Extensible authentication service processing system and method based on authentication unit

Abstract

The invention relates to the technical field of information system processing, and discloses an extensible authentication service processing system based on an authentication unit, which comprises an authentication unit modeling and process management module, a dynamic process optimization and resource scheduling module, an authentication template generation and auditing module, an encryption material processing and dynamic verification module and a system control and backup management module. The invention further provides an extensible authentication service processing method based on the authentication unit. The extensible authentication service processing method comprises the following steps of modeling the authentication unit, constructing a process matrix and decomposing the process matrix, constructing a conflict graph and screening parallel tasks, generating and auditing a template, encrypting materials and executing secret state verification, generating a version identifier and backing up and recovering an authentication state. According to the method, the authentication unit is introduced as a task basic component, unified modeling is performed in combination with the state vector and the resource vector, the technical effects of flow decoupling, clear structure and traceability are achieved, and the key bottleneck that the authentication flow in a large-scale system is difficult to schedule and expand in a unified manner is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of information system processing, and specifically to an extensible authentication service processing system and method based on an authentication unit. Background Art

[0002] With the continuous migration of various digital approval, authentication, and filing processes to the online environment, the structured management of identity information, qualification materials, and business processes has become increasingly important. Whether in the fields of industry access, application for professional qualifications, government supervision, professional review, credit authentication, etc., a large number of dynamically changing and diverse authentication requests need to be faced. These authentications often involve information collaboration at multiple levels such as document materials, process nodes, approval rules, and security levels. It is required to flexibly handle different authentication tasks, and at the same time, the entire process must be controllable, secure, and auditable.

[0003] In existing authentication systems, a template library mechanism is generally used to organize the process structure, and the authentication path and field rules are recorded through static configuration files or databases. This type of technology is highly efficient in processing standardized and high-frequency authentication tasks, and certain automatic audit capabilities can be achieved in cooperation with a rule engine. At the same time, some systems introduce queuing strategies or resource allocation models based on priorities, which can play a certain role in load balancing in scenarios with limited resources. In addition, there are also solutions that attempt to assist in the selection of process templates through a recommendation engine to improve the efficiency of authentication configuration. These mechanisms have shown a certain degree of stability and engineering controllability in traditional business scenarios.

[0004] However, with the highly diversified authentication scenarios and the increasing requirements for security and compliance, the limitations of the traditional template-driven mechanism have gradually emerged. On the one hand, the authentication process structure is redundant and updated frequently, resulting in high template maintenance costs, easy duplication of process logic, and loss of control of states. On the other hand, the static scheduling mechanism cannot fully identify resource conflicts and logical constraints between authentication tasks, leading to low execution efficiency. Although some systems support rule recommendation, they perform unstably when faced with no historical data or offset of the authentication path. In addition, a large amount of sensitive data involved in authentication materials mostly relies on local encryption or desensitization processing, and still needs to be decrypted for use in logical judgment, posing a risk of plaintext exposure, and there are structural shortcomings in privacy protection. Therefore, those skilled in the art have proposed an extensible authentication service processing system and method based on an authentication unit to solve the above problems. Summary of the Invention

[0005] Aiming at the deficiencies of the prior art, the present invention provides an extensible authentication service processing system and method based on an authentication unit, which solves the problems of poor scalability of the existing authentication system, rigidity of the scheduling mechanism, insufficient data protection, and invalidation of process templates in the prior art.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions: An extensible authentication service processing system based on an authentication unit, comprising: An authentication unit modeling and process management module, configured to receive an authentication request, construct an authentication unit structure, and generate an authentication process matrix including a state vector and a resource requirement vector; A dynamic process optimization and resource scheduling module, configured to perform matrix decomposition and conflict graph construction on the authentication process matrix, determine a set of authentication units that can be executed in parallel, and schedule resources for execution; An authentication template generation and review module, configured to generate an authentication template based on historical data and a new request and perform rule review when it is detected that the authentication request does not match a preset template; An encrypted material processing and dynamic verification module, configured to perform homomorphic encryption on authentication materials and perform logical determination and conditional verification in the encrypted state; A system control and backup management module, configured to generate version identifiers, perform periodic backups, and manage the restoration of authentication status during the execution of the authentication process.

[0007] Preferably, the authentication unit modeling and process management module includes: A unit initialization unit, configured to generate an authentication unit for each authentication request, where the authentication unit includes an authentication identifier, a state vector, a resource vector, a security level, material data, and a timestamp; A state vector construction unit, configured to map each stage of the authentication process to a state vector of a fixed dimension; A process matrix generation unit, configured to splice the state vectors and resource vectors of multiple authentication units to form an authentication process matrix.

[0008] Preferably, the dynamic process optimization and resource scheduling module includes: A matrix decomposition unit, configured to perform non-negative matrix decomposition on the authentication process matrix to extract process features and resource usage patterns; A constraint fusion unit, configured to embed a constraint matrix of security levels and logical orders in the matrix decomposition; A conflict graph construction unit, configured to construct a conflict graph based on resource overlap and policy differences between authentication units; A parallel screening unit, configured to extract a maximum weighted independent set according to the conflict graph to determine a set of authentication units to be executed in parallel.

[0009] Preferably, the authentication template generation and review module includes: A template generation unit, configured to construct an authentication process template through a generative adversarial network based on historical authentication process data and new authentication request data; A template discrimination unit, configured to perform process logic verification and field compliance verification on the generated authentication template; An audit execution unit is used to compare the authentication template with a preset rule set and determine whether the template is registered and stored in the database according to the comparison result.

[0010] Preferably, the encryption material processing and dynamic verification module includes: A material encryption unit is used to perform fully homomorphic encryption processing on key data fields in the authentication material; An encryption determination unit is used to perform encrypted Boolean logic judgment and numerical threshold comparison operations on the encrypted material; A verification optimization unit is used to encapsulate common logic judgment operations into an encryption calculation template and cache them for invocation.

[0011] Preferably, the system control and backup management module includes: A version generation unit is used to generate an authentication version identifier by combining the encrypted material with a timestamp; A data backup unit is used to periodically perform off-site encrypted storage of the current authentication unit structure and status data; A status recovery unit is used to recover the authentication unit status data from the most recent backup when the authentication process is interrupted, in error, or abnormal.

[0012] Preferably, the matrix decomposition unit minimizes the following objective function value: ; Where: Represents the authentication process matrix; Is the process feature matrix; Is the resource allocation matrix; Is the security level constraint matrix; Is the process logic sequence constraint matrix; Represents the Frobenius norm; Represents the element-wise product of matrices; 、 Are control weight parameters.

[0013] Preferably, the parallel screening unit constructs a maximum weighted independent set based on the following node weight function: ; Where: Represents the Node weight of the Th authentication unit; Is the security level value of this unit; And Are weight adjustment parameters.

[0014] Preferably, the encryption determination unit executes the following encrypted comparison logic: ; Wherein: represents the ciphertext value of a certain field in the authentication material; represents a preset encryption comparison threshold; is the ciphertext form of the logical judgment result.

[0015] The present invention also provides an extensible authentication service processing method based on an authentication unit, including the following steps: S1. Perform structured modeling on the authentication request to generate an authentication unit including a state vector, a resource vector, a security level, a material field, and a timestamp; S2. Combine multiple authentication units into a process matrix, perform matrix decomposition on the process matrix, and extract the potential process structure; S3. Construct a conflict graph between authentication units based on resource and policy conflicts, and calculate the maximum weighted independent subset; S4. When there is no matching template, generate an authentication template through a generative adversarial network based on historical data and new request data, and perform rule review; S5. Perform homomorphic encryption processing on the key fields in the authentication material, and perform logical verification operations in the ciphertext state; S6. Generate a version identifier from the authentication process data and the timestamp, and perform off-site encrypted backup regularly. When an exception occurs, perform authentication status recovery.

[0016] The present invention provides an extensible authentication service processing system and method based on an authentication unit. It has the following beneficial effects: 1. The present invention introduces an authentication unit as the basic component of the task, and unifies the modeling by combining the state vector and the resource vector, achieving the technical effects of process decoupling, clear structure, and traceability. Compared with the traditional authentication process construction method based on hard coding of business logic or multi-table splicing, it overcomes the problems of high process coupling and opaque state, and solves the key bottleneck that it is difficult to uniformly schedule and expand the authentication process in a large system.

[0017] 2. The present invention uses the method of matrix decomposition to fuse logical constraints to optimize the structure of the authentication process. Without relying on explicit rules or manual intervention, it realizes the goals of automatically extracting process features, identifying parallelism, and avoiding resource conflicts. Different from the previous authentication scheduling scheme based on static template driving, it solves the problems of low scheduling efficiency and frequent process deadlocks when dealing with high-concurrency complex tasks.

[0018] 3. The present invention uses a generative adversarial network to dynamically generate authentication templates and combines a rule review mechanism to automatically expand the authentication types, achieving the effect of no need for manual configuration and rapid adaptation to new authentication scenarios. Compared with the technical implementation of expanding the process by relying on a rule library or development work order in the traditional way, it avoids the interruption of the authentication process caused by template vacancies and breaks through the limitation of insufficient flexibility of the authentication system.

[0019] 4. The present invention embeds fully homomorphic encryption into the authentication material verification process to implement logical judgment in the ciphertext state. This mechanism ensures the full-process security of privacy data during transmission, storage, and verification, and does not damage the automation ability. Different from the plaintext judgment or segmented desensitization strategy in the prior art, it completely solves the problem that data leakage risk and automatic processing cannot be achieved at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is a schematic diagram of the system architecture of the present invention; Figure 2 It is a schematic diagram of the architecture of the authentication unit modeling and process management module of the present invention; Figure 3 It is a schematic diagram of the architecture of the dynamic process optimization and resource scheduling module of the present invention; Figure 4 It is a schematic diagram of the architecture of the authentication template generation and review module of the present invention; Figure 5 It is a schematic diagram of the architecture of the encryption material processing and dynamic verification module of the present invention; Figure 6 It is a schematic diagram of the architecture of the system control and backup management module of the present invention; Figure 7 It is a schematic diagram of the method flow of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0021] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0022] Please refer to the attached Figure 1 - attached Figure 6 , the embodiments of the present invention provide an extensible authentication service processing system and method based on an authentication unit, including: An authentication unit modeling and process management module, configured to receive an authentication request, construct an authentication unit structure, and generate an authentication process matrix including a state vector and a resource requirement vector; Specifically, in this embodiment, the authentication unit modeling and process management module constitutes the basic logic unit construction module of the authentication system of the present invention, which is mainly used to standardize each authentication service request into an independent authentication unit, and perform process management and matrix modeling through a unified structure, facilitating subsequent optimization scheduling and system expansion.

[0023] In this embodiment, when the authentication system receives an authentication request submitted by a user, the construction process of the "authentication unit" is first triggered by this module. The authentication unit is the smallest granularity authentication processing logic unit of the system.

[0024] During the generation of each authentication unit, the unit initialization unit will complete the initialization modeling. This initialization process includes the setting and binding of the following information fields: Authentication identifier: Used to uniquely identify the authentication unit, which is the basic field for subsequent data tracking, version generation, and archive management; Status vector: Used to describe the execution status of each stage in the current authentication process; Resource vector: Used to represent the system resources, computing capabilities, or manual intervention resources required to execute this authentication unit; Security level: Used to limit the access rights, encryption strength, and process priority of this unit in the system, ensuring differential processing of security policies; Material data: Includes materials related to the authentication application, such as product test reports, original record files, etc.; Timestamp: Used to mark the generation time of this authentication unit, and is subsequently used for version identifier generation and sequence recovery control.

[0025] In this embodiment, the structure of the authentication unit is encapsulated as a unified logical model to adapt to the differential data of different authentication types. In a preferred implementation, the authentication unit can be organized as an object or database entity with structured fields, facilitating decoupled calls by system modules.

[0026] To achieve unified modeling and batch processing of the authentication process, a representation method of the status vector is introduced in this embodiment. The construction of the status vector is completed by the status vector construction unit. The authentication process is split into several standard stages, such as "request submission", "material upload", "preliminary review completed", "on-site inspection", "certificate generation", etc. Each stage is mapped to a dimension in the status vector, and the value of this dimension represents the completion status of this stage.

[0027] In a preferred embodiment, the status vector is a fixed-length boolean vector or discrete state vector. For example, the length is The vector can represent the In each stage, each bit in the vector represents whether the corresponding stage has been completed or the current state. This design can describe the progress information of all types of authentication processes under a unified standard, which is conducive to horizontal comparison and batch optimization.

[0028] Corresponding to the state vector is the resource requirement vector introduced in this embodiment. This vector is automatically estimated by the system according to the attributes and task content of the authentication unit, such as the required expert review time, the computing volume of invoking the AI assistance model, the frequency of data interface calls, etc. This vector helps the subsequent resource scheduling module perform load balancing and conflict determination.

[0029] After the construction of the state vector and the resource vector is completed, multiple authentication units will be organized as a two-dimensional structure as a whole to form a unified authentication process matrix. This step is executed by the process matrix generation unit.

[0030] In a preferred implementation, the authentication process matrix is represented by a two-dimensional data in the following form: ; where: represents the state value of the th authentication unit in the th process stage; represents its demand value for the th resource dimension.

[0031] The entire matrix structure can simultaneously reflect the processing progress and resource requirements of each current authentication task in the system.

[0032] This authentication process matrix not only serves as a centralized expression carrier of the state, but also will be used as the input data source for the subsequent "dynamic process optimization and resource scheduling module", providing structured data support for process scheduling and parallel execution.

[0033] To ensure that the system has high flexibility when expanding the authentication type, the modeling process in this embodiment has the ability to be configured. The structure template of the authentication unit and the stage definition of the state vector can both be parameterized and set by the background management interface, allowing for personalized process modeling according to the authentication type (such as green product certification, voluntary certification, etc.).

[0034] In addition, the "timestamp" field bound to each authentication unit in the system is not only used for authentication cycle analysis, but also will be used as the core basis for version generation in the "system control and backup management module" to implement process snapshots and rollback recovery of the authentication unit.

[0035] Through the above settings of the modeling and matrixization mechanism, the present invention provides an authentication unit expression method that is universal for extended and multi-type authentication services, which not only improves the standardization degree of the data structure, but also provides an operable basic condition for subsequent scheduling and concurrency.

[0036] The dynamic process optimization and resource scheduling module is used to perform matrix decomposition and conflict graph construction on the authentication process matrix, determine the set of authentication units that can be executed in parallel, and schedule resources for execution; Specifically, in this embodiment, the dynamic process optimization and resource scheduling module is used to perform structured parsing and parallel scheduling on the authentication process matrix generated by the authentication unit modeling and process management module. The goal is to optimize the resource allocation structure and achieve efficient concurrent execution of multiple authentication units on the basis of meeting security and logical integrity.

[0037] In this embodiment, first, the matrix decomposition unit processes the authentication process matrix. The authentication process matrix is formed by splicing the state vectors and resource vectors of multiple authentication units, forming a unified two-dimensional data representation that includes authentication status and resource requirement information. This matrix can be formally expressed as: ; Where: represents the state vector matrix; represents the resource vector matrix; , is the number of authentication units, is the dimension of the state vector, is the resource dimension.

[0038] In order to extract potential process features and resource co-distribution patterns from the original matrix, in this embodiment, the non-negative matrix factorization (NMF) method is preferably used to decompose the original matrix into two low-rank matrices and , that is: ; Where: represents the projection of each authentication unit in the potential process feature space; represents the process state and resource combination corresponding to each feature. In this way, under the premise of maintaining the non-negative constraint of the data, the compressed modeling and decoupling processing of the process space can be realized.

[0039] In order to ensure that the constraint requirements of the authentication security level and the process logic sequence are integrated during the decomposition process, in this embodiment, two sparse constraint matrices are further introduced, namely the security level constraint matrix and the process logic sequence constraint matrix 。

[0040] Therefore, the matrix factorization objective function is designed as follows: ; Where: represents the authentication process matrix; is the process feature matrix; is the resource allocation matrix; is the security level constraint matrix; is the process logical sequence constraint matrix; represents the Frobenius norm; represents the element-wise product of matrices; 、 are control weight parameters.

[0041] In this objective function: The first term is the reconstruction error term, ensuring that the original process matrix can be restored as accurately as possible ; The second term is the process security constraint term, which punishes the mapping results that do not conform to the preset security level distribution; The third term is the logical sequence constraint term, which ensures that the process time sequence corresponding to the decomposition result still meets the logical sequence requirements.

[0042] The above matrix factorization result provides a low-dimensional and structure-optimized process expression basis for the scheduling of subsequent authentication tasks.

[0043] After the process matrix factorization is completed, the system enters the execution process of the conflict graph construction unit. The task of this unit is to graphically structure the information such as resource usage conflicts and security level differences between authentication units, and construct a conflict determination graph.

[0044] In this embodiment, the conflict graph construction method is as follows: Each authentication unit serves as a node in the graph; If there are resource dependency overlaps, security level contradictions, or process sequence constraint conflicts between two authentication units, an undirected edge is established between the nodes; Each edge can be assigned a conflict weight to represent the severity of the conflict, which is convenient for subsequent weight judgment.

[0045] After the graph construction is completed, the system will execute the scheduling logic of the parallel screening unit. This unit searches for a subset of authentication units that can be executed in parallel at the current moment based on the constructed conflict graph.

[0046] Preferably, in this embodiment, the Maximum Weighted Independent Set (MWIS) algorithm is used to extract the scheduling set. To this end, first, a node weight is assigned to each authentication unit node in the graph, and the weight function is set as follows: ; Where: represents the node weight of the th authentication unit; is the security level value of this unit; is the time urgency index; and are weight adjustment parameters.

[0047] Through the above weight function setting, the security requirements and time priorities of the authentication tasks can be balanced, ensuring that the system considers the coordination of business strategies and processing efficiency in scheduling.

[0048] Finally, the authentication unit set extracted by the Maximum Weighted Independent Set algorithm can be regarded as the parallel execution set within the current scheduling period. All authentication units in this set will be executed concurrently on the premise of non-conflicting resources, thereby improving the overall system operation efficiency.

[0049] To ensure the traceability of the system scheduling results and the stability of the scheduling process, the scheduling records in this embodiment will be stored in a structured manner and used to support scheduling rollback, task reconstruction, or recovery management after the interruption of the authentication process.

[0050] Through the above technical solution, the dynamic process optimization and resource scheduling module in this embodiment realizes the unified modeling and optimized scheduling control of resource conflicts, process constraints, and execution priorities among multiple authentication tasks, providing an efficient data flow orchestration foundation for the entire authentication system.

[0051] The authentication template generation and review module is used to generate an authentication template based on historical data and new requests and conduct rule review when it detects that the authentication request does not match the preset template; Specifically, in this embodiment, the authentication template generation and review module is used to automatically respond to the mismatch between the authentication request and the existing template during the operation of the authentication system, and jointly implement the generation, discrimination, and review of the authentication template through machine learning and rule inference technologies, and ensure that the generated template meets the system preset specification requirements in terms of semantic compliance and process logic.

[0052] In the startup phase of the authentication process, the system first determines whether the current authentication request can be directly matched with existing authentication templates. This determination is completed by the template comparison engine within the system. The comparison engine extracts key fields from the current authentication request, including the authentication type, the industry category to which the authentication subject belongs, the set of authentication object attributes, the type of required materials, etc., and performs a similarity calculation in the field vector space with the registered templates in the authentication template library.

[0053] When the system detects that the current request does not match any existing template, that is, the matching degree is lower than the preset threshold or there is a structural inconsistency in the key fields, the authentication template generation and review module will be automatically triggered and perform the following process: In this embodiment, the template generation process is responsible for the template generation unit, and its core is an authentication template generator and discriminator system constructed based on the generative adversarial network (GAN) architecture.

[0054] The generator model takes the following information as input: The field structure of the current authentication request; The template dataset of similar category tasks in the historical authentication process; The authentication process structure map defined within the system.

[0055] After the input information is vectorized and embedded, it is input into the generator neural network , and outputs a candidate authentication template . This generation process can be formally expressed as: ; Where: is a random noise variable used to generate diverse structure candidates; represents the historical authentication template dataset; represents the current authentication request field embedding.

[0056] The goal of the generator network is to learn the sequence arrangement method, the field dependence structure, and the rule adaptation boundary of each stage in the authentication process of the authentication task, so as to construct candidate authentication templates with complete structural logic.

[0057] In order to make a preliminary discrimination on the validity of the generated template, in this embodiment, a template discriminator unit is introduced to perform structural and compliance verification on the generated authentication template . This unit includes two sub-functional modules inside: The process logic verification module is used to check whether the internal stage sorting of the template conforms to the logical constraints of the preset authentication flow chart, such as whether there are loops, deadlocks, or illegal stage jumps; The field compliance verification module is used to check whether there are problems such as missing fields, duplicate fields, or inconsistent data types in the authentication template.

[0058] In this embodiment, the process logic verification is implemented by constructing a directed acyclic graph (DAG) structure, where nodes represent authentication stages and edges represent the dependency order between stages. The system uses a topological sorting algorithm to detect the legality of the process. If there are loops or illegal jump paths in the flowchart formed by the generated template, the template logic is directly determined to be incorrect.

[0059] For field compliance verification, based on the predefined field dictionary and field mapping rules, the field sets of each authentication stage in the template are matched and type-verified to ensure compliance with the structural semantic specifications.

[0060] When the generated template passes the above preliminary discrimination, it enters the execution process of the audit execution unit. The audit execution unit is responsible for comparing the template item by item with the preset rule set stored in the system to determine whether the template has the value of being stored in the library and the legality of registration.

[0061] In this embodiment, the preset rule set includes but is not limited to the following rule types: Authentication stage structure rules: used to specify the basic structures that each stage should have in various authentication services, such as whether the stages of "expert preliminary review" and "material upload" must be included; Field and main industry mapping rules: used to ensure the associated consistency between the industries to which different authentication entities belong and the field structures; Security level configuration rules: used to audit whether reasonable access control levels and data permission boundaries are configured for each stage in the template.

[0062] The audit execution unit abstracts the generated template structure into a rule vector , and matches it with the system preset rule matrix . Formally, it can be expressed as: ; Where: is the rule matching function, and the output is a boolean result , indicating whether the template meets all the current rule conditions.

[0063] If the template passes the rule audit, the audit execution unit will register the generated template structure information in the template library and synchronously update the authentication template index table for subsequent authentication requests to call. If it fails, the template will be recorded in the candidate failure item log and used to train the next generation model to continuously optimize the performance of the generator.

[0064] In this embodiment, to ensure that the authentication template system has the ability of continuous learning and updating, a feedback closed-loop is constructed between the template generation unit and the discrimination unit through an adversarial training mechanism. Each template that fails the review will be fed back to the generator network as a "negative sample" to guide the correction of its generation strategy, thereby improving the quality of the template structure.

[0065] Through the above design, the authentication template generation and review module in the present invention can not only dynamically adapt to the requirements of new authentication tasks, but also ensure that the generated results meet semantic consistency, structural rationality, and rule compliance, providing a structural basis for the continuous evolution and expansion of the authentication system.

[0066] The encrypted material processing and dynamic verification module is used to perform homomorphic encryption on the authentication materials and perform logical determination and conditional verification in the encrypted state; Specifically, in this embodiment, the encrypted material processing and dynamic verification module is used to process the authentication materials containing sensitive information in the authentication process, and realize the logical judgment and conditional verification of the authentication data in the encrypted state based on the homomorphic encryption technology, so as to ensure the coordinated unity of data security and process automation processing capabilities.

[0067] During the operation of the system, when the authentication unit is initialized and receives the authentication materials uploaded by the user, this module is first triggered by the material encryption unit. This unit performs fully homomorphic encryption processing on the key fields in the material data, such as test index results, evaluation scores, review opinions, etc.

[0068] Preferably, in this embodiment, the encryption algorithm can adopt homomorphic encryption schemes such as BFV or CKKS, and the specific selection is flexibly set according to the requirements of the authentication service for accuracy and performance.

[0069] To implement the encryption processing of the material data, the system first converts the key field data into a numerical representation, and then completes the ciphertext generation process through the public key encryption function : ; where: represents the th key field value in the original material; is its ciphertext form; is the encryption function, and the public key is uniformly maintained by the authentication system.

[0070] After encryption, the material data is stored in ciphertext state and transmitted to the subsequent processing process. Then, the encryption determination unit takes over and executes the relevant verification logic.

[0071] This determination unit supports various types of encrypted state logical judgments and numerical comparison operations, and does not require decryption of the ciphertext, thus retaining the integrity of the business logic while protecting privacy.

[0072] In this embodiment, the system supports the following form of encrypted comparison logic operations: ; Where: represents the ciphertext value of a certain field in the authentication material; represents the preset encryption comparison threshold; is the ciphertext form of the logical judgment result.

[0073] To implement the above operations, in this embodiment, the comparison logic design is completed by combining the construction of Boolean gates with the encrypted arithmetic circuit. The system converts the common comparison operations (such as "whether it exceeds the threshold", "whether it is within the range", "whether it is equal to a certain flag bit", etc.) into circuit expressions in the encrypted state and transmits them to the fully homomorphic computing engine for execution.

[0074] Since branch judgment cannot be directly executed in the encrypted state, this embodiment introduces a secure multiplexer to construct an encrypted conditional execution path to avoid intermediate leakage. This mechanism realizes conditional path selection by calculating the following function: ; Where: For the input parameter the expected value calculated; For the input parameter the expected value calculated; For the expected value; is the ciphertext of the Boolean judgment result, and the system selects and retains or 's calculation result according to its value, thereby realizing the encrypted reconstruction of the branch logic.

[0075] To improve the processing efficiency and reduce the overhead of repeated calculations, a verification optimization unit is introduced in this embodiment. This unit is responsible for encapsulating the frequently used logical judgment operations in the system into encrypted calculation templates and performing local caching processing for quick reuse by subsequent authentication tasks.

[0076] The encapsulated logical templates include but are not limited to the following structures: Interval determination template: used to determine whether a certain field value falls within a given encrypted interval; Threshold comparison template: used to perform operations such as greater than, less than, equal to, etc.; Multi-condition logic combination template: supports the series and nested operations of logical operations such as AND, OR, NOT, etc. in the encrypted state.

[0077] During operation, the system will dynamically load the ciphertext templates according to the task requirements, construct an encryption operation graph in combination with the input ciphertext parameters, and automatically execute by the homomorphic computing engine to generate an encryption judgment result, avoiding repeated construction of the operation path and improving the overall processing performance.

[0078] Throughout the process, the system does not decrypt the ciphertext data, and all judgment logics and operations are completed in the ciphertext space, ensuring the full-process confidentiality of the data during the authentication process.

[0079] Finally, the ciphertext calculation result is received by the subsequent module, and selective decryption is performed in combination with the authorization key in the system, and the content is restored only under the secure node with permissions, for further generation of the authentication conclusion or report output.

[0080] Through the above structure and processing flow, this embodiment provides a data encryption processing mechanism with high security, structurality, and automation characteristics, enabling the authentication system to maintain the full-process automatic judgment ability without sacrificing the privacy protection ability when facing highly sensitive authentication materials, and providing an important encryption support mechanism for sensitive industry authentication tasks.

[0081] The system control and backup management module is used to generate version identifiers, perform periodic backups, and manage the restoration of the authentication status during the execution of the authentication process.

[0082] Specifically, in this embodiment, the system control and backup management module is used to achieve full controllability management of the authentication process execution, specifically including periodic snapshots of the execution status of the authentication unit, generation and identification of process versions, and data restoration and status reconstruction operations in case of exceptions, so as to ensure that the system has high reliability and continuity in complex authentication scenarios.

[0083] In this embodiment, after the authentication process initializes the authentication unit, the system control and backup management module is in a resident running state and maintains a data subscription relationship with the process execution engine. When the system detects a change in the authentication unit status or an event of updated authentication materials, the version generation unit is first triggered to generate the corresponding authentication version.

[0084] The version generation unit generates a unique identifier by combining the encrypted form of the authentication materials and the authentication timestamp recorded by the system. The specific process is as follows: After the authentication materials are processed by the material encryption unit in Module Four, a ciphertext-form dataset is generated, denoted as . At the same time, the system records the current timestamp when the authentication unit status changes . The above two elements are jointly hashed through a hash function to generate the version identifier: ; Where: Indicates the authentication version identifier generated by the th state change; Indicates a string concatenation operation; Indicates an irreversible hash algorithm selected by the system (such as the preferred SHA series algorithms).

[0085] The generated version identifier has non-forgeability and time-dependency, and is used for subsequent process tracking and change location.

[0086] Subsequently, the data backup unit will automatically perform off-site backups of the current authentication unit structure status and its associated authentication material snapshots within the period set by the system. The backup content includes: The field values in the current authentication unit structure, such as authentication identifiers, status vectors, resource vectors, security levels, etc.; The current material data ciphertext; The current version identifier; The current scheduling tag and process position pointer.

[0087] To ensure the confidentiality and integrity of data during transmission and storage, the system preferably uses a symmetric encryption algorithm to encrypt and package the backup data and transmit it to an off-site storage node. The data encryption uses a periodic key generated by an independent key management system to ensure that the backup data has time-sensitive control.

[0088] The off-site backup node can be constructed through a distributed storage platform, and the system adopts a segmented storage and redundant coding mechanism to ensure the availability and anti-tampering ability of the data.

[0089] When an abnormality occurs in the authentication process, such as execution interruption, system failure, network interruption, manual termination, etc., the status recovery unit will be automatically activated to start the recovery process.

[0090] This status recovery process includes the following operation steps: The system first retrieves the version identifier of the most recent successful backup from the backup index table based on the unique identifier of the current authentication unit . Subsequently, extract the authentication unit structure and material data snapshot related to from the off-site storage node.

[0091] During the recovery operation process, the system reloads the status vector and resource vector, and resynchronizes the process execution pointer to the corresponding process node position. The authentication material data is also restored to the state before the abnormality occurred and remounted to the authentication unit.

[0092] The recovery process is supervised by the built-in process consistency check logic, and the system will perform structural integrity checks, field consistency checks, and logical pointer verifications on the restored state structure to ensure that the authentication process still has a legal execution path after recovery.

[0093] In addition, to avoid system logic deviation caused by state replay attacks, each recovery operation in this embodiment will automatically trigger the generation of a new version and record the system recovery flag for subsequent analysis by the audit system.

[0094] The system control and backup management module also provides an interface for supervision, allowing the system administrator to manually initiate operations such as status comparison, forced recovery, and version tracing, to achieve the ability of manual intervention in process control.

[0095] Through the above mechanism, this embodiment provides a process control and recovery framework suitable for highly sensitive authentication services, ensuring that the authentication process can still be quickly and accurately restored to a running state after interruption at any node, avoiding damage to authentication data or failure of business processing, and enhancing the robustness and sustainability of the overall system operation.

[0096] The scalable authentication service processing method based on the authentication unit described below can be correspondingly referred to the scalable authentication service processing system based on the authentication unit described above.

[0097] Please refer to the appendix Figure 7 , the present invention also provides a scalable authentication service processing method based on the authentication unit, including the following steps: S1. Perform structured modeling on the authentication request to generate an authentication unit containing a state vector, a resource vector, a security level, a material field, and a timestamp; S2. Combine multiple authentication units into a process matrix, perform matrix decomposition on the process matrix, and extract the potential process structure; S3. Construct a conflict graph between authentication units based on resource and policy conflicts, and calculate the maximum weighted independent subset; S4. When there is no matching template, generate an authentication template through a generative adversarial network based on historical data and new request data, and perform rule review; S5. Perform homomorphic encryption processing on the key fields in the authentication materials, and perform logical verification operations in the ciphertext state; S6. Generate a version identifier from the authentication process data and the timestamp, and perform off-site encrypted backup regularly. When an exception occurs, perform authentication state recovery.

[0098] Specifically, for S1: After receiving the authentication request, the system performs structured parsing and modeling operations on it. This modeling process comprehensively considers elements such as the identity information, business content, submission time, and sensitivity level in the authentication request to construct an authentication unit. Each authentication unit at least includes structural fields such as a state vector, a resource vector, a security level, a material field, and a timestamp, which are used to completely describe the logical state and resource dependency relationship of the authentication request.

[0099] S2: Organize multiple modeled authentication units into a process matrix according to the task arrangement, representing the set of current business to be processed by the authentication system. On this basis, the system performs matrix decomposition operations (such as singular value decomposition, non-negative matrix decomposition, etc.) on this process matrix to identify potential process execution patterns and authentication dependency structures, and improve the scheduling optimization ability and path adaptation ability of the authentication flow.

[0100] S3: Based on the resource occupancy and security policy conflict information between authentication units, construct a conflict graph. Each node in the conflict graph represents an authentication unit, and the existence of an edge indicates an unparallelizable conflict relationship between the two. The system further solves the maximum weighted independent subset in this graph structure as the set of authentication tasks that can be processed concurrently in the current scheduling cycle.

[0101] S4: When the authentication request to be processed does not match the existing authentication template, the system generates a potentially matching authentication template structure based on historical authentication data and new request data through a pre-trained generative adversarial network model. The generated template needs to undergo policy review and business compliance verification by the built-in rule engine to ensure that the generated structure meets the current authentication specifications and security requirements.

[0102] S5: Perform homomorphic encryption processing on the key field data in the authentication materials, so that the material data participates in subsequent logical judgments in the ciphertext state. Without decrypting the data, the system completes operations such as numerical comparison, interval determination, and conditional combination judgment between fields through a ciphertext logic circuit, ensuring the coexistence of privacy and operability of the data in the authentication process.

[0103] S6: During the execution of the authentication process, the system combines the core data fields of the authentication unit with the time stamp and uses the hash digest algorithm to generate a unique authentication version identifier for marking and tracing the authentication status. At the same time, the system automatically performs off-site encrypted backup of the current authentication status and structure data at a set period. When the authentication process is interrupted, fails, or exhibits abnormal behavior, the system can quickly restore the authentication status and reconstruct the process by reading the last successful backup data, ensuring the continuity and reliability of the authentication service.

[0104] The method of this embodiment can be used to implement the above system embodiment, and its principle and technical effects are similar, so they will not be elaborated here.

[0105] Although the embodiments of the present invention have been shown and described, for those of ordinary skill in the art, it can be understood that various changes, modifications, substitutions, and variations can be made to these embodiments without departing from the principle and spirit of the present invention. The scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. An extensible authentication service processing system based on an authentication unit, characterized in that It includes: The authentication unit modeling and process management module is used to receive an authentication request, construct the authentication unit structure, and generate an authentication process matrix containing a state vector and a resource requirement vector; The dynamic process optimization and resource scheduling module is used to perform matrix decomposition and conflict graph construction on the authentication process matrix, determine a set of authentication units that can be executed in parallel, and schedule resources to execute; The authentication template generation and review module is used to generate an authentication template based on historical data and a new request and perform rule review when it detects that the authentication request does not match the preset template; The encrypted material processing and dynamic verification module is used to perform homomorphic encryption on the authentication materials and perform logical judgment and conditional verification in the encrypted state; The system control and backup management module is used to generate version identifiers, perform periodic backups, and manage the restoration of the authentication status during the execution of the authentication process.

2. The scalable authentication service processing system based on an authentication unit according to claim 1, wherein The authentication unit modeling and process management module includes: The unit initialization unit is used to generate an authentication unit for each authentication request, and the authentication unit includes an authentication identifier, a state vector, a resource vector, a security level, material data, and a timestamp; The state vector construction unit is used to map each stage of the authentication process into a state vector with a fixed dimension; The process matrix generation unit is used to splice the state vectors and resource vectors of multiple authentication units to form an authentication process matrix.

3. The scalable authentication service processing system based on an authentication unit according to claim 1, wherein The dynamic process optimization and resource scheduling module includes: The matrix decomposition unit is used to perform non-negative matrix decomposition on the authentication process matrix to extract process features and resource usage patterns; The constraint fusion unit is used to embed a constraint matrix of security levels and logical orders in the matrix decomposition; The conflict graph construction unit is used to construct a conflict graph based on resource overlap and policy differences between authentication units; The parallel screening unit is used to extract the maximum weighted independent set according to the conflict graph to determine a set of authentication units that can be executed in parallel.

4. The scalable authentication service processing system based on an authentication unit according to claim 1, wherein The authentication template generation and review module includes: The template generation unit is used to construct an authentication process template through a generative adversarial network based on historical authentication process data and new authentication request data; The template discrimination unit is used to perform process logic verification and field compliance verification on the generated authentication template; The review execution unit is used to compare the authentication template with a preset rule set and decide whether to register and store the template according to the comparison result.

5. The scalable authentication service processing system based on an authentication unit according to claim 1, wherein The encrypted material processing and dynamic verification module includes: The material encryption unit is used to perform fully homomorphic encryption processing on the key data fields in the authentication materials; The encryption determination unit is used to perform encrypted Boolean logic judgment and numerical threshold comparison operations on the encrypted materials; The verification optimization unit is used to encapsulate common logic judgment operations into an encrypted calculation template and cache it for calling.

6. The scalable authentication service processing system based on an authentication unit according to claim 1, wherein The system control and backup management module includes: The version generation unit is used to generate an authentication version identifier by combining the encrypted materials and timestamps; The data backup unit is used to periodically store the current authentication unit structure and status data in an encrypted manner in a remote location; The status restoration unit is used to restore the authentication unit status data from the most recent backup when the authentication process is interrupted, in error, or abnormal.

7. The scalable authentication service processing system based on an authentication unit according to claim 3, wherein The matrix decomposition unit minimizes the following objective function value: ； Wherein: represents the authentication process matrix; is the process feature matrix; is the resource allocation matrix; is the security level constraint matrix; is the process logical sequence constraint matrix; represents the Frobenius norm; represents the element-wise product of matrices; and is the control weight parameter.

8. The scalable authentication service processing system based on an authentication unit according to claim 3, wherein The parallel screening unit constructs a maximum weighted independent set based on the following node weight function: ； Wherein: represents the node weight of the th authentication unit; is the security level value of this unit; is the time urgency index; and is the weight adjustment parameter.

9. The scalable authentication service processing system based on an authentication unit according to claim 5, wherein The encryption determination unit executes the following encrypted comparison logic: ； Wherein: represents the ciphertext value of a certain field in the authentication material; represents a preset encryption comparison threshold; is the ciphertext form of the logical judgment result.

10. A scalable authentication service processing method based on an authentication unit, which is applied to the scalable authentication service processing system according to any one of claims 1-9, and is characterized in that, It includes the following steps: S1. Perform structured modeling on the authentication request to generate an authentication unit including a state vector, a resource vector, a security level, a material field, and a timestamp; S2. Combine multiple authentication units into a process matrix, perform matrix decomposition on the process matrix, and extract the potential process structure; S3. Construct a conflict graph between authentication units based on resource and policy conflicts, and calculate the maximum weighted independent subset; S4. When there is no matching template, generate an authentication template through a generative adversarial network based on historical data and new request data and conduct rule review; S5. Perform homomorphic encryption processing on the keyword fields in the authentication materials, and execute logical verification operations in the ciphertext state; S6. Generate a version identifier from the authentication process data and the timestamp, and perform off-site encrypted backup regularly. When an exception occurs, perform authentication status recovery.

Images