Cloud environment intelligent identity authentication cross-domain interfacing method and system

Abstract

This invention relates to the fields of cloud computing and identity authentication security technology, and discloses a method and system for cross-domain intelligent identity authentication in a cloud environment. The method includes: collecting and preprocessing heterogeneous identity data from multiple cloud platforms to obtain a standardized identity dataset; constructing a unified identity semantic model based on the standardized identity dataset and generating feature embedding vectors; performing identity mapping transformation on the feature embedding vectors using a deep neural network to obtain mapped identity feature vectors; performing multi-factor adaptive trust assessment by combining the mapped identity feature vectors with real-time behavioral data to obtain dynamic trust assessment results; generating an adaptive security token based on the dynamic trust assessment results; and converting the adaptive security token into the protocol format required by the target system. This invention can solve the problems of heterogeneity and dynamic trust assessment in cross-domain identity authentication in a cloud environment, providing an effective solution for cloud computing security.

Description

Technical Field

[0001] This invention relates to the fields of cloud computing and identity authentication security technology, and more specifically, to a method and system for cross-domain intelligent identity authentication in a cloud environment. Background Technology

[0002] With the widespread application of cloud computing technology, enterprises and organizations typically use services from multiple cloud service providers simultaneously, forming a multi-cloud environment. In this environment, the identity authentication systems of different cloud platforms operate independently, using different data formats, authentication protocols, and security policies. This makes it difficult to share and mutually recognize user identity information across different platforms, severely restricting the efficient collaborative use of cloud resources. Existing technologies typically employ static mapping tables or simple transformation rules to handle cross-platform identity authentication, but this approach lacks flexibility and intelligence, and cannot adapt to dynamically changing cloud environments.

[0003] Traditional cross-domain identity authentication schemes often rely on pre-established trust relationships and hard-coded protocol conversion rules. When faced with new platforms or protocol changes, they require significant manual intervention, resulting in poor system scalability and adaptability. Furthermore, the lack of effective semantic understanding mechanisms in identity data processing makes it difficult to accurately resolve differences in identity representations across different cloud platforms. This leads to semantic loss or incorrect mapping during authentication, affecting its accuracy and reliability. These problems are particularly pronounced in large-scale heterogeneous cloud environments, becoming a technical bottleneck restricting the implementation of multi-cloud strategies.

[0004] Existing identity authentication systems generally employ static trust models, which cannot dynamically adjust trust levels based on user behavior characteristics, environmental context, and security risks, making it difficult to achieve fine-grained access control and risk management. Furthermore, token management and protocol conversion processes commonly suffer from low efficiency, high error rates, and insufficient security. Particularly in complex environments requiring support for multiple authentication protocols (such as SAML, OAuth, and OpenID Connect), the lack of intelligent protocol recognition and adaptive conversion mechanisms fails to meet the demands for efficient, accurate, and secure cross-domain identity authentication, necessitating an integrated and intelligent cross-domain identity authentication solution. Summary of the Invention

[0005] This invention provides a method and system for cross-domain intelligent identity authentication in cloud environments, solving technical problems such as the complexity of authentication protocol environments in related technologies.

[0006] This invention provides a cross-domain integration method for intelligent identity authentication in cloud environments, comprising the following steps:

[0007] Heterogeneous identity data from multiple cloud platforms are collected and preprocessed to obtain a standardized identity dataset;

[0008] A unified identity semantic model is constructed based on a standardized identity dataset, and feature embedding vectors are generated.

[0009] A deep neural network is used to perform an identity mapping transformation on the feature embedding vector to obtain the mapped identity feature vector;

[0010] By combining the mapped identity feature vector with real-time behavioral data, a multi-factor adaptive trust assessment is performed to obtain dynamic trust assessment results.

[0011] Generate adaptive security tokens based on dynamic trust assessment results;

[0012] Convert the adaptive security token into the protocol format required by the target system.

[0013] In a preferred embodiment, the steps for collecting and preprocessing heterogeneous identity data from a multi-cloud platform include:

[0014] Obtain raw identity data sets from multiple cloud platforms;

[0015] Perform data extraction and cleaning operations on each cloud platform to remove duplicates and null values;

[0016] The cleaned data is standardized to construct a unified record structure; the standardized records are then subjected to data quality verification and feature vectorization to generate a standardized identity dataset.

[0017] In a preferred embodiment, the steps of constructing a unified identity semantic model based on a standardized identity dataset include:

[0018] Extract user entity sets, attribute sets, role sets, permission sets, and context information sets from the standardized identity dataset;

[0019] Construct a set of semantic relationships, including user-role mappings, role-permission mappings, and attribute dependencies;

[0020] A unified identity semantic model is constructed based on entity sets and semantic relationship sets; standardized identity data is mapped to the semantic space and a fixed-dimensional feature embedding vector is generated.

[0021] In a preferred embodiment, the feature embedding vector has a fixed dimension of 512, which is calculated by mapping standardized identity data records to a semantic space and then using a feature generation function.

[0022] In a preferred embodiment, the step of performing identity mapping transformation on feature embedding vectors using a deep neural network includes:

[0023] Perform layer normalization preprocessing on the feature embedding vector;

[0024] The normalized feature vectors are transformed using a multi-head attention mechanism based on the Transformer architecture.

[0025] The transformed feature vectors are then subjected to target domain adaptation processing to obtain the mapped identity feature vectors.

[0026] In a preferred embodiment, the step of performing multi-factor adaptive trust assessment by combining the mapped identity feature vector with real-time behavioral data includes:

[0027] The calculation includes five core trust factors: behavioral pattern score, device fingerprint similarity, network risk assessment, time pattern score, and geographical location rationality.

[0028] Calculate the dynamic weights of each trust factor based on the current context information; extract temporal features using a long short-term memory network;

[0029] The basic trust level is calculated by combining the trust factor, dynamic weights, and temporal features.

[0030] By integrating users' historical trust levels, current trust levels, and contextual trust levels, a final dynamic trust level assessment result is obtained.

[0031] In a preferred embodiment, the formula for calculating the dynamic trust assessment result is as follows:

[0032] T(t)=α h ·T hist +α c ·T curr (t)+α ctx ·T ctx (t);

[0033] Where T(t) represents the current user's dynamic trust assessment result; α h T represents the weight of historical trust levels; hist Indicates the user's historical average trust level; α c Indicates the current trust level weight; T curr (t) represents the current confidence level at time t; α ctx T represents the contextual trust weight; ctx (t) represents the trust level adjustment at time t based on the current context.

[0034] In a preferred embodiment, the step of generating an adaptive security token based on the dynamic trust assessment result includes:

[0035] Verify whether the user's trust level meets the minimum requirements;

[0036] The token validity period is calculated based on the dynamic trust assessment results and security policies, using the following formula:

[0037] T valid =T base ×(1+T(t))×S factor ;

[0038] Among them, T base Indicates the basic validity period; S factor Indicates the safety adjustment factor; T valid T(t) represents the final calculated token validity period; T(t) represents the current user's dynamic trust assessment result.

[0039] Construct a JWT payload structure that includes user identifier, server endpoint, expiration time, trust score, and context information; sign the JWT payload structure and record it in the blockchain network to generate an adaptive security token.

[0040] In a preferred embodiment, the step of converting the adaptive security token into the protocol format required by the target system includes:

[0041] The protocol state is modeled using a state transition function, protocol features are extracted from the adaptive security token, and the compatibility score with the target protocol is analyzed.

[0042] The system applies a conversion decision function to select direct conversion, bridging conversion, or semantic conversion strategies based on compatibility scores, and uses a reinforcement learning policy model to select the optimal conversion action.

[0043] The protocol transformation is performed according to the selected strategy, while the Q-value update formula is applied for real-time learning and optimization of a multi-objective function that includes latency, error rate and security level.

[0044] The conversion quality assessment formula is applied to evaluate the conversion quality from three dimensions: information fidelity, performance indicators, and security feature retention.

[0045] Based on the Q-value and the multi-objective optimization function, it is determined whether the quality score meets the requirements. If necessary, the results are optimized and the policy parameters are updated using the gradient ascent method.

[0046] In a preferred embodiment, a cloud environment intelligent identity authentication cross-domain integration system is used to execute the above-described cloud environment intelligent identity authentication cross-domain integration method, including:

[0047] The data preprocessing module is used to collect and preprocess heterogeneous identity data from multiple cloud platforms to obtain a standardized identity dataset.

[0048] The semantic modeling module constructs a unified identity semantic model based on a standardized identity dataset and generates feature embedding vectors.

[0049] The identity mapping module is used to perform identity mapping transformation on the feature embedding vector using a deep neural network to obtain the mapped identity feature vector.

[0050] The trust assessment module is used to perform multi-factor adaptive trust assessment by combining the mapped identity feature vector with real-time behavioral data to obtain dynamic trust assessment results.

[0051] The token generation module is used to generate adaptive security tokens based on dynamic trust assessment results.

[0052] The protocol conversion module is used to convert adaptive security tokens into the protocol format required by the target system.

[0053] The beneficial effects of this invention are as follows:

[0054] The system achieves end-to-end intelligent processing from raw identity data to the final protocol format through six consecutive steps. Multi-level data cleaning and standardization techniques address the issue of heterogeneous identity data in multi-cloud environments; a unified semantic model enables accurate mapping of cross-platform identity representations; deep neural networks and multi-factor adaptive trust assessment achieve dynamic and accurate identity mapping and trust calculation; and security tokens are dynamically generated based on trust levels and intelligent protocol conversion is performed, improving the system's adaptability and security.

[0055] By innovatively combining advanced technologies such as deep learning, blockchain, and reinforcement learning, the system achieves adaptive security management and intelligent protocol conversion, enabling it to dynamically adjust authentication strategies and security levels based on user behavior and environmental context. In particular, the Transformer architecture and multi-head attention mechanism used in the identity mapping process, along with the multi-factor fusion algorithm in trust assessment, effectively solve problems such as inaccurate cross-platform identity mapping and insufficient authentication security in traditional solutions. Furthermore, the smart token design allows the token's validity period to be dynamically adjusted based on user trust levels, ensuring both security and improved user experience. Overall, the system exhibits data-driven, intelligently adaptive, and secure characteristics, providing a unified, efficient, and secure solution for identity authentication and resource access in multi-cloud environments, effectively supporting the implementation of enterprise multi-cloud strategies. Attached Figure Description

[0056] Figure 1 This is a flowchart of the cloud environment intelligent identity authentication cross-domain connection method of the present invention;

[0057] Figure 2 This is a time distribution diagram of each step in the present invention;

[0058] Figure 3 This is a data stream transmission efficiency diagram of the present invention;

[0059] Figure 4 This is a diagram showing the relationship between trust level and token validity period in this invention;

[0060] Figure 5 This is a distribution diagram of system resource utilization rate according to the present invention. Detailed Implementation

[0061] The subject matter described herein will now be discussed with reference to exemplary embodiments. It should be understood that these embodiments are discussed only to enable those skilled in the art to better understand and implement the subject matter described herein, and changes may be made to the function and arrangement of the elements discussed without departing from the scope of this specification. Various processes or components may be omitted, substituted, or added as needed in the examples. Furthermore, some features described in the examples may be combined in other examples.

[0062] At least one embodiment of the present invention discloses a cross-domain integration method for intelligent identity authentication in a cloud environment, such as... Figure 1 As shown, it includes the following steps:

[0063] Step 100: Collect and preprocess heterogeneous identity data from multiple cloud platforms to obtain a standardized identity dataset;

[0064] In one embodiment of the present invention, identity data formats are not uniform in a multi-cloud environment, and there are problems such as duplication, missing data, and inconsistent formats. Standardization preprocessing is required, which specifically includes the following steps:

[0065] Step 101: The input data is a collection of original identity data from multiple cloud platforms; the data format is a variety of heterogeneous formats such as JSON, XML, and CSV.

[0066] Step 102, input the raw identity data set from multiple cloud platforms:

[0067] Data raw ={D AW D Az D Al D Te ,...};

[0068] Among them, Data raw This represents a collection of raw identity data gathered from multiple cloud platforms; D AW D Az D Al D Te These represent the identity data information of the first, second, third, and fourth cloud platforms, respectively.

[0069] Step 103, Processing the original identity data set:

[0070] First create an empty list L raw =[] stores the cleaned data. For Data raw Data D of each cloud platform i Perform the following operations: Extract platform data p i =extract(D i Then apply the data cleaning function c. i =clean(p i Remove duplicates and null values, and finally add the cleaned data to L. raw List;

[0071] Among them, L raw D represents an empty list storing the cleaned data. i p represents the identity data of the i-th cloud platform; i This represents the data extracted from the i-th cloud platform; extract() represents the data extraction function; c i This represents the result of cleaning the i-th data; clean() represents the data cleaning function used to remove duplicates and null values;

[0072] Create a data list with a uniform format L norm =[]. For L raw Each identity record r i Build a standardized record structure:

[0073] R norm ={uid,attr,role,perm,ctx,src};

[0074] Each field is obtained using its corresponding extraction function:

[0075] uid = get_uid(r i );

[0076] attr = get_attr(r i );

[0077] role = get_role(r i );

[0078] perm = get_perm(r i );

[0079] ctx = get_ctx(r i );

[0080] src = get_src(r i );

[0081] Among them, L normRepresents a list storing data in a uniform format; r i Represents the i-th identity record; R norm This section defines a standardized record structure; `uid` represents a unique user identifier; `attr` represents user attribute information; `role` represents user role information; `perm` represents user permission information; `ctx` represents context information; `src` represents data source information; `get_uid()` is a function to extract the user ID; `get_attr()` is a function to extract user attributes; `get_role()` is a function to extract user roles; `get_perm()` is a function to extract user permissions; `get_ctx()` is a function to extract context information; and `get_src()` is a function to extract the data source.

[0082] Create a verification data list L valid =[]. For L norm Each record r in i Application data integrity verification conditions:

[0083] ifvalid(r i )∧complete(r i thenL valid .append(r i );

[0084] Among them, L valid Represents a list storing verified, valid data; r i This represents the i-th identity record; `valid()` represents the data validity validation function; `complete()` represents the data integrity validation function; `∧` represents the logical AND operator; `append()` represents the operation of adding elements to the list;

[0085] Create the processed dataset D proc =[]. For L valid Each record r in i Apply the feature vectorization function v = vectorize(r) i This involves converting structured data into a numerical vector representation and then adding it to D. proc middle.

[0086] Return the standardized identity dataset D proc .

[0087] Among them, D proc This represents the final processed dataset; v represents the vectorized feature vector; vectorize() represents the feature vectorization function, used to convert structured data into a numerical vector representation;

[0088] Step 104, the output represents the preprocessed standardized identity dataset D. proc :

[0089] D proc ={d1,d2,...,d N};

[0090] Among them, d1, d2, d N These represent the 1st, 2nd, and Nth standardized identity records, respectively; N represents the total number of standardized identity records.

[0091] Step 200: Construct a unified identity semantic model based on a standardized identity dataset and generate feature embedding vectors;

[0092] In one embodiment of the present invention, the semantic differences in identity representation across different cloud platforms make cross-domain mapping difficult, and a unified identity semantic representation model needs to be established.

[0093] A unified identity semantic model is constructed based on description logic and ontology engineering techniques;

[0094] Identity semantic model definition:

[0095] M id ={U,A,R,P,C,R};

[0096] Among them, M id The unified identity semantic model is represented by: U, A, R, P, C, and R. The set of user entities is represented by: U, A, R, P, C, C, and R.

[0097] U = {u1, u2, ..., u} n} represents the set of user entities, where u1, u2, u... n These represent the 1st, 2nd, and nth user entities, respectively, where n represents the total number of users in the system;

[0098] A = {a1, a2, ..., a} m} represents the set of user attributes, a1, a2, a... m These represent the 1st, 2nd, and mth user attributes, respectively, where m represents the total number of attribute types (e.g., name, email, department, etc.).

[0099] R = {r1, r2, ..., r} k} represents the set of roles, r1, r2, r3, r4, r5, r6, r7, r8 k These represent the 1st, 2nd, and kth roles, respectively, where k represents the total number of role types (e.g., administrator, regular user, etc.).

[0100] P = {p1, p2, ..., p}L} represents the set of permissions, p1, p2, p... L These represent the 1st, 2nd, and Lth roles, respectively, where L represents the total number of permission types (such as read, write, execute, etc.).

[0101] C = {c1, c2, ..., c} J} represents a set of context information, c1, c2, c3, c4, c5, c6, c7, c J These represent the 1st, 2nd, and Jth roles, respectively, where J represents the total number of context factors (such as login time, device type, geographical location, etc.).

[0102] R represents a set of semantic relations, including inheritance (is-a), composition (part-of), dependency (depends-on), etc.

[0103] Steps for building a unified identity semantic model:

[0104] Input: The standardized identity dataset D output from step 100 proc ;

[0105] Output: Unified Identity Semantic Model M id and the set of feature embedding vectors F embed ;

[0106] Among them, D proc M represents the standardized identity dataset output from step 100; id Represents a unified identity semantic model; F embed This represents a set of feature embedding vectors.

[0107] Step 201, entity and relation extraction;

[0108] From input dataset D proc Extract various entity sets from the middle, and extract the user entity set:

[0109] U = extract_users(D proc );

[0110] Attribute type collection:

[0111] A = extract_attr(D) proc );

[0112] Character type collection:

[0113] R1 = extract_roles(D proc );

[0114] Permission type collection:

[0115] P = extract_perm(D proc);

[0116] Context type collection:

[0117] C = extract_ctx(D proc );

[0118] Among them, extract_users() is a function to extract user entities from the dataset; extract_attr() is a function to extract attribute types; extract_roles() is a function to extract role types; extract_perm() is a function to extract permission types; and extract_ctx() is a function to extract context types.

[0119] Step 202, Semantic Relation Modeling: Construct a semantic relation set R2 = []. Establish three core relations respectively:

[0120] User-role mapping relationship:

[0121] R ur =build_ur(U,R1,D proc );

[0122] Role-permission mapping relationship:

[0123] R rp =build_rp(R1,P,D) proc );

[0124] Attribute dependency relationships:

[0125] R ad =build_ad(A,D proc );

[0126] Finally, merge all relationships:

[0127] R2 = combine(R ur ,R rp ,R ad );

[0128] Among them, R ur Represents the user-role mapping relationship; R rp Represents the role-permission mapping relationship; R ad The functions `build_ur()` and `build_rp()` represent attribute dependencies; `build_ad()` represents the function to build user-role mappings; `build_ad()` represents the function to build attribute dependencies; and `combine()` represents the function to merge relationships.

[0129] Step 203, Ontology Model Construction: Based on the extracted entity set and semantic relationships, construct a unified identity semantic model.

[0130] M id =build_model(U,A,R1,P,C,R2);

[0131] Where M id ={U,A,R1,P,C,R2} represents the complete identity ontology model; build_model() represents the function that builds the ontology model.

[0132] Step 204, Feature Embedding Generation: Create a list of feature embedding vectors F embed =[]. For D proc Each identity record r i Perform the following operations: First, map the records to the semantic space s i =map_semantic(r i M id Then, a 512-dimensional embedding vector is generated:

[0133] e i =generate_embed(s i (dim=512);

[0134] Add the generated embedding vector to F embed List;

[0135] Return the unified identity semantic model M id and the set of feature embedding vectors F embed ;

[0136] Where, r i Represents the i-th identity record; s i This represents the result of mapping the i-th record to the semantic space; e i This represents the i-th embedding vector; map_semantic() represents the function that maps records to the semantic space; generate_embed() represents the function that generates the embedding vector; dim=512 indicates that the dimension of the embedding vector is 512.

[0137] Step 300: Use a deep neural network to perform an identity mapping transformation on the feature embedding vector to obtain the mapped identity feature vector;

[0138] In one embodiment of the present invention, it is necessary to implement intelligent mapping from source domain identity to target domain identity in order to handle the cross-platform identity format conversion problem;

[0139] Input data: Feature embedding vector F output from step 200 embedand target domain information D target ;

[0140] Deep neural network identity mapping steps:

[0141] Step 301, Feature Preprocessing: Create a standardized feature list F norm = []. For F embed Each embedding vector e in i Application layer normalization function:

[0142] e norm =norm(e i );

[0143] Add the standardized embedding vector to F norm In the list, ensure that the input features have zero mean and unit variance.

[0144] Among them, F norm Represents a standardized list of features; e i Represents the i-th embedding vector; e norm This represents the standardized embedding vector; norm() represents the layer normalization function.

[0145] Step 302, Transformer Mapping: Create a list of mapping features F trans = []. For F norm Each standardized feature e in norm Perform the following Transformer transformation sequence:

[0146] First, a multi-head attention mechanism is applied:

[0147] out att =MultiHead(e norm ,e norm ,e norm );

[0148] Then perform residual joins and layer normalization:

[0149] out res =norm(e norm +out att );

[0150] Next, a nonlinear transformation is performed using a feedforward network:

[0151] out ffn =ffn(out) res );

[0152] Finally, residual connections and layer normalization are applied again to obtain the final output:

[0153] outfinal =norm(out) res +out ffn );

[0154] Among them, F trans Represents a list of mapped features; out att This represents the output of the multi-head attention mechanism; out res This represents the output after residual connections and layer normalization; out ffn Indicates the output of the feedforward network; out final This represents the final transformed output; ffn() represents the feedforward network function, which will transform the output... final Add to F trans In the list.

[0155] Step 303, Target Domain Adaptation: Create an adaptation feature list F mapped = []. For F trans Each mapping feature f in i Apply the target domain adaptation function:

[0156] f adapt =adapt(f i D target );

[0157] Among them, f i f represents the i-th mapping feature; adapt Represents the adapted features; adapt() represents the target domain adaptation function, D target This indicates target domain information.

[0158] It should be noted that this sub-step ensures that the mapped features are compatible with the representation specification of the target domain, and adds the adapted features to F. mapped In the list.

[0159] Return the mapped identity feature vector F mapped .

[0160] Step 400: Combine the mapped identity feature vector with real-time behavioral data to perform multi-factor adaptive trust assessment and obtain dynamic trust assessment results;

[0161] Trust level calculation formula:

[0162]

[0163] Among them, T score (t) represents the trust score at time t; σ() represents the sigmoid activation function; α i (t) represents the dynamic weight of the i-th factor at time t; f i(t) represents the i-th trust factor at time t; β represents the LSTM output weights; H lstm (t) represents the hidden state output of the LSTM network at time t; i represents the factor index, ranging from 1 to 5.

[0164] Detailed definitions of each trust factor:

[0165] Behavioral pattern rating:

[0166]

[0167] Where f1(t) represents the behavioral pattern score at time t; λ1 represents the behavioral score scaling factor; B score (t) represents the raw score calculated based on the user's historical behavior pattern at time t.

[0168] Device fingerprint similarity:

[0169]

[0170] Where f2(t) represents the device fingerprint similarity at time t; w j The weight of the j-th historical device is represented by sim(); the device fingerprint similarity calculation function is represented by D. curr Indicates the fingerprint characteristics of the currently logged-in device; D hist,j The fingerprint feature of the j-th historical device is represented by m1; m1 represents the total number of historical devices; and j represents the index of the historical device. This represents the sum of the weights of all historical devices.

[0171] Network risk assessment:

[0172]

[0173] Where f3(t) represents the network risk assessment at time t; risk() represents the network risk level assessment function; N t R represents the network environment where the user is located at time t; max This indicates the maximum risk level value.

[0174] Time Pattern Rating:

[0175]

[0176] Where f4(t) represents the time pattern score at time t; norm() represents the normal probability density function; cos() represents the cosine function; h(t) represents the number of hours corresponding to time t; μ t σ represents the average of users' frequent login times; t This represents the standard deviation of a user's frequently used login times.

[0177] Reasonable geographical location:

[0178]

[0179] Where f5(t) represents the geographical location rationality at time t; e represents the natural constant; dist() represents the geographical distance calculation function; L t L represents the user's geographic location coordinates at time t; exp D represents the expected location predicted based on the user's historical behavior. max This represents the maximum reasonable distance threshold.

[0180] Dynamic trust level calculation:

[0181] T(t)=α h ·T hist +α c ·T curr (t)+α ctx ·T ctx (t);

[0182] Where T(t) represents the current user's dynamic trust assessment result; α h T represents the weight of historical trust levels; hist Indicates the user's historical average trust level; α c Indicates the current trust level weight; T curr (t) represents the current confidence level at time t; α ctx T represents the contextual trust weight; ctx (t) represents the trust level adjustment at time t based on the current context.

[0183] Step 500: Generate an adaptive security token based on the dynamic trust assessment results;

[0184] Design a smart token generation mechanism based on the JWT (JSON Web Token) standard and well-known adaptive security technologies;

[0185] Trust-based smart token generation steps:

[0186] Input: Dynamic trust assessment result T(t), user identity information U id Target service information S target Security Policy P sec ;

[0187] Step 501, Trust Verification: Verify whether the user's trust level meets the minimum requirements. Set the minimum trust threshold T. min If the current trust level does not meet the conditions:

[0188] ifT(t) <T minThen return ERROR("User trust level is too low, refuse to generate token");

[0189] Among them, T min T(t) represents the minimum trust threshold; T(t) represents the current user's dynamic trust assessment result; ERROR() represents the error return function.

[0190] Step 502, Dynamic Validity Calculation: Obtain basic configuration parameters:

[0191] T base =P sec .period;

[0192] r c =P sec .risk = 0.5;

[0193] Assess the current threat level:

[0194] L threat =assess_threat(U id ,S target );

[0195] Calculate the safety adjustment factor:

[0196]

[0197] Final calculation of token validity period:

[0198] T valid =T base ×(1+T(t))×S factor ;

[0199] Among them, T base Indicates the basic validity period; P sec .period represents the base time period configured in the security policy; r c P represents the risk coefficient. sec .risk represents the risk parameters configured in the security policy; L threat This indicates the current threat level assessment result; `assess_threat()` represents the threat assessment function; U id Indicates user identity information; S target Indicates target service information; S factor Indicates the safety adjustment factor; T valid T(t) represents the final calculated token validity period; T(t) represents the current user's dynamic trust assessment result.

[0200] Step 503, JWT payload construction: Obtain the current timestamp:

[0201] t now =get_timestamp();

[0202] Constructing the JWT load structure:

[0203] payload={sub,aud,exp,iat,trust,level,ctx};

[0204] The definitions of each field are as follows:

[0205] sub=U id .id;

[0206] aud = S target .endpoint;

[0207] exp = t now +T valid ;

[0208] iat = t now ;

[0209] trust = T(t);

[0210] level = calc_level(T(t));

[0211] ctx contains contextual information such as IP address, device fingerprint, and geolocation.

[0212] Among them, t now `<timestamp>` represents the current system timestamp; `get_timestamp()` represents the function to retrieve the current timestamp; `payload` represents the payload portion of the JWT token; `sub` represents the body field in the JWT standard; `aud` represents the audience field in the JWT standard; `exp` represents the expiration time field in the JWT standard; `iat` represents the issuance time field in the JWT standard; `trust` represents a custom trust level field; `level` represents a custom security level field; `ctx` represents a custom context information field; `U` id .id represents the user identifier in the user identity information; S target .endpoint represents the service endpoint address in the target service information; T valid This indicates the token's validity period; calc_level() represents the function that calculates the security level based on trust level; T(t) represents the current user's dynamic trust level assessment result;

[0213] Step 504, Token Signing: Construct the JWT standard header: header = {alg, HS256, typ, JWT}, and generate the message to be signed;

[0214] Calculate the HMAC-SHA256 signature: sig = HMAC(key, msg), and assemble the final token:

[0215] Token=encode(header)+encode(payload)+encode(sig);

[0216] In this table, `header` represents the header information of the JWT token; `alg` represents the signature algorithm field; `HS256` represents the HMAC-SHA256 signature algorithm; `typ` represents the token type field; `JWT` represents the JSONWebToken type; `msg` represents the message content to be signed; `encode()` represents the Base64 encoding function; `payload` represents the payload part of the JWT token; `sig` represents the digital signature result; `HMAC()` represents the HMAC signature function; `key` represents the signature key; and `Token` represents the final generated complete JWT token.

[0217] Step 505, Blockchain Recording: Create Token Transaction Record:

[0218] Tx = create_tx(Token, T(t));

[0219] It includes information such as token hash, user ID, service ID, trust score, validity period, and timestamp. The transaction is broadcast to the blockchain network.

[0220] R broadcast = broadcast(Tx);

[0221] Where Tx represents a blockchain transaction record; create_tx() represents the function that creates the transaction record; Token represents the generated JWT token; T(t) represents the current user's dynamic trust assessment result; R broadcast This indicates the result of a blockchain broadcast; broadcast() is a function that broadcasts transactions to the blockchain network.

[0222] Step 600: Convert the adaptive security token into the protocol format required by the target system;

[0223] Design a protocol conversion model based on well-known theories of finite state machines (FSM) and reinforcement learning;

[0224] Smart protocol conversion steps:

[0225] Input: The adaptive security token Token output from step 500, and the target protocol type P. target Quality Requirements Q req ;

[0226] Step 601, Protocol Compatibility Analysis: Using State Transition Functions

[0227] δ:S×Σ→S models the protocol state;

[0228] Where the state set S = {s SAML ,s OAuth ,s OIDC ,s Bridge ,s Error ;

[0229] Extracting protocol features from the source token:

[0230] F src = extract_features(Token);

[0231] Obtain the feature set of the target protocol:

[0232] F target =get_features(P target );

[0233] Calculate the compatibility score between the two protocols:

[0234] Score comp =calc_compatibility(F src ,F target );

[0235] Where δ represents the state transition function; S represents the set of states; Σ represents the set of input symbols; s SAML Indicates the SAML protocol state; s OAuth Indicates the OAuth protocol status; s OIDC Indicates the OpenIDConnect protocol status; s Bridge Indicates bridging state; s Error Indicates an error status; F src Represents the source token features; extract_features() represents the feature extraction function; Token represents the JWT token; F target Represents the target protocol features; get_features() represents the function to retrieve protocol features; P target Indicates the target protocol type; Score comp This represents the compatibility score; calc_compatibility() is the function used to calculate compatibility.

[0236] This step provides the basic input to the state transition function, determining the initial state and possible transition paths.

[0237] Step 602, Transition Strategy Selection: Apply the transition decision function to select the optimal strategy.

[0238]

[0239] In practical applications, the decision thresholds are set to θ1 = 0.8 and θ2 = 0.4, and the corresponding implementation is as follows:

[0240]

[0241] This decision-making process utilizes a policy model based on reinforcement learning. To select the optimal transition action;

[0242] Where Decision() represents the transition decision function; P src Indicates the source protocol type; P dst Indicates the target protocol type; Score comp Indicates compatibility score; θ1 represents the threshold for direct conversion; θ2 represents the threshold for bridging conversion; Direct represents the direct conversion strategy; Bridge represents the bridging conversion strategy; Semantic represents the semantic conversion strategy; Strategy represents the selected conversion strategy; π θ (a|s) represents the probability of choosing action a in state s; Q θ (s,a) represents the state-action value function; s represents the current protocol state; a represents the transition action; a′ represents the possible action.

[0243] Step 603, Perform protocol conversion: Perform conversion based on the strategy selected in step 602, and simultaneously apply the Q-value update formula for real-time learning: Q θ (s,a)←Q θ (s,a)+α lr [r ′ +γmax a′ Q θ (s′,a′)-Q θ (s,a)];

[0244] Among them, Q θ (s,a) represents the state-action value function; α lr r represents the learning rate; ′ Represents immediate reward; γ represents the discount factor; s′ represents the next state; a′ represents the possible next action; max a′ This indicates selecting the action that maximizes the Q value;

[0245] For the direct conversion strategy:

[0246] R conv =direct_convert(Token,Ptarget );

[0247] For the bridging conversion strategy: first convert to an intermediate format:

[0248] F inter = to_bridge(Token);

[0249] Then switch to the target protocol:

[0250] R conv =bridge_to_target(F inter ,P target );

[0251] For semantic transformation strategies: First, extract the semantic representation:

[0252] S repr =extract_semantic(Token);

[0253] Regenerate the target protocol:

[0254] R conv ' =semantic_to_target(S) repr ,P target );

[0255] The transformation process simultaneously optimizes multiple objective functions:

[0256] Opt=min(λ1·L1+λ2·E1-λ3·S1);

[0257] Its, R conv Indicates the direct conversion result; R conv ′ indicates the bridging conversion result; R conv " indicates the semantic conversion result; direct_convert() indicates the direct conversion function; Token indicates the JWT token; P target Indicates the target protocol type; F inter This indicates the intermediate format; `to_bridge()` represents the function to convert to the bridging format; `bridge_to_target()` represents the function to convert from the bridging format to the target protocol; S repr The semantic representation is represented by: extract_semantic(); semantic_to_target(); Opt; λ1; error rate weight; λ3; security weight; L1; E1; and S1.

[0258] Step 604, Quality Verification: Evaluate the quality of the results using the conversion quality assessment formula.

[0259] Q total =w1·Q fidelity +w2·Q perf +w3·Q sec ;

[0260] The detailed definitions of each quality indicator are as follows:

[0261]

[0262] Calculate information fidelity:

[0263]

[0264] Evaluation performance metrics:

[0265]

[0266] Analysis of security retention:

[0267] The weights are set as follows: w1 = 0.4 (fidelity weight), w2 = 0.35 (performance weight), w3 = 0.25 (security weight);

[0268] Calculate the overall quality score using the formula above: Q score =0.4×Q fidelity +0.35×Q perf +0.25×Q sec ;

[0269] Among them, Q total Indicates the overall quality score; w1 represents the fidelity weight; w2 represents the performance weight; w3 represents the security weight; Q fidelity Indicates information fidelity; Q perf Indicates performance metrics; Q sec Indicates the degree of security retention; N orig N represents the number of original information items; conv Indicates the number of information items retained after conversion; T conv Indicates the conversion time; R usage Indicates resource utilization rate; N preserved Indicates the number of security attributes to be retained; N total Indicates the total number of security attributes; Q score This indicates the overall quality score;

[0270] Step 605, Result Optimization: Based on the Q-value and the multi-objective optimization function, determine whether the quality score meets the requirements.

[0271] ifQ scorereq If .min is used, the execution result will be optimized:

[0272] R opt =optimize(R conv Q req The optimization process utilizes the experience replay mechanism of reinforcement learning to adjust transformation parameters to improve the quality score.

[0273] The optimization uses the gradient ascent method to update the policy parameters:

[0274]

[0275] Where β = 0.01 is the optimization step size.

[0276] If the quality score meets the requirements, the conversion result is returned directly: return;

[0277] Among them, Q score Indicates the overall quality score; Q req .min represents the minimum threshold of quality requirements; R opt Represents the optimized result; optimize() represents the result optimization function; R conv Indicates the conversion result; Q req θ represents the quality requirement; β represents the strategy parameter; and β represents the optimization step size. This represents the gradient operator with respect to parameter θ; `return` indicates the return function; it returns the transformed protocol format `Result`. `Result` serves as the final output of the entire authentication process, provided to the target system to complete the cross-domain authentication process. The format and content of `Result` are as follows:

[0278] Data format: Target protocol format (SAML / XML, OAuth / JSON, etc.);

[0279] Destination: Provided to the target system for cross-domain identity authentication;

[0280] Data scale: A complete protocol format document containing all necessary authentication information.

[0281] In one embodiment of the present invention, a technical effect verification of the aforementioned cloud environment intelligent identity authentication cross-domain integration method is provided, such as... Figures 2 to 5 As shown, the results of processing time distribution for each step, comparison of data flow transmission efficiency, relationship between trust level and token validity period, and distribution of system resource utilization are presented respectively.

[0282] ​The embodiments of the present invention have been described above. However, the embodiments are not limited to the specific implementation methods described above. The specific implementation methods described above are merely illustrative and not restrictive. Those skilled in the art can make more equivalent embodiments under the guidance of the present embodiments, and all of them are within the protection scope of the present embodiments.

Claims

1. A method for cross-domain integration of intelligent identity authentication in a cloud environment, characterized in that, Includes the following steps: Heterogeneous identity data from multiple cloud platforms are collected and preprocessed to obtain a standardized identity dataset; A unified identity semantic model is constructed based on a standardized identity dataset, and feature embedding vectors are generated; the details are as follows: A unified identity semantic model is constructed based on descriptive logic and ontology engineering techniques. Identity semantic model definition: ; in, Represents a unified identity semantic model; Represents a set of user entities; Represents a set of user attributes; Represents a set of characters; Represents a set of permissions; Represents a set of contextual information; Represents a set of semantic relations; , represents the set of user entities, where, These represent the 1st, 2nd, and nth user entities, respectively, where n represents the total number of users in the system; , representing a set of user attributes These represent the 1st, 2nd, and mth user attributes, respectively, where m represents the total number of attribute types. , representing a set of characters These represent the 1st, 2nd, and kth characters, respectively, where k represents the total number of character types. , representing the set of permissions, These represent the 1st, 2nd, and Lth roles, respectively, where L represents the total number of permission types. Represents a set of contextual information. These represent the 1st, 2nd, and Jth roles, respectively, where J represents the total number of context factors; It represents a set of semantic relationships, including inheritance, composition, and dependency. Steps for building a unified identity semantic model: Input: The standardized identity dataset output from step 100 ; Output: Unified Identity Semantic Model and feature embedding vector set ; in, This represents the standardized identity dataset output from step 100; Represents a unified identity semantic model; Represents a set of feature embedding vectors; Step 201, entity and relation extraction; From the input dataset Extract various entity sets from the middle, and extract the user entity set: ； Attribute type collection: ； Character type collection: ； Permission type collection: ； Context type collection: ； in, This represents a function that extracts user entities from a dataset. This represents a function that extracts the attribute type. This function represents the method for extracting character types. Functions that represent the types of permissions to extract; This indicates a function that extracts the context type; Step 202, Semantic Relation Modeling: Constructing a Set of Semantic Relations Establish three core relationships respectively: User-role mapping relationship: ； Role-permission mapping relationship: ； Attribute dependency relationships: ； Finally, merge all relationships: ； in, This indicates the user-role mapping relationship; This indicates the role-permission mapping relationship; Indicates attribute dependencies; This represents a function that constructs user-role mappings. This function represents the method for constructing role-permission mappings. Represents a function that constructs attribute dependencies; A function representing a merge relationship; Step 203, Ontology Model Construction: Based on the extracted entity set and semantic relationships, construct a unified identity semantic model. ； in Represents a complete identity ontology model; This represents a function for constructing an ontology model; Step 204, Feature Embedding Generation: Create a list of feature embedding vectors. ;for Each identity record in Perform the following operations: First, map the records to the semantic space. Then, a 512-dimensional embedding vector is generated: ； Add the generated embedding vector to List; Return to unified identity semantic model and feature embedding vector set ; in, Indicates the first One identity record; Indicates the first The result of mapping records to the semantic space; Indicates the first Embedded vectors; This represents a function that maps records to a semantic space; This represents a function that generates an embedding vector; This indicates that the dimension of the embedding vector is 512; A deep neural network is used to perform an identity mapping transformation on the feature embedding vector to obtain the mapped identity feature vector; the details are as follows: Input data: Feature embedding vector output from step 200 and target domain information ; Deep neural network identity mapping steps: Step 301, Feature Preprocessing: Creating a Standardized Feature List ;for Each embedding vector in Application layer normalization function: ； Add the standardized embedding vector In the list, ensure that the input features have zero mean and unit variance; in, Represents a standardized feature list; Indicates the first Embedded vectors; This represents the standardized embedding vector; Indicates the layer normalization function; Step 302, Transformer Mapping: Create a list of mapped features ;for Each standardized feature in Perform the following Transformer transformation sequence: First, a multi-head attention mechanism is applied: ； Then perform residual joins and layer normalization: ； Next, a nonlinear transformation is performed using a feedforward network: ； Finally, residual connections and layer normalization are applied again to obtain the final output: ； in, Represents a list of mapping features; This represents the output of the multi-head attention mechanism; This represents the output after residual connections and layer normalization; This represents the output of the feedforward network; This indicates the final transformation output; Represents the feedforward network function, Add to List; Step 303, Target Domain Adaptation: Create a list of adaptation features ;for Each mapping feature in Apply the target domain adaptation function: ； in, Indicates the first One mapping feature; This indicates the adapted features; This represents the target domain adaptation function. Represents target domain information; It should be noted that this sub-step ensures that the mapped features are compatible with the representation specification of the target domain, and adds the adapted features to... List; Return the mapped identity feature vector ; By combining the mapped identity feature vector with real-time behavioral data, a multi-factor adaptive trust assessment is performed to obtain dynamic trust evaluation results; the details are as follows: Trust level calculation formula: ; in, Indicates time Trust rating; This represents the sigmoid activation function; Indicates time No. Dynamic weights of each factor; Indicates time No. One trust factor; Indicates the LSTM output weights; Indicates time Hidden state output of an LSTM network; This represents the factor index, ranging from 1 to 5; Detailed definitions of each trust factor: Behavioral pattern rating: ; in, Indicates time Behavioral pattern rating; Indicates the scaling factor for behavior rating; Indicates time The raw score is calculated based on the user's historical behavior patterns; Device fingerprint similarity: ; in, Indicates time The similarity of device fingerprints; Indicates the first The weight of each historical device; This represents the function for calculating device fingerprint similarity. This indicates the fingerprint characteristics of the currently logged-in device; Indicates the first Fingerprint characteristics of a historical device; Indicates the total number of historical devices; Index representing historical devices; This represents the sum of the weights of all historical devices; Network risk assessment: ； in, Indicates time Network risk assessment; This represents a function for assessing network risk levels. Indicates time The user's network environment; Indicates the maximum risk level value; Time Pattern Rating: ； in, Indicates time Time pattern scoring; This represents the probability density function of the normal distribution. Represents the cosine function; Indicates time The corresponding number of hours; This represents the average login time for users. The standard deviation of a user's frequently used login times; Reasonable geographical location: ； in, Indicates time The rationality of the geographical location; Represents the natural constant; This represents a function for calculating geographic distance. Indicates time The user's geographic location coordinates; This indicates the expected location predicted based on the user's historical behavior. Indicates the maximum reasonable distance threshold; Dynamic trust level calculation: ； in, This indicates the current user's dynamic trust level assessment result; Indicates the weight of historical trust levels; This indicates the user's historical average trust level; Indicates the current trust level weight; Indicates time Current level of trust; Indicates the contextual trust weight; Indicates time Trust level adjustment based on the current context; Generate adaptive security tokens based on dynamic trust assessment results; Convert the adaptive security token into the protocol format required by the target system.

2. The cloud environment intelligent identity authentication cross-domain integration method according to claim 1, characterized in that, The steps for collecting and preprocessing heterogeneous identity data from multi-cloud platforms include: Obtain raw identity data sets from multiple cloud platforms; Perform data extraction and cleaning operations on each cloud platform to remove duplicates and null values; The cleaned data is standardized to construct a unified record structure; the standardized records are then subjected to data quality verification and feature vectorization to generate a standardized identity dataset.

3. The cloud environment intelligent identity authentication cross-domain integration method according to claim 1, characterized in that, The steps for generating an adaptive security token based on dynamic trust assessment results include: Verify whether the user's trust level meets the minimum requirements; The token validity period is calculated based on the dynamic trust assessment results and security policies, using the following formula: ； in, Indicates the basic validity period; Indicates the safety adjustment factor; This indicates the final calculated validity period of the token; This indicates the current user's dynamic trust level assessment result; Construct a JWT payload structure that includes user identifier, server endpoint, expiration time, trust score, and context information; sign the JWT payload structure and record it in the blockchain network to generate an adaptive security token.

4. The cloud environment intelligent identity authentication cross-domain integration method according to claim 1, characterized in that, The steps to convert an adaptive security token into the protocol format required by the target system include: The protocol state is modeled using a state transition function, protocol features are extracted from the adaptive security token, and the compatibility score with the target protocol is analyzed. The system applies a conversion decision function to select direct conversion, bridging conversion, or semantic conversion strategies based on compatibility scores, and uses a reinforcement learning policy model to select the optimal conversion action. The protocol transformation is performed according to the selected strategy, while the Q-value update formula is applied for real-time learning and optimization of a multi-objective function that includes latency, error rate and security level. The conversion quality assessment formula is applied to evaluate the conversion quality from three dimensions: information fidelity, performance indicators, and security feature retention. Based on the Q-value and the multi-objective optimization function, it is determined whether the quality score meets the requirements. If necessary, the results are optimized and the policy parameters are updated using the gradient ascent method.

5. A cloud environment intelligent identity authentication cross-domain integration system, used to execute the cloud environment intelligent identity authentication cross-domain integration method as described in any one of claims 1-4, characterized in that, include: The data preprocessing module is used to collect and preprocess heterogeneous identity data from multiple cloud platforms to obtain a standardized identity dataset. The semantic modeling module constructs a unified identity semantic model based on a standardized identity dataset and generates feature embedding vectors. The identity mapping module is used to perform identity mapping transformation on the feature embedding vector using a deep neural network to obtain the mapped identity feature vector. The trust assessment module is used to perform multi-factor adaptive trust assessment by combining the mapped identity feature vector with real-time behavioral data to obtain dynamic trust assessment results. The token generation module is used to generate adaptive security tokens based on dynamic trust assessment results. The protocol conversion module is used to convert adaptive security tokens into the protocol format required by the target system.

Images