An identity authentication system and method based on multiple devices and multiple factors

Abstract

The present invention discloses an identity authentication system and method based on multiple devices and multiple factors, and relates to the technical field of identity authentication. The present invention collects all identity authentication methods existing in a device, extracts all authentication data, calculates the security value of each identity authentication method based on historical authentication data, calculates the adaptability of each identity authentication method and different users, and constructs an adaptation method set for each user; extracts dangerous data that affects user identity authentication from device data; analyzes the influence of characteristic vectors on the security value of each identity authentication method, and uses machine learning to construct a risk identification model; collects real-time dangerous data and inputs it into the risk identification model to judge the user's real-time identity authentication; and adjusts the user's identity authentication method using the user's adaptation method set and the security value of each identity authentication.

Description

Technical Field

[0001] The present invention relates to the field of identity authentication technology, and in particular to an identity authentication system and method based on multiple devices and multiple factors. Background Art

[0002] With the rapid development of technologies such as the internet, the Internet of Things, and mobile devices, network environments are becoming increasingly complex, and various cyberattack methods, such as phishing, password cracking, and data theft, are emerging. Traditional single-factor authentication methods, such as username and password authentication, are no longer sufficient to ensure the security of user information and systems. In recent years, with the development of technologies such as the Internet of Things and smart homes, multi-factor authentication that collaborates with multiple devices has become a hot topic in research and application. For example, the multi-factor authentication solution based on FIDO authentication in the HarmonyOS Next system allows users to use their smartphone for biometric recognition as the first factor, and then interact with their smartwatch as the second factor, leveraging FIDO authentication technology to ensure the security and convenience of the entire authentication process.

[0003] However, in today's multi-factor identity authentication, the model is relatively fixed and cannot be dynamically adjusted for different users, different usage scenarios and situations. In addition, due to different user habits, the same authentication strategy has different effects on different users, which greatly affects the user experience. Summary of the Invention

[0004] The purpose of the present invention is to provide an identity authentication system and method based on multiple devices and multiple factors to solve the problems raised in the prior art.

[0005] To achieve the above object, the present invention provides the following technical solutions:

[0006] A multi-factor authentication method based on multiple devices includes the following steps:

[0007] S100, collecting all identity authentication methods existing in the device, collecting historical authentication records for each identity authentication method, extracting all authentication data, and calculating the security value of each identity authentication method based on the historical authentication data;

[0008] Furthermore, the specific steps for calculating the security value of each identity authentication method based on historical authentication data are as follows:

[0009] S101, collect all identity authentication methods in the device, collect historical authentication records for each identity authentication method, and extract all authentication data as {S1, S2, S3, ..., S n}, S1, S2, S3, ..., S nRepresents the first, second, third, ..., nth type of authentication data extracted, where n is a positive integer; suppose that the number of historical authentication records collected is M, filter out the records of successful and failed authentications, compare the same type of authentication data in the successful and failed authentication records, and subtract the failed authentication data from the successful authentication data; when the difference between the same type of authentication data in the successful and failed authentications is not zero, determine that the corresponding authentication data is influencing data; and determine the sign of the influencing data difference; when the difference sign is positive, it is defined as positive influencing data; when the difference sign is negative, it is defined as negative influencing data;

[0010] S102. Extract impact data for different identity authentication methods and calculate the security value of different identity authentication methods. The formula is:

[0011] ;

[0012] In the formula, An represents the security value of the identity authentication method, S + i represents the i-th positive impact data, S - j represents the jth negative impact data, a represents the total number of positive impact data, and b represents the total number of negative impact data;

[0013] S103, using the same method to calculate the security of all the collected identity authentication methods is {An1, An2, An3, ..., An c}, An1, An2, An3,..., An c Indicates the calculated security value of the 1st, 2nd, 3rd, ..., cth authentication method, where c is a positive integer.

[0014] The security value of each authentication method is calculated based on the authentication data of historical users' authentication, which can clearly express the security of each authentication method. When users authenticate, an authentication strategy that combines multiple authentication methods can be reasonably formulated based on security, which greatly ensures the efficiency and security of user authentication.

[0015] S200, collecting behavioral data of different users during historical identity authentication, calculating the suitability of each identity authentication method for different users, and constructing a set of adaptation methods for each user;

[0016] Furthermore, the specific steps for constructing the adaptation method set for each user are:

[0017] S201. Collect behavioral data of different users during their historical identity authentication, including the number of times different identity authentication methods have been used, the authentication time, and the authentication success rate. Calculate the fitness by weighted summing the three types of behavioral data. The formula is:

[0018] ;

[0019] In the formula, Fit represents the fitness of the identity authentication method, α1, α2, and α3 represent the weights of the number of uses, authentication time, and authentication success rate, respectively; C represents the number of uses, T represents the authentication time, and P represents the authentication success rate;

[0020] S202: For the same user, the compatibility between the user and different identity authentication methods is calculated as {Fit1, Fit2, Fit3, ..., Fit c}, Fit1, Fit2, Fit3,..., Fit c Represents the compatibility between the user and the 1st, 2nd, 3rd, ..., cth identity authentication method. Arrange the compatibility of all identity authentication methods in ascending order, calculate the difference between adjacent compatibility, obtain c-1 compatibility differences, select the previous compatibility with the maximum difference as the adaptation threshold, and use all identity authentication methods with a compatibility greater than the adaptation threshold to construct the adaptation method set {SH1, SH2, SH3, ..., SH d}, SH1, SH2, SH3,..., SH d Indicates the 1st, 2nd, 3rd, ..., dth identity authentication method in the adaptation method set, where d is a positive integer and d≤c;

[0021] S203: Calculate the behavioral data of identity authentication performed in the history of all users who use the device to construct an adaptation method set for each user.

[0022] Based on the behavioral data in the user's history, an adaptation method set for each user is constructed, and the identity authentication method suitable for each user is found. When specifying the identity authentication strategy, it is more in line with the user, improving the user experience and realizing a personalized authentication method.

[0023] S300, collecting device data during historical user identity authentication, comparing the device data during successful and failed authentication, and extracting dangerous data that affects user identity authentication from the device data;

[0024] Furthermore, the specific steps to extract dangerous data that affects identity authentication are:

[0025] S301, collect the device data of historical user identity authentication, calculate the difference between each device data when the identity authentication succeeds and fails {Zc1, Zc2, Zc3, ..., Zc u}, Zc1, Zc2, Zc3,..., Zc u IZc represents the calculated difference between the first, second, third, ..., u types of device data when the identity authentication succeeds and fails, where u is a positive integer. The standard deviation of the calculated u types of differences is IZc.

[0026] S302, using the calculated standard deviation of the difference to judge the difference of all devices, when Zc>IZc, the corresponding device data is judged to be dangerous data, when Zc≤IZc, it is judged not to be dangerous data; after judging the data of all devices, the dangerous data is {W1, W2, W3, ..., W r}, W1, W2, W3, ..., W r Indicates the first, second, third, ..., rth type of dangerous data obtained by judgment, r is a positive integer, and r <u。

[0027] S400: Process the extracted risk data and convert it into a feature vector of the same dimension, map the security value of each identity authentication method, analyze the impact of the feature vector on the security value of each identity authentication method, and use machine learning to build a risk identification model;

[0028] Furthermore, the specific steps for building a risk identification model using machine learning are as follows:

[0029] S401. Process the extracted dangerous data and convert it into a feature vector of the same dimension. The formula is:

[0030] ;

[0031] In the formula, Wn represents the transformed feature vector, W represents the extracted dangerous data, min(W) represents the minimum value in the extracted dangerous data, and max(W) represents the maximum value in the extracted dangerous data;

[0032] S402. Map the security value of each identity authentication method, analyze the influence of the characteristic vector on the security value of each identity authentication method, use the characteristic vector as an independent variable and the security value of each identity authentication method as a variable, draw a curve graph, fit the curve graph, and obtain a polynomial of the influence of the characteristic vector on the security value of each identity authentication method. Suppose the form of the polynomial is , β0 is a constant term, β0 to β r Represents the coefficients of the 1st to rth eigenvectors;

[0033] S403. Repeat the steps for each identity authentication method to obtain the polynomial for each identity authentication method; collect the security values when identity authentication fails in history, calculate the average value and standard deviation, subtract the standard deviation from the average value to obtain the danger threshold, and construct the risk identification model as: , where Ay represents the danger threshold.

[0034] S500. Extract the identity authentication method with the highest adaptation degree in the adaptation method set of each user as the default method for the corresponding user. When the user performs identity authentication using the default method, collect real-time danger data and input it into the risk identification model to judge the user's real-time identity authentication;

[0035] Further, the specific steps for judging the user's real-time identity authentication are as follows:

[0036] S501. Extract the identity authentication method with the highest adaptation degree in the adaptation method set of each user as the default method for the corresponding user. When the user performs identity authentication using the default method, collect real-time danger data and input it into the risk identification model, and calculate the real-time security values {Ans1, Ans2, Ans3,..., Ans d} of all identity authentication methods in the user's adaptation method set. Ans1, Ans2, Ans3,..., Ans d represent the real-time security values of the 1st, 2nd, 3rd,..., dth identity authentication methods in the user's adaptation method set. Extract the real-time security value of the user's default method as Mans, and judge the real-time security value of the default method in the risk identification model. When Mans < Ay, judge that there is a risk in the user's real-time identity authentication; when Mans ≥ Ay, judge that there is no risk in the user's real-time identity authentication.

[0037] Judging the real-time security value using the security threshold to obtain whether there is a security risk during the user's real-time identity authentication can not only check the security of the user's identity authentication, but also formulate different authentication strategies for different authentication situations according to the specific real-time scenarios and conditions; greatly increasing the diversity and extensiveness of user identity authentication.

[0038] S600. According to the analysis result of the user's real-time danger data by the risk identification model, adjust the user's identity authentication method using the user's adaptation method set and the security value of each identity authentication.

[0039] Further, the specific steps for adjusting the user's identity authentication method using the user's adaptation method set and the security value of each identity authentication are as follows:

[0040] S601: When it is determined that there is a risk in the user's real-time identity authentication, the identity authentication methods are added to the user's adaptation method set in the order of the degree of adaptability, and the real-time security value after the addition is calculated. The formula is:

[0041] ;

[0042] In the formula, TAn represents the security value after adding the identity authentication method, and tAn represents the security value of the added identity authentication method. Identity authentication methods are added in sequence until TAn is greater than Ay.

[0043] When adding real-time identity authentication methods for users, we not only consider whether there are risks, but also whether it is suitable for the user. The two-fold addition of identity authentication methods increases the user's experience while ensuring the security of identity authentication.

[0044] An identity authentication system based on multiple devices and multiple factors, the identity authentication system includes a data collection module, a security value calculation module, an adaptation method set construction module, a dangerous data search module, a model construction module, a real-time calculation module and a method addition module;

[0045] The data collection module is used to collect historical records of user identity authentication;

[0046] The security value calculation module is used to extract all authentication data and calculate the security value of each identity authentication method based on historical authentication data;

[0047] The adaptation method set building module is used to calculate the adaptability of each identity authentication method and different users, and build an adaptation method set for each user;

[0048] The dangerous data search module is used to compare the device data when the authentication succeeds and fails, and extract the dangerous data that affects the user's identity authentication from the device data;

[0049] The model building module is used to analyze the impact of feature vectors on the security value of each identity authentication method and build a risk identification model using machine learning;

[0050] The real-time calculation module is used to collect real-time risk data and input it into the risk identification model to calculate the real-time security value of all identity authentication methods in the adaptation method set;

[0051] The method adding module is used to judge the real-time security value and add a method for real-time user identity authentication.

[0052] The model building module includes a polynomial calculation unit and a model building unit;

[0053] The polynomial calculation unit is used to map the security value of each identity authentication method, analyze the influence of the characteristic vector on the security value of each identity authentication method, draw a curve and fit it to obtain a polynomial of the influence of dangerous data on the security value;

[0054] The model building unit is used to collect security values ​​when identity authentication fails in history, calculate the average value and standard deviation, subtract the standard deviation from the average value to obtain a danger threshold, and build a risk identification model.

[0055] The real-time calculation module includes a real-time safety value calculation unit and a judgment unit;

[0056] The real-time security value calculation unit is used to collect real-time risk data and calculate the real-time security value of all identity authentication methods in the adaptation mode set using polynomials;

[0057] The judgment unit is used to extract the real-time security value of the default mode and judge the real-time security value of the default mode using the security threshold.

[0058] Compared with the prior art, the present invention has the following beneficial effects:

[0059] 1. This aspect calculates the security value of each authentication method based on the authentication data of historical users during identity authentication, which can clearly express the security of each authentication method. When users authenticate, an authentication strategy that combines multiple authentication methods is reasonably formulated based on security, which greatly ensures the efficiency and security of user authentication.

[0060] 2. This aspect uses security thresholds to judge real-time security values ​​and determine whether there are security risks during real-time user authentication. This not only checks the security of user authentication, but also formulates different authentication strategies for different authentication situations based on specific real-time scenarios and situations; it greatly increases the diversity and breadth of user authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 This is a module distribution diagram of an identity authentication system based on multiple devices and multiple factors according to the present invention;

[0062] Figure 2 The figure is a schematic diagram of the steps of a multi-device multi-factor identity authentication method according to the present invention. DETAILED DESCRIPTION

[0063] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0064] Example: Figure 1-Figure 2 As shown, the present invention provides a technical solution.

[0065] A multi-factor authentication method based on multiple devices includes the following steps:

[0066] S100, collecting all identity authentication methods existing in the device, collecting historical authentication records for each identity authentication method, extracting all authentication data, and calculating the security value of each identity authentication method based on the historical authentication data;

[0067] The specific steps for calculating the security value of each identity authentication method based on historical authentication data are as follows:

[0068] S101, collect all identity authentication methods in the device, collect historical authentication records for each identity authentication method, and extract all authentication data as {S1, S2, S3, ..., S n}, S1, S2, S3, ..., S n Represents the first, second, third, ..., nth type of authentication data extracted, where n is a positive integer; suppose that the number of historical authentication records collected is M, filter out the records of successful and failed authentications, compare the same type of authentication data in the successful and failed authentication records, and subtract the failed authentication data from the successful authentication data; when the difference between the same type of authentication data in the successful and failed authentications is not zero, determine that the corresponding authentication data is influencing data; and determine the sign of the influencing data difference; when the difference sign is positive, it is defined as positive influencing data; when the difference sign is negative, it is defined as negative influencing data;

[0069] S102. Extract impact data for different identity authentication methods and calculate the security value of different identity authentication methods. The formula is:

[0070] ;

[0071] In the formula, An represents the security value of the identity authentication method, S + i represents the i-th positive impact data, S - j represents the jth negative impact data, a represents the total number of positive impact data, and b represents the total number of negative impact data;

[0072] S103, using the same method to calculate the security of all the collected identity authentication methods is {An1, An2, An3, ..., An c}, An1, An2, An3,..., An c Indicates the calculated security value of the 1st, 2nd, 3rd, ..., cth authentication method, where c is a positive integer.

[0073] The security value of each authentication method is calculated based on the authentication data of historical users' authentication, which can clearly express the security of each authentication method. When users authenticate, an authentication strategy that combines multiple authentication methods can be reasonably formulated based on security, which greatly ensures the efficiency and security of user authentication.

[0074] S200, collecting behavioral data of different users during historical identity authentication, calculating the suitability of each identity authentication method for different users, and constructing a set of adaptation methods for each user;

[0075] The specific steps to construct the adaptation method set for each user are:

[0076] S201. Collect behavioral data of different users during their historical identity authentication, including the number of times different identity authentication methods have been used, the authentication time, and the authentication success rate. Calculate the fitness by weighted summing the three types of behavioral data. The formula is:

[0077] ;

[0078] In the formula, Fit represents the fitness of the identity authentication method, α1, α2, and α3 represent the weights of the number of uses, authentication time, and authentication success rate, respectively; C represents the number of uses, T represents the authentication time, and P represents the authentication success rate;

[0079] S202: For the same user, the compatibility between the user and different identity authentication methods is calculated as {Fit1, Fit2, Fit3, ..., Fit c}, Fit1, Fit2, Fit3,..., Fit c Represents the compatibility between the user and the 1st, 2nd, 3rd, ..., cth identity authentication method. Arrange the compatibility of all identity authentication methods in ascending order, calculate the difference between adjacent compatibility, obtain c-1 compatibility differences, select the previous compatibility with the maximum difference as the adaptation threshold, and use all identity authentication methods with a compatibility greater than the adaptation threshold to construct the adaptation method set {SH1, SH2, SH3, ..., SH d}, SH1, SH2, SH3,..., SHd Indicates the 1st, 2nd, 3rd, ..., dth identity authentication method in the adaptation method set, where d is a positive integer and d≤c;

[0080] S203: Calculate the behavioral data of identity authentication performed in the history of all users who use the device to construct an adaptation method set for each user.

[0081] Based on the behavioral data in the user's history, an adaptation method set for each user is constructed, and the identity authentication method suitable for each user is found. When specifying the identity authentication strategy, it is more in line with the user, improving the user experience and realizing a personalized authentication method.

[0082] S300, collecting device data during historical user identity authentication, comparing the device data during successful and failed authentication, and extracting dangerous data that affects user identity authentication from the device data;

[0083] The specific steps to extract dangerous data that affects identity authentication are:

[0084] S301, collect the device data of historical user identity authentication, calculate the difference between each device data when the identity authentication succeeds and fails {Zc1, Zc2, Zc3, ..., Zc u}, Zc1, Zc2, Zc3,..., Zc u IZc represents the calculated difference between the first, second, third, ..., u types of device data when the identity authentication succeeds and fails, where u is a positive integer. The standard deviation of the calculated u types of differences is IZc.

[0085] S302, using the calculated standard deviation of the difference to judge the difference of all devices, when Zc>IZc, the corresponding device data is judged to be dangerous data, when Zc≤IZc, it is judged not to be dangerous data; after judging the data of all devices, the dangerous data is {W1, W2, W3, ..., W r}, W1, W2, W3, ..., W r Indicates the first, second, third, ..., rth type of dangerous data obtained by judgment, r is a positive integer, and r <u。

[0086] S400: Process the extracted risk data and convert it into a feature vector of the same dimension, map the security value of each identity authentication method, analyze the impact of the feature vector on the security value of each identity authentication method, and use machine learning to build a risk identification model;

[0087] The specific steps for building a risk identification model using machine learning are:

[0088] S401. Process the extracted dangerous data and convert it into a feature vector of the same dimension. The formula is:

[0089] ;

[0090] In the formula, Wn represents the transformed feature vector, W represents the extracted dangerous data, min(W) represents the minimum value of the extracted dangerous data, and max(W) represents the maximum value of the extracted dangerous data;

[0091] S402. Map the security values of each authentication method, analyze the influence of the feature vector on the security value of each authentication method. Take the feature vector as the independent variable and the security value of each authentication method as the variable, draw a curve graph, and fit the curve graph to obtain the influence polynomial of the feature vector on the security value of each authentication method. Assume the form of the polynomial is , β0 is the constant term, and β0 to β r represent the coefficients of the 1st to the rth feature vectors;

[0092] S403. Repeat the steps for each authentication method to obtain the polynomial for each authentication method; collect the security values at the time of authentication failure in history, calculate the average value and standard deviation, subtract the standard deviation from the average value to obtain the danger threshold, and construct the risk identification model as: , where Ay represents the danger threshold.

[0093] S500. Extract the authentication method with the highest adaptability in the adaptation method set of each user as the default method for the corresponding user. When the user performs identity authentication using the default method, collect real-time dangerous data and input it into the risk identification model to judge the user's real-time identity authentication;

[0094] The specific steps for judging the user's real-time identity authentication are as follows:

[0095] S501. Extract the authentication method with the highest adaptability in the adaptation method set of each user as the default method for the corresponding user. When the user performs identity authentication using the default method, collect real-time dangerous data and input it into the risk identification model, and calculate the real-time security values {Ans1, Ans2, Ans3,..., Ans d} of all authentication methods in the user's adaptation method set. Ans1, Ans2, Ans3,..., Ans d represent the real-time security values of the 1st, 2nd, 3rd,..., dth authentication methods in the user's adaptation method set. Extract the real-time security value of the user's default method as Mans, and judge the real-time security value of the default method in the risk identification model. When Mans < Ay, it is judged that there is a risk in the user's real-time identity authentication; when Mans ≥ Ay, it is judged that there is no risk in the user's real-time identity authentication.

[0096] By using security thresholds to judge real-time security values, we can determine whether there are security risks during real-time user authentication. This not only checks the security of user authentication, but also allows us to formulate different authentication strategies for different authentication situations based on specific real-time scenarios and situations. This greatly increases the diversity and breadth of user authentication.

[0097] S600: According to the analysis result of the user's real-time risk data by the risk identification model, the user's identity authentication method is adjusted using the user's adaptation method set and the security value of each identity authentication.

[0098] The specific steps for adjusting the user's authentication method using the user's adaptation method set and the security value of each authentication method are as follows:

[0099] S601: When it is determined that there is a risk in the user's real-time identity authentication, the identity authentication methods are added to the user's adaptation method set in the order of the degree of adaptability, and the real-time security value after the addition is calculated. The formula is:

[0100] ;

[0101] In the formula, TAn represents the security value after adding the identity authentication method, and tAn represents the security value of the added identity authentication method. Identity authentication methods are added in sequence until TAn is greater than Ay.

[0102] When adding real-time identity authentication methods for users, we not only consider whether there are risks, but also whether it is suitable for the user. The two-fold addition of identity authentication methods increases the user's experience while ensuring the security of identity authentication.

[0103] An identity authentication system based on multiple devices and multiple factors, the identity authentication system includes a data collection module, a security value calculation module, an adaptation method set construction module, a dangerous data search module, a model construction module, a real-time calculation module and a method addition module;

[0104] The data collection module is used to collect historical records of user identity authentication;

[0105] The security value calculation module is used to extract all authentication data and calculate the security value of each identity authentication method based on historical authentication data;

[0106] The adaptation method set building module is used to calculate the adaptability of each identity authentication method and different users, and build an adaptation method set for each user;

[0107] The dangerous data search module is used to compare the device data when the authentication succeeds and fails, and extract the dangerous data that affects the user's identity authentication from the device data;

[0108] The model building module is used to analyze the impact of feature vectors on the security value of each identity authentication method and build a risk identification model using machine learning;

[0109] The real-time calculation module is used to collect real-time risk data and input it into the risk identification model to calculate the real-time security value of all identity authentication methods in the adaptation method set;

[0110] The method adding module is used to judge the real-time security value and add a method for real-time user identity authentication.

[0111] The model building module includes a polynomial calculation unit and a model building unit;

[0112] The polynomial calculation unit is used to map the security value of each identity authentication method, analyze the influence of the characteristic vector on the security value of each identity authentication method, draw a curve and fit it to obtain a polynomial of the influence of dangerous data on the security value;

[0113] The model building unit is used to collect security values ​​when identity authentication fails in history, calculate the average value and standard deviation, subtract the standard deviation from the average value to obtain a danger threshold, and build a risk identification model.

[0114] The real-time calculation module includes a real-time safety value calculation unit and a judgment unit;

[0115] The real-time security value calculation unit is used to collect real-time risk data and calculate the real-time security value of all identity authentication methods in the adaptation mode set using polynomials;

[0116] The judgment unit is used to extract the real-time security value of the default mode and judge the real-time security value of the default mode using the security threshold.

[0117] Example: Now analyze the identity authentication of a certain device. Assume that the device has three authentication methods: SMS authentication, fingerprint authentication, and facial authentication. Based on the historical user authentication data, the influencing data is obtained as complexity and information volume. A security value calculation method for the three authentication methods is constructed. The security values ​​of the three authentication methods are calculated based on the same device data.

[0118] First, there is a user 1. The adaptability of the three authentication methods is calculated. The adaptive method set of user 1 includes SMS authentication and facial authentication.

[0119] Collect device data from historical authentications and identify the risky data, including the number of authenticated devices and authentication frequency. Calculate the polynomials for the three authentication methods. For example, the polynomial for SMS authentication is An = 1.2 + 2.3 × Wn1 + 0.3 × Wn2. Assume that SMS authentication is the default method for user 1 and calculate the real-time security values ​​for the adapted method set to be 18 and 25. The SMS authentication value is 18, and the calculated security threshold is 30. This indicates that user 1's real-time identity authentication is at risk.

[0120] Add facial authentication to the adaptation method set, and calculate the security value after adding it to be 43. If it is greater than the security threshold, authentication is allowed.

[0121] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above and that the invention can be embodied in other specific forms without departing from the spirit or essential characteristics of the invention. Therefore, the embodiments should be considered in all respects as illustrative and non-restrictive, and the scope of the invention is defined by the appended claims, not the foregoing description, and all variations within the meaning and range of equivalents of the claims are intended to be included therein. Any reference sign in a claim should not be construed as limiting the claim to which it relates.

Claims

1. A multi-device multi-factor identity authentication method, characterized by: The method comprises the following steps: S100, collecting all identity authentication methods existing in the device, collecting historical authentication records for each identity authentication method, extracting all authentication data, and calculating the security value of each identity authentication method based on the historical authentication data; S200, collecting behavioral data of different users during historical identity authentication, calculating the suitability of each identity authentication method for different users, and constructing a set of adaptation methods for each user; The specific steps to construct the adaptation method set for each user are: S201. Collect behavioral data of different users during their historical identity authentication, including the number of times different identity authentication methods have been used, the authentication time, and the authentication success rate. Calculate the fitness by weighted summing the three types of behavioral data. The formula is: ； In the formula, Fit represents the fitness of the identity authentication method, α1, α2, and α3 represent the weights of the number of uses, authentication time, and authentication success rate, respectively; C represents the number of uses, T represents the authentication time, and P represents the authentication success rate; S202: For the same user, the compatibility between the user and different identity authentication methods is calculated as {Fit1, Fit2, Fit3, ..., Fit c }, Fit1, Fit2, Fit3,..., Fit c Represents the compatibility between the user and the 1st, 2nd, 3rd, ..., cth identity authentication method. Arrange the compatibility of all identity authentication methods in ascending order, calculate the difference between adjacent compatibility, obtain c-1 compatibility differences, select the previous compatibility with the maximum difference as the adaptation threshold, and use all identity authentication methods with a compatibility greater than the adaptation threshold to construct the adaptation method set {SH1, SH2, SH3, ..., SH d }, SH1, SH2, SH3,..., SH d Indicates the 1st, 2nd, 3rd, ..., dth identity authentication method in the adaptation method set, where d is a positive integer and d≤c; S203: Calculate the identity authentication behavior data of all users who have used the device in history, and construct an adaptation method set for each user; S300, collecting device data during historical user identity authentication, comparing the device data during successful and failed authentication, and extracting dangerous data that affects user identity authentication from the device data; The specific steps to extract dangerous data that affects identity authentication are: S301, collect the device data of historical user identity authentication, calculate the difference between each device data when the identity authentication succeeds and fails {Zc1, Zc2, Zc3, ..., Zc u }, Zc1, Zc2, Zc3,..., Zc u IZc represents the calculated difference between the first, second, third, ..., u types of device data when the identity authentication succeeds and fails, where u is a positive integer. The standard deviation of the calculated u types of differences is IZc. S302, using the calculated standard deviation of the difference to judge the difference of all devices, when Zc>IZc, the corresponding device data is judged to be dangerous data, when Zc≤IZc, it is judged not to be dangerous data; after judging the data of all devices, the dangerous data is {W1, W2, W3, ..., W r }, W1, W2, W3, ..., W r Indicates the first, second, third, ..., rth type of dangerous data obtained by judgment, r is a positive integer, and r <u; S400: Process the extracted risk data and convert it into a feature vector of the same dimension, map the security value of each identity authentication method, analyze the impact of the feature vector on the security value of each identity authentication method, and use machine learning to build a risk identification model; The specific steps for building a risk identification model using machine learning are: S401. Process the extracted dangerous data and convert it into a feature vector of the same dimension. The formula is: ； In the formula, Wn represents the transformed feature vector, W represents the extracted dangerous data, min(W) represents the minimum value in the extracted dangerous data, and max(W) represents the maximum value in the extracted dangerous data; S402. Map the security value of each identity authentication method, analyze the influence of the characteristic vector on the security value of each identity authentication method, use the characteristic vector as an independent variable and the security value of each identity authentication method as a variable, draw a curve graph, fit the curve graph, and obtain a polynomial of the influence of the characteristic vector on the security value of each identity authentication method. Suppose the form of the polynomial is , β0 is a constant term, β0 to β r Represents the coefficients of the 1st to rth eigenvectors; S403. Repeat the steps for each identity authentication method to obtain a polynomial for each identity authentication method; collect the security values ​​of identity authentication failures in history, calculate the average value and standard deviation, subtract the standard deviation from the average value to obtain the risk threshold, and construct a risk identification model as follows: , Ay represents the danger threshold; S500: Extract the identity authentication method with the highest adaptability from the set of adaptation methods for each user as the default method for the corresponding user. When the user uses the default method for identity authentication, collect real-time risk data and input it into the risk identification model to determine the user's real-time identity authentication. S600: According to the analysis result of the user's real-time risk data by the risk identification model, the user's identity authentication method is adjusted using the user's adaptation method set and the security value of each identity authentication.

2. The multi-device multi-factor identity authentication method according to claim 1, characterized in that: The specific steps of calculating the security value of each identity authentication method based on historical authentication data in S100 are: S101, collect all identity authentication methods in the device, collect historical authentication records for each identity authentication method, and extract all authentication data as {S1, S2, S3, ..., S n }, S1, S2, S3, ..., S n represents the first, second, third, ..., nth type of authentication data extracted, where n is a positive integer. Assume that the number of historical authentication records collected is M. Filter out the records of successful and failed authentications. Compare the same authentication data in the successful and failed authentication records, and subtract the failed authentication data from the successful authentication data. When the difference between the same authentication data when the authentication succeeds and fails is not zero, the corresponding authentication data is judged as the influencing data; and the sign of the influencing data difference is judged. When the difference sign is positive, it is defined as positive influencing data; when the difference sign is negative, it is defined as negative influencing data; S102. Extract impact data for different identity authentication methods and calculate the security value of different identity authentication methods. The formula is: ； In the formula, An represents the security value of the identity authentication method, S + i represents the i-th positive impact data, S - j represents the jth negative impact data, a represents the total number of positive impact data, and b represents the total number of negative impact data; S103, using the same method to calculate the security of all the collected identity authentication methods is {An1, An2, An3, ..., An c }, An1, An2, An3,..., An c Indicates the calculated security value of the 1st, 2nd, 3rd, ..., cth authentication method, where c is a positive integer.

3. The identity authentication method based on multiple devices and multiple factors according to claim 1, characterized in that: The specific steps of determining the real-time user identity authentication in S500 are: S501. Extract the identity authentication method with the highest adaptation degree in the adaptation method set of each user as the default method for the corresponding user. When the user performs identity authentication using the default method, collect real-time risk data and input it into the risk identification model, and calculate the real-time security values {Ans1, Ans2, Ans3,..., Ans d} of all identity authentication methods in the user adaptation method set. Ans1, Ans2, Ans3,..., Ans d represent the real-time security values of the 1st, 2nd, 3rd,..., dth identity authentication methods in the user adaptation method set. Extract the real-time security value of the user's default method as Mans, and judge the real-time security value of the default method in the risk identification model. When Mans < Ay, it is judged that the user's real-time identity authentication is at risk; when Mans ≥ Ay, it is judged that the user's real-time identity authentication is not at risk.

4. The identity authentication method based on multiple devices and multiple factors according to claim 1, characterized in that: The specific steps of adjusting the user's identity authentication method using the user's adaptation method set and the security value of each identity authentication in S600 are: S601: When it is determined that there is a risk in the user's real-time identity authentication, the identity authentication methods are added to the user's adaptation method set in the order of the degree of adaptability, and the real-time security value after the addition is calculated. The formula is: ； In the formula, TAn represents the security value after adding the identity authentication method, and tAn represents the security value of the added identity authentication method. Identity authentication methods are added in sequence until TAn is greater than Ay.

5. A multi-device multi-factor identity authentication system using the multi-device multi-factor identity authentication method according to any one of claims 1 to 4, characterized in that: The identity authentication system includes a data collection module, a security value calculation module, an adaptation method set construction module, a dangerous data search module, a model construction module, a real-time calculation module and a method addition module; The data collection module is used to collect historical records of user identity authentication; The security value calculation module is used to extract all authentication data and calculate the security value of each identity authentication method based on historical authentication data; The adaptation method set building module is used to calculate the adaptability of each identity authentication method and different users, and build an adaptation method set for each user; The dangerous data search module is used to compare the device data when the authentication succeeds and fails, and extract the dangerous data that affects the user's identity authentication from the device data; The model building module is used to analyze the impact of feature vectors on the security value of each identity authentication method and build a risk identification model using machine learning; The real-time calculation module is used to collect real-time risk data and input it into the risk identification model to calculate the real-time security value of all identity authentication methods in the adaptation method set; The method adding module is used to judge the real-time security value and add a method for real-time user identity authentication.

6. The multi-device multi-factor identity authentication system according to claim 5, characterized in that: The model building module includes a polynomial calculation unit and a model building unit; The polynomial calculation unit is used to map the security value of each identity authentication method, analyze the influence of the characteristic vector on the security value of each identity authentication method, draw a curve and fit it to obtain a polynomial of the influence of dangerous data on the security value; The model building unit is used to collect security values ​​when identity authentication fails in history, calculate the average value and standard deviation, subtract the standard deviation from the average value to obtain a danger threshold, and build a risk identification model.

7. The multi-device multi-factor identity authentication system according to claim 5, characterized in that: The real-time calculation module includes a real-time safety value calculation unit and a judgment unit; The real-time security value calculation unit is used to collect real-time risk data and calculate the real-time security value of all identity authentication methods in the adaptation mode set using polynomials; The judgment unit is used to extract the real-time security value of the default mode and judge the real-time security value of the default mode using the security threshold.

Images