A multi-node multi-factor security authentication method and system

Abstract

This application proposes a multi-node multi-factor security authentication method and system, which belongs to the field of computer security authentication. Among them, the method includes: first receiving the authentication behavior of the user end and counting the proportion of malicious authentication samples; then counting the average proportion of the trigger frequency of the multi-time window of the authentication behavior, and using 1 minus the average to set it as the abnormal weight; based on the abnormal weight, weighting the proportion of malicious authentication samples to obtain an authentication strength evaluation value; when the authentication strength evaluation value reaches the threshold, constructing a zero-knowledge proof R1CS constraint based on a preset authentication factor array; performing BLS signature aggregation verification through a distributed node network to obtain an authentication log; finally, writing the Merkle root of the authentication log into the blockchain to complete the audit and evidence storage. This application dynamically evaluates authentication risks based on user behavior and adaptively adjusts authentication strength to avoid redundant authentication and insecure authentication, thereby improving authentication security and user experience.

Description

Technical Field

[0001] The present invention relates to the field of computer security authentication, and in particular to a multi-node multi-factor security authentication method and system. Background Art

[0002] With the rapid development of information technology and the increasing threat of cybersecurity, identity authentication, as the first line of defense for information system security, has become increasingly important. Multi-factor authentication, as an effective identity verification mechanism, combines multiple authentication factors (such as passwords, biometrics, and hardware tokens) to enhance information system security and has been widely adopted in various information systems.

[0003] However, existing multi-factor authentication methods generally employ static authentication strategies, requiring identity verification to proceed according to a fixed, pre-set authentication process regardless of changes in user behavior. When users are in low-risk environments or experiencing normal behavior, information systems still require them to complete all pre-set authentication steps, resulting in redundant authentication. This not only increases the user's operational burden but also reduces user experience and system efficiency. When user behavior exhibits anomalies or is in high-risk environments, static authentication may be insufficient to address potential security threats, leading to unsafe authentication and potentially posing security risks to information systems. Summary of the Invention

[0004] The present invention aims to solve the technical problem that the multi-factor authentication method in the prior art is static authentication and cannot dynamically adjust the authentication strength according to the user's behavior status, resulting in redundant authentication or insecure authentication. The present invention provides a multi-node multi-factor security authentication method and system to solve the problem.

[0005] The technical solution of the present invention to solve the above technical problems is as follows:

[0006] In a first aspect, the present invention provides a multi-node multi-factor security authentication method, including: receiving authentication behavior of a user terminal, retrieving samples of similar behavior to count the proportion of malicious authentication samples; counting the average proportion of trigger frequencies of the authentication behavior in multiple time windows on the user terminal, and subtracting the average proportion of trigger frequencies in multiple time windows from 1 to set the abnormal weight; based on the abnormal weight, weighting the proportion of malicious authentication samples to obtain an authentication strength evaluation value; when the authentication strength evaluation value is greater than or equal to an authentication strength threshold, constructing a zero-knowledge proof R1CS constraint based on a preset authentication factor array; performing BLS signature aggregation verification on the zero-knowledge proof R1CS constraint through a distributed node network to obtain an authentication log; and writing the Merkle root of the authentication log into a blockchain to complete audit evidence storage.

[0007] In a second aspect, the present invention provides a multi-node multi-factor security authentication system, including: a malicious sample statistics module, which is used to receive the authentication behavior of the user terminal, retrieve similar behavior samples and count the proportion of malicious authentication samples; an abnormal weight determination module, which is used to count the average proportion of the trigger frequency of the authentication behavior in multiple time windows on the user terminal, and use 1 minus the average proportion of the trigger frequency of the multiple time windows to set it as the abnormal weight; an authentication strength assessment module, which is used to weight the proportion of malicious authentication samples based on the abnormal weight to obtain an authentication strength assessment value; a constraint construction module, which is used to construct a zero-knowledge proof R1CS constraint based on a preset authentication factor array when the authentication strength assessment value is greater than or equal to the authentication strength threshold; a signature verification module, which is used to perform BLS signature aggregation verification on the zero-knowledge proof R1CS constraint through a distributed node network to obtain an authentication log; an audit evidence module, which is used to write the Merkle root of the authentication log into the blockchain to complete the audit evidence.

[0008] The beneficial effects of the present invention are:

[0009] The system receives authentication behavior from the user, retrieves samples of similar behaviors, and calculates the proportion of malicious authentication samples. Through historical data analysis, it establishes a risk baseline for the current authentication behavior. It calculates the average frequency ratio of authentication behavior triggering in multiple time windows on the user side, and uses 1 minus the average frequency ratio to set the anomaly weight. The degree of behavioral anomaly is quantified by analyzing the temporal distribution characteristics of user behavior. Based on the anomaly weight, it weights the proportion of malicious authentication samples to obtain an authentication strength assessment value. By combining historical risk data with the current degree of behavioral anomaly, it dynamically calculates the authentication strength requirement appropriate for the current situation. When the authentication strength assessment value is greater than or equal to the authentication strength threshold, it constructs a zero-knowledge proof (R1CS) constraint based on a preset authentication factor array. When high-strength authentication is required, a multi-factor authentication mechanism is activated, while protecting user privacy information through zero-knowledge proof technology. Through a distributed node network, the zero-knowledge proof (R1CS) constraint is aggregated and verified using the BLS signature to obtain an authentication log. A multi-node collaborative verification mechanism is used to improve the reliability of the authentication results and the system's fault tolerance. The Merkle root of the authentication log is written to the blockchain for audit and verification, ensuring the traceability of the authentication process and the immutability of the audit data.

[0010] Through the above technical solution, the purpose of dynamically evaluating authentication risks based on user behavior and adaptively adjusting authentication strength is achieved, effectively avoiding redundant authentication and insecure authentication problems. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 A schematic diagram of a multi-factor security authentication method for multiple nodes provided by the present invention;

[0012] Figure 2This is a structural diagram of a multi-node multi-factor security authentication system provided by the present invention.

[0013] In the accompanying drawings, the components represented by the reference numerals are as follows:

[0014] Malicious sample statistics module 11, abnormal weight determination module 12, authentication strength assessment module 13, constraint construction module 14, signature verification module 15, audit evidence module 16. DETAILED DESCRIPTION

[0015] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making any creative efforts shall fall within the scope of protection of the present invention.

[0016] In the description of the present invention, the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of the technical features indicated. Therefore, a feature specified as "first" or "second" may explicitly or implicitly include one or more of the specified features. In the description of the present invention, "plurality" means two or more, unless otherwise specifically defined.

[0017] In the description of the present invention, the term "for example" is used to mean "used as an example, illustration or illustration". Any embodiment of the present invention described as "for example" is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is given to enable any person skilled in the art to implement and use the present invention. In the following description, details are listed for the purpose of explanation. It should be understood that a person of ordinary skill in the art can recognize that the present invention can be implemented without using these specific details. In other examples, well-known structures and processes are not elaborated in detail to avoid obscuring the description of the present invention with unnecessary details. Therefore, the present invention is not intended to be limited to the embodiments shown, but is consistent with the widest scope consistent with the principles and features disclosed herein.

[0018] Example 1, as Figure 1 As shown, an embodiment of the present invention provides a multi-node multi-factor security authentication method, including:

[0019] S1. Receive authentication behavior from the user, retrieve samples of similar behavior, and calculate the proportion of malicious authentication samples.

[0020] Specifically, first, an authentication behavior request is received from the user side. The authentication behavior includes but is not limited to user login operations, requests to access sensitive resources, permission change applications and other interactive behaviors related to identity authentication. After receiving the authentication behavior, a similar behavior sample retrieval mechanism is started. Specifically, feature extraction is performed on the received authentication behavior to obtain the characteristic parameters of the current authentication behavior, such as authentication timestamp, source IP address, device characteristics, user agent identification, authentication type, access resource path, session duration, operation sequence mode, network environment parameters, etc.; based on the characteristic parameters of the current authentication behavior, a set of similar behavior samples that match its attributes are retrieved from a pre-established historical behavior sample database. The matching criteria of the similar behavior samples include but are not limited to the similarity of multi-dimensional attributes such as authentication type, time characteristics, geographic location, device characteristics, and operation mode.

[0021] After obtaining a set of similar behavior samples, we identify the security labels for the samples within that set, count the number of samples marked as malicious authentication, and calculate the ratio of malicious authentication samples to the total number of similar behavior samples to obtain the malicious authentication sample ratio. This malicious authentication sample ratio reflects the historical security risk level of the current authentication behavior type and provides basic data support for subsequent authentication strength assessments.

[0022] Through the above processing, a preliminary risk quantitative assessment of the current authentication behavior can be conducted based on historical data, laying a data foundation for dynamically adjusting the authentication strategy.

[0023] S2. Count the average proportion of the authentication behavior triggering frequency in multiple time windows on the user end, and subtract the average proportion of the authentication behavior triggering frequency in multiple time windows from 1 to set the result as the abnormality weight.

[0024] Specifically, a multi-time window statistical analysis is performed on the historical triggering pattern of the authentication behavior on the user side. Specifically, according to the preset time window division strategy, the historical time period is divided into multiple continuous time windows, and each time window has the same time span. In each time window, the triggering frequency of the authentication behavior is counted, and the proportion of the triggering frequency in the sum of the triggering frequencies of all authentication behaviors in the corresponding time window is calculated, so as to obtain the triggering frequency proportion of a single time window. Subsequently, the triggering frequency proportions of multiple time windows are statistically processed, and the arithmetic mean of the triggering frequency proportions of multiple time windows is calculated to obtain the mean of the triggering frequency proportions of multiple time windows, which reflects the degree of normalized triggering of the authentication behavior on the user side.

[0025] Based on reverse thinking from user behavior anomaly detection, the anomaly weight is calculated by subtracting the average trigger frequency ratio across multiple time windows from 1. The logic behind this anomaly weight calculation is that a higher average trigger frequency ratio for a particular authentication behavior indicates that the behavior is more consistent with the user's typical usage patterns and is less abnormal. Conversely, a lower average trigger frequency ratio indicates that the behavior deviates more from the typical pattern and is therefore subject to a higher anomaly weight.

[0026] By determining the above-mentioned abnormal weight, the degree of deviation of the current authentication behavior from the user's historical behavior pattern can be quantified, providing a numerical basis for the abnormal behavior for the subsequent dynamic adjustment of the authentication strength.

[0027] S3. Based on the abnormal weight, weight the proportion of malicious authentication samples to obtain an authentication strength evaluation value.

[0028] Specifically, the anomaly weight is used as a risk amplification factor and mathematically calculated against the proportion of malicious authentication samples. The weighted calculation formula is: Authentication Strength Assessment = Anomaly Weight × Malicious Authentication Sample Percentage. This weighted calculation effectively integrates historical risk data with the current level of behavioral anomaly.

[0029] The principle of the above weighting mechanism is that when a user's authentication behavior deviates from its historical normal pattern (the anomaly weight is large), even if the proportion of historical malicious samples of such behavior is relatively low, the risk assessment level of the authentication behavior will still be increased; on the contrary, when a user's authentication behavior is consistent with its historical usage habits (the anomaly weight is small), even if such behavior has certain historical security risks, the risk assessment level will be moderately lowered.

[0030] The authentication strength assessment value obtained through this weighted calculation comprehensively reflects the dual risk characteristics of the current authentication behavior. On the one hand, it reflects the historical security risk level of this type of authentication behavior, and on the other hand, it reflects the degree of abnormality of the current behavior relative to the user's individual behavior patterns. This authentication strength assessment value provides a quantitative decision-making basis for dynamically adjusting authentication strength, thereby implementing an adaptive authentication strategy based on risk level.

[0031] S4. When the authentication strength evaluation value is greater than or equal to the authentication strength threshold, construct a zero-knowledge proof R1CS constraint based on a preset authentication factor array.

[0032] Specifically, based on the obtained authentication strength assessment value, a threshold-based dynamic authentication mechanism is initiated. Specifically, the authentication strength assessment value is first compared with a preset authentication strength threshold. If the authentication strength assessment value is greater than or equal to the authentication strength threshold, it indicates that the current authentication behavior presents a high security risk and requires initiation of an enhanced authentication process.

[0033] After determining that the authentication strength assessment value is greater than or equal to the authentication strength threshold, a zero-knowledge proof R1CS constraint is constructed based on a preset authentication factor array. The preset authentication factor array contains multiple authentication elements, such as biometric data, dynamic tokens, digital certificates, hardware identification, and other multi-factor authentication components. Based on the current risk level and user characteristics, an appropriate authentication factor combination is selected from the preset authentication factor array. The zero-knowledge proof R1CS constraint construction process includes: first, converting the authentication factors selected from the preset authentication factor array into an arithmetic circuit representation; second, establishing a corresponding constraint equation for each authentication factor based on the arithmetic circuit to ensure the correctness of the verification process; and then, combining multiple constraint equations to form a complete zero-knowledge proof R1CS constraint. This zero-knowledge proof R1CS constraint has zero-knowledge properties and can prove that a user meets the corresponding authentication requirements without revealing the user's specific authentication information.

[0034] Through the construction of the above-mentioned R1CS constraints, a balance between privacy protection and security authentication is achieved. It can not only dynamically adjust the authentication strength according to the risk level, but also protect the user's sensitive information from being leaked during the authentication process, laying a technical foundation for the subsequent distributed verification process.

[0035] S5. Perform BLS signature aggregation verification on the zero-knowledge proof R1CS constraint through a distributed node network to obtain an authentication log.

[0036] Specifically, the zero-knowledge proof R1CS constraint and its associated proof data are first distributed to multiple verification nodes in a pre-configured distributed node network. The distributed node network utilizes a decentralized architecture, comprised of multiple independent verification nodes, each equipped with zero-knowledge proof verification capabilities and BLS signature generation capabilities. After receiving the zero-knowledge proof R1CS constraint, each verification node independently executes the zero-knowledge proof verification algorithm to verify whether the user's submitted proof satisfies the pre-set constraints.

[0037] After verification is complete, each validator generates a corresponding BLS signature based on its verification results. BLS signatures are aggregatable, allowing signatures from multiple nodes to be combined into a single aggregate signature. The BLS signatures from each validator are collected and the signature aggregation algorithm is executed to combine multiple independent signatures into a compact aggregate signature.

[0038] At the same time, according to the preset consensus mechanism, the number of nodes that have passed the verification is counted. When the number of nodes that have passed the verification reaches the preset threshold requirement, the authentication is considered successful. Based on the verification results and the aggregate signature, an authentication log is generated containing key information such as the authentication timestamp, verification node information, aggregate signature data, and verification status.

[0039] Through the above-mentioned distributed verification mechanism, the decentralization and fault tolerance of the authentication process are achieved, avoiding the risk of single point failure. At the same time, the BLS signature aggregation technology is used to improve the verification efficiency, providing a reliable authentication record for subsequent blockchain evidence storage.

[0040] Furthermore, the authentication behavior of the user end is received, and similar behavior samples are retrieved to calculate the proportion of malicious authentication samples, including:

[0041] S11. Extracting the first authentication behavior to the Nth authentication behavior from the authentication behavior;

[0042] S12. Retrieve first similar behavior samples within a preset time window of the first authentication behavior, and count the proportion of first malicious authentication samples in the first similar behavior samples;

[0043] S13, until the Nth similar behavior sample in the preset time window of the Nth authentication behavior is retrieved, and the proportion of the Nth malicious authentication sample in the Nth similar behavior sample is counted;

[0044] S14: Add the first malicious authentication sample ratio to the Nth malicious authentication sample ratio into the malicious authentication sample ratio.

[0045] In one feasible implementation, the received authentication behavior is first decomposed, splitting the complex authentication behavior into multiple independent authentication behaviors. Specifically, according to preset behavior classification rules, the first authentication behavior, the second authentication behavior, and so on are sequentially extracted from the authentication behavior, where N is a positive integer representing the total number of authentication behaviors included in the authentication process. Authentication behaviors include, but are not limited to, independent authentication operations such as password entry, fingerprint recognition, token verification, and device binding verification.

[0046] Then, a similar sample retrieval mechanism is started for the first authentication behavior. Within the preset time window, a first set of similar behavior samples that match the characteristics of the first authentication behavior is retrieved from the historical behavior sample database. Next, a security label analysis is performed on the first set of similar behavior samples to identify the number of samples marked as malicious authentication, and the proportion of the first malicious authentication samples in the total number of the first similar behavior samples is calculated to obtain the first malicious authentication sample proportion. Following the same processing method as step S12, similar sample retrieval and malicious sample proportion statistics are performed on the second to Nth authentication behaviors in turn. The specific process is: retrieve the Nth similar behavior sample within the preset time window of the Nth authentication behavior, and count the proportion of the Nth malicious authentication sample in the Nth similar behavior sample, until the calculation of the malicious sample proportion of all N authentication behaviors is completed.

[0047] Afterwards, the obtained first malicious authentication sample ratio, second malicious authentication sample ratio, and finally Nth malicious authentication sample ratio are subjected to a set operation, and these N ratio values ​​are uniformly added to the malicious authentication sample ratio, providing multi-dimensional malicious behavior probability data support for subsequent comprehensive risk assessment.

[0048] Through the above decomposition and malicious authentication sample statistics, we can conduct refined risk quantification analysis of complex authentication behaviors, thereby improving the accuracy and comprehensiveness of malicious behavior identification.

[0049] Furthermore, retrieving first similar behavior samples within a preset time window of the first authentication behavior, and counting the proportion of first malicious authentication samples in the first similar behavior samples, includes:

[0050] S121. Obtain a predefined high-risk behavior library;

[0051] S122: When the first authentication behavior belongs to the high-risk behavior library, the proportion of the first malicious authentication samples is equal to 1;

[0052] S123. When the first authentication behavior does not belong to the high-risk behavior library, count the proportion of the first malicious authentication samples in the first similar behavior samples.

[0053] In a preferred embodiment, a pre-built high-risk behavior library is first obtained. This library is a database of malicious authentication behavior characteristics established based on historical security event analysis, threat intelligence collection, and expert knowledge accumulation. This library contains authentication behavior patterns that have been confirmed to be high-risk or malicious, such as logins from unusual geographic locations, access at unusual times, authentication from suspicious devices, brute force cracking attempts, privilege escalation attacks, and other typical malicious authentication behavior characteristics. This library utilizes a dynamic update mechanism, regularly supplementing and optimizing its content based on the latest security threat information.

[0054] Then, the characteristic parameters of the first authentication behavior are extracted, such as authentication timestamp, source IP address, device characteristics, user agent identifier, authentication type, access resource path, session duration, operation sequence mode, network environment parameters, etc. The characteristic parameters of the first authentication behavior are matched and compared with the behavior patterns in the high-risk behavior library. When it is determined that the characteristics of the first authentication behavior completely match or are highly similar to a malicious behavior pattern in the high-risk behavior library, the proportion of the first malicious authentication sample is set to a value of 1, that is, a malicious probability of 100%. This processing mechanism is based on the deterministic judgment of known malicious behaviors and does not require complex statistical analysis. It can quickly identify clear threat behaviors.

[0055] If the first authentication behavior is determined not to fall within a known malicious pattern in the high-risk behavior library, a statistical analysis mechanism based on historical data is initiated. Specifically, within the first set of similar behavior samples, the number of samples marked as malicious authentication is identified and counted, and their proportion to the total number of first similar behavior samples is calculated to obtain the first malicious authentication sample ratio. This statistical method can provide a probabilistic risk assessment for undefined authentication behaviors based on historical empirical data.

[0056] Through the above-mentioned hierarchical judgment mechanism, an organic combination of deterministic identification and probabilistic assessment is achieved, which can not only quickly deal with known high-risk behaviors, but also reasonably quantify the risks of unknown behaviors, thereby improving the accuracy and efficiency of the overall risk assessment.

[0057] Furthermore, the average proportion of the authentication behavior triggering frequency in multiple time windows on the user terminal is counted, and the average proportion of the authentication behavior triggering frequency in multiple time windows is subtracted from 1 to set the abnormal weight, including:

[0058] S21. Divide the preset time zone equally according to the set time window width to obtain a plurality of time windows;

[0059] S22. Counting the sum of trigger frequencies of all authentication behaviors based on the multiple time windows;

[0060] S23. Counting trigger frequencies of a plurality of first authentication behaviors of the first authentication behavior based on the plurality of time windows;

[0061] S24. Calculate the ratio of the triggering frequencies of the plurality of first authentication behaviors to the sum of the plurality of triggering frequencies to obtain a proportion of the triggering frequencies of the plurality of first authentication behaviors;

[0062] S25: Perform average statistics on the trigger frequency proportions of the plurality of first authentication behaviors to obtain an average of the trigger frequency proportions of the plurality of time windows.

[0063] In a preferred embodiment, the preset time zone is first divided into equal intervals according to the preset time window width. Specifically, the total duration of the preset time zone is evenly divided according to the preset time window width, generating a number of continuous and non-overlapping time windows. For example, if the preset time zone is 30 days and the time window width is set to 3 days, 10 time windows will be generated, each covering a time range of 3 days. The number and width of the time windows can be flexibly configured according to the actual application scenario and user behavior characteristics.

[0064] Subsequently, based on several time windows, the trigger frequency statistics of all authentication behaviors of the user in each time window are performed. Specifically, each time window is traversed, and the trigger times of all types of authentication behaviors initiated by the user in the window are counted, including login authentication, resource access authentication, permission change authentication and other authentication operations. The trigger frequencies of all authentication behaviors in each time window are summarized to obtain the sum of several trigger frequencies, which reflects the overall authentication activity of the user in different time periods. At the same time, for the specific authentication behaviors that need to be analyzed currently (such as the first authentication behavior of the authentication behavior), special frequency statistics are performed in several time windows. Each time window is searched one by one, and the specific trigger times of the first authentication behavior in the window are counted to form the trigger frequency of the authentication behavior in each time window, which is recorded as several first authentication behavior trigger frequencies.

[0065] Subsequently, the frequency ratio calculation process is performed. Specifically, the ratio of the trigger frequency of the first authentication behavior in each time window to the sum of the trigger frequencies of all authentication behaviors in the corresponding time window is calculated to obtain the relative ratio of the trigger frequency of the first authentication behavior in the time window. The same ratio calculation is performed on all time windows to obtain several first authentication behavior trigger frequency ratios. Afterwards, the several first authentication behavior trigger frequency ratios are statistically processed. The arithmetic mean of several first authentication behavior trigger frequency ratios is calculated to obtain the mean of the trigger frequency ratios of multiple time windows. This mean reflects the average relative importance and normalization level of the first authentication behavior in the user's historical behavior pattern.

[0066] Through the above-mentioned multi-level time window analysis mechanism, the degree of normalization of specific authentication behaviors in user behavior patterns can be accurately quantified, providing a reliable statistical basis for subsequent anomaly weight calculations.

[0067] Furthermore, performing average statistics on the trigger frequency proportions of the plurality of first authentication behaviors to obtain the average of the trigger frequency proportions of the plurality of time windows includes:

[0068] S251. Calculate time spans between median moments of the time windows and the current moment.

[0069] S252: Calculate the ratio of the time spans to the preset time zone durations to obtain time window weights.

[0070] S253: Based on the weights of the multiple time windows, perform weighted mean statistics on the trigger frequency proportions of the multiple first authentication behaviors to obtain the mean of the trigger frequency proportions of the multiple time windows.

[0071] In a preferred embodiment, in the specific implementation process of performing weighted mean statistics on the trigger frequency proportions of several first authentication behaviors, a weight distribution mechanism based on time decay is adopted to more accurately reflect the timeliness characteristics of the user behavior pattern.

[0072] First, the time span calculation is performed on several time windows. Specifically, the median time of each time window is determined, that is, the midpoint between the start and end times of the time window. Then, the time difference between the median time of each time window and the current time is calculated to obtain several time span arrays. The time span reflects the time distance between each time window and the current time, providing the basic data of the time dimension for subsequent weight calculations.

[0073] Then, a standardized calculation of the time window weights is performed. The time span corresponding to each time window is compared to the total duration of the preset time zone to obtain several standardized time-distance ratios. Based on the principle that the credibility of user behavior decays over time, an inverse weighting strategy is adopted: the smaller the time span (i.e., the closer to the current moment), the greater the corresponding weight value; the larger the time span (i.e., the farther from the current moment), the smaller the corresponding weight value. For example, using the inverse calculation formula, that is, weight value = 1 - time-distance ratio, several time window weights are obtained, reflecting the degree of influence of behavioral data in different time periods on the current authentication decision.

[0074] Subsequently, based on the weights of several time windows, a weighted average calculation is performed on the trigger frequency ratios of several first authentication behaviors. The specific calculation formula is: Multi-time window trigger frequency ratio average = Σ(trigger frequency ratio of the i-th time window × i-th time window weight) / Σ(time window weight). Through this weighted statistical mechanism, the importance of recent behavior patterns can be highlighted, while appropriately considering the reference value of historical behavior, to obtain a multi-time window trigger frequency ratio average that better matches the user's current behavior characteristics.

[0075] Through the above-mentioned weighted statistics, time-attenuated behavior pattern analysis and privacy-protected authentication verification are realized, providing reliable support for dynamic authentication strength adjustment.

[0076] Furthermore, when the authentication strength evaluation value is greater than or equal to the authentication strength threshold, a zero-knowledge proof R1CS constraint is constructed based on a preset authentication factor array, including:

[0077] S41. Obtain an array of mandatory authentication factors and a set of authentication factors to be optimized;

[0078] S42. Based on the authentication behavior, perform frequent authentication factor combination mining on the authentication factor set to be optimized to obtain a frequent authentication factor combination set;

[0079] S43, adding the frequent authentication factor combination set into the taboo combination space, performing authentication factor combination optimization according to the expected number of authentication factors, and obtaining a target authentication factor combination;

[0080] S44. Construct the zero-knowledge proof R1CS constraint based on the mandatory authentication factor array and the target authentication factor combination.

[0081] In a preferred embodiment, in the specific implementation process of constructing the zero-knowledge proof R1CS constraint, a multi-level authentication factor optimization selection mechanism is adopted to ensure the best balance between authentication strength and user experience.

[0082] First, a pre-configured array of mandatory authentication factors is obtained. This array contains mandatory core authentication elements, such as user identity identification, basic password verification, and other indispensable authentication components. Simultaneously, a set of authentication factors to be optimized is obtained. This set contains authentication factors that can be dynamically selected based on risk level, such as biometrics, hardware tokens, digital certificates, device binding verification, and geolocation verification. This set of authentication factors to be optimized provides flexible adjustment options for authentication strength. Then, based on current authentication behavior, frequent pattern mining is performed on the set of authentication factors to be optimized. For example, an association rule mining algorithm is used to analyze the frequency of occurrence of various authentication factor combinations in historical authentication records, identifying authentication factor combination patterns that are frequently used simultaneously in similar authentication scenarios. By setting a minimum support threshold, authentication factor combinations that frequently appear in historical data are screened to form a set of frequent authentication factor combinations. This set of frequent authentication factor combinations reflects the user's regular authentication habits and historical authentication strategies.

[0083] Then, the set of frequent authentication factor combinations is added to the taboo combination space to avoid selecting authentication combinations that are too familiar to users and prevent the authentication strength from being reduced due to habitual operations. Based on the preset expected number of authentication factors, and excluding the constraints of the taboo combination space, a combinatorial optimization search is performed on the set of authentication factors to be optimized. A heuristic algorithm is used to comprehensively consider multi-dimensional evaluation indicators such as authentication strength, user convenience, and system resource consumption to select the optimal authentication factor combination as the target authentication factor combination. Subsequently, a complete zero-knowledge proof R1CS constraint is constructed based on the array of required authentication factors and the target authentication factor combination. All selected authentication factors are converted into corresponding arithmetic circuit representations, and corresponding constraint equations are established for each authentication factor to obtain the zero-knowledge proof R1CS constraint.

[0084] For example, suppose a user is authenticating access to an enterprise core system. The specific implementation process is as follows: First, obtain the array of required authentication factors, including biometric hash verification (SHA256 fingerprint, 256 bits) and dynamic token verification (HMAC-SHA256 output, 256 bits) two mandatory authentication factors. A set of authentication factors to be optimized was also obtained, including various optional authentication components such as PUF response verification, digital certificate verification, device binding verification, and geolocation verification. Then, historical authentication records were analyzed, revealing that in similar high-risk authentication scenarios, the combination "biometric verification + PUF response verification" appeared 82% of the time, while the combination "dynamic token + PUF response" appeared 75% of the time. By setting a minimum support threshold of 70%, these two frequently occurring authentication factor combinations were screened out, forming a set of frequently occurring authentication factor combinations. Subsequently, the frequently occurring combinations "biometric verification + PUF response verification" and "dynamic token + PUF response" were added to the taboo combination space to avoid selecting overly common authentication schemes. Based on the requirement of a desired number of authentication factors of three, an optimization search was performed under the constraint of excluding taboo combinations, ultimately selecting the triple authentication combination of "biometric verification + dynamic token verification + PUF response verification" as the target authentication factor combination. Subsequently, a zero-knowledge proof R1CS constraint was constructed based on the array of mandatory authentication factors and the target authentication factor combination.

[0085] For example, define the expected verification value based on the array of required authentication factors (Biometric Hash Expected Value), (Dynamic Token Expected Value), defines the user authentication credentials based on the target authentication factor combination, which are (heartbeat phase modulation characteristics), (True random number seed), (PUF response stable bit string). Among them, the heartbeat phase modulation feature is the heartbeat timing phase change pattern extracted from the contactless collection of the user's heartbeat signal by the millimeter wave radar array, which reflects the microscopic time interval change and intensity modulation law of the user's heartbeat. It has individual biological uniqueness and liveness detection capabilities, and can effectively prevent counterfeit attacks such as recording and playback; the true random number seed is a high-quality random bit sequence generated by obtaining the hardware-level physical entropy source through the quantum noise acquisition component and after Toeplitz matrix compression processing. This seed is generated based on physical random processes such as quantum tunneling effects, and is unpredictable and non-reproducible, providing cryptographic strength randomness guarantees for the authentication process; the PUF response stable bit string is a device unique identifier generated by the physical unclonable function (PUF) hardware module based on the microscopic physical differences in the integrated circuit manufacturing process. This bit string uses uncontrollable physical properties such as transistor threshold voltage changes and wire delay differences. After error correction coding processing, it forms a stable device fingerprint with device-level uniqueness and anti-cloning characteristics. Subsequently, three constraint equations were established, namely, biometric hash correctness SHA256 ( )= 、Dynamic token validity HMAC-SHA256( ,"TOKEN")= , PUF response stability HD(ECC( ),PUF_reg)≤⌊n / 8⌋. By converting these constraint equations into standard R1CS matrix form, a complete zero-knowledge proof R1CS constraint is constructed. Users can prove that they meet the triple authentication requirements without revealing specific authentication information.

[0086] Furthermore, an array of mandatory authentication factors is obtained, including:

[0087] S411, performing Toeplitz matrix compression on the hardware entropy source data obtained by the quantum noise acquisition component to generate a true random number seed;

[0088] S412. Collecting the user's vital sign signals through a millimeter-wave radar array and extracting heartbeat phase modulation features;

[0089] S413. Generate a PUF response stable bit string through the PUF physical unclonable function;

[0090] S414: Add the true random number seed, the heartbeat phase modulation feature, and the PUF response stable bit string into the mandatory authentication factor array.

[0091] In a preferred embodiment, in the specific implementation process of obtaining the array of required authentication factors, an authentication factor generation mechanism based on hardware-level security features is adopted to ensure the unforgeability and high entropy characteristics of the authentication factors.

[0092] First, the quantum noise acquisition component acquires high-quality hardware entropy source data. Based on the principles of randomness in quantum physics, the quantum noise acquisition component collects true random signals generated by physical processes such as quantum tunneling and thermal noise. The collected hardware entropy source data undergoes Toeplitz matrix compression, performing matrix multiplication with a preset Toeplitz matrix to compress and debias the entropy source data. This compression process effectively eliminates systematic biases in the hardware acquisition process, extracting a high-quality, uniformly distributed random bit sequence to generate a true random number seed. This true random number seed is unpredictable and non-reproducible, providing cryptographically strong randomness for subsequent authentication.

[0093] The user's vital signs are then monitored contactlessly using a millimeter-wave radar array. The millimeter-wave radar array emits millimeter-wave signals of a specific frequency and detects changes in the reflected signal caused by the rise and fall of the user's chest, collecting vital signs such as heartbeat and respiration in real time. The collected vital sign signals undergo digital signal processing. Using filtering, denoising, and feature extraction algorithms, the phase modulation characteristics of the heartbeat signal are separated and extracted from the composite vital sign signal. This phase modulation characteristic reflects the microscopic timing characteristics and intensity variation patterns of the user's heartbeat, possessing individual uniqueness and liveness detection capabilities, effectively preventing forgery attacks.

[0094] Subsequently, a unique device identifier (UID) is generated using a PUF (Physical Unclonable Function) hardware module. The PUF module constructs a unique device-level response function based on uncontrollable microscopic physical variations during the integrated circuit manufacturing process, such as variations in transistor threshold voltage and wire delays. A preset stimulus signal is input to the PUF module, which generates a corresponding response signal based on its inherent physical properties. To improve response stability, the original PUF response is error-corrected using algorithms such as BCH or Reed-Solomon codes. This generates a stable PUF response bit string that can tolerate a certain amount of bit errors. This bit string is highly reproducible under the same stimulus conditions and exhibits significant variability between devices.

[0095] Afterwards, the three types of high-security authentication factors generated in the previous steps are integrated. The true random number seed, heartbeat phase modulation feature, and PUF response stable bit string are encapsulated according to a preset data format and added to the array of required authentication factors. Each authentication factor in this array has different security characteristics: the true random number seed provides cryptographic randomness, the heartbeat phase modulation feature provides biological liveness verification, and the PUF response stable bit string provides device hardware binding. The organic combination of these three authentication factors forms a multi-dimensional security authentication foundation covering randomness, biology, and physics, providing high-strength authentication factor support for the subsequent construction of zero-knowledge proofs.

[0096] Furthermore, the frequent authentication factor combination set is added to the taboo combination space, and authentication factor combination optimization is performed according to the expected number of authentication factors to obtain a target authentication factor combination, including:

[0097] S431: Based on the expected number of authentication factors, the set of authentication factors to be optimized is combined while avoiding the taboo combination space to obtain a first authentication factor combination;

[0098] S432. Calculate the square of the mean of the intersection and union ratio of the first authentication factor combination and the factor type of the frequent authentication factor combination set, and set it as a first fitness;

[0099] S433: When the first fitness is greater than or equal to a fitness threshold, eliminate the first authentication factor combination;

[0100] S434: When the first fitness is less than the fitness threshold, add the first authentication factor combination to a set of candidate authentication factor combinations;

[0101] S435. When the number of combinations in the candidate authentication factor combination set is greater than or equal to the set number, take the authentication factor combination with the minimum fitness in the candidate authentication factor combination set and set it as the target authentication factor combination.

[0102] In a preferred embodiment, in the specific implementation process of performing authentication factor combination optimization, an intelligent optimization algorithm based on taboo search and fitness evaluation is adopted to ensure that the selected authentication factor combination not only meets the security strength requirements but also avoids the user's inertial operation mode.

[0103] First, based on a preset expected number of authentication factors, a combination generation mechanism is initiated. Specifically, the set of frequent authentication factor combinations serves as a constraint in the taboo combination space, ensuring that subsequently generated combinations do not overlap with the user's historical patterns. Using a combinatorial algorithm, the set of authentication factors to be optimized is permuted and combined according to the expected number of authentication factors. While avoiding the taboo combination space, authentication factors are randomly or according to preset rules to generate candidate first authentication factor combinations. This combination generation process ensures the diversity and novelty of the authentication factors. Subsequently, a similarity metric is performed on the first authentication factor combination. Specifically, the factor type intersection-over-intersection ratio (Jaccard similarity coefficient) is calculated between the first authentication factor combination and each combination in the set of frequent authentication factor combinations. The formula for calculating the intersection-over-intersection ratio is: the number of authentication factor types shared by the two combinations divided by the union of all the authentication factor types contained in the two combinations. The mean intersection-over-intersection ratio of the first authentication factor combination to all combinations in the set of frequent authentication factor combinations is then arithmetic averaged to obtain the mean. This mean is then squared and set as the first fitness. This fitness value reflects the degree of similarity between the first authentication factor combination and the user's historically frequent combinations.

[0104] When the first fitness is greater than or equal to the preset fitness threshold, it indicates that the first authentication factor combination is too similar to the user's historical habitual pattern, and there is a risk of reduced authentication strength due to the user's familiarity with the operation. In this case, the first authentication factor combination is marked as an unqualified candidate and eliminated, and will not enter the subsequent optimization process. When the first fitness is less than the fitness threshold, it indicates that the first authentication factor combination is sufficiently different from the user's historical habitual pattern, which can effectively avoid the risk of inertial operation and meet the authentication strength requirements. The qualified first authentication factor combination is added to the set of candidate authentication factor combinations as a candidate for the target authentication factor combination. This processing mechanism ensures that all combinations in the set of candidate combinations have the necessary security features.

[0105] When the number of combinations in the candidate authentication factor combination set reaches or exceeds the preset number, it indicates that sufficient qualified candidate combinations have been collected. All combinations in the candidate authentication factor combination set are sorted in ascending order by fitness value, and the authentication factor combination with the smallest fitness value is selected as the final target authentication factor combination. This selection strategy is based on the principle that a smaller fitness value indicates a greater difference from historically used patterns. This ensures that the selected combination can minimize user inertia and provide optimal authentication security strength.

[0106] Through the above-mentioned multi-level screening and optimization mechanism, it is possible to intelligently select the authentication factor combination that is most different from the user's historical behavior pattern while ensuring the validity of authentication, thereby achieving the organic unity of authentication security and anti-inertia operation.

[0107] Example 2, as Figure 2 As shown, based on the same inventive concept as the multi-node multi-factor security authentication method provided in the first embodiment, the embodiment of the present invention further provides a multi-node multi-factor security authentication system, including:

[0108] Malicious sample statistics module 11, used to receive authentication behavior of the user end, retrieve similar behavior samples and calculate the proportion of malicious authentication samples;

[0109] An abnormal weight determination module 12 is used to calculate the average proportion of the authentication behavior triggering frequency in multiple time windows on the user terminal, and subtract the average proportion of the authentication behavior triggering frequency in multiple time windows from 1 to set the average proportion as the abnormal weight;

[0110] An authentication strength evaluation module 13 is configured to weight the proportion of malicious authentication samples based on the anomaly weight to obtain an authentication strength evaluation value;

[0111] A constraint construction module 14 is configured to construct a zero-knowledge proof R1CS constraint based on a preset authentication factor array when the authentication strength evaluation value is greater than or equal to an authentication strength threshold;

[0112] The signature verification module 15 is used to perform BLS signature aggregation verification on the zero-knowledge proof R1CS constraint through a distributed node network to obtain an authentication log;

[0113] The audit evidence storage module 16 is used to write the Merkle root of the authentication log into the blockchain to complete the audit evidence storage.

[0114] Furthermore, the malicious sample statistics module 11 includes the following execution steps:

[0115] Extracting the first authentication behavior to the Nth authentication behavior from the authentication behavior;

[0116] Retrieving first similar behavior samples in a preset time window of the first authentication behavior, and counting the proportion of first malicious authentication samples in the first similar behavior samples;

[0117] until retrieving the Nth similar behavior sample in the preset time window of the Nth authentication behavior, and counting the proportion of the Nth malicious authentication sample in the Nth similar behavior sample;

[0118] The first malicious authentication sample ratio to the Nth malicious authentication sample ratio are added to the malicious authentication sample ratio.

[0119] Furthermore, the malicious sample statistics module 11 further includes the following execution steps:

[0120] Access to a predefined library of high-risk behaviors;

[0121] When the first authentication behavior belongs to the high-risk behavior library, the proportion of the first malicious authentication samples is equal to 1;

[0122] When the first authentication behavior does not belong to the high-risk behavior library, the proportion of the first malicious authentication samples in the first similar behavior samples is counted.

[0123] Furthermore, the abnormal weight determination module 12 includes the following execution steps:

[0124] According to the set time window width, the preset time zone is evenly divided to obtain several time windows;

[0125] Based on the multiple time windows, summing up multiple trigger frequencies of all authentication behaviors;

[0126] Based on the multiple time windows, counting multiple first authentication behavior triggering frequencies of the first authentication behavior of the authentication behavior;

[0127] Calculating a ratio of the trigger frequencies of the plurality of first authentication behaviors to the sum of the plurality of trigger frequencies to obtain a proportion of the trigger frequencies of the plurality of first authentication behaviors;

[0128] Perform average statistics on the trigger frequency proportions of the plurality of first authentication behaviors to obtain an average of the trigger frequency proportions of the plurality of time windows.

[0129] Furthermore, the abnormal weight determination module 12 further includes the following execution steps:

[0130] Calculating time spans between median moments of the time windows and the current moment;

[0131] Calculating the ratio of the plurality of time spans to the duration of the preset time zones to obtain a plurality of time window weights;

[0132] Based on the weights of the multiple time windows, weighted mean statistics are performed on the trigger frequency proportions of the multiple first authentication behaviors to obtain the mean of the trigger frequency proportions of the multiple time windows.

[0133] Furthermore, the constraint construction module 14 includes the following execution steps:

[0134] Obtain the array of required authentication factors and the set of authentication factors to be optimized;

[0135] Based on the authentication behavior, performing frequent authentication factor combination mining on the authentication factor set to be optimized to obtain a frequent authentication factor combination set;

[0136] Adding the frequent authentication factor combination set into the taboo combination space, performing authentication factor combination optimization according to the expected number of authentication factors, and obtaining a target authentication factor combination;

[0137] The zero-knowledge proof R1CS constraint is constructed based on the mandatory authentication factor array and the target authentication factor combination.

[0138] Furthermore, the constraint construction module 14 further includes the following execution steps:

[0139] Perform Toeplitz matrix compression on the hardware entropy source data obtained by the quantum noise acquisition component to generate a true random number seed;

[0140] The millimeter-wave radar array is used to collect the user's vital sign signals and extract the heartbeat phase modulation characteristics;

[0141] Generate a PUF response stable bit string through the PUF physical unclonable function;

[0142] The true random number seed, the heartbeat phase modulation feature and the PUF response stable bit string are added to the mandatory authentication factor array.

[0143] Furthermore, the constraint construction module 14 further includes the following execution steps:

[0144] Based on the expected number of authentication factors, the set of authentication factors to be optimized is combined to obtain a first authentication factor combination while avoiding the taboo combination space;

[0145] Calculate the square of the mean of the intersection and union ratio of the first authentication factor combination and the factor type of the frequent authentication factor combination set, and set it as the first fitness;

[0146] When the first fitness is greater than or equal to a fitness threshold, eliminating the first authentication factor combination;

[0147] When the first fitness is less than the fitness threshold, adding the first authentication factor combination to a candidate authentication factor combination set;

[0148] When the number of combinations in the candidate authentication factor combination set is greater than or equal to the set number, the authentication factor combination with the minimum fitness in the candidate authentication factor combination set is taken as the target authentication factor combination.

[0149] It should be noted that, in the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

[0150] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0151] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded computer, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0152] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0153] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0154] Although preferred embodiments of the present invention have been described, additional changes and modifications to these embodiments may occur to those skilled in the art once the basic inventive concepts become known.

[0155] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the present invention and its equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A multi-factor security authentication method for multiple nodes, characterized in that: include: Receive authentication behavior from the user, retrieve samples of similar behavior, and calculate the percentage of malicious authentication samples; Counting the average proportion of the authentication behavior triggering frequency in multiple time windows on the user end, and subtracting the average proportion of the authentication behavior triggering frequency in multiple time windows from 1 to set the result as the abnormality weight; Based on the anomaly weight, weight the proportion of malicious authentication samples to obtain an authentication strength assessment value; When the authentication strength evaluation value is greater than or equal to the authentication strength threshold, constructing a zero-knowledge proof R1CS constraint based on a preset authentication factor array; Perform BLS signature aggregation verification on the zero-knowledge proof R1CS constraint through a distributed node network to obtain an authentication log; The Merkle root of the authentication log is written into the blockchain to complete the audit evidence.

2. The method according to claim 1, wherein Receive authentication behavior from the user, retrieve samples of similar behavior, and calculate the percentage of malicious authentication samples, including: Extracting the first authentication behavior to the Nth authentication behavior from the authentication behavior; Retrieving first similar behavior samples in a preset time window of the first authentication behavior, and counting the proportion of first malicious authentication samples in the first similar behavior samples; until retrieving the Nth similar behavior sample in the preset time window of the Nth authentication behavior, and counting the proportion of the Nth malicious authentication sample in the Nth similar behavior sample; The first malicious authentication sample ratio to the Nth malicious authentication sample ratio are added to the malicious authentication sample ratio.

3. The method according to claim 2, wherein Retrieving first similar behavior samples within a preset time window of the first authentication behavior, and counting the proportion of first malicious authentication samples in the first similar behavior samples, including: Access to a predefined library of high-risk behaviors; When the first authentication behavior belongs to the high-risk behavior library, the proportion of the first malicious authentication samples is equal to 1; When the first authentication behavior does not belong to the high-risk behavior library, the proportion of the first malicious authentication samples in the first similar behavior samples is counted.

4. The method according to claim 1, wherein Count the average proportion of the authentication behavior triggering frequency in multiple time windows on the user end, and subtract the average proportion of the authentication behavior triggering frequency in multiple time windows from 1 to set the abnormal weight, including: According to the set time window width, the preset time zone is evenly divided to obtain several time windows; Based on the multiple time windows, summing up multiple trigger frequencies of all authentication behaviors; Based on the multiple time windows, counting multiple first authentication behavior triggering frequencies of the first authentication behavior of the authentication behavior; Calculating a ratio of the trigger frequencies of the plurality of first authentication behaviors to the sum of the plurality of trigger frequencies to obtain a proportion of the trigger frequencies of the plurality of first authentication behaviors; Perform average statistics on the trigger frequency proportions of the plurality of first authentication behaviors to obtain an average of the trigger frequency proportions of the plurality of time windows.

5. The method according to claim 4, wherein Performing average statistics on the trigger frequency proportions of the plurality of first authentication behaviors to obtain the average of the trigger frequency proportions of the plurality of time windows includes: Calculating time spans between median moments of the time windows and the current moment; Calculating the ratio of the plurality of time spans to the duration of the preset time zones to obtain a plurality of time window weights; Based on the weights of the multiple time windows, weighted mean statistics are performed on the trigger frequency proportions of the multiple first authentication behaviors to obtain the mean of the trigger frequency proportions of the multiple time windows.

6. The method according to claim 1, wherein When the authentication strength evaluation value is greater than or equal to the authentication strength threshold, a zero-knowledge proof R1CS constraint is constructed based on a preset authentication factor array, including: Obtain the array of required authentication factors and the set of authentication factors to be optimized; Based on the authentication behavior, performing frequent authentication factor combination mining on the authentication factor set to be optimized to obtain a frequent authentication factor combination set; Adding the frequent authentication factor combination set into the taboo combination space, performing authentication factor combination optimization according to the expected number of authentication factors, and obtaining a target authentication factor combination; The zero-knowledge proof R1CS constraint is constructed based on the mandatory authentication factor array and the target authentication factor combination.

7. The method according to claim 6, wherein Get the array of required authentication factors, including: Perform Toeplitz matrix compression on the hardware entropy source data obtained by the quantum noise acquisition component to generate a true random number seed; The millimeter-wave radar array is used to collect the user's vital sign signals and extract the heartbeat phase modulation characteristics; Generate a PUF response stable bit string through the PUF physical unclonable function; The true random number seed, the heartbeat phase modulation feature and the PUF response stable bit string are added to the mandatory authentication factor array.

8. The method according to claim 6, wherein Adding the frequent authentication factor combination set into the taboo combination space, performing authentication factor combination optimization according to the expected number of authentication factors, and obtaining the target authentication factor combination, including: Based on the expected number of authentication factors, the set of authentication factors to be optimized is combined to obtain a first authentication factor combination while avoiding the taboo combination space; Calculate the square of the mean of the intersection and union ratio of the first authentication factor combination and the factor type of the frequent authentication factor combination set, and set it as the first fitness; When the first fitness is greater than or equal to a fitness threshold, eliminating the first authentication factor combination; When the first fitness is less than the fitness threshold, adding the first authentication factor combination to a candidate authentication factor combination set; When the number of combinations in the candidate authentication factor combination set is greater than or equal to the set number, the authentication factor combination with the minimum fitness in the candidate authentication factor combination set is taken as the target authentication factor combination.

9. A multi-node multi-factor security authentication system, characterized in that: For implementing the method according to any one of claims 1 to 8, the system comprises: Malicious sample statistics module, used to receive authentication behaviors from the user end, retrieve samples of similar behaviors and calculate the proportion of malicious authentication samples; An abnormal weight determination module is used to calculate the average proportion of the authentication behavior triggering frequency in multiple time windows on the user terminal, and subtract the average proportion of the multiple time window triggering frequency from 1 to set the average proportion as the abnormal weight; An authentication strength assessment module, configured to weight the proportion of malicious authentication samples based on the anomaly weight to obtain an authentication strength assessment value; A constraint construction module, configured to construct a zero-knowledge proof R1CS constraint based on a preset authentication factor array when the authentication strength evaluation value is greater than or equal to an authentication strength threshold; A signature verification module is used to perform BLS signature aggregation verification on the zero-knowledge proof R1CS constraint through a distributed node network to obtain an authentication log; The audit evidence module is used to write the Merkle root of the authentication log into the blockchain to complete the audit evidence.

Images