms associated with the user as the current cloud platform is returned to execute in sequence until the traversal of the cloud platforms associated with the user is completed; the historical relationship model has the same structure as the current relationship model; According to the historical relationship model of users on each cloud platform, the authentication parameter range associated with the user is determined, and the authentication parameter range is stored in a third-party database.

3. The method according to claim 2, characterized in that Based on the authentication scores of multiple groups of historical sensitive behaviors and historical non-sensitive behaviors within each unit statistical time, a historical relationship model of users in the current cloud platform is constructed, including: According to the authentication scores of multiple groups of historical sensitive behaviors and historical non-sensitive behaviors in each unit statistical time, a local relationship model of the user in each unit statistical time in the current cloud platform is constructed respectively; the local relationship model in each unit statistical time has the same structure as the current relationship model; The local relationship models within each unit statistical time are integrated to obtain the historical relationship model of the user in the current cloud platform.

4. The method according to claim 2, characterized in that: Based on the historical relationship model of users on each cloud platform, determine the range of authentication parameters associated with the user, including: Taking each parameter position of the historical relationship model as the current position in turn, and determining the model parameter range of the current position according to the model parameters of the current parameter position in each historical relationship model; The set of model parameter ranges at each position in the historical relationship model is used as the authentication parameter range associated with the user.

5. The method according to claim 1, characterized in that Determining whether the current user behavior within the authentication period is credible according to the parameters in the current relationship model and the authentication parameter range includes: Extracting model parameters of each position in the current relationship model, and comparing the model parameters of each position with the model parameter range of the corresponding position in the authentication parameter range; If the model parameter of at least one position in the current relationship model is not within the model parameter range of the corresponding position in the authentication parameter range, it is determined that the current user behavior is not credible.

6. The method according to any one of claims 1 to 5, characterized in that: The non-sensitive behavior includes at least one of behavior status, behavior habit and behavior use; the sensitive behavior includes at least one of behavior authentication and behavior contract.

7. A cloud domain authentication device, characterized in that: include: A user behavior acquisition module is used to acquire multiple groups of current user behaviors of users in the target cloud platform during the authentication period; A current model building module, used to determine the authentication scores of the current sensitive behaviors and the current non-sensitive behaviors in each group of current user behaviors, and to build a current relationship model of the current sensitive behaviors and the current non-sensitive behaviors of the user in the target cloud platform according to the authentication scores; A behavior determination model, used to obtain the authentication parameter range associated with the user from a third-party database, and determine whether the current user behavior within the authentication period is credible according to the parameters in the current relationship model and the authentication parameter range; The request rejection module is used to reject the user's access request in the target cloud platform when the current user behavior is not trustworthy.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the cloud domain authentication method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the cloud domain authentication method according to any one of claims 1 to 6 when executed.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the computer program implements the cloud domain authentication method according to any one of claims 1 to 6.

Images