Cloud computing identity authentication method
By building an operation behavior analysis model and firefly optimization algorithm, the effective duration of JWT is dynamically adjusted, and the security and user experience problems caused by the fixed JWT's effective duration are solved, and the security and user experience balance of cloud computing identity authentication is achieved.
Patent Information
- Application Number
- CN202510578832.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-05-07
- Publication Date
- 2025-08-15
- Estimated Expiration
- Not applicable · inactive patent
AI Technical Summary
In the existing cloud computing identity authentication methods, the effective duration setting of JWT can easily lead to a reduction in security, and too short will affect the user experience, and the traditional fixed duration setting cannot adapt to changes in user behavior.
By collecting user operation logs, building an operation behavior analysis model and combining firefly optimization algorithms, dynamically adjusting the effective duration of JWT, and using background threads to analyze user behavior to adjust the second effective duration of JWT to avoid frequent reauthentication.
It realizes that while ensuring server security, reduces frequent user authentication, improves user experience, and avoids the model from falling into local optimal solutions through Firefly optimization algorithm.
Smart Images
Figure FT_1 
Figure FT_2 
Figure BDA0005389660000000031
Abstract
Description
Technical Field
[0001] The present invention relates to the field of data security technology, and more particularly, to a cloud computing identity authentication method. Background Art
[0002] With the rapid development of cloud computing, more and more users are hosting their data and applications in the cloud. However, ensuring the security of cloud data and the authenticity of user identities has become a crucial issue. Existing authentication methods typically rely on multi-factor authentication (MFA) technologies, such as user accounts, passwords, verification codes, and biometrics (such as fingerprints and facial features). However, maintaining session status after a user logs in and verifying the user's identity in subsequent requests remains a pressing issue.
[0003] Currently, JSON Web Token (JWT) is used to maintain session status and verify the user's identity information in subsequent requests. That is, after a user successfully logs in, the server will generate a JWT for the user, cache it on the server, set the validity period (TTL), and return it to the user. The JWT contains the user's identity information and permission information. When the user initiates a request, it will carry the JWT in the Authorization field of the HTTP request header. The server receives and verifies the user's identity information and permission information in the JWT, and returns the user's requested resource after verification.
[0004] However, the above solutions usually set a fixed validity period for JWT based on work experience. If the validity period of JWT is too long, once the JWT is stolen, the attacker may be able to illegally access system resources for a long time. If the validity period of JWT is too short, frequent re-authentication will seriously affect the user experience. Summary of the Invention
[0005] The present invention provides a cloud computing identity authentication method to solve the technical problems in the above-mentioned background technology.
[0006] The present invention provides a cloud computing identity authentication method, comprising the following steps:
[0007] Step S101: After the user successfully logs in, the server returns the user's JWT and sets a first validity period for the user's JWT.
[0008] Step S102, collecting the user's operation log according to the user's unique identifier at preset time intervals t within a preset time period T;
[0009] The user's unique identifier is represented by the user's IP address;
[0010] Operation logs include: operation type, operation result and timestamp;
[0011] Operation types include: login, logout, add, delete, modify and query;
[0012] Operation results include: success and failure;
[0013] Step S103: Clean the user's operation log to generate a feature sequence;
[0014] The feature sequence includes N sequence units, and the nth sequence unit represents the total number of operations, number of successful logins, number of failed logins, number of successful additions, number of failed additions, number of successful deletions, number of failed deletions, number of successful modifications, number of failed modifications, number of successful queries, and number of failed queries of the user in the nth time period, where 1≤n≤N, and N=T / t;
[0015] Step S104: constructing an operation behavior analysis model and training the operation behavior analysis model in combination with the Firefly optimization algorithm;
[0016] Step S105: Input the feature sequence into the trained operation behavior analysis model, and the output value represents the second validity period of the user's JWT;
[0017] The second validity period of the user's JWT refers to the validity period of the JWT that is reset after the first validity period of the JWT expires or the user re-logins midway.
[0018] Furthermore, the first effective duration, T, and t are all custom parameters, and T is less than or equal to the first effective duration.
[0019] Furthermore, a query tool provided by a database storing operation logs is used to collect statistics on operation logs in N time periods to generate a feature sequence.
[0020] Furthermore, the operation behavior analysis model includes N hidden layers, the nth hidden layer inputs the nth sequence unit of the feature sequence and outputs an update vector;
[0021] The update vector output by the Nth hidden layer is input to the classifier, and the classification space of the classifier represents the second validity period of the user's JWT.
[0022] Furthermore, the calculation formula of the nth hidden layer includes:
[0023]
[0024]
[0025] Among them H n represents the update vector of the nth hidden layer output, Xn represents the nth sequence unit of the feature sequence input to the nth hidden layer, X i-1 and X i Represent the i-1th sequence unit and the i-th sequence unit of the feature sequence input to the i-1th hidden layer and the i-th hidden layer respectively, and X0 is assigned to 0. Update n and Reset n Represent the hidden vector of the nth hidden layer, the update gate output value, and the reset gate output value, and Update n and Reset n are real values between 0 and 1. and denote the first weight parameter, the second weight parameter, the third weight parameter, the fourth weight parameter, the fifth weight parameter and the sixth weight parameter of the nth hidden layer, respectively. and They represent the first bias parameter, the second bias parameter, and the third bias parameter of the nth hidden layer, respectively. Represents the correlation coefficient between the i-1th hidden layer and the i-th hidden layer, and the correlation coefficient is a real value between 0 and 1. The value is assigned to 1, e represents a natural constant, ⊙ represents a Hadamard product, concat represents a concatenation operation, MLP represents a multi-layer perceptron, sigmoid represents a sigmoid activation function, and tanh represents a hyperbolic tangent activation function.
[0026] Furthermore, sample labels of training samples used to train the operation behavior analysis model are obtained through annotation by network security experts.
[0027] Furthermore, during the training process of the operational behavior analysis model, the difference between the value output by the operational behavior analysis model at each iteration and the sample label of the training sample is specified as the loss function, and the loss function is used as the objective function of the firefly optimization algorithm. The fitness value of the individual is calculated through the objective function, and the individual is represented by the weight parameters and bias parameters of the operational behavior analysis model. The individual with the smallest fitness value is selected as the weight parameters and bias parameters of the operational behavior analysis model.
[0028] Furthermore, after the user successfully logs in, a pair of asymmetric keys is generated on the server side: a public key and a private key. The private key is used to sign the JWT header and payload, and the public key is distributed to the user through an X509 certificate or HTTPS to verify the integrity and authenticity of the JWT.
[0029] Furthermore, after the user successfully logs in, the feature sequence of the user is generated according to steps S101 to S103 by starting the background thread, and is input into the trained operation behavior analysis model to obtain the second valid time of the JWT.
[0030] The present invention provides a cloud computing identity authentication system, comprising:
[0031] A first validity period generation module is used to return the user's JWT to the server after the user successfully logs in, and set the first validity period for the user's JWT;
[0032] An operation log collection module is used to collect the user's operation log according to the user's unique identifier within a preset time period T and at preset time intervals t;
[0033] A feature sequence generation module is used to clean the user's operation log and generate a feature sequence;
[0034] Operation behavior analysis model construction module, which is used to build the operation behavior analysis model and train the operation behavior analysis model in combination with the Firefly optimization algorithm;
[0035] The second effective duration generation module is used to input the feature sequence into the trained operation behavior analysis model, and the output value represents the second effective duration of the user's JWT.
[0036] The beneficial effects of the present invention are: the present invention starts the operation behavior analysis model through the background thread to analyze the user's operation log, realizes the dynamic adjustment of the JWT effective time, avoids the user's frequent re-authentication, and can also ensure the server-side security to a certain extent, and combined with the firefly optimization algorithm, it can prevent the operation behavior analysis model from falling into the local optimal solution. BRIEF DESCRIPTION OF THE DRAWINGS
[0037] Figure 1 It is a flow chart of a cloud computing identity authentication method of the present invention;
[0038] Figure 2 It is a schematic diagram of a cloud computing identity authentication system of the present invention.
[0039] In the figure: a first effective duration generating module 201, an operation log collecting module 202, a feature sequence generating module 203, an operation behavior analysis model building module 204, and a second effective duration generating module 205. DETAILED DESCRIPTION
[0040] The subject matter described herein will now be discussed with reference to exemplary embodiments. It should be understood that these embodiments are discussed solely to enable those skilled in the art to better understand and implement the subject matter described herein, and that the functions and arrangements of the elements discussed may be varied without departing from the scope of this specification. Various examples may omit, substitute, or add various processes or components as needed. In addition, features described with respect to some examples may also be combined in other examples.
[0041] It should be noted that, unless otherwise defined, the technical or scientific terms used in one or more embodiments of the present invention should have the usual meanings understood by people with ordinary skills in the field to which the present invention belongs. The "first", "second" and similar words used in one or more embodiments of the present invention do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprising" and similar words mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, but do not exclude other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the object being described changes, the relative positional relationship may also change accordingly.
[0042] like Figures 1 and 2 As shown, a cloud computing identity authentication method includes the following steps:
[0043] Step S101: After the user successfully logs in, the server returns the user's JWT and sets a first validity period for the user's JWT.
[0044] Step S102, collecting the user's operation log according to the user's unique identifier at preset time intervals t within a preset time period T;
[0045] Operation logs include: operation type, operation result and timestamp;
[0046] Operation types include: login, logout, add, delete, modify and query;
[0047] Operation results include: success and failure;
[0048] Step S103: Clean the user's operation log to generate a feature sequence;
[0049] The feature sequence includes N sequence units, and the nth sequence unit represents the total number of operations, number of successful logins, number of failed logins, number of successful additions, number of failed additions, number of successful deletions, number of failed deletions, number of successful modifications, number of failed modifications, number of successful queries, and number of failed queries of the user in the nth time period, where 1≤n≤N, and N=T / t;
[0050] Step S104: constructing an operation behavior analysis model and training the operation behavior analysis model in combination with the Firefly optimization algorithm;
[0051] Step S105: Input the feature sequence into the trained operation behavior analysis model, and the output value represents the second validity period of the user's JWT;
[0052] The second validity period of the user's JWT refers to the validity period of the JWT that is reset after the first validity period of the JWT expires or the user re-logins midway.
[0053] It should be noted that the application scenario of the present invention is to analyze the user's operation behavior based on the user's operation log after the user logs in successfully. For example, the user's operation behavior is similar to that of a web crawler, sending requests at a very high frequency, resulting in a surge in server-side load, affecting the normal use of other users. Therefore, the present invention dynamically adjusts the effective duration of JWT by analyzing the user's operation behavior to improve the security of the server and user experience. In addition, the server-side verification of the user's identity information during login is not limited to the traditional account and password, but can also include multi-factor authentication such as verification code and biometrics, such as fingerprint recognition or facial recognition, etc., which will not be elaborated here.
[0054] It should be noted that JWT consists of three components: header, payload and signature. The header usually contains the signature algorithm and token type used by JWT, and then encoded by Base64Url. For example, the JSON representation of the header is: {"algorithm": "HS256", "type": "JWT"}. The payload usually includes the user's identity information, permission information and validity period, and is also encoded by Base64Url. The signature is generated by the header, payload and key using the signature algorithm specified in the header, which is used to verify whether the payload has been tampered with.
[0055] In one embodiment of the present invention, the first effective duration, T and t are all custom parameters, and T is less than or equal to the first effective duration. Preferably, the first effective duration is set to 2 hours, T is set to 2 hours, and t is set to 10 minutes, then N=T / t=12.
[0056] For example, if T is set to 2 hours and t is set to 10 minutes, and user operation logs are collected starting at 13:00, then the first sequence unit of the feature sequence generated by data cleaning of the user's operation logs will represent the total number of user operations between 13:00 and 13:10, and the second sequence unit will represent the total number of user operations between 13:10 and 13:20, and so on.
[0057] In one embodiment of the present invention, the user's unique identifier is represented by the user's IP address, or by the user's unique ID stored on the server, such as an auto-incrementing primary key ID or a distributed primary key ID generated by Snowflake.
[0058] In one embodiment of the present invention, a query tool provided by a database storing operation logs is used to collect statistics on operation logs in N time periods to generate a feature sequence.
[0059] For example, if the database storing operation logs is a MySQL database, the query statement for counting the number of successful logins between 13:00 and 13:10 is: SELECT COUNT(*)SUM(CASE WHEN operation_type='login' AND operation_result='success' THEN 1 ELSE 0 END) AS login_success_count FROM log WHERE user_id='1' AND log_time BETWEEN '13:00' AND '13:10'.
[0060] In one embodiment of the present invention, the operation behavior analysis model includes N hidden layers, the nth hidden layer inputs the nth sequence unit of the feature sequence and outputs an update vector;
[0061] The update vector output by the Nth hidden layer is input to the classifier, and the classification space of the classifier represents the second validity period of the user's JWT.
[0062] In one embodiment of the present invention, the calculation formula of the nth hidden layer includes:
[0063]
[0064]
[0065] Among them H n represents the update vector of the nth hidden layer output, X n represents the nth sequence unit of the feature sequence input to the nth hidden layer, X i-1 and X iRepresent the i-1th sequence unit and the i-th sequence unit of the feature sequence input to the i-1th hidden layer and the i-th hidden layer respectively, and X0 is assigned to 0. Update n and Reset n Represent the hidden vector of the nth hidden layer, the update gate output value, and the reset gate output value, and Update n and Reset n are real values between 0 and 1. and denote the first weight parameter, the second weight parameter, the third weight parameter, the fourth weight parameter, the fifth weight parameter and the sixth weight parameter of the nth hidden layer, respectively. and They represent the first bias parameter, the second bias parameter, and the third bias parameter of the nth hidden layer, respectively. Represents the correlation coefficient between the i-1th hidden layer and the i-th hidden layer, and the correlation coefficient is a real value between 0 and 1. The value is assigned to 1, e represents a natural constant, ⊙ represents a Hadamard product, concat represents a concatenation operation, MLP represents a multi-layer perceptron, sigmoid represents a sigmoid activation function, and tanh represents a hyperbolic tangent activation function.
[0066] It should be noted that the operational behavior analysis model provided by the present invention is constructed based on GRU and improved on its basis, that is, the input of each hidden layer no longer depends on the output of the previous hidden layer, and then the gating function of GRU is realized by historical input and multi-layer perceptron. Moreover, since each time hidden layer can be calculated independently, it can be more easily parallelized on a multi-core processor or GPU, thereby improving the training speed.
[0067] It should be noted that the correlation coefficient between the current hidden layer and the previous hidden layer is mapped into a real value between 0 and 1 through a multilayer perceptron. For example, each sequence unit of the feature sequence is represented by a vector of size 1×11. The operation process of the multilayer perceptron can be simplified to a vector of size 1×22 multiplied by a vector of size 22×1 (concatenating two vectors of size 1×11) and then passing through a sigmoid activation function. The update gate output value and the reset gate output value are both real values between 0 and 1. The third weight parameter, the fourth weight parameter, the fifth weight parameter and the sixth weight parameter are all designed as vectors of size 11×1, and the first weight parameter and the second weight parameter can be designed as matrices of size 11×16. The sizes of the hidden vector and the update vector are both 1×16.
[0068] In one embodiment of the present invention, sample labels of training samples used to train the operation behavior analysis model are obtained by annotation by network security experts.
[0069] In one embodiment of the present invention, during the training process of the operation behavior analysis model, the difference between the value output by the operation behavior analysis model at each iteration and the sample label of the training sample is specified as the loss function, and the loss function is used as the objective function of the firefly optimization algorithm. The fitness value of the individual is calculated through the objective function, and the individual is represented by the weight parameters and bias parameters of the operation behavior analysis model. The individual with the smallest fitness value is selected as the weight parameters and bias parameters of the operation behavior analysis model. The specific calculation formula of the firefly optimization algorithm is not repeated here.
[0070] It should be noted that updating the weight parameters and bias parameters of the operation behavior analysis model through the firefly optimization algorithm can overcome the problem that the gradient descent method is prone to falling into local minima to a certain extent.
[0071] In one embodiment of the present invention, after the user logs in successfully, a pair of asymmetric keys is generated on the server side: a public key and a private key. The header and payload of the JWT are signed by the private key, and the public key is distributed to the user through an X509 certificate or HTTPS to verify the integrity and authenticity of the JWT.
[0072] In one embodiment of the present invention, after the user successfully logs in, a feature sequence of the user is generated according to steps S101 to S103 by starting a background thread, and the feature sequence is input into the trained operation behavior analysis model to obtain the second validity period of the JWT.
[0073] It should be noted that the setting of the first valid duration is to avoid the user logging in for too long, which affects the user experience. If the valid duration of JWT is generated directly based on the user's historical operation log when the user logs in, it may take a lot of time, and this method is not suitable for the first login of a newly registered user. Therefore, the present invention generates the second valid duration of JWT through a background thread, thereby improving the user experience.
[0074] In one embodiment of the present invention, Figure 2 As shown, the present invention provides a cloud computing identity authentication system, comprising:
[0075] A first validity period generation module 201 is used to return the user's JWT to the server after the user successfully logs in, and set a first validity period for the user's JWT;
[0076] An operation log collection module 202 is configured to collect the user's operation logs based on the user's unique identifier at preset time intervals t within a preset time period T;
[0077] A feature sequence generation module 203 is used to perform data cleaning on the user's operation log to generate a feature sequence;
[0078] An operation behavior analysis model construction module 204 is used to construct an operation behavior analysis model and train the operation behavior analysis model in combination with the Firefly optimization algorithm;
[0079] The second effective duration generation module 205 is used to input the feature sequence into the trained operation behavior analysis model, and the output value represents the second effective duration of the user's JWT.
[0080] Furthermore, the corresponding role permissions and button permissions on the server are queried based on the user's identity information and permission information in the JWT payload. Role permissions can be used to control the displayed page, and button permissions can be used to control the operation of the page buttons.
[0081] The above describes the embodiments of this embodiment, but this embodiment is not limited to the above specific implementation methods. The above specific implementation methods are merely illustrative and not restrictive. Ordinary technicians in this field can also make many forms based on the inspiration of this embodiment, all of which are protected by this embodiment.
Claims
1. A cloud computing identity authentication method, characterized in that: The following steps are involved: Step S101: After the user successfully logs in, the server returns the user's JWT and sets a first validity period for the user's JWT. Step S102, collecting the user's operation log according to the user's unique identifier at preset time intervals t within a preset time period T; The user's unique identifier is represented by the user's IP address; Operation logs include: operation type, operation result and timestamp; Operation types include: login, logout, add, delete, modify and query; Operation results include: success and failure; Step S103: Clean the user's operation log to generate a feature sequence; The feature sequence includes N sequence units, and the nth sequence unit represents the total number of operations, number of successful logins, number of failed logins, number of successful additions, number of failed additions, number of successful deletions, number of failed deletions, number of successful modifications, number of failed modifications, number of successful queries, and number of failed queries of the user in the nth time period, where 1≤n≤N, and N=T / t; Step S104: constructing an operation behavior analysis model and training the operation behavior analysis model in combination with the Firefly optimization algorithm; Step S105: Input the feature sequence into the trained operation behavior analysis model, and the output value represents the second validity period of the user's JWT; The second validity period of the user's JWT refers to the validity period of the JWT that is reset after the first validity period of the JWT expires or the user re-logins midway.
2. A cloud computing identity authentication method according to claim 1, characterized in that: The first effective duration, T, and t are all custom parameters, and T is less than or equal to the first effective duration.
3. A cloud computing identity authentication method according to claim 1, characterized in that: The query tool provided by the database storing the operation logs is used to count the operation logs of N time periods to generate a feature sequence.
4. A cloud computing identity authentication method according to claim 1, characterized in that: The operational behavior analysis model includes N hidden layers, where the nth hidden layer inputs the nth sequence unit of the feature sequence and outputs an update vector; The update vector output by the Nth hidden layer is input to the classifier, and the classification space of the classifier represents the second validity period of the user's JWT.
5. A cloud computing identity authentication method according to claim 4, characterized in that: The calculation formula for the nth hidden layer includes: Among them H n represents the update vector of the nth hidden layer output, X n represents the nth sequence unit of the feature sequence input to the nth hidden layer, X i-1 and X i Represent the i-1th sequence unit and the i-th sequence unit of the feature sequence input to the i-1th hidden layer and the i-th hidden layer respectively, and X0 is assigned to 0. Update n and Reset n Represent the hidden vector of the nth hidden layer, the update gate output value, and the reset gate output value, and Update n and Reset n are real values between 0 and 1. and denote the first weight parameter, the second weight parameter, the third weight parameter, the fourth weight parameter, the fifth weight parameter and the sixth weight parameter of the nth hidden layer, respectively. and They represent the first bias parameter, the second bias parameter, and the third bias parameter of the nth hidden layer, respectively. Represents the correlation coefficient between the i-1th hidden layer and the i-th hidden layer, and the correlation coefficient is a real value between 0 and 1. The value is assigned to 1, e represents a natural constant, ⊙ represents a Hadamard product, concat represents a concatenation operation, MLP represents a multi-layer perceptron, sigmoid represents a sigmoid activation function, and tanh represents a hyperbolic tangent activation function.
6. A cloud computing identity authentication method according to claim 1, characterized in that: The sample labels of the training samples used to train the operation behavior analysis model are obtained through annotation by network security experts.
7. A cloud computing identity authentication method according to claim 5, characterized in that: During the training process of the operational behavior analysis model, the difference between the value output by the operational behavior analysis model at each iteration and the sample label of the training sample is specified as the loss function, and the loss function is used as the objective function of the firefly optimization algorithm. The fitness value of the individual is calculated through the objective function, and the individual is represented by the weight parameters and bias parameters of the operational behavior analysis model. The individual with the smallest fitness value is selected as the weight parameters and bias parameters of the operational behavior analysis model.
8. A cloud computing identity authentication method according to claim 1, characterized in that: After the user logs in successfully, a pair of asymmetric keys is generated on the server: a public key and a private key. The private key is used to sign the JWT header and payload. The public key is distributed to the user through an X509 certificate or HTTPS to verify the integrity and authenticity of the JWT.
9. A cloud computing identity authentication method according to claim 1, characterized in that: After the user logs in successfully, the background thread is started to generate the user's feature sequence according to steps S101 to S103, and the feature sequence is input into the trained operation behavior analysis model to obtain the second valid time of the JWT.
10. A cloud computing identity authentication system, characterized in that: Executing a cloud computing identity authentication method according to any one of claims 1 to 9, comprising: A first validity period generation module is used to return the user's JWT to the server after the user successfully logs in, and set the first validity period for the user's JWT; An operation log collection module is used to collect the user's operation log according to the user's unique identifier within a preset time period T and at preset time intervals t; A feature sequence generation module is used to clean the user's operation log and generate a feature sequence; Operation behavior analysis model construction module, which is used to build the operation behavior analysis model and train the operation behavior analysis model in combination with the Firefly optimization algorithm; The second effective duration generation module is used to input the feature sequence into the trained operation behavior analysis model, and the output value represents the second effective duration of the user's JWT.