Desktop cloud security access control method based on multi-factor authentication

Abstract

The invention belongs to the technical field of computer security, and relates to a desktop cloud security access control method based on multi-factor authentication, which comprises the following steps: acquiring hardware authentication information submitted by a user; collecting behavior characteristic data when a user operates and inputs; detecting an environment safety state of the access terminal; generating an authentication confidence level, wherein the authentication confidence level is divided into a high risk level, a medium risk level and a low risk level; assigning an initial access right based on the authentication confidence level; after the initial access authority is obtained, continuously comparing the current behavior characteristic data with the initial behavior characteristic data, and updating the authentication confidence level in a mechanical operation mode; and dynamically adjusting the access permission according to the updated authentication confidence level, and triggering an automatic permission degradation mechanism when a continuous non-operation state is detected. The problem that permission change depends on manual intervention in a traditional mode is solved.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer security and relates to a desktop cloud security access control method based on multi-factor authentication. Background Art

[0002] In traditional access control systems, user authentication primarily relies on single-factor authentication methods such as static passwords or fixed tokens. These methods only confirm user identity at the moment of login and are unable to mitigate the risks of identity hijacking or privilege abuse during a session. With the development of automated attack tools, attackers can easily steal passwords or copy hardware tokens, posing as legitimate users to conduct data theft or unauthorized operations. Furthermore, the lack of real-time monitoring of the security status of terminal devices means that vulnerable systems can become a gateway for attacks.

[0003] Some solutions incorporate two-factor authentication or periodic scanning mechanisms. For example, they combine SMS verification codes with passwords for secondary verification, or require terminals to install security software and periodically submit scanning reports. While these methods increase the threshold for attack, the verification process is often focused on the initial login phase and fails to cover the entire user lifecycle. While behavioral analysis technology is used to identify abnormal operations, it is often limited to independent modules and lacks deep integration with access control systems.

[0004] Based on the above problems, traditional methods rely on manual intervention to change permissions, and response delays expose the system to continuous threats, ultimately forming a passive defense mode that is unable to cope with increasingly complex identity forgery attacks and automated penetration methods. Summary of the Invention

[0005] In order to solve the above problems, the present invention provides a desktop cloud security access control method based on multi-factor authentication.

[0006] The desktop cloud security access control method based on multi-factor authentication includes the following steps:

[0007] S1. Obtain hardware authentication information submitted by the user. The hardware authentication information is generated by a physical token and contains a unique identifier.

[0008] S2. Collecting behavioral feature data during user input operations. Behavioral feature data refers to the continuous trajectory formed by the user's interactive actions on the operation interface;

[0009] S3. Check the environmental security status of the access terminal, including the integrity of system patches and the level of active operation of security protection software;

[0010] S4. Generate an authentication confidence level through logical judgment based on hardware authentication information, behavioral feature data, and environmental security status. The authentication confidence level is divided into high risk level, medium risk level, and low risk level;

[0011] S5. Assign initial access permissions based on authentication confidence levels. High-risk levels trigger secondary authentication, medium-risk levels restrict data download capabilities, and low-risk levels grant full operational permissions.

[0012] S6. After obtaining the initial access rights, continuously compare the current behavior feature data with the initial behavior feature data and update the authentication confidence level in the mechanized operation mode;

[0013] S7. Dynamically adjust access permissions based on the updated authentication confidence level, and trigger an automatic permission downgrade mechanism when a continuous inactivity state is detected.

[0014] A further solution of the present invention, obtaining hardware authentication information submitted by a user, includes the following steps:

[0015] Reading an encrypted data packet stored inside the physical token, the encrypted data packet consisting of a digital certificate and a dynamic counter value;

[0016] The encrypted data packet is transmitted to the authentication server, which verifies its legitimacy by comparing it with the pre-stored certificate copy and the counter history record;

[0017] If the certificates match and the counter value is in a reasonable increasing range, the hardware authentication is considered to have passed; if any verification fails, the hardware authentication is considered to have failed.

[0018] A further solution of the present invention collects behavioral characteristic data during user input operations, including the following steps:

[0019] When a mouse or touch device performs a click, drag, or move action on the operation interface, the coordinate points of the input device and the corresponding timestamps are recorded at fixed time intervals, forming raw trajectory data consisting of multiple coordinate points connected in time sequence;

[0020] The original trajectory data is preprocessed to remove noise caused by device jitter, and the horizontal and vertical displacements of adjacent coordinate points are calculated separately to generate behavioral feature data consisting of displacement vectors and time intervals.

[0021] A further solution of the present invention is to detect the environmental security status of the access terminal, including the following steps:

[0022] Traverse the predefined list of critical system patches, compare the version identifiers of the installed patches with the version identifiers of the latest patches one by one, and calculate the patch completeness score;

[0023] Monitor the process lifespan and virus database update status of security protection software, and calculate the protection activity score based on the ratio of actual scan times to required scan times within the preset period;

[0024] The test results are converted into a patch integrity score and a protection activity score, and the weighted sum of the two scores is used to generate an environmental safety factor.

[0025] If the environmental safety factor is lower than the set security threshold, the terminal environment is judged to have security risks. The security threshold is dynamically set based on the risk tolerance of the enterprise security policy and historical security incident analysis.

[0026] A further solution of the present invention generates an authentication confidence level through logical judgment based on hardware authentication information, behavioral characteristic data, and environmental security status, including the following steps:

[0027] The hardware authentication information verification result is determined to be fully credible or partially credible based on the certificate validity and counter continuity of the physical token, where fully credible corresponds to a first score and partially credible corresponds to a second score;

[0028] Calculate the trajectory direction distribution similarity and time interval volatility standard deviation between the current behavior feature data and the historical baseline data to generate a behavior feature matching score;

[0029] The hardware certification score, behavioral feature matching score, and environmental safety factor are weighted and summed according to preset weights. The preset weights are dynamically adjusted according to the enterprise security policy to generate a comprehensive risk value.

[0030] The comparison results of the comprehensive risk value with the preset high-risk threshold and low-risk threshold are used to divide the certification confidence level.

[0031] A further solution of the present invention, logic judgment, includes:

[0032] A decision-making process that compares multidimensional input data with a quantitative score and threshold according to preset rules;

[0033] A high risk level indicates a high probability of identity forgery or terminal intrusion;

[0034] The medium risk level indicates that there are potential security vulnerabilities and some operations need to be restricted;

[0035] A low risk level indicates that all safety conditions are met.

[0036] A further solution of the present invention allocates initial access rights based on authentication confidence levels, including the following steps:

[0037] Call the preset permission policy library, and once the authentication confidence level is determined, automatically call the corresponding policy;

[0038] For high-risk users, the system blocks direct access and initiates a secondary authentication process, requiring the user to verify their identity through biometrics or a dynamic verification code.

[0039] For users with a medium risk level, the system allows browsing data but prohibits file downloading and outgoing operations;

[0040] For users with low risk levels, the system opens up full functional permissions including data editing, downloading and sharing.

[0041] A further solution of the present invention is to call a preset authority policy library, comprising the following steps:

[0042] The permission policy library supports multiple format extensions, including JSON / XML / SQL databases, and is parsed through adapter mode to ensure compatibility with existing systems;

[0043] Based on the least privilege principle and dynamic risk response mechanism of the enterprise security policy, combined with expert experience, the authentication confidence level is mapped to a rule base of predefined operation permission sets.

[0044] A further embodiment of the present invention continuously compares the current behavior characteristic data with the initial behavior characteristic data, including the following steps:

[0045] Intercept the current behavior feature data and extract the directional distribution of the displacement vector and the fluctuation characteristics of the time interval within the window;

[0046] Calculate the similarity between the vector direction distribution of the current window and the direction distribution of the initial behavior feature data, and compare the standard deviation of the time interval volatility;

[0047] If the direction distribution similarity is lower than the preset similarity threshold and the time interval volatility approaches zero, the preset similarity threshold is obtained through training of historical normal user behavior data, and it is determined that a mechanized operation mode exists.

[0048] A further solution of the present invention dynamically adjusts access rights based on the updated authentication confidence level, including the following steps:

[0049] When the authentication confidence level is raised due to abnormal operation, new restriction rules are immediately written to the permission token;

[0050] If no valid operation input is made for a period exceeding the preset time limit, which refers to the no-operation tolerance time window set in the enterprise security policy and is calculated based on the system clock, the permission level will be reduced by one level.

[0051] Send a refresh command to the user terminal to make the new permissions take effect immediately and interrupt the operation process that does not meet the new permission level.

[0052] In summary, the present invention has the following beneficial technical effects:

[0053] 1. By integrating hardware authentication, behavioral characteristics, and terminal environment security data in real time, a quantitative authentication confidence level is generated, and access rights are dynamically allocated and adjusted based on this level. This mechanism accurately matches user operation risks with permission scopes, immediately triggering permission downgrade or secondary authentication when abnormal behavior or environmental threats are detected, effectively preventing high-risk operations from being executed. Compared with traditional static permission models, this significantly improves real-time defense capabilities against new threats such as identity forgery, automated attacks, and terminal intrusions, ensuring that security policies always evolve in sync with risk trends.

[0054] 2. An automated assessment mechanism based on the terminal environment's security factor accurately quantifies system patch integrity and protective software activity, avoiding over-reliance on manual inspections. The system automatically implements differentiated permission control based on risk level: low-risk users receive full operational permissions to ensure efficiency, while medium- and high-risk users receive enhanced security through functional restrictions or secondary authentication. This strategy minimizes the operational burden on the security team while ensuring that legitimate users pass verification without noticing and that malicious access is accurately blocked, achieving an optimal balance between security and availability.

[0055] 3. Establish a complete monitoring chain from initial authentication to session termination. During user operations, current behavior is continuously compared with historical baselines, detecting anomalies through trajectory direction distribution similarity and time interval fluctuations. Automatic privilege downgrade upon non-operation timeout further eliminates the risk of idle sessions being hijacked. This full-cycle dynamic verification mechanism adheres to the zero-trust principle, radically transforming the traditional one-time pass authentication model. The system maintains a proactive defense state in complex network environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. The drawings are used to provide a further understanding of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0057] Figure 1 A schematic diagram of the flow chart in the embodiment of the present application is disclosed.

[0058] Figure 2 The present invention discloses a schematic structural diagram in an embodiment of the present application. DETAILED DESCRIPTION

[0059] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0060] The following is combined with Figure 1-Figure 2 The preferred embodiments of the present invention are described in detail.

[0061] Refer to the attached Figure 1 The present invention proposes a desktop cloud security access control method based on multi-factor authentication, which includes the following steps:

[0062] S1. Obtain hardware authentication information submitted by the user. The hardware authentication information is generated by a physical token and contains a unique identifier.

[0063] S2. Collecting behavioral feature data during user input operations. Behavioral feature data refers to the continuous trajectory formed by the user's interactive actions on the operation interface;

[0064] S3. Check the environmental security status of the access terminal, including the integrity of system patches and the level of active operation of security protection software;

[0065] S4. Generate an authentication confidence level through logical judgment based on hardware authentication information, behavioral feature data, and environmental security status. The authentication confidence level is divided into high risk level, medium risk level, and low risk level;

[0066] S5. Assign initial access permissions based on authentication confidence levels. High-risk levels trigger secondary authentication, medium-risk levels restrict data download capabilities, and low-risk levels grant full operational permissions.

[0067] S6. After obtaining the initial access rights, continuously compare the current behavior feature data with the initial behavior feature data and update the authentication confidence level in the mechanized operation mode;

[0068] S7. Dynamically adjust access permissions based on the updated authentication confidence level, and trigger an automatic permission downgrade mechanism when a continuous inactivity state is detected.

[0069] In one embodiment of the present invention, step S1 includes the following steps:

[0070] Obtain the hardware authentication information submitted by the user. The hardware authentication information is generated by a physical token and contains a unique identifier.

[0071] Specifically, when a user accesses the desktop cloud system, the system detects whether the physical token is connected to the terminal device. The physical token is an independent hardware device with encryption capabilities. The user must insert it into the terminal device's USB port or connect it via near-field communication. The system reads the encrypted data packet stored within the physical token, which consists of a digital certificate and a dynamic counter value. The digital certificate is preset, non-replicable identity data, and the dynamic counter value is automatically incremented by a microchip built into the physical token each time it is plugged in or unplugged.

[0072] The encrypted data packet is transmitted to the authentication server, which verifies its legitimacy by comparing it with a pre-stored copy of the certificate and the counter's historical value. If the certificates match and the counter value is within a reasonable incrementing range, the hardware authentication is considered successful. If any verification fails, the hardware authentication is considered unsuccessful.

[0073] Hardware authentication information refers to the encrypted data packet generated by the physical token, containing the digital certificate and dynamic counter value. This data cannot be simulated by software and differs with each use. A physical token is an independent hardware device with encryption capabilities, used to generate, store, and dynamically update authentication information. A unique identifier, formed by combining the serial number of the digital certificate and the current value of the dynamic counter, ensures traceability of each authentication request. The dynamic counter value represents the value generated by the physical token's built-in chip and automatically increments each time the token is plugged in or removed, or when authentication is triggered.

[0074] The setting of a reasonable increment interval refers to the legal range of the dynamic counter value, which is usually defined dynamically in combination with the historical counter value, time window, and business scenario. Assume that the counter value recorded by the server last time is C old , the new submission value is C new , legal conditions C new >C old And C new ≤C old +N, N represents the tolerance threshold;

[0075] The tolerance threshold is set to strike a balance between security and availability based on business scenarios and security requirements. The upper limit of the threshold is determined through historical statistical analysis (normal user operation frequency, average network latency) and stress testing (simulating high concurrency and cross-time zone scenarios). For example, if the theoretical maximum number of plugging and unplugging per day is 100 times, the threshold N is set to 100.

[0076] For example, assume that employees of a manufacturing company use a physical token in the form of a USB to access a desktop cloud system. When the employee inserts the USB token into a workshop computer, the system automatically reads the digital certificate (including the employee number and department code issued by the company) and the current value of the plug-in counter (the 128th use) in the token.

[0077] After receiving the data packet containing the certificate and the counter value 128, the authentication server first verifies whether the certificate is consistent with the valid certificate stored in the enterprise database, and then checks whether the counter value last recorded by the token is 127. If both verifications pass, the hardware authentication is determined to be successful; if any verification fails, the hardware authentication is determined to have failed.

[0078] In one embodiment of the present invention, step S2 includes the following steps:

[0079] After the hardware authentication determined in step S1 is passed, the behavioral feature data of the user's operation input is collected. The behavioral feature data refers to the continuous trajectory formed by the user's interactive actions generated by the input device on the operation interface.

[0080] Specifically, after the hardware authentication verification is successful, the trajectory recording function is activated. When the user clicks, drags, or moves on the operation interface through a mouse or touch device, the coordinate points of the input device and the corresponding timestamps are recorded at fixed time intervals, forming raw trajectory data consisting of multiple coordinate points connected in chronological order. The raw trajectory data is then preprocessed to remove the noise caused by device jitter, and the horizontal and vertical displacements of adjacent coordinate points are calculated separately to generate behavioral feature data consisting of displacement vectors and time intervals. The horizontal and vertical displacements of adjacent coordinate points are calculated separately to meet the following formula:

[0081]

[0082] Where Δx norm Indicates the horizontal position; Δy norm Indicates the vertical position; Δx is the coordinate difference between adjacent events of the input device; Δy is the coordinate difference between adjacent events of the input device; W represents the screen width resolution; H represents the screen height resolution.

[0083] Behavioral feature data includes both spatial location and operation timing information, including the sequence of coordinate points and their timestamps collected by the input device. Interactive actions refer to user commands generated by clicking, moving, or dragging a mouse. Continuous trajectories represent motion paths formed by chronologically arranging preprocessed displacement vectors, representing the uniqueness of user operating habits.

[0084] For example, suppose a finance employee enters a password and moves the mouse from interface coordinates (100, 200) to (150, 180) over 0.5 seconds. The horizontal displacement Δx = 50 pixels and the vertical displacement Δy = -20 pixels between the two points are recorded. The original pixel coordinates are converted to coordinates normalized to a percentage based on the screen resolution, generating a displacement vector (50, -20) with an associated time interval of 0.5 seconds. After continuously collecting 20 such vectors, behavioral signature data representing the user's operating rhythm is generated.

[0085] In one embodiment of the present invention, step S3 includes the following steps:

[0086] After completing the hardware authentication information verification and behavioral characteristic data collection, the environmental security status of the access terminal is dynamically detected. The environmental security status includes the integrity of the system patches and the operating activity of the security protection software.

[0087] Specifically, the system calls the terminal operating system's application programming interface (API) to traverse a predefined list of critical system patches, comparing the version identifiers of installed patches with those of the latest patches. For security software detection, the system monitors the running status of its processes and the timing of virus database updates, while also counting the number of security scan tasks triggered within a preset period. The detection results are converted into a patch integrity score and a protection activity score, which are then weighted and summed to generate an environmental safety factor.

[0088] The calculation of the patch completeness score satisfies the following formula:

[0089]

[0090] Among them, S p Score the patch completeness; N mis N is the number of patches not installed on the system; total N is the total number of patches that should be installed. mis and N total The settings are based on a predefined patch list that is dynamically maintained by the enterprise security team.

[0091] The calculation of the protection activity score satisfies the following formula:

[0092]

[0093] Among them, S a Score the protection activity; T alive T is the survival time of the security software process, obtained through the system process monitoring interface; total N is the total duration of the detection cycle, the total time window for evaluating protection activity, defined by the enterprise security policy; scan N is the actual number of scans, which represents the actual number of times the security software performs the scan task during the detection cycle; required The number of scans required is defined by the enterprise security policy.

[0094] The calculation of the environmental safety factor satisfies the following formula:

[0095] C env =w p ·S p +w a ·S a

[0096] Among them, C env Indicates environmental safety factor; S a Indicates the protection activity score; S p represents the patch completeness score; w p represents the patch integrity weight; w a represents the protection activity weight; w p and w a Defined by enterprise security policy.

[0097] If the environmental safety factor is lower than the set security threshold, the terminal environment is judged to have security risks. The security threshold is dynamically set based on the risk tolerance of the enterprise security policy and historical security incident analysis.

[0098] Among them, the environmental security status refers to the health of the terminal device in terms of system vulnerability protection and security software operation. System patch integrity refers to the installation coverage of critical security patches, which is calculated by the ratio of the number of missing patches to the total number of patches that should be installed. The activeness of security protection software refers to the continuous operation status of the antivirus software process and the frequency of regular scanning tasks, which is measured by the product of the process survival time and the number of scan task triggers. The virus database is the core database of security protection software, which contains the signature codes of known viruses, malware, and vulnerability attacks (such as hash values, behavior patterns, signatures, etc.), which are used for real-time comparison and detection of threats in the system.

[0099] For example, when a laptop computer was connected to a desktop cloud, the system detected that it was missing the high-risk patch numbered KB4566789, which was marked as mandatory in the predefined list. This resulted in a lower patch integrity score. The terminal's security software virus database update was 15 days late, and no full disk scan had been performed in the past 24 hours, resulting in a corresponding decrease in the protection activity score. The system multiplied the two scores by weighting factors of 0.6 and 0.4, respectively, and added them together to obtain an environmental safety factor of 0.55, which is lower than the preset safety threshold of 0.7 and triggers an environmental risk alert.

[0100] In one embodiment of the present invention, step S4 includes the following steps:

[0101] Based on the hardware authentication information in step S1, the behavioral feature data in step S2, and the environmental security status in step S3, an authentication confidence level is generated through logical rule judgment. The level is used to quantify the risk level of the user identity and the terminal environment.

[0102] Specifically, the system maps three types of input data, namely hardware authentication information verification results, behavioral feature data matching degree and environmental safety factor, to a predefined scoring interval. The hardware authentication information verification results are determined to be "completely trustworthy" or "partially trustworthy" based on the certificate validity of the physical token and the continuity of the counter. The behavioral feature data matching degree is calculated by the similarity between the current trajectory vector and the historical baseline data, and the environmental safety factor directly uses the output value of step S3. The three types of scores are weighted and summed according to the preset weight distribution ratio to obtain a comprehensive risk value. The hardware authentication has the highest weight, the environmental safety has the second highest weight, and the behavioral feature has the lowest weight. If the comprehensive risk value exceeds the high risk threshold, it is judged as a high risk level. If it is between the high risk threshold and the low risk threshold, it is a medium risk level. If it is below the low risk threshold, it is a low risk level.

[0103] The calculation of comprehensive risk value satisfies the following formula:

[0104] R=w h ·S h +w e ·C env +w b ·S b

[0105] Among them, R represents the comprehensive risk value, which is a quantitative indicator representing the overall security of the terminal; S h Indicates the hardware authentication score. The verification result is obtained by calling the hardware authentication interface (when the hardware is completely trusted, S h =1.0, when the hardware is partially reliable S h =0.5, when the hardware is untrustworthy S h =0); S b Indicates the matching degree of behavioral feature data, which is calculated by the similarity between the current trajectory vector and the historical baseline data; w h 、w e 、w b is the weight coefficient, which is dynamically adjusted according to the enterprise security policy. Hardware authentication has the highest weight, followed by environmental security, and behavioral characteristics have the lowest weight.

[0106] The authentication confidence level is a composite indicator representing the trustworthiness of the user's identity and the security of the environment. Its value is determined by hardware trustworthiness, behavioral compliance, and environmental health. Logical judgment refers to the decision-making process of applying quantitative scores to multi-dimensional input data and comparing them with thresholds based on pre-set rules. A high risk level indicates a high probability of identity forgery or terminal intrusion, a medium risk level indicates a potential security vulnerability requiring partial operation restrictions, and a low risk level indicates that all security conditions are met.

[0107] The predefined scoring intervals map hardware authentication information, behavioral characteristics, and environmental security status to a uniform range of [0, 1], where 0 represents complete untrustworthiness / high risk and 1 represents complete trustworthiness / zero risk. High- and low-risk thresholds are dynamically set based on historical security incident statistics.

[0108] For example, the hardware authentication verification result is "completely trustworthy" (score 1.0), the behavioral feature matching degree is 80% (score 0.8), and the environmental safety factor is 0.6. According to the weight distribution, hardware authentication accounts for 50%, environmental safety accounts for 30%, and behavioral features account for 20%. The comprehensive risk value R = 1.0×0.5+0.6×0.3+0.8×0.2=0.5+0.18+0.16=0.84; if the high risk threshold is 0.8, then 0.84>0.8 triggers a high risk level.

[0109] In one embodiment of the present invention, step S5 includes the following steps:

[0110] According to the authentication confidence level generated in step S4, the user's initial operation authority to access the desktop cloud system is dynamically allocated to achieve an accurate match between the risk level and the authority scope.

[0111] Specifically, the system establishes a permission policy library containing three levels: high-risk, medium-risk, and low-risk. After the authentication confidence level is determined, the corresponding policy is automatically invoked. The permission policy library includes the following: for high-risk users, the system blocks direct access channels and initiates a secondary authentication process, requiring users to verify their identity through biometrics or dynamic verification codes; for medium-risk users, the system allows data browsing but prohibits file downloads and outbound operations; for low-risk users, the system opens full functional permissions, including data editing, downloading, and sharing.

[0112] The result of permission allocation is dynamically bound to the user session through a digital token, and the permission identifier in the token is automatically updated when the permission changes.

[0113] Initial access rights refer to the scope of system operations granted to a user after initial authentication. The secondary authentication process refers to a security enhancement mechanism that adds additional verification steps to basic authentication. Full operational permissions refer to the maximum set of authorizations that complies with enterprise security policies. The permission policy library supports multi-format extensions (JSON / XML / SQL databases) and uses adapter pattern parsing to ensure compatibility with existing systems. Based on the principle of least privilege and dynamic risk response mechanisms in enterprise security policies, and incorporating expert experience, it maps authentication confidence levels to a rule library of predefined operational permission sets.

[0114] For example, a developer was assigned a medium-risk level due to insufficient terminal environment security when logging in. The system granted them access to product design documents, but prohibited them from exporting files via USB or email attachments. After they updated their environment to meet security standards through a patch, the system automatically adjusted their authentication confidence level to low risk on subsequent logins, and updated their authorization token to allow them to download the latest version of the design drawings.

[0115] In one embodiment of the present invention, step S6 includes the following steps:

[0116] After the user obtains the initial access rights, the user's operating behavior is continuously monitored and compared with the initial behavioral feature data collected in step S2 in real time, and a mechanized operating mode is detected to update the authentication confidence level.

[0117] Specifically, during the user operation process, the system intercepts the current behavior feature data in a fixed time window, and extracts the directional distribution of the displacement vector and the volatility characteristics of the time interval in the window. The similarity between the vector directional distribution of the current window and the directional distribution of the initial behavior feature data is calculated, and the standard deviation of the time interval volatility is compared. If the directional distribution similarity is lower than the preset similarity threshold and the time interval volatility approaches zero, it is determined that a mechanized operation mode exists. After detecting the mechanized operation mode, the comprehensive risk value of the current session is increased by a fixed proportion based on step S4, and the authentication confidence level is re-divided according to the updated risk value.

[0118] Time interval volatility refers to the degree of dispersion of the time differences between adjacent operations. It is quantified by the standard deviation and satisfies the following formula:

[0119]

[0120] Among them, σ t is the standard deviation of time volatility; t i is the timestamp difference of the input device event; n is the sampling window size; μ t is the mean of the time interval, which satisfies the following formula:

[0121]

[0122] Direction distribution similarity refers to the degree of overlap between the vector direction angle distribution of the current operation trajectory and the vector direction angle distribution of the initial trajectory, and satisfies the following formula:

[0123]

[0124] Among them, Sim is the direction distribution similarity; K is the number of direction partitions; H baseline (k) is the historical baseline direction angle histogram, which is generated by training with user historical data; Hcurrent (k) is the current operation direction angle histogram, and the number of vectors in each interval is counted. Step S2 generates (Δx norm , Δy norm )Conversion angle θ=arctan2(Δx norm , Δy norm ), and the 360 degrees are divided into K=36 intervals for group counting.

[0125] Mechanized operation patterns refer to non-human behavioral characteristics characterized by highly repetitive operation trajectories and extremely even time intervals. The preset similarity threshold is derived through training based on historical normal user behavior data. Similarity data for the directional distribution of at least 1,000 normal user operation trajectories is collected, and the lowest 5% percentile is used as the high-risk threshold.

[0126] For example, during order approval, the initial operation is manifested as irregular mouse movement speed and multi-directional clicks (the standard deviation of the direction distribution is 35 degrees, and the standard deviation of the time interval is 0.3 seconds). In subsequent operations, the system detected 10 consecutive horizontal movements to the right (the standard deviation of the direction was reduced to 2 degrees) and each movement took exactly 0.5 seconds (the standard deviation of the time interval was 0.02 seconds). The similarity of the direction distribution dropped to 30% (the threshold was set to 50%), and the time volatility was less than 0.05 seconds, triggering the determination of the mechanized operation mode. The system upgraded its authentication confidence level from low risk to medium risk, immediately prohibited the batch export of the purchase list function, and popped up a secondary verification request.

[0127] In one embodiment of the present invention, step S7 includes the following steps:

[0128] The user access rights are adjusted in real time according to the authentication confidence level updated in step S6, and the automatic permission downgrade mechanism is triggered when a continuous no-operation state is detected.

[0129] Specifically, the system monitors the permission level of the current session in real time using a dynamic identifier in the permission token. If the authentication confidence level is raised due to abnormal operation (such as the mechanized operation mode detected in step S6), the system immediately writes new restriction rules to the permission token, such as reducing the originally downloadable file types from all to only text formats.

[0130] The system activates an inactivity countdown timer. If a user fails to make any valid input for a period exceeding the preset time, their privilege level will be forcibly downgraded by one level, regardless of their current authentication confidence level. This downgrade is done in a gradual, step-by-step manner to avoid jumping directly from high privilege to complete block. After the privilege level is changed, the system sends a refresh command to the user's terminal, making the new privileges effective immediately and terminating any operations that do not meet the new privilege level.

[0131] Dynamic access adjustment refers to the technical process of modifying the set of actions a user can perform in real time based on the latest risk assessment results. Preset duration refers to the inactivity tolerance window set in the enterprise security policy, calculated by accumulating inactivity time using the system clock. Automatic privilege reduction refers to a privilege reduction mechanism triggered by a time threshold without manual intervention, such as downgrading from low-risk, full privileges to medium-risk, restricted privileges.

[0132] For example, a designer, after obtaining low-risk permissions, temporarily leaves their workstation while viewing a 3D model file, resulting in 25 minutes of inactivity (the default duration is 20 minutes). After the system detects that the countdown timer has expired, it downgrades their permission level to medium risk, automatically closes the open model file, and prohibits further access to core design data. Upon returning, the user moves the mouse again, and the system requires them to complete an identity verification via SMS verification code before restoring their permissions to their original level.

[0133] See attached Figure 2 , the present invention also proposes a desktop cloud security access control system based on multi-factor authentication, including the following modules:

[0134] An authentication information collection module is used to obtain hardware authentication information submitted by a user, wherein the hardware authentication information includes a unique identifier generated by a physical token;

[0135] A behavior feature acquisition module is used to acquire behavior feature data during user operation input, wherein the behavior feature data is a displacement vector sequence generated by preprocessing the continuous trajectory of the input device;

[0136] The environmental security detection module is used to detect the environmental security status of the access terminal and generate an environmental security factor by calculating the weighted sum of the patch integrity score and the protection activity score;

[0137] A risk assessment module is configured to generate an authentication confidence level by weightedly calculating a comprehensive risk value based on the verification results of the hardware authentication information, the matching degree of the behavioral characteristic data, and the environmental safety factor, and mapping the weighted risk value to a preset threshold range;

[0138] A permissions allocation module that allocates initial access permissions based on the authentication confidence level, where a high risk level triggers a secondary authentication process, a medium risk level restricts data download functionality, and a low risk level grants full operational permissions;

[0139] The behavior monitoring module is used to continuously compare the current behavior feature data with the initial behavior feature data during the user access process, and update the authentication confidence level when a mechanized operation mode is detected;

[0140] The dynamic adjustment module adjusts access rights in real time according to the updated authentication confidence level, and triggers the automatic permission downgrade mechanism when there is no continuous operation for a preset period of time.

[0141] It should be noted that the formulas described above can translate physical quantities of different attributes into unitless standard values or superimposable parameters of the same dimension through the principle of dimensional consistency and mathematical standardization (e.g., normalization, dimensionless parameter conversion, or unit system unification). This eliminates the interference of different dimensions on the operational logic, allowing the formulas to retain the distribution characteristics of the original data while maintaining mathematical rationality and adaptability to objective laws. The above are merely exemplary embodiments of the present invention and are not intended to limit the scope of the present invention.

[0142] The modules can be implemented in whole or in part through software, hardware, or a combination thereof, supporting hardware embedded in or independent of a processor in a computer device, and also supporting software stored in a memory in a computer device, so that the processor can call and execute operations corresponding to the modules.

[0143] It should be noted that the human body information (including but not limited to human device information and personal information, etc.) and data (including but not limited to data used for analysis, stored data and displayed data, etc.) involved in the present invention are all information and data authorized by the human body or fully authorized by all parties. The collection, use and processing of relevant data require relevant legal standards.

[0144] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention, and should all be included in the scope of protection of the present invention.

Claims

1. A desktop cloud security access control method based on multi-factor authentication, characterized in that: The following steps are involved: S1. Obtain hardware authentication information submitted by the user. The hardware authentication information is generated by a physical token and contains a unique identifier. S2. Collecting behavioral feature data during user input operations. Behavioral feature data refers to the continuous trajectory formed by the user's interactive actions on the operation interface; S3. Check the environmental security status of the access terminal, including the integrity of system patches and the level of active operation of security protection software; S4. Generate an authentication confidence level through logical judgment based on hardware authentication information, behavioral feature data, and environmental security status. The authentication confidence level is divided into high risk level, medium risk level, and low risk level; S5. Assign initial access permissions based on authentication confidence levels. High-risk levels trigger secondary authentication, medium-risk levels restrict data download capabilities, and low-risk levels grant full operational permissions. S6. After obtaining the initial access rights, continuously compare the current behavior feature data with the initial behavior feature data and update the authentication confidence level in the mechanized operation mode; S7. Dynamically adjust access permissions based on the updated authentication confidence level, and trigger an automatic permission downgrade mechanism when a continuous inactivity state is detected.

2. The desktop cloud security access control method based on multi-factor authentication according to claim 1 is characterized in that: Obtaining the hardware authentication information submitted by the user includes the following steps: Reading an encrypted data packet stored inside the physical token, the encrypted data packet consisting of a digital certificate and a dynamic counter value; The encrypted data packet is transmitted to the authentication server, which verifies its legitimacy by comparing it with the pre-stored certificate copy and the counter history record; If the certificates match and the counter value is in a reasonable increasing range, the hardware authentication is considered to have passed; if any verification fails, the hardware authentication is considered to have failed.

3. The desktop cloud security access control method based on multi-factor authentication according to claim 1 is characterized in that: Collecting behavioral feature data during user input operations includes the following steps: When a mouse or touch device performs a click, drag, or move action on the operation interface, the coordinate points of the input device and the corresponding timestamps are recorded at fixed time intervals, forming raw trajectory data consisting of multiple coordinate points connected in time sequence; The original trajectory data is preprocessed to remove noise caused by device jitter, and the horizontal and vertical displacements of adjacent coordinate points are calculated separately to generate behavioral feature data consisting of displacement vectors and time intervals.

4. The desktop cloud security access control method based on multi-factor authentication according to claim 1 is characterized in that: Checking the environmental security status of the access terminal includes the following steps: Traverse the predefined list of critical system patches, compare the version identifiers of the installed patches with the version identifiers of the latest patches one by one, and calculate the patch completeness score; Monitor the process lifespan and virus database update status of security protection software, and calculate the protection activity score based on the ratio of actual scan times to required scan times within the preset period; The test results are converted into a patch integrity score and a protection activity score, and the weighted sum of the two scores is used to generate an environmental safety factor. If the environmental safety factor is lower than the set security threshold, the terminal environment is judged to have security risks. The security threshold is dynamically set based on the risk tolerance of the enterprise security policy and historical security incident analysis.

5. The desktop cloud security access control method based on multi-factor authentication according to claim 1 is characterized in that: Based on hardware authentication information, behavioral feature data, and environmental security status, the authentication confidence level is generated through logical judgment, including the following steps: The hardware authentication information verification result is determined to be fully credible or partially credible based on the certificate validity and counter continuity of the physical token, where fully credible corresponds to a first score and partially credible corresponds to a second score; Calculate the trajectory direction distribution similarity and time interval volatility standard deviation between the current behavior feature data and the historical baseline data to generate a behavior feature matching score; The hardware certification score, behavioral feature matching score, and environmental safety factor are weighted and summed according to the preset weights. The preset weights are dynamically adjusted according to the enterprise security policy to generate a comprehensive risk value. The comparison results of the comprehensive risk value with the preset high-risk threshold and low-risk threshold are used to divide the certification confidence level.

6. The desktop cloud security access control method based on multi-factor authentication according to claim 5 is characterized in that: Logical reasoning, including: A decision-making process that compares multidimensional input data with a quantitative score and threshold according to preset rules; A high risk level indicates a high probability of identity forgery or terminal intrusion; The medium risk level indicates that there are potential security vulnerabilities and some operations need to be restricted; A low risk level indicates that all safety conditions are met.

7. The desktop cloud security access control method based on multi-factor authentication according to claim 5 is characterized in that: Assigning initial access rights based on authentication confidence level involves the following steps: Call the preset permission policy library, and once the authentication confidence level is determined, automatically call the corresponding policy; For high-risk users, the system blocks direct access and initiates a secondary authentication process, requiring the user to verify their identity through biometrics or a dynamic verification code. For users with a medium risk level, the system allows browsing data but prohibits file downloading and outgoing operations; For users with low risk levels, the system opens up full functional permissions including data editing, downloading and sharing.

8. The desktop cloud security access control method based on multi-factor authentication according to claim 7 is characterized in that: Calling the preset permission policy library includes the following steps: The permission policy library supports multiple format extensions, including JSON / XML / SQL databases, and is parsed through adapter mode to ensure compatibility with existing systems; Based on the least privilege principle and dynamic risk response mechanism of the enterprise security policy, combined with expert experience, the authentication confidence level is mapped to a rule base of predefined operation permission sets.

9. The desktop cloud security access control method based on multi-factor authentication according to claim 1, characterized in that: Continuously comparing the current behavior feature data with the initial behavior feature data includes the following steps: Intercept the current behavior feature data and extract the directional distribution of the displacement vector and the fluctuation characteristics of the time interval within the window; Calculate the similarity between the vector direction distribution of the current window and the direction distribution of the initial behavior feature data, and compare the standard deviation of the time interval volatility; If the direction distribution similarity is lower than the preset similarity threshold and the time interval volatility approaches zero, the preset similarity threshold is obtained through training of historical normal user behavior data, and it is determined that a mechanized operation mode exists.

10. The desktop cloud security access control method based on multi-factor authentication according to claim 9 is characterized in that: Dynamically adjust access permissions based on the updated authentication confidence level, including the following steps: When the authentication confidence level is raised due to abnormal operation, new restriction rules are immediately written to the permission token; If no valid operation input is made for a period exceeding the preset time limit, which refers to the no-operation tolerance time window set in the enterprise security policy and is calculated based on the system clock, the permission level will be reduced by one level. Send a refresh command to the user terminal to make the new permissions take effect immediately and interrupt the operation process that does not meet the new permission level.

Images