Method for secure access control of desktop cloud based on multi-factor authentication

Abstract

The application belongs to the technical field of computer security, and relates to a desktop cloud security access control method based on multi-factor authentication, which comprises the following steps: obtaining hardware authentication information submitted by a user; collecting behavior characteristic data when the user operates input; detecting the environment security state of an access terminal; generating an authentication confidence level, which is divided into a high-risk level, a medium-risk level and a low-risk level; distributing initial access rights based on the authentication confidence level; after obtaining the initial access rights, continuously comparing current behavior characteristic data with initial behavior characteristic data, and updating the authentication confidence level when in a mechanical operation mode; dynamically adjusting access rights according to the updated authentication confidence level, and triggering an automatic right downgrade mechanism when a continuous non-operation state is detected. The application solves the problem that traditional methods rely on manual intervention for right change.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of computer security, and relates to a desktop cloud security access control method based on multi-factor authentication. BACKGROUND

[0002] In a traditional access control system, user identity authentication mainly relies on single-factor verification methods such as static passwords or fixed tokens. These methods can only confirm the user identity at the moment of login and cannot deal with the risks of identity hijacking or abuse of authority during the session process. With the development of automated attack tools, attackers can easily steal passwords or copy hardware tokens and then pretend to be legitimate users to implement data theft or unauthorized operations. At the same time, the security state of terminal devices lacks real-time monitoring, and systems with vulnerabilities may become attack entry points.

[0003] Some solutions introduce two-factor authentication or periodic scanning mechanisms. For example, a secondary verification is performed by combining a short message verification code with a password, or a terminal is required to install security software and periodically submit a scanning report. Although such methods increase the attack threshold, the verification process is often concentrated in the initial login stage and cannot cover the entire operation period of the user. Behavior analysis technology is used to identify abnormal operations, but it is mostly limited to independent modules and does not deeply interact with the authority control system.

[0004] Based on the above problems, the traditional method relies on manual intervention for authority changes, and the response delay exposes the system to continuous threats, ultimately forming a passive defense mode, which is difficult to deal with increasingly complex identity spoofing attacks and automated penetration means. SUMMARY

[0005] To solve the above problems, the application provides a desktop cloud security access control method based on multi-factor authentication.

[0006] The desktop cloud security access control method based on multi-factor authentication comprises the following steps:

[0007] S1, obtaining hardware authentication information submitted by a user, the hardware authentication information being generated by a physical token and containing a unique identifier;

[0008] S2, collecting behavior feature data when the user operates input, the behavior feature data being continuous tracks formed by interactive actions of the user on an operation interface;

[0009] S3, detecting an environmental security state of an access terminal, the environmental security state including system patch integrity and running activity level of security protection software;

[0010] S4, generating an authentication confidence level according to the hardware authentication information, the behavior feature data, and the environmental security state through logical judgment, the authentication confidence level being divided into a high-risk level, a medium-risk level, and a low-risk level;

[0011] S5, assigning initial access permissions based on the authentication confidence level, wherein a high-risk level triggers a secondary authentication process, a medium-risk level restricts data download functions, and a low-risk level grants full operation permissions;

[0012] S6, after obtaining the initial access permissions, continuously comparing the current behavior characteristic data with the initial behavior characteristic data, and updating the authentication confidence level in a mechanical operation mode;

[0013] S7, dynamically adjusting the access permissions according to the updated authentication confidence level, and triggering an automatic permission downgrade mechanism when a continuous inaction state is detected.

[0014] In a further aspect of the application, the hardware authentication information submitted by the user is obtained, including the following steps:

[0015] The encrypted data packet stored in the physical token is read, which is composed of a digital certificate and a dynamic counter value;

[0016] The read encrypted data packet is transmitted to the authentication server, which verifies its legality by comparing the pre-stored certificate copy and the counter history record;

[0017] If the certificate matches and the counter value is in a reasonable increasing interval, the hardware authentication is determined to be passed; if any of the verifications fails, the hardware authentication is determined to be failed.

[0018] In a further aspect of the application, the behavior characteristic data when the user operates the input is collected, including the following steps:

[0019] When the mouse or touch device performs click, drag or move actions on the operation interface, the coordinate points and corresponding time stamps of the input device are recorded at fixed time intervals to form original trajectory data connected in time sequence by multiple coordinate points;

[0020] The original trajectory data is preprocessed to remove noise points caused by device jitter, and the horizontal displacement and vertical displacement of adjacent coordinate points are calculated respectively to generate behavior characteristic data composed of displacement vectors and time intervals.

[0021] In a further aspect of the application, the environmental security state of the access terminal is detected, including the following steps:

[0022] The pre-defined key system patch list is traversed, and the version identifier of the installed patch is compared with the version identifier of the latest patch one by one to calculate the patch integrity score;

[0023] The process survival time of the security protection software and the virus library update state are monitored, and the protection activity score is calculated by combining the ratio of the actual scanning times to the required scanning times in a preset period;

[0024] The detection result is converted into a patch integrity score and a protection activity score, and an environment safety coefficient is generated by weighted summation of the two score values;

[0025] If the environment safety coefficient is lower than a set safety threshold, it is determined that the terminal environment has a security risk, and the safety threshold is dynamically set based on the risk tolerance of the enterprise security policy and historical security event analysis.

[0026] In a further aspect of the application, an authentication confidence level is generated by logical judgment based on hardware authentication information, behavior characteristic data and environment safety state, including the following steps:

[0027] The hardware authentication information verification result is determined to be completely trusted or partially trusted according to the certificate validity and the continuity of the counter of the physical token, and the completely trusted corresponds to a first score value and the partially trusted corresponds to a second score value;

[0028] The trajectory direction distribution similarity of the current behavior characteristic data and the historical baseline data and the time interval fluctuation standard deviation are calculated to generate a behavior characteristic matching degree score;

[0029] The hardware authentication score, the behavior characteristic matching degree score and the environment safety coefficient are weighted and summed according to preset weights, the preset weights are dynamically adjusted according to the enterprise security policy, and a comprehensive risk value is generated;

[0030] The comparison result of the comprehensive risk value and the preset high risk threshold and low risk threshold divides the authentication confidence level.

[0031] In a further aspect of the application, the logical judgment includes:

[0032] A decision-making process of quantifying and threshold comparing the multi-dimensional input data according to a preset rule;

[0033] The high risk level indicates a high probability risk of identity forgery or terminal intrusion;

[0034] The medium risk level indicates that there is a potential security vulnerability that needs to be partially restricted;

[0035] The low risk level indicates that all security conditions are met.

[0036] In a further aspect of the application, initial access permissions are assigned based on the authentication confidence level, including the following steps:

[0037] A preset permission policy library is called, and the authentication confidence level is determined to automatically call the corresponding policy;

[0038] For a user with a high risk level, the system blocks the direct access channel and starts a secondary authentication process, requiring the user to verify the identity through biometric recognition or dynamic verification code;

[0039] The medium-risk level user is allowed to browse data but is forbidden to download files and send out data;

[0040] The low-risk level user is allowed to use all functions including data editing, downloading and sharing.

[0041] The further scheme of the present application comprises the following steps of:

[0042] The permission policy library supports multiple formats, including JSON / XML / SQL database, and is parsed through an adapter mode to ensure compatibility with existing systems.

[0043] Based on the minimum permission principle and dynamic risk response mechanism of enterprise security policy, the authentication confidence level is mapped to the rule library of the predefined operation permission set in combination with expert experience.

[0044] The further scheme of the present application comprises the following steps of continuously comparing the current behavior characteristic data with the initial behavior characteristic data:

[0045] The current behavior characteristic data is intercepted, and the direction distribution of displacement vectors and the fluctuation characteristic of time intervals in the window are extracted.

[0046] The similarity of the vector direction distribution of the current window and the direction distribution of the initial behavior characteristic data is calculated, and the standard deviation of the time interval fluctuation is compared.

[0047] If the direction distribution similarity is lower than a preset similarity threshold value, and the time interval fluctuation tends to zero, the preset similarity threshold value is obtained by training historical normal user behavior data, and it is determined that there is a mechanical operation mode.

[0048] The further scheme of the present application comprises the following steps of dynamically adjusting the access permission according to the updated authentication confidence level:

[0049] When the authentication confidence level is increased due to abnormal operation, a new restriction rule is immediately written to the permission token.

[0050] When the time of continuous generation of effective operation input exceeds a preset time length, the preset time length refers to the operation tolerance time window set in the enterprise security policy, the non-activity time is accumulated and calculated through the system clock, and the permission level is reduced by one level.

[0051] A refresh instruction is sent to the user terminal, so that the new permission takes effect immediately and the operation process that does not meet the new permission level is interrupted.

[0052] In summary, the present application has the following beneficial technical effects:

[0053] 1. Through real-time fusion of hardware authentication, behavior characteristics and terminal environment security data, a quantitative authentication confidence level is generated, and access rights are dynamically allocated and adjusted based on the level. This mechanism can accurately match user operation risk and permission range, and immediately trigger permission downgrade or secondary authentication when abnormal behavior or environmental threats are detected, effectively preventing high-risk operations from being executed. Compared with traditional static permission models, the real-time defense capability against new threats such as identity spoofing, automated attacks and terminal intrusion is significantly improved, so that the security policy always evolves in synchronization with the risk situation;

[0054] 2. Based on the automatic evaluation mechanism of terminal environment security coefficient, the system patch integrity and protection software activity are accurately quantified to avoid excessive reliance on manual inspection. The system automatically implements differentiated permission control according to risk level: low-risk users obtain complete operation permission to ensure efficiency, and high-risk users are secured through function restriction or secondary authentication. This strategy minimizes the operational burden of the security team while ensuring that legitimate users pass the verification without awareness and malicious access is accurately intercepted, achieving the optimal balance between security and usability;

[0055] 3. A complete monitoring chain is established from initial authentication to session termination. The current behavior is continuously compared with the historical baseline during user operation, and abnormalities are detected through trajectory direction distribution similarity and time interval volatility. The design of automatic permission downgrade upon inactivity timeout further eliminates the risk of hijacking idle sessions. The whole-cycle dynamic verification mechanism implements the zero trust principle, completely changing the traditional one-time pass mode of authentication, and the system always maintains an active defense state in complex network environments. BRIEF DESCRIPTION OF DRAWINGS

[0056] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced below, and the drawings are used to provide further understanding of the present application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0057] Fig. 1 The flowchart of the embodiment of the present application is disclosed.

[0058] Fig. 2 The structural schematic diagram of the embodiment of the present application is disclosed. DETAILED DESCRIPTION

[0059] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. All other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0060] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Figs. 1-2 The preferred detailed description of the present application is made.

[0061] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Fig. 1 The present application proposes a desktop cloud security access control method based on multi-factor authentication, comprising the following steps:

[0062] S1, obtaining hardware authentication information submitted by a user, the hardware authentication information being generated by a physical token and containing a unique identifier;

[0063] S2, collecting behavior feature data when the user operates to input, the behavior feature data being continuous tracks formed by interactive actions of the user on an operation interface;

[0064] S3, detecting an environment security state of an access terminal, the environment security state including system patch integrity and running activity degree of security protection software;

[0065] S4, generating an authentication confidence level through logical judgment according to the hardware authentication information, the behavior feature data and the environment security state, the authentication confidence level being divided into a high-risk level, a medium-risk level and a low-risk level;

[0066] S5, assigning an initial access right based on the authentication confidence level, wherein the high-risk level triggers a secondary authentication process, the medium-risk level limits a data download function, and the low-risk level grants complete operation right;

[0067] S6, after obtaining the initial access right, continuously comparing current behavior feature data with initial behavior feature data, and updating the authentication confidence level when a mechanical operation mode is detected;

[0068] S7, dynamically adjusting the access right according to the updated authentication confidence level, and triggering an automatic right downgrade mechanism when a continuous no-operation state is detected.

[0069] In one of the embodiments of the present application, step S1 comprises the following steps:

[0070] Obtaining hardware authentication information submitted by a user, the hardware authentication information being generated by a physical token and containing a unique identifier.

[0071] Specifically, when a user accesses the desktop cloud system, the system detects whether a physical token has been connected to the terminal device. The physical token is an independent hardware device with encryption function, which needs to be inserted into the USB interface of the terminal device or connected through near field communication. The system reads the encrypted data packet stored in the physical token, which is composed of a digital certificate and a dynamic counter value. The digital certificate is a pre-set non-replicable identity data, and the dynamic counter value is automatically accumulated by the microchip built-in the physical token each time it is plugged in or out.

[0072] The read encrypted data packet is transmitted to the authentication server, which verifies its legality by comparing the pre-stored certificate copy and the counter history record. If the certificate matches and the counter value is in a reasonable incremental interval, the hardware authentication is determined to be passed; if any of the verifications fails, the hardware authentication is determined to be failed.

[0073] Among them, the hardware authentication information refers to the encrypted data packet generated by the physical token, which contains the digital certificate and the dynamic counter value, and cannot be simulated by software and differs each time it is used. The physical token is an independent hardware device with encryption function, which is used to generate, store and dynamically update the authentication information. The unique identifier is the authentication identifier formed by the combination of the serial number of the digital certificate and the current value of the dynamic counter, which ensures the traceability of each authentication request. The dynamic counter value represents the value generated by the built-in chip of the physical token, which automatically increments each time it is plugged in or out or triggers authentication.

[0074] The setting of the reasonable incremental interval refers to the legal range of the dynamic counter value, which is usually dynamically defined in combination with the historical counter value, time window and business scenario; assuming that the last recorded counter value on the server is C old , the newly submitted value is C new , the legal condition is C new >C old and C new ≤C old +N, N represents the tolerance threshold;

[0075] The setting of the tolerance threshold balances between security and availability based on business scenarios and security requirements; the upper limit of the threshold is determined through historical statistical analysis (normal operation frequency of users, average network delay time) and stress testing (simulation of high concurrency and cross-time zone scenarios); for example, the theoretical maximum value of daily plugging is 100, and the threshold N is set to 100.

[0076] For example, assuming that the employees of a manufacturing enterprise use USB-shaped physical tokens to access the desktop cloud system; when the employee inserts the USB token into the workshop computer, the system automatically reads the digital certificate (including the employee number and department code uniformly issued by the enterprise) and the current value of the plugging counter (128th use) in the token.

[0077] After the authentication server receives the data packet containing the certificate and the counter value 128, it first verifies whether the certificate is consistent with the valid certificate stored in the enterprise database, and then checks whether the last recorded counter value on the token is 127. If both verifications pass, it is determined that the hardware authentication passes; if either verification fails, it is determined that the hardware authentication fails.

[0078] In one embodiment of the present application, step S2 comprises the following steps:

[0079] After the hardware authentication is determined to pass based on step S1, the behavior feature data of the user when operating the input device is collected. The behavior feature data refers to the continuous trajectory formed by the interactive action of the user on the operation interface through the input device.

[0080] Specifically, after the hardware authentication verification succeeds, the trajectory recording function is activated. When the user performs a click, drag, or move action on the operation interface through the mouse or touch device, the coordinate points of the input device and the corresponding time stamps are recorded at fixed time intervals to form original trajectory data connected in time sequence by multiple coordinate points. Then, the original trajectory data is preprocessed to remove noise points generated by device jitter, and the horizontal displacement and vertical displacement of adjacent coordinate points are calculated respectively to generate behavior feature data composed of displacement vectors and time intervals. The horizontal displacement and vertical displacement of adjacent coordinate points are calculated to satisfy the following formula:

[0081]

[0082] wherein, Δx norm represents the horizontal position; Δy norm represents the vertical position; Δx is the adjacent event coordinate difference of the input device; Δy is the adjacent event coordinate difference of the input device; W represents the screen width resolution; and H represents the screen height resolution.

[0083] The behavior feature data contains dual information of spatial position and operation time sequence, including the coordinate point sequence and its time stamp collected by the input device. The interactive action refers to the operation instruction generated by the user through mouse clicking, moving, or dragging. The continuous trajectory refers to the motion path representation formed by the displacement vectors arranged in time sequence after preprocessing, which represents the uniqueness of the user's operation habit.

[0084] For example, assuming that the financial personnel input the password, the mouse moves from the interface coordinate (100, 200) to (150, 180) with a time consumption of 0.5 seconds, the horizontal displacement Δx = 50 pixels and the vertical displacement Δy = -20 pixels between the two points are recorded, the original pixel coordinates are converted into standardized percentage coordinates based on the screen resolution, and the displacement vector (50, -20) is generated with a time interval of 0.5 seconds. After 20 such vectors are continuously collected, the behavior feature data representing the operation rhythm of the user is formed.

[0085] In one embodiment of the present application, step S3 comprises the following steps:

[0086] After completing the hardware authentication information verification and behavior characteristic data collection, the environment security state of the access terminal is dynamically detected, and the environment security state includes system patch integrity and security protection software running activity level.

[0087] Specifically, by calling the application program interface of the terminal operating system, the pre-defined key system patch list is traversed, and the version identifier of the installed patch is compared with the version identifier of the latest patch one by one. For the detection of the security protection software, the running state of its process and the virus library update time are monitored, and the triggering number of security scanning tasks within a preset period is counted. The detection results are converted into patch integrity score and protection activity level score, and the environment security coefficient is generated by weighted summation of the two score values.

[0088] The calculation of the patch integrity score satisfies the following formula:

[0089]

[0090] Among them, S p is the patch integrity score; N mis is the number of patches not installed by the system; N total is the total number of patches that should be installed. N mis and N total are set based on the pre-defined patch list, which is dynamically maintained by the enterprise security team.

[0091] The calculation of the protection activity level score satisfies the following formula:

[0092]

[0093] Among them, S a is the protection activity level score; T alive is the survival time of the security software process, which is obtained through the system process monitoring interface; T total is the total time length of the detection period, which is the total time window for evaluating the protection activity level, and is defined by the enterprise security policy; N scan is the actual scanning number, which represents the actual number of scanning tasks performed by the security software within the detection period; N required is the required scanning number, which is defined by the enterprise security policy.

[0094] The calculation of the environment security coefficient satisfies the following formula:

[0095] C env = w p · S p + w a · S a

[0096] wherein C env represents the environmental safety coefficient; S a represents the protection activity score; S p represents the patch integrity score; w p represents the patch integrity weight; w a represents the protection activity weight; w p and w a defined by the enterprise security policy.

[0097] If the environmental safety coefficient is lower than the set safety threshold, it is determined that the terminal environment has a security risk, and the safety threshold is dynamically set based on the risk tolerance of the enterprise security policy and historical security event analysis.

[0098] wherein the environmental safety state refers to the health degree of the terminal device at the system vulnerability protection and security software running level. The system patch integrity refers to the installation coverage rate of the key security patch, which is calculated by the proportion of the missing patch quantity to the total number of installed patches. The security protection software running activity degree refers to the continuous running state of the antivirus software process and the frequency of periodic scanning tasks, which is measured by the product of the process survival time and the scanning task triggering frequency. The virus library is the core database of the security protection software, which contains the feature codes (such as hash value, behavior pattern, signature, etc.) of known viruses, malicious software and vulnerability attacks, and is used for real-time comparison and detection of threats in the system.

[0099] For example, when a notebook computer accesses the desktop cloud, the system detects that it is missing a high-risk patch numbered KB4566789, which is marked as a mandatory item in the predefined list, resulting in a decrease in the patch integrity score. The virus library of the security software of the terminal is updated 15 days behind schedule, and no full disk scanning has been performed in the past 24 hours, so the protection activity score also decreases. The system adds the two scores multiplied by the weight coefficients of 0.6 and 0.4 respectively, and obtains the environmental safety coefficient as 0.55, which is lower than the preset safety threshold of 0.7, triggering the environmental risk alarm.

[0100] In one embodiment of the application, step S4 comprises the following steps:

[0101] Based on the hardware authentication information of step S1, the behavior feature data of step S2, and the environmental safety state of step S3, the authentication confidence level is generated by logical rule judgment, and the level is used to quantify the risk level of the user identity and the terminal environment.

[0102] Specifically, the system maps the three types of input data, hardware authentication information verification result, behavior characteristic data matching degree and environment safety coefficient, to a predefined scoring interval. The hardware authentication information verification result is determined as "completely trusted" or "partially trusted" according to the certificate validity and the continuity of the counter of the physical token. The behavior characteristic data matching degree is calculated by the similarity of the current trajectory vector and the historical baseline data. The environment safety coefficient directly uses the output value of step S3. The three types of scores are weighted and summed according to the preset weight distribution ratio to obtain a comprehensive risk value. The weight of hardware authentication is the highest, the weight of environment safety is the second, and the weight of behavior characteristic is the lowest. If the comprehensive risk value exceeds the high risk threshold, it is determined as a high risk level. If it is between the high risk threshold and the low risk threshold, it is a medium risk level. If it is lower than the low risk threshold, it is a low risk level.

[0103] The calculation of the comprehensive risk value satisfies the following formula:

[0104] R = w h · S h + w e · C env + w b · S b

[0105] wherein R represents the comprehensive risk value, representing the quantitative index of the overall security of the terminal; S h represents the hardware authentication score, which is obtained by calling the hardware authentication interface to obtain the verification result (S h = 1.0 when the hardware is completely trusted, S h = 0.5 when the hardware is partially trusted, and S h = 0 when the hardware is not trusted); S b represents the behavior characteristic data matching degree, which is calculated by the similarity of the current trajectory vector and the historical baseline data; w h , w e , and w b are weight coefficients, which are dynamically adjusted according to the enterprise security policy. The weight of hardware authentication is the highest, the weight of environment safety is the second, and the weight of behavior characteristic is the lowest.

[0106] wherein the authentication confidence level is a composite index representing the user identity trustworthiness and the environment safety, and its value is determined by the hardware trustworthiness, the behavior compliance, and the environment health. The logical judgment is a decision-making process of quantitatively scoring and threshold comparison on multi-dimensional input data according to the preset rules. The high risk level indicates a high probability risk of identity forgery or terminal intrusion. The medium risk level indicates that there is a potential security vulnerability that needs to be partially restricted. The low risk level indicates that all security conditions are met.

[0107] The predefined score interval refers to the unified mapping of three types of security indexes, hardware authentication information, behavior characteristic data and environment security state, to the interval [0, 1], wherein 0 represents complete untrustworthiness / high risk, and 1 represents complete trustworthiness / zero risk. The high risk threshold and the low risk threshold are dynamically set based on historical security event statistics.

[0108] For example, the hardware authentication verification result is "complete trustworthiness" (score 1.0), the behavior characteristic matching degree is 80% (score 0.8), and the environment security coefficient is 0.6. According to the weight distribution, the hardware authentication accounts for 50%, the environment security accounts for 30%, and the behavior characteristic accounts for 20%, and the comprehensive risk value R = 1.0*0.5 + 0.6*0.3 + 0.8*0.2 = 0.5 + 0.18 + 0.16 = 0.84. If the high risk threshold is 0.8, then 0.84>0.8 triggers the high risk level.

[0109] In one of the embodiments of the application, step S5 comprises the following steps:

[0110] According to the authentication confidence level generated in step S4, the initial operation permission of the user accessing the desktop cloud system is dynamically allocated, so as to realize the accurate matching of the risk level and the permission range.

[0111] Specifically, the system establishes a permission policy library containing three levels of high risk level, medium risk level and low risk level, and automatically calls the corresponding policy after the authentication confidence level is determined. The permission policy library includes that for the high risk level user, the system blocks the direct access channel and starts a secondary authentication process, requiring the user to verify the identity through biometric identification or dynamic verification code; for the medium risk level user, the system allows browsing data but prohibits file download and external sending operation; and for the low risk level user, the system opens all function permissions including data editing, downloading and sharing.

[0112] The result of the permission allocation is dynamically bound to the user session through a digital token, and the permission identifier in the token is automatically updated when the permission is changed.

[0113] The initial access permission refers to the system operation range that the user obtains for the first time after authentication. The secondary authentication process refers to a security enhancement mechanism that adds an additional verification link based on the basic authentication. The complete operation permission refers to the maximum authorized set that meets the enterprise security policy. The permission policy library supports multiple formats such as JSON, XML and SQL database, and is parsed through the adapter mode to ensure compatibility with the existing system. Based on the principle of least privilege of enterprise security policy and the dynamic risk response mechanism, the authentication confidence level is mapped to the rule library of the predefined operation permission set combined with expert experience.

[0114] For example, when a certain R&D personnel logs in due to insufficient terminal environment security coefficient, he is determined to be a medium risk level, and the system grants him the right to access product design documents, but prohibits exporting files through USB copying or email attachment form. After the personnel updates the environment security coefficient through patching, the system automatically adjusts his authentication confidence level to low risk during subsequent login, and the permission token is updated to allow downloading the latest version of design drawings.

[0115] In one embodiment of the present application, step S6 comprises the following steps:

[0116] After the user obtains initial access rights, the user's operation behavior is continuously monitored and compared with the initial behavior feature data collected in step S2 in real time to detect mechanical operation mode to update the authentication confidence level.

[0117] Specifically, the system intercepts the current behavior feature data in a fixed time window during user operation, extracts the direction distribution of displacement vectors and the volatility feature of time intervals in the window. The similarity of the vector direction distribution of the current window and the direction distribution of the initial behavior feature data is calculated, and the standard deviation of the time interval volatility is compared. If the direction distribution similarity is lower than the preset similarity threshold and the time interval volatility tends to zero, it is determined that there is a mechanical operation mode. After detecting the mechanical operation mode, the comprehensive risk value of the current session is increased by a fixed proportion based on step S4, and the authentication confidence level is reclassified according to the updated risk value.

[0118] The time interval volatility refers to the dispersion degree of the time difference value of adjacent operation actions, which is quantitatively calculated by standard deviation, satisfying the following formula:

[0119]

[0120] Where σ t is the time volatility standard deviation; t i is the input device event timestamp difference; n is the sampling window size; μ t is the time interval mean, satisfying the following formula:

[0121]

[0122] The direction distribution similarity refers to the overlap degree of the vector direction angle distribution of the current operation trajectory and the initial trajectory vector direction angle distribution, satisfying the following formula:

[0123]

[0124] Where Sim is the direction distribution similarity; K is the direction partition number; H baseline (k) is the historical baseline direction angle histogram, which is generated by training user historical data; Hcurrent (k) is the current operating direction angle histogram, the number of each interval vector is counted, and step S2 generates (Δx norm , Δy norm ) conversion angle θ = arctan2 (Δx norm , Δy norm ), and the 360-degree uniform division is divided into K = 36 interval groups.

[0125] The mechanized operation mode refers to the non-human behavior characteristics that the operation trajectory presents high repeatability and extremely uniform time interval. The preset similarity threshold is obtained by training historical normal user behavior data. The direction distribution similarity data of at least 1000 normal user operation trajectories are collected, and the lowest 5% quantile value is taken as the high-risk determination threshold.

[0126] For example, during order approval, the initial operation is characterized by irregular mouse movement speed and multi-directional clicking (direction distribution standard deviation is 35 degrees, and time interval standard deviation is 0.3 seconds). In the subsequent operation, the system detects that the horizontal right movement is continuous for 10 times (the direction standard deviation is reduced to 2 degrees) and each movement takes exactly 0.5 seconds (the time interval standard deviation is 0.02 seconds). The direction distribution similarity is reduced to 30% (the threshold is set to 50%), and the time fluctuation is less than 0.05 seconds, triggering the mechanized operation mode determination. The system upgrades the authentication confidence level from low risk to medium risk, immediately prohibits the bulk export of the procurement list function, and pops up a secondary verification request.

[0127] In one embodiment of the present application, step S7 comprises the following steps:

[0128] The authentication confidence level updated according to step S6 is used to adjust the user access rights in real time, and the automatic right downgrade mechanism is triggered when a continuous inaction state is detected.

[0129] Specifically, the system monitors the right level of the current session in real time through the dynamic identifier in the right token. When the authentication confidence level is adjusted due to abnormal operation (such as the mechanized operation mode detected in step S6), the system immediately writes new restriction rules to the right token, for example, reducing the original downloadable file type from all to only text format.

[0130] The system starts an inaction countdown timer. When the user continuously does not produce valid operation input for more than a preset time, the right level is forced to be reduced by one level regardless of the current authentication confidence level. The right downgrade adopts a step-by-step decreasing strategy to avoid jumping directly from high right to complete blocking. After the right is changed, the system sends a refresh instruction to the user terminal to make the new right take effect immediately and interrupt the operation process that does not meet the new right level.

[0131] The dynamic adjustment of access permissions refers to a technical process of modifying the set of executable operations of a user in real time according to the latest risk determination result. The preset time length refers to a non-operation tolerance time window set in the enterprise security policy, and the non-activity time is calculated by accumulating the system clock. The automatic reduction of the permission level refers to a permission reduction mechanism triggered according to the time threshold without manual intervention, for example, from low-risk complete permissions to medium-risk limited permissions.

[0132] For example, a certain designer obtains a low-risk level permission, and temporarily leaves the workstation when viewing a 3D model file, resulting in a continuous non-operation of 25 minutes (the preset time length is 20 minutes). After the system detects that the countdown timer is over, the permission level of the designer is reduced to medium risk, and the opened model file is automatically closed and the core design data is prohibited from being accessed again. After the designer returns, the mouse is moved again, and the system requires the designer to complete identity verification through an SMS verification code, and the permission level is restored to the original level.

[0133] Referring to the accompanying drawings, Fig. 2 The application also provides a desktop cloud security access control system based on multi-factor authentication, which comprises the following modules:

[0134] The authentication information acquisition module is configured to obtain hardware authentication information submitted by a user, wherein the hardware authentication information comprises a unique identifier generated by a physical token.

[0135] The behavior feature acquisition module is configured to acquire behavior feature data of the user when the user operates an input device, wherein the behavior feature data is generated by a displacement vector sequence of a continuous trajectory of the input device after preprocessing.

[0136] The environment security detection module is configured to detect the environment security state of a terminal, and generate an environment security coefficient by calculating a weighted sum of a patch integrity score and a protection activity score.

[0137] The risk assessment module is configured to calculate a comprehensive risk value by weighting based on a verification result of the hardware authentication information, a matching degree of the behavior feature data, and the environment security coefficient, and map the comprehensive risk value to a preset threshold interval to generate an authentication confidence level.

[0138] The permission allocation module is configured to allocate an initial access permission according to the authentication confidence level, wherein a secondary authentication process is triggered for a high-risk level, a data download function is limited for a medium-risk level, and complete operation permissions are granted for a low-risk level.

[0139] The behavior monitoring module is configured to continuously compare current behavior feature data with initial behavior feature data during the access process of the user, and update the authentication confidence level when a mechanical operation mode is detected.

[0140] The dynamic adjustment module adjusts the access right in real time according to the updated authentication confidence level, and triggers the automatic right downgrade mechanism when continuous inaction reaches a preset time length.

[0141] It should be noted that: the above formulas can convert physical quantities of different properties into unitless standard values or parameters of the same dimension through the principle of dimensional consistency and mathematical standardization methods (such as normalization processing, dimensionless parameter conversion, or unit system unification), thereby eliminating the interference of different dimensions on the operation logic, making the formula retain the original data distribution characteristics while having mathematical operation rationality and objective law adaptability. The above is only an exemplary embodiment of the present application, and cannot limit the scope of the present application.

[0142] The various modules can be realized by software, hardware and their combination in whole or in part, support hardware form embedded in or independent of the processor in the computer device, and also support software form stored in the memory in the computer device, so as to facilitate the processor to call and execute the operations corresponding to the above various modules.

[0143] It should be noted that the human information (including but not limited to human device information and personal information, etc.) and data (including but not limited to data for analysis, stored data and displayed data, etc.) involved in the present application are all information and data authorized by the human body or fully authorized by all parties. The collection, use and processing of relevant data require relevant legal standards.

[0144] The above embodiments are only used to illustrate the technical solutions of the present application, but not to limit them; although the present application is described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. A method for secure access control of a desktop cloud based on multi-factor authentication, characterized in that, The method comprises the following steps: S1, obtaining hardware authentication information submitted by a user, the hardware authentication information being generated by a physical token and containing a unique identifier; S2, collecting behavior characteristic data when the user operates an input, the behavior characteristic data being continuous tracks formed by interactive actions of the user on an operation interface; S3, detecting an environment security state of an access terminal, the environment security state including system patch integrity and security protection software running activity, and an environment security coefficient being generated by calculating a weighted sum of a patch integrity score and a protection activity score; S4, generating an authentication confidence level by logical judgment according to the hardware authentication information, the behavior characteristic data and the environment security state, the authentication confidence level being divided into a high-risk level, a medium-risk level and a low-risk level; The hardware authentication information verification result is determined as completely trusted, partially trusted or untrusted according to the certificate validity and the continuity of the counter of the physical token, the completely trusted corresponding to a first score, the partially trusted corresponding to a second score and the untrusted corresponding to a third score; The track direction distribution similarity of the current behavior characteristic data and historical baseline data and the time interval fluctuation standard deviation are calculated to generate a behavior characteristic matching degree score; The hardware authentication score, the behavior characteristic matching degree score and the environment security coefficient are weighted and summed according to preset weights, the preset weights being dynamically adjusted according to enterprise security strategies, and a comprehensive risk value is generated; The authentication confidence level is divided according to a comparison result of the comprehensive risk value and preset high-risk and low-risk thresholds; S5, assigning an initial access right based on the authentication confidence level, the high-risk level triggering a secondary authentication process, the medium-risk level limiting a data download function and the low-risk level granting complete operation rights; S6, after obtaining the initial access right, continuously comparing the current behavior characteristic data with initial behavior characteristic data, and updating the authentication confidence level in a mechanical operation mode; S7, dynamically adjusting the access right according to the updated authentication confidence level, and triggering an automatic right downgrade mechanism when a continuous no-operation state is detected.

2. The multi-factor authentication based desktop cloud security access control method of claim 1, wherein, The behavior characteristic data when the user operates an input comprises the following steps: When a mouse or a touch device performs a click, drag or move action on an operation interface, coordinate points of the input device and corresponding time stamps are recorded at fixed time intervals to form original track data connected in time sequence by multiple coordinate points; After preprocessing the original track data to remove noise points caused by device jitter, the horizontal displacement and the vertical displacement of adjacent coordinate points are calculated respectively to generate behavior characteristic data composed of displacement vectors and time intervals.

3. The multi-factor authentication based desktop cloud security access control method of claim 1, wherein, The environment security state of the access terminal comprises the following steps: Traverse a pre-defined key system patch list, compare the version identifier of the installed patch with the version identifier of the latest patch one by one, and calculate a patch integrity score; Monitor the process survival time of the security protection software and the virus library update state, and calculate a protection activity score according to the proportion of the actual scanning times to the required scanning times in a preset period; The detection results are converted into the patch integrity score and the protection activity score, and the environment security coefficient is generated by weighted sum of the two score values. If the environmental safety coefficient is lower than the set safety threshold, it is determined that the terminal environment has security risks, and the safety threshold is dynamically set based on the risk tolerance of the enterprise security policy and historical security event analysis.

4. The multi-factor authentication based desktop cloud security access control method of claim 1, wherein, Logical judgment, including: According to the preset rule, the multi-dimensional input data is quantitatively scored and compared with the threshold value decision process; High risk level indicates a high probability of risk of identity forgery or terminal intrusion; Medium risk level indicates that there are potential security vulnerabilities that need to be partially restricted; Low risk level indicates that all security conditions are met.

5. The multi-factor authentication based desktop cloud security access control method of claim 1, wherein, Based on the authentication confidence level, initial access permissions are assigned, including the following steps: Call the preset permission policy library, and the authentication confidence level decision is completed. The corresponding strategy is automatically called; High-risk level users, the system blocks direct access channels and starts a secondary authentication process, requiring users to verify their identity through biometric identification or dynamic verification code; Medium risk level users, the system allows browsing data but prohibits file download and external transmission operations; Low risk level users, the system opens all function permissions including data editing, downloading and sharing.

6. The multi-factor authentication based desktop cloud security access control method of claim 5, wherein, Call the preset permission policy library, including the following steps: The permission policy library supports multiple formats, including JSON / XML / SQL database, which is parsed through the adapter mode to ensure compatibility with existing systems; Based on the principle of least privilege of enterprise security policy and dynamic risk response mechanism, combined with expert experience, the authentication confidence level is mapped to the rule library of the predefined operation permission set.

7. The multi-factor authentication based desktop cloud security access control method of claim 1, wherein, Continuously compare the current behavior characteristic data with the initial behavior characteristic data, including the following steps: During user operation, the current behavior characteristic data is intercepted in a fixed time window, and the direction distribution of the displacement vector and the volatility characteristics of the time interval in the window are extracted; Calculate the similarity of the vector direction distribution of the current window and the direction distribution of the initial behavior characteristic data, and compare the standard deviation of the time interval volatility at the same time; If the direction distribution similarity is lower than the preset similarity threshold, and the time interval volatility tends to zero, the preset similarity threshold is obtained by training historical normal user behavior data, it is determined that there is a mechanical operation mode.

8. The multi-factor authentication based desktop cloud security access control method of claim 7, wherein, According to the updated authentication confidence level, dynamically adjust the access permissions, including the following steps: When the authentication confidence level is increased due to abnormal operation, immediately write new restriction rules to the permission token; When the time of continuous non-effective operation input exceeds the preset time length, the preset time length refers to the non-operation tolerance time window set in the enterprise security policy, the non-active time is calculated by the system clock, and the permission level is reduced by one; Send a refresh instruction to the user terminal to make the new permissions take effect immediately and interrupt the operation process that does not meet the new permission level.

Images