Multi-factor authentication trusted data space access control method, platform and medium

Abstract

The application discloses a multi-factor authentication trusted data space access control method, platform and medium, relates to the technical field of data security, and comprises the following steps: analyzing the permission, record, path and target of a user who requests access, and obtaining access parameters; generating a verification gradient based on the security level of the parameter matching the permission, record, path and target; combining the gradient with the user authentication record to create an authentication requirement factor with gradient constraints; generating a space access permission according to the authentication result to control the trusted data access permission. The scheme strengthens the data security protection capability through a dynamic multi-factor verification mechanism. The application solves the technical problem that the existing technology lacks a multi-factor dynamic authentication and fine-grained access control mechanism in the data space access process, resulting in insufficient data security protection capability, achieves the technical effect of dynamically adjusting the access permission based on multi-factor authentication, and effectively improves the data security and credibility in the data space access process.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to a trusted data space access control method, platform, and medium based on multi-factor authentication. Background Technology

[0002] A trusted data space refers to a controlled environment that supports data storage, exchange, and sharing while meeting security, privacy, and trust requirements. It typically incorporates security mechanisms such as identity authentication, access control, and behavior auditing to ensure data is not illegally accessed, tampered with, or leaked during circulation. In a trusted data space, access control, as a core safeguard, directly relates to the confidentiality and integrity of data resources. Currently, traditional data access control methods often rely on single authentication factors, such as static passwords, biometric identification, or hardware tokens. However, in diverse user access scenarios and complex network environments, single-factor authentication struggles to effectively identify impersonation, privilege abuse, and abnormal behavior, resulting in significant shortcomings in data security protection. Furthermore, while existing multi-factor authentication methods introduce multiple authentication techniques, their authentication strategies lack correlation with the specific attributes of access requests. They fail to dynamically adjust authentication strength based on multi-dimensional data such as access paths, request targets, and historical records, leading to risks of insufficient utilization of authentication resources or ineffective protective measures. Summary of the Invention

[0003] This invention provides a multi-factor authentication trusted data space access control method, platform, and medium to solve the technical problem in the prior art where the lack of multi-factor dynamic authentication and fine-grained access control mechanisms during data space access leads to insufficient data security protection capabilities. It achieves the technical effect of dynamically adjusting access permissions based on multi-factor authentication and effectively improving data security and trustworthiness during data space access.

[0004] In a first aspect, the present invention provides a trusted data space access control method with multi-factor authentication, wherein the trusted data space access control method with multi-factor authentication includes:

[0005] The system parses the user's permissions, access records, access path, and requested access target to obtain user access parameters. Based on these parameters, it performs access verification security level matching with the user's permissions, access records, access path, and requested access target to obtain a matching verification gradient. This gradient is then used to identify and match the user's authentication factor record information to create user authentication requirement factors, which are constrained by the authentication gradient. Based on the authentication result of these factors, a space access permission result is sent, which controls the user's access permissions to trusted data.

[0006] Secondly, the present invention also provides a multi-factor authentication trusted data space access control platform, wherein the multi-factor authentication trusted data space access control platform includes:

[0007] User parsing module: parses the user's permissions, access records, access path, and requested access target to obtain user access parameters; Security level matching module: matches the access verification security level based on the user access parameters, user permissions, access records, access path, and requested access target to obtain a matching verification gradient; Factor identification and matching module: uses the matching verification gradient to identify and match the authentication factor record information of the requesting user to create authentication requirement factors for the requesting user, which have authentication gradient constraints; Access permission sending module: sends a spatial access permission result based on the authentication result of the authentication requirement factors for the requesting user, which is used to control the access permission permissions of the requesting user for trusted data.

[0008] Thirdly, the present invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the multi-factor authentication trusted data space access control method provided by the present invention.

[0009] This invention discloses a multi-factor authentication-based trusted data space access control method, platform, and medium, comprising: parsing user permissions, access records, access paths, and requested access targets of a requesting user to obtain user access parameters; matching access verification security levels based on the user access parameters from the user permissions, access records, access paths, and requested access targets to obtain a matching verification gradient; using the matching verification gradient to identify and match with the authentication factor record information of the requesting user to create a requesting user authentication requirement factor, wherein the requesting user authentication requirement factor has authentication gradient constraints; and sending a space access permission result based on the authentication result of the requesting user authentication requirement factor, wherein the space access permission result is used to control the requesting user's access permission permissions for trusted data. The multi-factor authentication-based trusted data space access control method, platform, and medium disclosed in this invention solve the technical problem in the prior art of insufficient data security protection capabilities due to the lack of multi-factor dynamic authentication and fine-grained access control mechanisms during data space access, achieving the technical effect of dynamically adjusting access permissions based on multi-factor authentication and effectively improving data security and trustworthiness during data space access. Attached Figure Description

[0010] Figure 1 This is a flowchart illustrating the trusted data space access control method with multi-factor authentication according to the present invention.

[0011] Figure 2This is a schematic diagram of the structure of the trusted data space access control platform with multi-factor authentication according to the present invention.

[0012] Figure labeling: User parsing module 11, security level matching module 12, factor identification matching module 13, access permission sending module 14. Detailed Implementation

[0013] The above technical solutions will now be described in detail with reference to the accompanying drawings and specific embodiments to provide a better understanding of them. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. It should be understood that the present invention is not limited to the exemplary embodiments used only to explain the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention. Furthermore, it should be noted that, for ease of description, only the parts related to the present invention are shown in the drawings, not all of them.

[0014] Example 1, as Figure 1 This is a flowchart illustrating the trusted data space access control method with multi-factor authentication according to the present invention, wherein the trusted data space access control method with multi-factor authentication includes:

[0015] The system parses the user's permissions, access records, access path, and access target to obtain the user's access parameters.

[0016] Specifically, when a user initiates a request to access trusted data space, the system analyzes four aspects: user permissions, access records, access path, and the target of the request to comprehensively understand the user's access behavior. Regarding user permissions, the system queries the database to determine if the user has the necessary permissions to access the target data or resources. User permissions typically include different access levels, such as administrator, regular user, and read-only permissions. This step ensures that only authorized users can access restricted resources. Regarding access records, the system analyzes the user's historical access records, including data accessed, access time, access frequency, and device information, to identify any abnormal user behavior (such as frequent access to sensitive data) and to assess any potential risks associated with the user. Regarding the access path, the system checks the user's source IP address, the device used, and the network environment (such as VPN or direct connection). This process aims to understand the security of the access environment; for example, if a user accesses from an untrusted IP address, a higher level of authentication may be required. For the requested access target, the system analyzes the specific data resource or service the user is requesting to access. This includes identifying the sensitivity and importance of the requested resource—for example, whether the user is accessing a regular file or sensitive data. Based on the resource's security level, authentication and access permission policies are adjusted. Finally, by integrating the above four information sources, user access parameters are generated. These parameters provide the foundational data for subsequent access verification, authentication gradient matching, and other operations, ensuring that the user's identity, historical behavior, access environment, and the security requirements of the access target are comprehensively considered when granting access permissions.

[0017] Based on the user access parameters, the access verification security level is matched from the user permissions, access records, access path, and requested access target to obtain the matching verification gradient.

[0018] Specifically, based on the user access parameters obtained in the previous step, security level verification and matching are performed across four dimensions: user permissions, access records, access paths, and requested access targets. Specifically, based on the user permission information in the access parameters, the user's permission category and authorization scope are analyzed to determine the corresponding permission verification gradient. Generally, the higher the permission level, the stricter the corresponding verification requirements. Based on the access record information in the access parameters, the user's historical access characteristics are extracted to determine the user's user record verification gradient. Based on the access path in the access parameters, the device, network environment, and source IP address used by the user are analyzed to assess the trustworthiness of the access path and determine the user's access network verification gradient. Based on the requested access target in the access parameters, the data sensitivity and security level of the requested access target are analyzed to determine the user's access data verification gradient. Finally, by comparing and filtering the verification gradients of each dimension, the one with the strictest verification requirements is extracted as the final matching verification gradient. This matching verification gradient is used to dynamically guide the setting of subsequent authentication strategies, ensuring that the authentication strength matches the access risk, thereby improving data security while avoiding waste of authentication resources.

[0019] In some embodiments, based on the user access parameters, an access verification security level is matched from the user permissions, access records, access path, and requested access target to obtain a matching verification gradient, including:

[0020] Based on the user permissions, analyze the user permission type to determine the permission verification gradient; based on the access records, extract memory features to obtain the user record verification gradient; based on the access path, analyze the access device, network environment, and network access path confidence to determine the access network verification gradient; based on the requested access target, analyze the security level of the access target to obtain the access data verification gradient; based on the permission verification gradient, user record verification gradient, access network verification gradient, and access data verification gradient, extract the requirement constraint gradients of each dimension, and filter the verification gradient with the largest requirement constraint gradient to obtain the matching verification gradient.

[0021] Specifically, based on user permissions, the user's permission type and permission level are analyzed, such as ordinary access permissions, sensitive data management permissions, or administrator permissions. Based on different permission types, the corresponding permission verification gradient is determined. The higher the permission level, the larger the corresponding permission verification gradient, which means that the requirements for user authentication are more stringent. In general, the permission verification gradient is directly taken from the permission level.

[0022] Based on access records, memory features of user access behavior are extracted. These features include user permissions, access paths, access goals, access frequency, access time habits, verification gradients, and verification results. For example, if a user's historical access behavior is stable and without anomalies, the user record verification gradient is low; if there are abnormal access patterns or high-frequency sudden accesses, the user record verification gradient increases. Typically, the scores corresponding to each memory feature can be weighted, such as the user's permission level, the credibility of the access path, the sensitivity of the access goal, and the deviation of the access frequency, thereby quantifying the user record verification gradient.

[0023] Based on the access path information, the confidence level of the access device, network environment, and network access path is analyzed. Specifically, the overall trustworthiness of the access path is assessed based on the security of each node in the access link. For example, in a financial industry application scenario, if the access path involves a mobile banking app accessing a bank's API gateway through a carrier network, and the API gateway enforces two-way TLS authentication and the core system only accepts intranet requests, then the access path has a high confidence level, and the corresponding network verification gradient is low. Similarly, in a medical data sharing scenario, if the path involves hospital A accessing hospital B's data sandbox through a medical consortium blockchain node, and the consortium blockchain node performs authentication and the data sandbox uses differential privacy protection, then the access path also has a high confidence level. If the access path contains unencrypted transmission, weak authentication, or untrusted relay nodes, the confidence level decreases, and the network verification gradient increases accordingly. The confidence level can be assessed based on the risk weights of different types of nodes.

[0024] Based on the target of the access request, the security level of the accessed data is analyzed. For example, if the target is public data, the data verification gradient is low; if the target is highly sensitive data such as financial transactions or medical records, the data verification gradient is significantly higher, depending on the data's security level.

[0025] Finally, based on the extracted permission verification gradient, user record verification gradient, network access verification gradient, and data access verification gradient, the requirement constraint gradient for each dimension is extracted. This represents the specific gradient level within each dimension's verification gradient. Then, the verification gradient with the largest requirement constraint gradient is selected as the matching verification gradient for this access request. This matching verification gradient will guide subsequent authentication factor matching and authentication strength configuration, ensuring that the platform flexibly adjusts its authentication strategy according to access risks in a dynamic environment, effectively improving the security and trustworthiness of data space access control.

[0026] In some embodiments, obtaining the matching verification gradient further includes:

[0027] Based on the user permissions, access records, access paths, and requested access targets, cross-gradient effects are applied to obtain cross-validation relationship coefficients; these cross-validation relationship coefficients are then used to correct the requirement constraint gradients and reset the matching validation gradients.

[0028] Specifically, firstly, based on access records, key behavioral characteristics associated with users' past accesses are extracted to form access memory features. Access memory features include, but are not limited to, the user's used permission categories, access path selection patterns, distribution of access target types, and changes in access frequency. For example, if a user habitually accesses the company's internal systems via the intranet during work hours, and all historical verification results are successful, then the user's access memory features demonstrate high access regularity and credibility. Subsequently, based on user permissions, the user's hierarchical relationship within the permission system and the correspondence between permissions and different types of data resources are analyzed to form user permission relationship features. For example, high-privilege users typically have access rights to more highly sensitive data resources, and their permission structure is closely related to data categories. After extracting access memory features and user permission relationship features, cross-risk impact analysis is performed sequentially, combining current access path information and requested access targets, to assess the direction and magnitude of how a change in a particular feature modulates the overall access risk. For example, when it is detected that a user is using a high-privilege account but accessing sensitive data through an abnormal access path, it is determined that this feature combination has a significant upward risk trend, and the credible impact relationship is a negative reinforcing relationship. Based on the credible impact relationships obtained from the cross-analysis of the above dimensions, cross-validation relationship coefficients are configured. These coefficients quantify the risk moderating effect among various features; the larger the coefficient value, the more significant the impact of the feature combination on improving access risk, requiring stronger authentication in subsequent verification processes. Finally, the cross-validation relationship coefficients are used to correct the demand constraint gradients extracted from each dimension, dynamically adjusting the matching verification gradients to make the overall authentication strategy more consistent with the actual access risk situation.

[0029] In some embodiments, cross-gradient influence is performed based on the user permissions, access records, access paths, and requested access targets to obtain cross-validation relationship coefficients, including:

[0030] Based on the access records, user access permissions, access paths, access targets, access frequencies, access time habits, verification gradients, and verification results are extracted to obtain access memory features. Access permission level relationships and data relationship types are parsed based on the user permissions to obtain user permission relationship features. Cross-risk impact analysis is performed sequentially using the user permission relationship features, access memory features, access paths, and requested access targets to identify credible impact relationships for each dimension. These credible impact relationships represent the risk adjustment direction and degree of influence between dimensional features. The cross-validation relationship coefficients are configured using the credible impact relationships for each dimension.

[0031] Specifically, the process begins by extracting user access records, including the permission categories used during past accesses, typical access path selections, common access target types, access frequency variations, access time habit distribution, verification gradients for each verification, and corresponding pass / reject results. By organizing and summarizing this historical data, access memory features reflecting user access behavior characteristics are established. Subsequently, based on the user's current permissions, the correspondence between their permission level and accessible data types is analyzed, forming user permission relationship features. These features not only reflect the user's permission hierarchy within the organization but also describe the degree of association between the user and different data categories in the data classification system. For example, a user may primarily handle self-generated data or specific business data, or possess broad data access permissions. After extracting the access memory features and permission relationship features, a cross-risk impact analysis is conducted on the user's current access path, requested access target, and the extracted user permission relationship features and access memory features. Specifically, the system cross-analyzes user permission relationship characteristics and access memory characteristics to assess the consistency between user permission levels and historical access behavior patterns. For example, if a user holds high permissions but their historical access behavior is concentrated on low-sensitivity data and is compliant with regulations, the system identifies a low risk in permission usage, with a negative moderating relationship, indicating reduced access risk. Conversely, if a high-privilege user frequently accesses sensitive data historically and has abnormal access records, the system identifies a positive moderating relationship, indicating an increased risk level. Secondly, the system cross-analyzes access paths and access memory characteristics to detect whether the current access path matches the user's past access habits. For example, if a user has consistently accessed through a secure network environment, but the access path suddenly changes to an uncontrolled public network, a positive moderating relationship is identified, indicating an increasing risk trend in the access path. Thirdly, the system cross-analyzes access paths and requested access targets to determine whether there is a match between path security and access data sensitivity. For example, when the security confidence of the access path is low and the access target is highly sensitive data, a strong positive moderating relationship is identified, indicating an overall increase in the risk of the access request. Through the above cross-analysis, a credible impact relationship is established between each pair of features. This credible impact relationship includes two aspects: first, the direction of risk moderating, i.e., whether the feature combination leads to an increase (positive) or decrease (negative) in risk; and second, the degree of risk moderating, i.e., quantifying the magnitude of the impact based on the neural network model corresponding to each feature combination. Through this cross-risk impact analysis, credible impact relationships between features of various dimensions are identified, which describe the moderating direction and degree of impact of different feature combinations on the overall access risk.Based on these credible influence relationships, cross-validation coefficients are configured. This involves using the risk adjustment direction as a symbol for the degree of risk adjustment, such as positive risk adjustment or negative risk adjustment, to quantify the risk changes resulting from the interactions between features. The risk adjustment degrees of each feature are then weighted to obtain the cross-validation coefficients. These coefficients will be used to dynamically correct the demand constraint gradients of each dimension during subsequent matching and validation gradient adjustments, thereby more accurately reflecting the true security posture of access requests.

[0032] In some embodiments, obtaining the matching verification gradient includes:

[0033] An analysis network graph is constructed, including a first-order analysis network and a second-order analysis network. The first-order analysis network is used to analyze the self-verification requirement gradient of user permissions, access records, access paths, and requested access targets. The second-order analysis network is used to analyze the cross-validation relationships of each dimension. The user permission relationship features, access memory features, access paths, and requested access targets are sequentially imported according to the configured user permissions, access records, access paths, and requested access target graph nodes, outputting the first-order verification gradients of each dimension and the second-order cross-validation relationship coefficients. The second-order cross-validation relationship coefficients are used to adjust and correct the first-order verification gradients of each dimension to obtain the matching verification gradient.

[0034] Specifically, in the process of obtaining the matching verification gradient, an analysis network graph needs to be pre-constructed. This analysis network graph contains a first-order analysis network and a second-order analysis network. The role of the first-order analysis network is to analyze each independent dimension of the user access request, including user permissions, access records, access paths, and request access targets. Each dimension is represented as a graph node in the first-order analysis network, and each graph node has an analysis logic for a specific dimension (which is the aforementioned process of determining each verification gradient). Based on the access data provided by the user, the features of each dimension are imported into the corresponding node, and each node generates a corresponding verification gradient, such as permission verification gradient, user record verification gradient, access network verification gradient, and access data verification gradient. These verification gradients are organized into the first-order verification gradients for each dimension and output uniformly by the first-order analysis network. The second-order analysis network is used to analyze cross-validation relationships between different dimensions. Each feature combination corresponds to a graph node, and each graph node has a neural network model for a specific combination. This model performs cross-analysis based on the input combination, establishing the risk adjustment direction and impact level. The output node then weights the risk adjustment direction and impact level generated by each graph node and outputs the result as the second-order cross-validation relationship coefficient. The neural network model for each graph node can be constructed using a multilayer perceptron and iteratively trained through forward propagation, loss calculation (cross-entropy loss and mean squared error), backpropagation, and parameter optimization (Adam optimizer). The training data consists of sample combination data and corresponding cross-validation labels. Finally, based on the cross-validation relationship coefficients output by the second-order analysis network, the maximum validation gradient determined based on the first-order validation gradients for each dimension is adjusted and corrected. Specifically, 1 is added to the cross-validation relationship coefficient, and the result is multiplied by the maximum validation gradient to obtain the matching validation gradient. In summary, this method dynamically corrects the validation gradient, making it more accurately reflect the comprehensive risk level of each access request, laying the foundation for subsequent authentication decisions and access control.

[0035] The matching verification gradient is used to identify and match the authentication factor record information of the requesting user to create authentication requirement factors for the requesting user, and the authentication requirement factors for the requesting user have authentication gradient constraints.

[0036] Specifically, after generating a matching verification gradient based on the access request, the system uses this gradient to access the user's corresponding verification factor database and performs authentication method filtering and matching operations. During this process, authentication methods that meet the requirements of the matching verification gradient are prioritized. For example, when the matching verification gradient is high, a strong authentication method, such as a combination of biometrics and dynamic passwords, is preferred. When the matching verification gradient is medium or low, traditional password authentication or device binding authentication methods can be matched. Finally, through the identification and filtering based on the matching verification gradient, the authentication requirement factors for the requesting user corresponding to this access request are created. These authentication requirement factors clearly define the selected authentication method and its corresponding authentication gradient constraints, ensuring that the authentication method dynamically matches the access risk level, thus guaranteeing both the security of data space access and the user authentication experience.

[0037] In some embodiments, the matching verification gradient is used to identify and match with the authentication factor record information of the requesting user to create authentication requirement factors for the requesting user, including:

[0038] Establish a verification factor library for accessing users, which stores the user's authentication factor records, methods, and factor verification evaluations; use the matching verification gradient to identify in the verification factor library according to the verification gradient requirements, obtain the matching verification methods and the authentication gradient constraints corresponding to the verification methods, and obtain the authentication requirement factors for the requesting user.

[0039] Specifically, a verification factor database is first established for each accessing user. This database stores various authentication factor recording methods and corresponding factor verification evaluations. Authentication factor recording methods include, but are not limited to, static passwords, biometric recognition (such as fingerprints and facial recognition), dynamic tokens, and multi-device binding authentication. Factor verification evaluations include historical success rates, stability, error rates, and abnormal event records for each authentication factor recording method, representing the performance and credibility of the authentication method in past applications. Subsequently, based on the matching verification gradient generated from the access request, identification and matching are performed in the verification factor database according to the verification gradient requirements. Specifically, the verification strength requirements of the current access request are analyzed, and the search for various gradient schemes of authentication factor recording methods is performed with the goal of minimizing the overlap of gradient methods and maximizing the evaluation requirement value. This ensures that the selected authentication method not only meets the gradient requirements but also has high stability and reliability. For example, if an authentication method has failed multiple times in historical verifications or has a high error rate, other better-performing authentication methods will be preferred, ensuring that the verification gradient requirements are met while minimizing the risk of failure. After matching is completed, matching verification methods and corresponding authentication gradient constraints are generated. These are then used as authentication requirement factors for the requesting user. These authentication requirement factors explicitly specify which authentication steps the user needs to complete (e.g., password + fingerprint verification), and define the security level requirements for each step, ensuring that the authentication strategy matches the actual risk of the access request. Finally, the authentication requirement factors for the requesting user are applied to subsequent authentication processes. These constraints guide the verification process, ensuring a balance between security and efficiency.

[0040] In some embodiments, the matching verification gradient is used to identify verification factors in the verification factor library according to verification gradient requirements to obtain matching verification methods and authentication gradient constraints corresponding to the verification methods, including:

[0041] The multimodal verification forms of the authentication factor recording methods are analyzed to determine the verification evaluation values ​​of each form; the verification gradient and the evaluation requirement values ​​of each gradient are analyzed according to the matching verification gradient; based on the evaluation requirement values ​​of each gradient, the gradient schemes of the authentication factor recording methods are searched with the goal of minimizing the overlap of gradient methods and maximizing the evaluation requirement values, so as to obtain the matching verification methods of each gradient and the verification forms that satisfy the gradient evaluation requirement values ​​as authentication gradient constraints.

[0042] Specifically, the authentication factors recorded by the requesting user are first analyzed for multimodal verification. Each authentication method (such as password, fingerprint, hardware token, etc.) may have different verification forms. For example, biometrics may have fingerprint scanning and facial recognition verification methods, while dynamic tokens may have time-based one-time passwords and location-based verification methods. Based on the characteristics of each authentication method, its multimodal verification form is analyzed, and a verification evaluation for each form is obtained, such as success rate, stability, and user experience metrics. This results in a verification evaluation value for each verification form, representing its performance and reliability in historical use. Subsequently, the authentication methods are further analyzed based on the current matching verification gradient. The matching verification gradient represents the authentication strength requirement of the current access request; a higher verification gradient means a stronger authentication method is needed. The platform will analyze the gradient requirement value of each verification method based on this verification gradient requirement, i.e., the minimum authentication strength required for each authentication method (or its verification form). Each verification method has a predetermined verification gradient range, and the platform will determine whether the authentication method meets the current gradient requirement based on this range. Next, based on the verification gradient and evaluation requirement value of each authentication method, a gradient scheme search for authentication factor recording methods is performed. During this process, different authentication methods or combinations of authentication methods are evaluated. The goal is to find the authentication scheme with the minimum overlap of gradient methods and the maximum evaluation requirement value. Minimum overlap means avoiding the repeated use of multiple verification methods with the same characteristics, while the maximum evaluation requirement value means selecting the best-performing authentication methods to meet the current verification strength requirements. Finally, based on the search results, matching verification methods are obtained for each authentication method, i.e., authentication methods that meet the current verification gradient requirements. The verification form of each authentication method in the authentication process is also determined and applied as an authentication gradient constraint to ensure that the selected verification methods and forms meet the security requirements of the access request in subsequent authentication processes, while improving the efficiency and user experience of the authentication process.

[0043] Based on the authentication result of the user's authentication requirements, a space access permission result is sent. The space access permission result is used to control the user's access permission for trusted data.

[0044] Specifically, the system first verifies the user's access request based on their authentication requirements and the information provided during the verification process (such as passwords, biometrics, hardware tokens, etc.). If the user's authentication method meets the verification gradient requirements of the current access request, authentication passes; otherwise, authentication fails. The authentication result is fed back to the platform as the basis for subsequent access decisions. Once the user's authentication request passes verification, a spatial access permission result is generated based on the authentication result. This result clearly indicates whether the user has permission to access the requested data resource. For example, if the user passes high-strength authentication and their permissions allow access to sensitive data, then the user will be allowed to access that data; conversely, if the user's authentication fails to meet the requirements, or their permissions are insufficient to access a resource, the access request will be denied. In summary, based on the access permission result, data access permissions can be dynamically adjusted to ensure that only authenticated users who meet security requirements can access the corresponding data resources, while ensuring dynamic adaptation between the authentication mechanism and access requirements to prevent unauthorized access and potential security risks.

[0045] In some embodiments, sending the space access license result further includes:

[0046] A trust framework is established between different security domains, defining trust relationships and authentication information exchange mechanisms. When a user attempts to access cross-domain resources, a collaborative verification request is initiated based on the trust relationship and authentication information exchange mechanism, providing the user's authentication information. The domain where the resource resides makes an authentication decision based on the received authentication information and the matching authentication gradient, and sends the space access permission result.

[0047] Specifically, to achieve secure access to cross-domain resources, a cross-domain trust framework needs to be established, within which trust relationships and authentication information exchange mechanisms are defined. First, trust relationships between different security domains are defined. The core purpose of the trust framework is to ensure that only authenticated and authorized users can access resources in other domains. The access control system within each security domain establishes trust relationships with other domains, allowing trusted users to access data and services in one domain from another. Trust relationships are typically set based on factors such as authentication, data protection levels, access permission rules, and authentication history. Next, based on the established trust framework, an authentication information exchange mechanism is defined—that is, how to securely transmit user authentication information during cross-domain access. Encryption is typically used for cross-domain transmission to prevent malicious data tampering or leakage. Simultaneously, protocols and data formats are designed to ensure the compatibility of authentication information and the efficiency of exchange. For example, after a user successfully authenticates in domain A, domain A will transmit the user's authentication information, authentication status, and authentication level to domain B through a secure communication channel. Subsequently, when a user attempts to access cross-domain resources, the platform initiates a collaborative verification request based on trust relationships and authentication information exchange mechanisms. At this point, the user's authentication information is transmitted from the source domain (e.g., domain A) to the target resource's domain (e.g., domain B) through the authentication information exchange mechanism. Domain B, based on the received authentication information, the user's access permissions in domain B, and the matching authentication gradient, makes an authentication decision. For example, if the user is accessing highly sensitive data from domain B, domain B may require additional authentication measures (e.g., two-factor authentication); otherwise, the authentication strength requirement is lower. After the authentication decision, the access control system of the resource's domain generates a spatial access permission result based on the authentication result. This result clearly indicates whether the user has been granted access to the target resource. If the user passes authentication and meets the access conditions, the resource's domain will allow the user to access the corresponding resource and send an access permission result; if authentication fails or the user's permissions are insufficient, the access request will be rejected, and an access denial result will be returned. This process ensures secure access to cross-domain resources, guarantees efficient and secure exchange of authentication information between different domains, and effectively controls user access permissions to resources, thereby protecting data security and integrity.

[0048] In summary, the multi-factor authentication trusted data space access control method provided by this invention has the following technical effects:

[0049] The system parses the user's permissions, access records, access path, and requested access target to obtain user access parameters. Based on these parameters, it performs access verification security level matching based on the user's permissions, access records, access path, and requested access target to obtain a matching verification gradient. This gradient is then used to identify and match the user's authentication factor records, creating user authentication requirement factors with authentication gradient constraints. Based on the authentication result of these factors, a space access permission result is sent. This result controls the user's access permissions to trusted data, thereby achieving the technical effect of dynamically adjusting access permissions based on multi-factor authentication and effectively improving data security and trustworthiness during data space access.

[0050] Example 2, as Figure 2 This is a schematic diagram of the structure of the multi-factor authentication trusted data space access control platform of the present invention. For example, Figure 1 The flowchart of the multi-factor authentication trusted data space access control method of the present invention can be seen as follows: Figure 2 The structure shown is implemented.

[0051] Based on the same concept as the multi-factor authentication trusted data space access control method in the embodiments described above, the present invention also provides a multi-factor authentication trusted data space access control platform including:

[0052] User parsing module 11: Parses the user's permissions, access records, access path, and requested access target to obtain user access parameters; Security level matching module 12: Based on the user access parameters, performs access verification security level matching from the user's permissions, access records, access path, and requested access target to obtain a matching verification gradient; Factor identification and matching module 13: Uses the matching verification gradient to identify and match with the authentication factor record information of the requesting user to create authentication requirement factors for the requesting user, which have authentication gradient constraints; Access permission sending module 14: Based on the authentication result of the authentication requirement factors for the requesting user, sends a spatial access permission result, which is used to control the access permission permissions of the requesting user for trusted data.

[0053] In some embodiments, the security level matching module 12 includes:

[0054] Based on the user permissions, analyze the user permission type to determine the permission verification gradient; based on the access records, extract memory features to obtain the user record verification gradient; based on the access path, analyze the access device, network environment, and network access path confidence to determine the access network verification gradient; based on the requested access target, analyze the security level of the access target to obtain the access data verification gradient; based on the permission verification gradient, user record verification gradient, access network verification gradient, and access data verification gradient, extract the requirement constraint gradients of each dimension, and filter the verification gradient with the largest requirement constraint gradient to obtain the matching verification gradient.

[0055] In some embodiments, the security level matching module 12 includes:

[0056] Based on the user permissions, access records, access paths, and requested access targets, cross-gradient effects are applied to obtain cross-validation relationship coefficients; these cross-validation relationship coefficients are then used to correct the requirement constraint gradients and reset the matching validation gradients.

[0057] In some embodiments, the security level matching module 12 includes:

[0058] Based on the access records, user access permissions, access paths, access targets, access frequencies, access time habits, verification gradients, and verification results are extracted to obtain access memory features. Access permission level relationships and data relationship types are parsed based on the user permissions to obtain user permission relationship features. Cross-risk impact analysis is performed sequentially using the user permission relationship features, access memory features, access paths, and requested access targets to identify credible impact relationships for each dimension. These credible impact relationships represent the risk adjustment direction and degree of influence between dimensional features. The cross-validation relationship coefficients are configured using the credible impact relationships for each dimension.

[0059] In some embodiments, the security level matching module 12 includes:

[0060] An analysis network graph is constructed, including a first-order analysis network and a second-order analysis network. The first-order analysis network is used to analyze the self-verification requirement gradient of user permissions, access records, access paths, and requested access targets. The second-order analysis network is used to analyze the cross-validation relationships of each dimension. The user permission relationship features, access memory features, access paths, and requested access targets are sequentially imported according to the configured user permissions, access records, access paths, and requested access target graph nodes, outputting the first-order verification gradients of each dimension and the second-order cross-validation relationship coefficients. The second-order cross-validation relationship coefficients are used to adjust and correct the first-order verification gradients of each dimension to obtain the matching verification gradient.

[0061] In some embodiments, the factor identification and matching module 13 includes:

[0062] Establish a verification factor library for accessing users, which stores the user's authentication factor records, methods, and factor verification evaluations; use the matching verification gradient to identify in the verification factor library according to the verification gradient requirements, obtain the matching verification methods and the authentication gradient constraints corresponding to the verification methods, and obtain the authentication requirement factors for the requesting user.

[0063] In some embodiments, the factor identification and matching module 13 includes:

[0064] The multimodal verification forms of the authentication factor recording methods are analyzed to determine the verification evaluation values ​​of each form; the verification gradient and the evaluation requirement values ​​of each gradient are analyzed according to the matching verification gradient; based on the evaluation requirement values ​​of each gradient, the gradient schemes of the authentication factor recording methods are searched with the goal of minimizing the overlap of gradient methods and maximizing the evaluation requirement values, so as to obtain the matching verification methods of each gradient and the verification forms that satisfy the gradient evaluation requirement values ​​as authentication gradient constraints.

[0065] In some embodiments, the access license sending module 14 includes:

[0066] A trust framework is established between different security domains, defining trust relationships and authentication information exchange mechanisms. When a user attempts to access cross-domain resources, a collaborative verification request is initiated based on the trust relationship and authentication information exchange mechanism, providing the user's authentication information. The domain where the resource resides makes an authentication decision based on the received authentication information and the matching authentication gradient, and sends the space access permission result.

[0067] In embodiment three, the present invention also provides a computer-readable storage medium that can be used to store software programs, computer-executable programs, and modules, such as program instructions / modules corresponding to the multi-factor authentication trusted data space access control method in the embodiments of the present invention, thereby implementing the above-mentioned multi-factor authentication trusted data space access control method.

[0068] It should be understood that the embodiments disclosed in this invention and the above description enable those skilled in the art to implement this invention. However, this invention is not limited to the embodiments mentioned above. It should be understood that those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this invention, and should all be included within the protection scope of this invention.

Claims

1. A method for trusted data space access control with multi-factor authentication, characterized in that, The method comprises the following steps: user permission, access record, access path, request access target analysis of the user accessing the user access parameters; According to the user access parameters, the user permission, access record, access path, request access target is matched with the access verification security level, and the matching verification gradient is obtained; Using the matching verification gradient and the authentication factor record information of the request access user to identify and match, creating a request user authentication demand factor, the request user authentication demand factor has authentication gradient constraint; According to the authentication result of the request user authentication demand factor, the space access permission result is sent, which is used to control the access permission authority of the request access user to the trusted data; Obtaining the matching verification gradient comprises: Constructing an analysis network, including a first-order analysis network and a second-order analysis network, the first-order analysis network is used to analyze the self-authentication demand gradient of user permission, access record, access path and request access target, and the second-order analysis network is used to analyze the cross verification relationship of each dimension, wherein the user permission relationship feature, access memory feature, access path and request access target are imported in turn according to the configured user permission, access record, access path and request access target graph node, and the first-order verification gradient of each dimension and the second-order cross verification relationship coefficient are outputted; The first-order verification gradient of each dimension is adjusted and corrected by using the second-order cross verification relationship coefficient, and the matching verification gradient is obtained.

2. The multi-factor authenticated trusted data space access control method of claim 1, wherein, According to the user access parameters, the user permission, access record, access path, request access target is matched with the access verification security level, and the matching verification gradient is obtained, comprising: According to the user permission, the user permission type is analyzed, and the permission verification gradient is determined; According to the access record, the memory feature is extracted, and the user record verification gradient is obtained; According to the access path, the access device, network environment and network access path confidence are analyzed, and the access network verification gradient is determined; According to the request access target, the security level of the access target is analyzed, and the access data verification gradient is obtained; According to the permission verification gradient, the user record verification gradient, the access network verification gradient and the access data verification gradient, the demand constraint gradient of each dimension is extracted, the verification gradient with the largest demand constraint gradient is screened, and the matching verification gradient is obtained.

3. The multi-factor authenticated trusted data space access control method of claim 2, wherein, Obtaining the matching verification gradient further comprises: According to the user permission, access record, access path and request access target, the cross gradient influence is obtained, and the cross verification relationship coefficient is obtained; The demand constraint gradient is corrected by using the cross verification relationship coefficient, and the matching verification gradient is reset.

4. The multi-factor authenticated trusted data space access control method of claim 3, wherein, According to the user permission, access record, access path and request access target, the cross gradient influence is obtained, and the cross verification relationship coefficient is obtained, comprising: According to the access record, the user use permission, access path, access target, access frequency, access time habit, verification gradient and verification result are extracted, and the access memory feature is obtained; According to the user permission, the access permission level relationship and data relationship type are analyzed, and the user permission relationship feature is obtained; Cross risk influence analysis is performed on the user authority relationship feature, access memory feature, access path, and request access target in sequence to identify a trusted influence relationship in each dimension, and the trusted influence relationship is used to represent a risk adjustment direction and influence degree between dimension features; The cross verification relationship coefficient is configured by using the trusted influence relationship in each dimension.

5. The multi-factor authenticated trusted data space access control method of claim 1, wherein, A request user authentication demand factor is created by using the matching verification gradient and authentication factor record information of the request access user for identification matching, and the request user authentication demand factor includes: A verification factor library of the access user is established, which stores authentication factor record means and factor verification evaluation of the user; The matching verification gradient is identified in the verification factor library according to verification gradient demand to obtain a matching verification means and an authentication gradient constraint corresponding to the verification means, and the request user authentication demand factor is obtained.

6. The multi-factor authenticated trusted data space access control method of claim 5, wherein, The matching verification gradient is identified in the verification factor library according to verification gradient demand to obtain a matching verification means and an authentication gradient constraint corresponding to the verification means, including: A multi-modal verification form of the authentication factor record means is analyzed to determine an evaluation value of each form of verification; The matching verification gradient is analyzed to obtain a verification gradient and a gradient evaluation demand value; Based on the gradient evaluation demand value, a gradient scheme of the authentication factor record means is searched with the minimum gradient means overlap degree and the maximum evaluation demand value as the target to obtain a matching verification means of each gradient and a verification form satisfying the gradient evaluation demand value as an authentication gradient constraint.

7. The multi-factor authenticated trusted data space access control method of claim 1, wherein, The space access permission result also includes: A trust framework is established between different security domains to define a trust relationship and an authentication information exchange mechanism; When a request access user attempts to access a cross-domain resource, a collaborative verification request is initiated based on the trust relationship and the authentication information exchange mechanism to provide authentication information of the request access user; A domain where the resource is located makes an authentication decision based on the received authentication information and a matching authentication gradient and sends a space access permission result.

8. A multi-factor authenticated trusted data space access control platform, characterized by, A method for implementing the multi-factor authentication of the trusted data space access control method of any one of claims 1-7, including: A user analysis module: analyzing a user permission, access record, access path, and request access target of a request access user to obtain a user access parameter; A security level matching module: matching a verification security level from the user permission, access record, access path, and request access target based on the user access parameter to obtain a matching verification gradient; A factor identification matching module: creating a request user authentication demand factor by using the matching verification gradient and authentication factor record information of the request access user for identification matching, and the request user authentication demand factor has an authentication gradient constraint; An access permission sending module: sending a space access permission result based on an authentication result of the request user authentication demand factor, and the space access permission result is used to control access permission authority of the request access user to the trusted data.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the multi-factor authentication of the trusted data space access control method of any one of claims 1 to 7.

Images