A Trust Assessment Method Based on Log-Odds Regression Model

Abstract

The application discloses a trust evaluation method based on a logarithmic probability regression model, and in a FIDO (Fast Identity Online) application scenario, multi-dimensional data of a target user based on a first factor for service authentication is acquired; feature variables corresponding to the multi-dimensional data are determined; wherein the multi-dimensional data at least includes one of authenticator identification, relying party service identification, relying party user identification, user role identification, and UAF (Universal Authentication Framework) authentication response message identification; the feature variables corresponding to the multi-dimensional data are input into a pre-trained logarithmic probability regression model, a target trust score is determined based on the logarithmic probability regression model; and a multi-factor authentication decision result is determined according to the target trust score. A technical scheme of dynamic trust evaluation and further guiding security authentication in the process of user continuous access to Internet resources in the FIDO application scenario is realized.

Description

Technical Field

[0001] This application relates to the fields of network technology and security technology, and in particular to a trust assessment method based on a log-odds regression model. Background Technology

[0002] In the fields of network and security technology, traditional username / password authentication stores user secrets on the server side for comparison. If the server is compromised, all user secrets will be leaked. MFA (Multi-Factor Authentication) requires users to pass two or more authentication factors before being authorized to use internet resources. However, static MFA authentication still suffers from the problem of all user secrets being leaked if the server is compromised, failing to meet the security needs of users continuously accessing internet resources and mitigating dynamic security risks.

[0003] FIDO (Fast Identity Online) aims to create a more secure and user-friendly online authentication standard. This protocol allows users to authenticate using local devices (such as smartphones or other personal devices) without relying on traditional passwords. FIDO technology is widely used in various scenarios requiring user authentication, such as user login and money transfers. However, in FIDO applications, there is currently no solution for how to achieve dynamic trust assessment during continuous user access to internet resources. Summary of the Invention

[0004] This application provides a trust assessment method based on a log-odds regression model, which provides a technical solution for dynamic trust assessment during a user's continuous access to Internet resources in a FIDO application scenario.

[0005] Firstly, this application provides a trust assessment method based on a log-odds regression model, the method comprising:

[0006] In the online fast identity verification FIDO application scenario, multidimensional data of the target user's service authentication based on the first factor is obtained; the feature variables corresponding to each of the multidimensional data are determined; wherein, the multidimensional data includes at least one of the following: authenticator identifier, dependent service identifier, dependent user identifier, user role identifier, and universal authentication framework UAF authentication response message identifier;

[0007] The feature variables corresponding to each of the multidimensional data are input into a pre-trained log-odds regression model, and the target trust score is determined based on the log-odds regression model; the multi-factor authentication decision result is determined based on the target trust score.

[0008] The above technical solution has the following advantages or beneficial effects:

[0009] In this application, a log-odds regression model for service authentication trust assessment is pre-trained. During inference, in the FIDO (Fixed-Oriented Online Authentication) application scenario, after the target user performs service authentication based on the first factor, multi-dimensional data such as the authenticator identifier, dependent service identifier, dependent user identifier, user role identifier, and UAF (User Assurance Framework) authentication response message identifier are obtained. Then, the feature variables corresponding to each of these multi-dimensional data are determined. The feature variables corresponding to each of the multi-dimensional data are summarized and input into the trained log-odds regression model, which outputs a target trust score. Based on this target trust score, the multi-factor authentication decision is determined. This implements a technical solution for dynamic trust assessment and subsequent security authentication guidance during continuous user access to internet resources in a FIDO application scenario.

[0010] Furthermore, determining the feature variables corresponding to each of the multidimensional data includes:

[0011] The multidimensional data is preprocessed; wherein the data preprocessing includes at least one of the following: data cleaning, data integration, data transformation, and data reduction.

[0012] The multidimensional data after data preprocessing is normalized to determine the feature variables corresponding to each of the multidimensional data.

[0013] The above technical solution has the following advantages or beneficial effects:

[0014] To improve the accuracy of trust assessment, it is first necessary to ensure the accuracy of identifying the characteristic variables corresponding to each of the multidimensional data. Based on this consideration, this application, when determining the accuracy of the characteristic variables corresponding to each of the multidimensional data, first employs data cleaning, data integration, data transformation, and data reduction methods to preprocess the multidimensional data, thereby improving the standardization and completeness of the preprocessed multidimensional data. Then, the preprocessed multidimensional data is normalized to determine the characteristic variables corresponding to each of the multidimensional data. This ensures the accuracy of identifying the characteristic variables corresponding to each of the multidimensional data, thus providing a foundation for improving the accuracy of trust assessment.

[0015] Furthermore, the normalization process performed on the preprocessed multidimensional data to determine the characteristic variables corresponding to each of the multidimensional data includes:

[0016] The preprocessed multidimensional data is then standardized by standard deviation and Z-score normalization to determine the feature variables corresponding to each of the multidimensional data; or

[0017] The multidimensional data after data preprocessing is subjected to min-max normalization to determine the feature variables corresponding to each of the multidimensional data.

[0018] The above technical solution has the following advantages or beneficial effects:

[0019] In this application, to improve the accuracy and flexibility of determining the characteristic variables corresponding to each multidimensional data point, two methods can be used. Method 1: Determine the characteristic variables corresponding to each multidimensional data point using the standard deviation standardization (Z-Score) normalization method; this method converts the preprocessed multidimensional data into characteristic variables of a standard normal distribution with a mean of 0 and a standard deviation of 1. Method 2: Determine the characteristic variables corresponding to each multidimensional data point using the min-max normalization method; this method scales the preprocessed multidimensional data to a characteristic variable between a specified minimum and maximum value; the minimum value can be 0, and the maximum value can be 1. Determining the characteristic variables corresponding to each multidimensional data point using either of these two methods improves the accuracy and flexibility of the determination process.

[0020] Furthermore, the process of pre-training the log-odds regression model includes:

[0021] For each set of sample data in the training set, the set of sample data is input into the log-odds regression model to be trained. The set of sample data includes multidimensional sample data, a field with a value of 1, and a label field. The parameters to be trained in the log-odds regression model are weight vectors. The weight vectors are estimated using the log-maximum likelihood method. During the iterative training process, when the estimated weight vectors are used to determine that the convergence condition is met, the log-odds regression model is considered to have completed training.

[0022] The above technical solution has the following advantages or beneficial effects:

[0023] In this application, for each authentication process involving the same or different users, a set of multidimensional sample data corresponding to that authentication can be collected. Then, a field with a value of 1 and a label field are added after the multidimensional sample data to obtain a set of sample data corresponding to that authentication. The label value in the label field is either 1 or 0; 1 indicates that multi-factor authentication is performed, and 0 indicates that multi-factor authentication is not performed. This allows multiple sets of sample data to form a training set. For each set of sample data in the training set, the set of sample data is input into the log-odds regression model to be trained, and the log-maximum likelihood method is used to estimate the weight vector in the log-odds regression model. When the estimated weight vector determines that the convergence condition is met, the log-odds regression model training is considered complete. This improves the accuracy and efficiency of log-odds regression model training.

[0024] Furthermore, estimating the weight vector using the log-maximum likelihood method includes:

[0025] The weight vector is estimated using the log-maximum likelihood method and regularization.

[0026] The above technical solution has the following advantages or beneficial effects:

[0027] In this application, the log-maximum likelihood method and regularization are used to estimate the weight vector, thereby preventing overfitting of the model during iterative training. Furthermore, based on the estimated weight vector, the convergence condition is determined, indicating that the log-odds regression model training is complete. This further improves the accuracy and efficiency of the log-odds regression model training.

[0028] Furthermore, the estimation of the weight vector using the log-maximum likelihood method and regularization includes:

[0029] Using the log-maximum likelihood method and regularization, based on the formula... Estimate the weight vector;

[0030] in, Let i be the multidimensional data of the i-th sample data and the field with a value of 1. x i Let y be the multidimensional data of the i-th sample; β = (w; b), where w is the weight, b is the bias term, and β is the weight vector; T represents the transpose; y i Let be the label value in the i-th sample data, which can be 1 or 0. 1 indicates that multi-factor authentication is performed, and 0 indicates that multi-factor authentication is not performed; α is the regularization parameter, 0 < α < 1.

[0031] This application estimates the weight vector using the above formula, where, This is a regularization term, which improves the accuracy of estimating the weight vector.

[0032] Further, determining the convergence condition based on the estimated weight vector includes:

[0033] The magnitude of the gradient vector is determined based on the estimated weight vector. If the magnitude of the gradient vector is less than a preset first threshold, the convergence condition is determined to be met.

[0034] Further, determining the magnitude of the gradient vector based on the estimated weight vector includes:

[0035] Based on the estimated weight vector and The formula determines the magnitude of the gradient vector;

[0036] Where X is m The matrix formed; Y is m y''s i The matrix formed;

[0037] The above technical solution has the following advantages or beneficial effects:

[0038] In this application, the magnitude of the gradient vector is determined by the above formula, thereby improving the accuracy of determining the magnitude of the gradient vector. Furthermore, when the magnitude of the gradient vector is less than a preset first threshold, it is determined that the convergence condition is met, thereby improving the accuracy of training the log-odds regression model.

[0039] Further, determining the convergence condition based on the estimated weight vector includes:

[0040] Determine the change in the weight vector estimated in two consecutive training iterations. If the change is less than a preset second threshold, the convergence condition is satisfied.

[0041] The above technical solution has the following advantages or beneficial effects:

[0042] In this application, during the iterative process of the log-odds regression model, an alternative scheme is provided to determine whether the convergence condition is met. Specifically, the change in the weight vector estimated in two consecutive iterations is determined, and it is judged whether this change is less than a preset second threshold. If so, the convergence condition is determined to be met, thereby improving the accuracy and flexibility of determining whether the convergence condition is met. It should be noted that this application includes, but is not limited to, the two methods described above for determining whether the convergence condition is met. For example, the convergence condition can also be determined when the number of iterations reaches a preset threshold.

[0043] Furthermore, based on the target trust score, the multi-factor authentication decision result is determined as follows:

[0044] If the target trust score is greater than the preset third threshold, the multi-factor authentication decision result is determined to be to perform multi-factor authentication;

[0045] If the multi-factor authentication decision result is determined to be multi-factor authentication, the method further includes:

[0046] Based on the pre-defined correspondence between each trust score range and at least one factor, at least one second factor corresponding to the target trust score range to which the target trust score belongs is determined; and the at least one second factor is used for service authentication.

[0047] The above technical solution has the following advantages or beneficial effects:

[0048] In this application, if the target trust score exceeds a preset third threshold, the multi-factor authentication decision is determined to proceed with multi-factor authentication. Furthermore, a pre-defined correspondence is established between each trust score range and at least one factor, including the correspondence between each trust score range and factor type, and the correspondence between each trust score range and the number of factors. For example, a trust score range of 0.7-1 corresponds to three factors: fingerprint recognition, voiceprint recognition, and iris recognition. A trust score range of 0.5-0.7 corresponds to two factors: fingerprint recognition and voiceprint recognition. Based on the pre-defined correspondence between each trust score range and at least one factor, at least one second factor corresponding to the target trust score range to which the target trust score belongs is determined; and at least one second factor is used for service authentication. This further improves the accuracy and flexibility of service authentication. Moreover, different correspondences between trust score ranges and at least one factor can be set according to the needs of different users, thereby improving the adaptability of service authentication to user needs.

[0049] Secondly, this application provides a trust assessment device based on a log-odds regression model, the device comprising:

[0050] The determination module is used in the online fast authentication FIDO application scenario to obtain multi-dimensional data of the target user's service authentication based on the first factor; and to determine the feature variables corresponding to each of the multi-dimensional data; wherein, the multi-dimensional data includes at least one of the following: authenticator identifier, dependent service identifier, dependent user identifier, user role identifier, and universal authentication framework (UAF) authentication response message identifier;

[0051] The evaluation module is used to input the feature variables corresponding to each of the multidimensional data into a pre-trained log-odds regression model, determine the target trust score based on the log-odds regression model, and determine the multi-factor authentication decision result based on the target trust score.

[0052] Furthermore, the determining module is specifically used to preprocess the multidimensional data; wherein the data preprocessing includes at least one of data cleaning, data integration, data transformation, and data reduction; and to normalize the multidimensional data after data preprocessing to determine the feature variables corresponding to each of the multidimensional data.

[0053] Furthermore, the determining module is specifically used to perform standard deviation standardization and Z-Score normalization on the multidimensional data after data preprocessing to determine the feature variables corresponding to each of the multidimensional data; or to perform min-max normalization on the multidimensional data after data preprocessing to determine the feature variables corresponding to each of the multidimensional data.

[0054] Furthermore, the device also includes:

[0055] The training module is used to input each set of sample data in the training set into the log-odds regression model to be trained. The set of sample data includes multidimensional sample data, a field with a value of 1, and a label field. The parameters to be trained in the log-odds regression model are weight vectors. The weight vectors are estimated using the log-maximum likelihood method. During the iterative training process, when the convergence condition is met based on the estimated weight vectors, the training of the log-odds regression model is considered complete.

[0056] Furthermore, the training module is specifically used to estimate the weight vector using the log-maximum likelihood method and regularization.

[0057] Furthermore, the training module is specifically used to employ the log-maximum likelihood method and regularization, according to the formula... Estimate the weight vector;

[0058] in, Let i be the multidimensional data of the i-th sample data and the field with a value of 1. x i Let y be the multidimensional data of the i-th sample; β = (w; b), where w is the weight, b is the bias term, and β is the weight vector; T represents the transpose; y i Let be the label value in the i-th sample data, which can be 1 or 0. 1 indicates that multi-factor authentication is performed, and 0 indicates that multi-factor authentication is not performed; α is the regularization parameter, 0 < α < 1.

[0059] Furthermore, the training module is specifically used to determine the magnitude of the gradient vector based on the estimated weight vector, and if the magnitude of the gradient vector is less than a preset first threshold, it is determined that the convergence condition is met.

[0060] Furthermore, the training module is specifically used to train based on the estimated weight vector and The formula determines the magnitude of the gradient vector;

[0061] Where X is m The matrix formed; Y is m y''s i The matrix formed.

[0062] Furthermore, the training module is specifically used to determine the change value of the weight vector estimated in two adjacent training iterations. If the change value is less than a preset second threshold, it is determined that the convergence condition is met.

[0063] Furthermore, the evaluation module is specifically used to determine the multi-factor authentication decision result as multi-factor authentication if the target trust score is greater than a preset third threshold.

[0064] The evaluation module is further configured to determine at least one second factor corresponding to the target trust score range to which the target trust score belongs, based on the pre-defined correspondence between each trust score range and at least one factor; and to use the at least one second factor for service authentication.

[0065] Thirdly, this application provides an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0066] Memory, used to store computer programs;

[0067] A processor, used to execute a program stored in memory, implements the method described.

[0068] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described herein.

[0069] Fifthly, this application provides a computer program product comprising an executable program that is executed by a processor to implement the method described. Attached Figure Description

[0070] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0071] Figure 1 A schematic diagram of the first trust assessment process based on a log-odds regression model provided for this application;

[0072] Figure 2 This is a schematic diagram of the components in the FIDO application scenario provided in this application;

[0073] Figure 3 A schematic diagram illustrating the process of determining the feature variables corresponding to each of the multidimensional data provided in this application;

[0074] Figure 4 A schematic diagram illustrating the process of pre-training the log-odds regression model provided for this application;

[0075] Figure 5 A schematic diagram of the second trust assessment process based on a log-odds regression model provided for this application;

[0076] Figure 6A flowchart of data preprocessing based on a log-odds regression model in the FIDO application scenario provided in this application;

[0077] Figure 7 A flowchart of the trust assessment based on the log-odds regression model provided for this application;

[0078] Figure 8 A schematic diagram of the trust assessment device based on the log-odds regression model provided in this application;

[0079] Figure 9 A schematic diagram of the electronic device structure provided in this application. Detailed Implementation

[0080] To make the objectives and implementation methods of this application clearer, the exemplary implementation methods of this application will be clearly and completely described below with reference to the accompanying drawings of the exemplary embodiments of this application. Obviously, the exemplary embodiments described are only some embodiments of this application, and not all embodiments.

[0081] It should be noted that the brief descriptions of terms in this application are only for the convenience of understanding the embodiments described below, and are not intended to limit the embodiments of this application. Unless otherwise stated, these terms should be understood in their ordinary and common meaning.

[0082] The terms "first," "second," "third," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar or related objects or entities, and do not necessarily imply a specific order or sequence, unless otherwise specified. It should be understood that such terms are interchangeable where appropriate.

[0083] The terms “comprising” and “having”, and any variations thereof, are intended to cover but not exclude inclusion, for example, a product or device that includes a range of components is not necessarily limited to all of the components that are clearly listed, but may include other components that are not clearly listed or that are inherent to such product or device.

[0084] The term "module" refers to any known or subsequently developed hardware, software, firmware, artificial intelligence, fuzzy logic, or combination of hardware and / or software code that is capable of performing the functions associated with that element.

[0085] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

[0086] For ease of explanation, the above description has been provided in conjunction with specific embodiments. However, the above exemplary discussion is not intended to be exhaustive or to limit the embodiments to the specific forms disclosed above. Various modifications and variations can be obtained based on the above teachings. The selection and description of the above embodiments are for the purpose of better explaining the principles and practical applications, thereby enabling those skilled in the art to better utilize the described embodiments and various different variations of embodiments suitable for specific use considerations.

[0087] The following are definitions of terms used in this application:

[0088] FIDO (Fast Identity Online): The FIDO Alliance, or Fast Identity Online Alliance, is an industry association established in July 2012. Its mission is to meet market demands and cope with online verification requirements, thereby improving security, protecting user privacy, and simplifying the user experience.

[0089] UAF (Universal Authentication Framework): The UAF protocol allows online services to provide a passwordless and multi-factor authentication experience. Users generate a user-associated authentication certificate public and private key by selecting a local authentication mechanism (generally including biometric authentication such as facial recognition, fingerprint recognition, voiceprint recognition, iris recognition, etc.). After registration, when users need authentication services, they simply repeat the local authentication process and then sign the relevant user authentication using the previously generated user-associated authentication certificate private key. UAF supports multi-factor authentication mechanisms, such as fingerprint + PIN code.

[0090] TLS (Transport Layer Security): TLS is a TCP-based transport layer security protocol primarily used to provide confidentiality, data integrity, and data source verification between client / server applications. Its functionality relies mainly on three types of algorithms: hash functions, symmetric encryption, and asymmetric encryption. The TLS protocol consists of two layers: the TLS Record protocol and the TLS Handshake protocol. Its predecessor was the SSL (Secure Sockets Layer) protocol. Application layer protocols (such as HTTP, FTP, Telnet, etc.) can run transparently on top of the TLS protocol.

[0091] This application proposes a trust assessment method based on a log-odds regression model for FIDO application scenarios. By collecting cross-platform multi-source information such as FIDO authenticator information, dependent service information, dependent user information, UAF registration and UAF authentication request response log information, a trust assessment method based on log-odds regression model, L2 regularization and gradient descent is designed. Based on trust scores and pre-set thresholds, multi-factor authentication or re-authentication decisions are made to achieve dynamic security authentication.

[0092] Figure 1 The first trust assessment process based on a log-odds regression model provided for this application includes the following steps:

[0093] S101: In the online fast authentication FIDO application scenario, obtain multi-dimensional data of the target user's service authentication based on the first factor; determine the feature variables corresponding to each of the multi-dimensional data; wherein, the multi-dimensional data includes at least one of the following: authenticator identifier, dependent service identifier, dependent user identifier, user role identifier, and universal authentication framework UAF authentication response message identifier;

[0094] S102: Input the feature variables corresponding to each of the multidimensional data into a pre-trained log-odds regression model, determine the target trust score based on the log-odds regression model, and determine the multi-factor authentication decision result based on the target trust score.

[0095] The trust assessment method based on the log-odds regression model provided in this application is applied to electronic devices, such as servers of dependent parties. The FIDO trust assessment engine is deployed in the electronic device to realize the trust assessment process based on the log-odds regression model.

[0096] The FIDO online fast authentication application mainly includes six components: Web client, FIDO client, FIDO authenticator, Web server, FIDO server, and FIDO trust assessment engine. Figure 2 This is a schematic diagram of the components used in the FIDO application scenario provided in this application. Figure 2 As shown, the user equipment side includes a web client, a FIDO client, and a FIDO authenticator, while the dependent parties include a web server, a FIDO server, and a FIDO trust evaluation engine. The web client and web server communicate via the TLS protocol. The FIDO client and FIDO server communicate via the UAF protocol.

[0097] The functions of each component are briefly described below:

[0098] Web client: Acts as a user agent for the FIDO client. The web client communicates with the web server via the TLS security protocol.

[0099] FIDO Client: Acts as a user agent through a web client, interacting with the FIDO server using UAF (Universal Authentication Framework) protocol messages (registration, authentication, transaction confirmation, deregistration), and adapting to various specific FIDO authenticators.

[0100] FIDO Authenticator: A secure entity connected to or encapsulated within a FIDO user device. Its built-in matcher includes biometric authentication methods such as facial recognition, fingerprint recognition, voiceprint recognition, and iris recognition. It can create key materials associated with the relying party (the relying party's associated authentication certificate public and private keys, digital signature, and hash). The authenticator's own authentication private key and the user's associated authentication certificate private key are stored in a secure area of ​​the device. These keys can be used to participate in FIDO strong authentication protocols, such as generating responses to cryptographic challenges to prove themselves to the relying party.

[0101] Web server: Provides online web services; acts as a proxy for the FIDO server, transmitting UAF protocol messages for interaction between FIDO clients and the FIDO server.

[0102] FIDO Server: Interacts with FIDO clients via UAF protocol messages (registration, authentication, transaction confirmation, deregistration) through a web server; accepts metadata services such as FIDO authenticator public key certificates provided by FIDO authenticator vendors; invokes the FIDO trust assessment engine to make MFA multi-factor authentication decisions based on trust scores, thereby achieving dynamic security authentication.

[0103] FIDO Trust Assessment Engine: The trust assessment engine is designed based on a log-odds regression model, L2 regularization, and gradient descent. It summarizes and analyzes cross-platform multi-source information such as FIDO authenticator information, dependent service information, dependent user information, UAF registration and UAF authentication request response log information, and outputs a trust score. Based on the trust score and a pre-set threshold, it makes multi-factor authentication or re-authentication decisions to achieve dynamic security authentication.

[0104] In this application, under the FIDO (Fixed-Oriented Online Authentication) application scenario, the user first performs service authentication using a first factor. After the target user completes service authentication based on the first factor, the electronic device acquires multi-dimensional data. This multi-dimensional data includes, but is not limited to, one of the following: authenticator identifier, dependent service identifier, dependent user identifier, user role identifier, and Universal Authentication Framework (UAF) authentication response message identifier. The first factor can be, for example, one of biometric authentication factors such as face, fingerprint, voiceprint, or iris. After acquiring the multi-dimensional data of the target user's service authentication based on the first factor, the corresponding feature variables for each multi-dimensional data are determined. Then, the corresponding feature variables are input into a pre-trained log-odds regression model for trust assessment. The target trust score is determined based on the log-odds regression model. Based on the target trust score, the multi-factor authentication decision is determined. Optionally, when the target trust score is greater than a certain threshold, the multi-factor authentication decision indicates that multi-factor re-authentication is required; when the target trust score is not greater than a certain threshold, the multi-factor authentication decision indicates that multi-factor re-authentication is not required.

[0105] In this application, a log-odds regression model for service authentication trust assessment is pre-trained. During inference, in the FIDO (Fixed-Oriented Online Authentication) application scenario, after the target user performs service authentication based on the first factor, multi-dimensional data such as the authenticator identifier, dependent service identifier, dependent user identifier, user role identifier, and UAF (User Assurance Framework) authentication response message identifier are obtained. Then, the feature variables corresponding to each of these multi-dimensional data are determined. The feature variables corresponding to each of the multi-dimensional data are summarized and input into the trained log-odds regression model, which outputs a target trust score. Based on this target trust score, the multi-factor authentication decision is determined. This implements a technical solution for dynamic trust assessment and subsequent security authentication guidance during continuous user access to internet resources in a FIDO application scenario.

[0106] Figure 3 The process diagram provided for determining the feature variables corresponding to each of the multidimensional data provided in this application includes the following steps:

[0107] S201: Perform data preprocessing on the multidimensional data; wherein the data preprocessing includes at least one of data cleaning, data integration, data transformation, and data reduction;

[0108] S202: Normalize the multidimensional data after data preprocessing to determine the feature variables corresponding to each of the multidimensional data.

[0109] To improve the accuracy of trust assessment, it is first necessary to ensure the accuracy of identifying the characteristic variables corresponding to each of the multidimensional data. Based on this consideration, this application, when determining the accuracy of the characteristic variables corresponding to each of the multidimensional data, first employs data cleaning, data integration, data transformation, and data reduction methods to preprocess the multidimensional data, thereby improving the standardization and completeness of the preprocessed multidimensional data. Then, the preprocessed multidimensional data is normalized to determine the characteristic variables corresponding to each of the multidimensional data. This ensures the accuracy of identifying the characteristic variables corresponding to each of the multidimensional data, thus providing a foundation for improving the accuracy of trust assessment.

[0110] In this application, the step of normalizing the preprocessed multidimensional data to determine the feature variables corresponding to each of the multidimensional data includes:

[0111] The preprocessed multidimensional data is then standardized by standard deviation and Z-score normalization to determine the feature variables corresponding to each of the multidimensional data; or

[0112] The multidimensional data after data preprocessing is subjected to min-max normalization to determine the feature variables corresponding to each of the multidimensional data.

[0113] In this application, to improve the accuracy and flexibility of determining the characteristic variables corresponding to each multidimensional data point, two methods can be used. Method 1: Determine the characteristic variables corresponding to each multidimensional data point using the standard deviation standardization (Z-Score) normalization method; this method converts the preprocessed multidimensional data into characteristic variables of a standard normal distribution with a mean of 0 and a standard deviation of 1. Method 2: Determine the characteristic variables corresponding to each multidimensional data point using the min-max normalization method; this method scales the preprocessed multidimensional data to a characteristic variable between a specified minimum and maximum value; the minimum value can be 0, and the maximum value can be 1. Determining the characteristic variables corresponding to each multidimensional data point using either of these two methods improves the accuracy and flexibility of the determination process.

[0114] Figure 4 A schematic diagram illustrating the process of pre-training the log-odds regression model provided for this application includes the following steps:

[0115] S301: For each set of sample data in the training set, input the set of sample data into the log-odds regression model to be trained, wherein the set of sample data includes multidimensional sample data, a field with a value of 1 and a label field, and the parameters to be trained in the log-odds regression model are weight vectors.

[0116] S302: The weight vector is estimated using the log-maximum likelihood method; during the iterative training process, when the estimated weight vector satisfies the convergence condition, the training of the log-odds regression model is considered complete.

[0117] The weight vector is estimated using the log-maximum likelihood method, including:

[0118] According to the formula Estimate the weight vector β.

[0119] In this application, for each authentication process involving the same or different users, a set of multidimensional sample data corresponding to that authentication can be collected. Then, a field with a value of 1 and a label field are added after the multidimensional sample data to obtain a set of sample data corresponding to that authentication. The label value in the label field is either 1 or 0; 1 indicates that multi-factor authentication is performed, and 0 indicates that multi-factor authentication is not performed. This allows multiple sets of sample data to form a training set. For each set of sample data in the training set, the set of sample data is input into the log-odds regression model to be trained, and the log-maximum likelihood method is used to estimate the weight vector in the log-odds regression model. When the estimated weight vector determines that the convergence condition is met, the log-odds regression model training is considered complete. This improves the accuracy and efficiency of log-odds regression model training.

[0120] In this application, estimating the weight vector using the log-maximum likelihood method includes:

[0121] The weight vector is estimated using the log-maximum likelihood method and regularization. This prevents overfitting during iterative training. Furthermore, the estimated weight vector determines the completion of the log-odds regression model training when the convergence condition is met. This further improves the accuracy and efficiency of the log-odds regression model training.

[0122] In this application, the method of estimating the weight vector using the log-maximum likelihood method and regularization includes:

[0123] Using the log-maximum likelihood method and regularization, based on the formula... Estimate the weight vector;

[0124] in, Let i be the multidimensional data of the i-th sample data and the field with a value of 1. x i Let y be the multidimensional data of the i-th sample; β = (w; b), where w is the weight, b is the bias term, and β is the weight vector; T represents the transpose; y i Let be the label value in the i-th sample data, which can be 1 or 0. 1 indicates that multi-factor authentication is performed, and 0 indicates that multi-factor authentication is not performed; α is the regularization parameter, 0 < α < 1.

[0125] This application estimates the weight vector using the above formula, where, This is a regularization term, which improves the accuracy of estimating the weight vector.

[0126] The step of determining the convergence condition based on the estimated weight vector includes:

[0127] The magnitude of the gradient vector is determined based on the estimated weight vector. If the magnitude of the gradient vector is less than a preset first threshold, the convergence condition is determined to be met.

[0128] Determining the magnitude of the gradient vector based on the estimated weight vector includes:

[0129] Based on the estimated weight vector and The formula determines the magnitude of the gradient vector;

[0130] Where X is m The matrix formed; Y is m y''s i The matrix formed;

[0131] In this application, the magnitude of the gradient vector is determined using the aforementioned formula, thereby improving the accuracy of determining the magnitude of the gradient vector. Furthermore, when the magnitude of the gradient vector is less than a preset first threshold, the convergence condition is satisfied, thus improving the accuracy of training the log-odds regression model. The preset first threshold is an integer value close to 0, such as 0.1 or 0.05.

[0132] Further, determining the convergence condition based on the estimated weight vector includes:

[0133] The change in the estimated weight vector between two consecutive training iterations is determined. If the change is less than a preset second threshold, the convergence condition is considered met. The preset second threshold is, for example, a small value close to 0.

[0134] In this application, during the iterative process of the log-odds regression model, an alternative scheme is provided to determine whether the convergence condition is met. Specifically, the change in the weight vector estimated between two consecutive iterations is determined, and it is judged whether this change is less than a preset second threshold. If so, the convergence condition is determined to be met, thereby improving the accuracy and flexibility of determining whether the convergence condition is met. It should be noted that this application includes, but is not limited to, the two methods described above for determining whether the convergence condition is met. For example, the convergence condition can also be determined when the number of iterations reaches a preset threshold. The preset threshold could be, for example, 2000 iterations, 3000 iterations, or similar values.

[0135] Figure 5 The second trust assessment process based on a log-odds regression model provided for this application includes the following steps:

[0136] S401: In the online fast authentication FIDO application scenario, obtain multi-dimensional data of the target user's service authentication based on the first factor; determine the feature variables corresponding to each of the multi-dimensional data; wherein, the multi-dimensional data includes at least one of the following: authenticator identifier, dependent service identifier, dependent user identifier, user role identifier, and universal authentication framework UAF authentication response message identifier;

[0137] S402: Input the feature variables corresponding to each of the multidimensional data into a pre-trained log-odds regression model, and determine the target trust score based on the log-odds regression model; if the target trust score is greater than a preset third threshold, determine the multi-factor authentication decision result as multi-factor authentication.

[0138] S403: Based on the pre-defined correspondence between each trust score range and at least one factor, determine at least one second factor corresponding to the target trust score range to which the target trust score belongs; and use the at least one second factor for service authentication.

[0139] In this application, if the target trust score is greater than a preset third threshold, the multi-factor authentication decision is determined to proceed with multi-factor authentication. The preset third threshold is, for example, a value such as 0.5 or 0.6. Furthermore, a pre-defined correspondence between each trust score range and at least one factor is established, including the correspondence between each trust score range and factor type, and the correspondence between each trust score range and the number of factors. For example, a trust score range of 0.7-1 corresponds to three factors: fingerprint recognition, voiceprint recognition, and iris recognition. A trust score range of 0.5-0.7 corresponds to two factors: fingerprint recognition and voiceprint recognition. Based on the pre-defined correspondence between each trust score range and at least one factor, at least one second factor corresponding to the target trust score range to which the target trust score belongs is determined; and at least one second factor is used for service authentication. This further improves the accuracy and flexibility of service authentication. Moreover, different correspondences between trust score ranges and at least one factor can be set according to the needs of different users, thereby improving the adaptability of service authentication to user needs.

[0140] Figure 6 The data preprocessing flowchart for the FIDO application scenario based on the log-odds regression model provided in this application includes the following steps:

[0141] S501: The FIDO server obtains metadata such as public key certificates from authoritative and reliable FIDO authenticator vendors in the FIDO Alliance; users log in to the dependent web service via a web client using TLS, register public and private key certificates associated with the user with the FIDO server based on the UAF registration protocol, the certificate private key is stored in the secure area of ​​the user's device, and the certificate public key is stored on the FIDO server after being verified and decrypted.

[0142] S502: The user logs into the dependent party's web service via a web client using TLS. The FIDO server triggers a UAF authentication request. After the user verifies their biometrics using the built-in FIDO authenticator, an authenticator response message is generated. The response message is digitally signed using the private key of the dependent party's user certificate generated during registration. The FIDO server verifies and parses the UAF authentication request response message to complete the UAF authentication process.

[0143] S503: The FIDO server aggregates cross-platform multi-source information such as FIDO authenticator information, dependent service information, dependent user information, UAF registration and UAF authentication request and response log information, and performs necessary data preprocessing. Data preprocessing includes data cleaning (handling missing values ​​and outliers), data integration, data transformation (data standardization, normalization and feature extraction), and data reduction (feature selection and data dimensionality reduction).

[0144] S504: Selected feature variables after data preprocessing may include, but are not limited to, authenticator ID, dependent service ID, dependent user ID, user role ID, UAF authentication response message ID, etc.; Z-Score normalization (converting the data into a standard normal distribution with a mean of 0 and a standard deviation of 1) or min-max normalization (scaling the data to a specified minimum and maximum value (usually 0 and 1)) shall be performed on the selected feature variables.

[0145] S505: Assume that there are n feature variables to be selected in the end, and the number of training samples is m; label y (1 or 0) on each of the m training samples by manual means or by auxiliary tools; each training sample data has n feature variable values, and an element that is always 1 is added at the end, so that the m training samples construct a dataset D with m rows and (n+1) columns; the m labels corresponding to the m training samples constitute a label vector Y with m rows and 1 column.

[0146] Figure 7 The trust assessment flowchart based on the log-odds regression model provided for this application includes the following steps:

[0147] Step 1: The "Sigmoid" function corresponding to the log-odds regression model in this application is expressed as follows:

[0148]

[0149] x is an n-row, 1-column vector of a training sample corresponding to n feature variables, w is an n-row, 1-column weight vector, and b is the bias.

[0150] β = (w; b).

[0151] Step 2: Given a dataset D and a label vector Y, apply the log-maximum likelihood method to the aforementioned "Sigmoid" function to estimate the weight column vector β, which is equivalent to minimizing the following function:

[0152]

[0153] Step 3: To alleviate model overfitting, L2 regularization, i.e., ridge regression, is introduced. The function to be minimized becomes:

[0154] The regularization parameter α satisfies 0 < α < 1.

[0155] Step 4: L(β) is a high-order differentiable continuous convex function with respect to β. According to convex optimization theory, its numerical optimal solution can be found using the gradient descent method.

[0156]

[0157] X is a set of m column vectors The matrix consists of (n+1) rows and m columns; σ is an m-row, 1-column vector.

[0158] Step 5: The initial value of the (n+1)th row, 1st column weight vector β can be a normally distributed random number with a mean of 0 and a standard deviation of 1, k = 0; the iterative formula for the (k+1)th step is:

[0159] Where η is the step size or learning rate, 0 < η < 1.

[0160] Step 6: The convergence conditions for gradient descent generally include the gradient vector magnitude being close to 0, the change in the weight vector being less than a certain preset threshold, or reaching a preset threshold for the number of iterations. When the convergence conditions are met, the weight vector β corresponding to the optimal solution of L(β) can be obtained, and the learning of the log-odds regression model can be completed.

[0161] Step 7: Use the "K-fold cross-validation method" (K is usually set to 10) to test and optimize the learned log-odds model; the FIDO server authentication strategy module calls the trust assessment scoring engine based on the log-odds regression model, and uses the "Sigmoid" function corresponding to the log-odds regression model. The system outputs a trust score (a real number in the interval (0,1)) and a pre-set threshold (e.g., 0.5) to determine whether multi-factor authentication or re-authentication is needed, thus achieving dynamic security authentication.

[0162] This application proposes a trust assessment method based on a log-odds regression model for FIDO application scenarios. A trust assessment method based on a log-odds regression model, L2 regularization, and gradient descent is designed. It aggregates and analyzes cross-platform multi-source information, including FIDO authenticator information, dependent service information, dependent user information, UAF registration, and UAF authentication request / response log information, to output a trust score. The trust assessment method introduces L2 regularization, i.e., ridge regression, to effectively alleviate the critical model overfitting problem in machine learning. The key algorithmic implementation logic of the trust assessment method is briefly described, including the representation of the minimum solution of the corresponding function using the log-maximum likelihood method, L2 regularization representation, and gradient descent iterative representation. Based on the trust score and a pre-set threshold, multi-factor authentication or re-authentication decisions are made to achieve dynamic security authentication.

[0163] Figure 8 This application provides a schematic diagram of a trust assessment device based on a log-odds regression model, the device comprising:

[0164] The determination module 11 is used to obtain multi-dimensional data of the target user's service authentication based on the first factor in the online fast authentication FIDO application scenario; and determine the feature variables corresponding to each of the multi-dimensional data; wherein, the multi-dimensional data includes at least one of the following: authenticator identifier, dependent service identifier, dependent user identifier, user role identifier, and universal authentication framework UAF authentication response message identifier;

[0165] Evaluation module 12 is used to input the feature variables corresponding to each of the multidimensional data into a pre-trained log-odds regression model, determine the target trust score based on the log-odds regression model, and determine the multi-factor authentication decision result based on the target trust score.

[0166] Furthermore, the determining module 11 is specifically used to preprocess the multidimensional data; wherein the data preprocessing includes at least one of data cleaning, data integration, data transformation, and data reduction; and to normalize the multidimensional data after data preprocessing to determine the feature variables corresponding to each of the multidimensional data.

[0167] Furthermore, the determining module 11 is specifically used to perform standard deviation standardization and Z-Score normalization on the multidimensional data after data preprocessing to determine the feature variables corresponding to each of the multidimensional data; or to perform min-max normalization on the multidimensional data after data preprocessing to determine the feature variables corresponding to each of the multidimensional data.

[0168] Furthermore, the device also includes:

[0169] Training module 13 is used to input each set of sample data in the training set into the log-odds regression model to be trained. The set of sample data includes multidimensional sample data, a field with a value of 1, and a label field. The parameters to be trained in the log-odds regression model are weight vectors. The weight vectors are estimated using the log-maximum likelihood method. During iterative training, when the convergence condition is met based on the estimated weight vectors, the training of the log-odds regression model is considered complete.

[0170] Furthermore, the training module 13 is specifically used to estimate the weight vector using the log-maximum likelihood method and regularization.

[0171] Furthermore, the training module 13 is specifically used to employ the log-maximum likelihood method and regularization, according to the formula... Estimate the weight vector;

[0172] in, Let i be the multidimensional data of the i-th sample data and the field with a value of 1. x i Let y be the multidimensional data of the i-th sample; β = (w; b), where w is the weight, b is the bias term, and β is the weight vector; T represents the transpose; y i Let be the label value in the i-th sample data, which can be 1 or 0. 1 indicates that multi-factor authentication is performed, and 0 indicates that multi-factor authentication is not performed; α is the regularization parameter, 0 < α < 1.

[0173] Furthermore, the training module 13 is specifically used to determine the magnitude of the gradient vector based on the estimated weight vector, and if the magnitude of the gradient vector is less than a preset first threshold, it is determined that the convergence condition is met.

[0174] Furthermore, the training module 13 is specifically used to train the weights based on the estimated weight vector and... The formula determines the magnitude of the gradient vector;

[0175] Where X is m The matrix formed; Y is m y''s i The matrix formed.

[0176] Furthermore, the training module 13 is specifically used to determine the change value of the weight vector estimated in two adjacent training iterations, and if the change value is less than a preset second threshold, it is determined that the convergence condition is met.

[0177] Furthermore, the evaluation module 12 is specifically used to determine the multi-factor authentication decision result as multi-factor authentication if the target trust score is greater than a preset third threshold.

[0178] The evaluation module 12 is further configured to determine at least one second factor corresponding to the target trust score range to which the target trust score belongs, based on the pre-defined correspondence between each trust score range and at least one factor; and to use the at least one second factor for service authentication.

[0179] This application also provides an electronic device, such as Figure 9 As shown, it includes: processor 21, communication interface 22, memory 23 and communication bus 24, wherein processor 21, communication interface 22 and memory 23 communicate with each other through communication bus 24;

[0180] The memory 23 stores a computer program, which, when executed by the processor 21, causes the processor 21 to perform any of the above method steps.

[0181] The communication bus mentioned in the above electronic devices can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not indicate that there is only one bus or one type of bus.

[0182] Communication interface 22 is used for communication between the above-mentioned electronic device and other devices.

[0183] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0184] The processors mentioned above can be general-purpose processors, including central processing units, network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits, field-programmable gate arrays or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0185] This application also provides a computer-readable storage medium storing a computer program executable by an electronic device, which, when run on the electronic device, causes the electronic device to perform any of the above method steps.

[0186] This application provides a computer program product, which includes an executable program that, when executed by a processor, implements the method described herein.

[0187] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0188] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A trust evaluation method based on a logit regression model, characterized by, The method includes: In the online fast identity verification FIDO application scenario, multidimensional data of the target user's service authentication based on the first factor is obtained; the feature variables corresponding to each of the multidimensional data are determined; wherein, the multidimensional data includes at least one of the following: authenticator identifier, dependent service identifier, dependent user identifier, user role identifier, and universal authentication framework UAF authentication response message identifier; The feature variables corresponding to each of the multidimensional data are input into a pre-trained log-odds regression model, and the target trust score is determined based on the log-odds regression model; the multi-factor authentication decision result is determined based on the target trust score. The Sigmoid function corresponding to the logarithmic probability regression model is: , wherein x is an n-row 1-column vector corresponding to a certain n-feature variable training sample, w is an n-row 1-column weight vector, and b is a bias, ; ; The process of pre-training a log-odds regression model includes: For each set of sample data in the training set, the set of sample data is input into the log-odds regression model to be trained. The set of sample data includes multidimensional sample data, a field with a value of 1, and a label field. The parameters to be trained in the log-odds regression model are weight vectors. The weight vectors are estimated using the log-maximum likelihood method. During the iterative training process, when the convergence condition is met based on the estimated weight vectors, the training of the log-odds regression model is considered complete. The determination of the multi-factor authentication decision result based on the target trust score includes: If the target trust score is greater than the preset third threshold, the multi-factor authentication decision result is determined to be to perform multi-factor authentication; The step of estimating the weight vector using the log-maximum likelihood method includes: According to the formula estimate the weight vector β; wherein, is the sample multi-dimensional data in the i th sample data and the field value is 1, ; is the sample multi-dimensional data in the i th sample data; , w is the weight, b is the bias term, β is the weight vector; T represents the transpose; is the label value in the i th sample data, taking 1 or 0, 1 represents performing multi-factor authentication, and 0 represents not performing multi-factor authentication; The step of determining the convergence condition based on the estimated weight vector includes: Determine the change in the weight vector estimated in two consecutive training iterations. If the change is less than a preset second threshold, the convergence condition is satisfied.

2. The method of claim 1, wherein, Determining the feature variables corresponding to each of the multidimensional data includes: The multidimensional data is preprocessed; wherein the data preprocessing includes at least one of the following: data cleaning, data integration, data transformation, and data reduction. The multidimensional data after data preprocessing is normalized to determine the feature variables corresponding to each of the multidimensional data.

3. The method of claim 2, wherein, The step of normalizing the preprocessed multidimensional data to determine the feature variables corresponding to each of the multidimensional data includes: The preprocessed multidimensional data is then standardized by standard deviation and Z-score normalization to determine the feature variables corresponding to each of the multidimensional data; or The multidimensional data after data preprocessing is subjected to min-max normalization to determine the feature variables corresponding to each of the multidimensional data.

4. The method of claim 1, wherein, The estimation of the weight vector using the log-maximum likelihood method includes: The weight vector is estimated using the log-maximum likelihood method and regularization.

5. The method of claim 4, wherein, The estimation of the weight vector using the log-maximum likelihood method and regularization includes: The weight vector is estimated according to the formula using the log maximum likelihood method and regularization. wherein, is the sample multi-dimensional data in the i-th sample data and the field with a value of 1, is the sample multi-dimensional data in the i-th sample data; , w is a weight, b is a bias term, β is a weight vector; T represents transposition; is the label value in the i-th sample data, taking 1 or 0, 1 representing performing multi-factor authentication, 0 representing not performing multi-factor authentication; α is a regularization parameter, 0 < α < 1.​ 6. The method of claim 5, wherein, The step of determining the convergence condition based on the estimated weight vector includes: The magnitude of the gradient vector is determined based on the estimated weight vector. If the magnitude of the gradient vector is less than a preset first threshold, the convergence condition is determined to be met.

7. The method of claim 6, wherein, Determining the magnitude of the gradient vector based on the estimated weight vector includes: determining the magnitude of the gradient vector according to the estimated weight vector and the formula, wherein X is a matrix of m Y is a matrix of m Y is a matrix of m .

8. The method of claim 1, wherein, If the multi-factor authentication decision result is determined to be multi-factor authentication, the method further includes: According to a pre-set corresponding relationship between each trust score range and at least one factor, at least one second factor corresponding to a target trust score range to which the target trust score belongs is determined; and service authentication is performed by using the at least one second factor.

Images