An intelligent management system and method applied to an interactive authentication platform

Abstract

The application discloses an intelligent management system and method applied to an interactive authentication platform, relates to the technical field of interactive authentication platform intelligent management, and comprises a multi-factor dynamic authentication module, a behavior mode analysis module and a risk assessment and decision module; the multi-factor dynamic authentication module is used for integrating a plurality of authentication factors and verifying the identity of a client calling party; the behavior mode analysis module is used for collecting and analyzing historical interactive data of the client calling party, and constructing a behavior mode model; and the risk assessment and decision module is used for quantitatively evaluating the risk level of each service interaction. According to the application, a plurality of authentication factor combinations are obtained based on an authentication strategy, special protection of various service requests is realized, the identity of the client calling party is accurately verified in combination with the constructed behavior mode model, and through the multiple protection mechanisms, information misuse or malicious operation can be effectively avoided, and accurate protection of interactive information by the system is realized.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of intelligent management of interactive authentication platforms, and particularly relates to an intelligent management system and method applied to an interactive authentication platform. BACKGROUND

[0002] In the current complex network environment, interactions between service ends and between service ends and clients are increasingly frequent, and traditional authentication methods have been difficult to cope with diversified and complex attack methods.

[0003] The traditional authentication method based on a username and a password has low security, an attacker can easily impersonate a caller to call a service interface after obtaining the password, and complete information theft or perform malicious operations, meanwhile, the traditional authentication method lacks effective supervision and analysis of the behavior of the calling party, so that potential malicious attacks suffered by the client cannot be discovered in time, and the existing authentication system cannot balance the work efficiency and security of service interaction. SUMMARY

[0004] The application aims to provide an intelligent management system and method applied to an interactive authentication platform to solve the problems in the prior art.

[0005] To achieve the above-mentioned purpose, the application provides the following technical scheme: an intelligent management system applied to an interactive authentication platform, the system comprising a client, a server and an authentication server;

[0006] The client and the server perform information interaction, the client is used for initiating a service request to the server, collecting authentication information according to an authentication requirement sent by the server, and submitting the collected authentication information to the server;

[0007] The server and the authentication server perform information interaction, the server is used for sending an authentication requirement to the client according to an authentication strategy fed back by the authentication server, forwarding the service request initiated by the client and the submitted authentication information to the authentication server, and deciding whether to allow the service request to continue execution according to an authentication result of the authentication server;

[0008] The authentication server is used for generating an authentication strategy according to client information and feeding back to the server, and performing authentication processing on the authentication information forwarded by the server, and feeding back an authentication processing result to the server.

[0009] Further, the authentication server is internally provided with a multi-factor dynamic authentication module, a behavior pattern analysis module and a risk assessment and decision module.

[0010] The multi-factor dynamic authentication module is used for integrating several authentication factors to verify the identity of the client calling party, dynamically adjusting the authentication strategy through multi-factors, and ensuring that the system can be applied to different application scenarios and security requirements.

[0011] The behavior pattern analysis module is used for collecting and analyzing historical interaction data of the client calling party, and constructing a behavior pattern model.

[0012] The risk assessment and decision module is used for quantitatively evaluating the risk level of each service interaction, and feeding back the evaluation result as an authentication result to the server.

[0013] Further, the multi-factor dynamic authentication module includes an authentication strategy generation unit, an authentication information analysis unit and a dynamic authentication unit.

[0014] The authentication strategy generation unit determines the target service interface of the server according to the application identifier of the client and the initiated service request, and dynamically generates an authentication strategy according to the permission level of the determined target service interface and the service request type initiated by the client.

[0015] The authentication information analysis unit matches and analyzes the authentication information collected by the client according to the dynamically generated authentication strategy, the reserved information of the client calling party on the server, and the historical interaction information of the client calling party on the server, verifies the identity of the client calling party based on the matching analysis result, and if the identity verification is successful, the authentication result is to execute the service request, and if the identity verification is not successful, the authentication result is to reject the service request.

[0016] The dynamic authentication unit generates a dynamic key by using an asymmetric encryption algorithm in combination with the timestamp corresponding to the completion of the identity verification of the client calling party, the random number and the unique identification code of the device used by the client calling party after the identity verification of the client calling party is successful, and transmits the generated dynamic key to the client and the server. The client uses the dynamic key to encrypt the initiated service request data, and the server decrypts the service request data using the dynamic key after receiving the service request.

[0017] In the key generation process, the dynamic authentication unit combines the timestamp, the random number, and the unique identification code of the device used by the client calling party to ensure the uniqueness and unpredictability of the key, and the key is invalidated immediately after each service interaction and regenerated for the next interaction, thereby ensuring the high security of the service request data.

[0018] Further, the behavior pattern analysis module includes a judgment unit, a behavior feature acquisition unit and a behavior pattern model construction unit.

[0019] The judgment unit performs integrity check on the decrypted data obtained by the server, and judges whether the service request initiated by the client needs to be re-authenticated according to the check result; when the integrity of the decrypted data obtained by the server is 1, the service request initiated by the client does not need to be re-authenticated; when the integrity of the decrypted data obtained by the server is not 1, the service request initiated by the client is re-authenticated according to the multi-factor authentication module;

[0020] The behavior feature acquisition unit acquires the behavior features of the client invoker in each service request process when the judgment result is that the service request initiated by the client does not need to be re-authenticated.

[0021] The behavior pattern model construction unit constructs a behavior pattern model according to the acquired behavior features.

[0022] Further, the specific method for the behavior feature acquisition unit to acquire the behavior features of the client invoker in each service request process is:

[0023] The key time stamp of the client invoker in the service request process is acquired, including the time T1 when the client initiates the service request, the start time T2 and the end time T3 when the client collects the authentication information;

[0024] The type of the service request initiated by the client at T1 is determined, the request frequency f of the client invoker to the determined type of service request is acquired, the linear relationship model R between the request frequency and the collection time is constructed with the request frequency as the independent variable and the authentication information collection time as the dependent variable, the request frequency f is input into the linear relationship model R, and the collection time R f is obtained as the first static behavior feature of the client invoker. f -(T3-T2) as the first static behavior feature of the client invoker.

[0025] The target service interface called by the client at T1 is determined, and each type of target service interface is numbered in descending order of the number of times of calling the target service interface by the client invoker, and the numbering result is: i=1,2,…,n; n represents the total number of target service interfaces, the difference value s between the number of the historical target service interface called by the client invoker when initiating the determined type of service request and the number of the determined target service interface is calculated, and the difference value g between the value 1 and 1 / |s| is taken as the second static behavior feature of the client invoker.

[0026] When the server executes the determined type of service request, the interaction information of the client invoker is acquired, including the interaction object, the interaction level and the interaction type.

[0027] According to the historical interaction information of the client invoker, the interaction level and the interaction type of each interaction object are determined, the same interaction level or the same interaction type is given the same weight value, and each interaction object is numbered, and the numbering result is: j=1, 2, …, m; m represents the total number of interaction objects;

[0028] According to the obtained interaction information of the client invoker, the weight value d1p corresponding to the interaction level of the interaction object p and the weight value d2p corresponding to the interaction type are determined, p=1, 2, …, m;

[0029] According to the historical interaction information, the average weight value d1´p corresponding to the interaction level of the interaction object p and the average weight value d2´p corresponding to the interaction type are obtained.

[0030] d1p-d1´p is taken as the first dynamic behavior feature of the client invoker, and d2p-d2´p is taken as the second dynamic behavior feature of the client invoker.

[0031] By obtaining the dynamic behavior features and static behavior features of the client invoker, and constructing a behavior pattern model according to the obtained behavior features, the identity of the client invoker can be accurately verified, and the management effect of the system is further improved.

[0032] Further, the specific method for constructing the behavior pattern model by the behavior pattern model construction unit according to the obtained behavior features is:

[0033] H=a1×g+a2×ln[1+|R f -(T3-T2)|] is taken as the first behavior pattern model of the client invoker, wherein a1 and a2 both represent proportional coefficients and a1+a2=1, and H represents the first behavior feature value of the client invoker;

[0034] K=a3×(d1p-d1´p)+a4×(d2p-d2´p) is taken as the second behavior pattern model of the client invoker, wherein a3 and a4 both represent proportional coefficients and a3+a4=1, and K represents the second behavior feature value of the client invoker;

[0035] When K>Y or H>X, it indicates that the interaction information of the client invoker is abnormal behavior information, and when 0≤K≤Y and 0≤H≤X, it indicates that the interaction information of the client invoker is normal behavior information.

[0036] Further, the risk assessment and decision module comprises a risk assessment unit and an authentication decision unit;

[0037] The risk assessment unit performs risk assessment on the interaction behavior of the client invoker according to the first behavior characteristic value and the second behavior characteristic value when the interaction information of the client invoker is determined as abnormal behavior information.

[0038] The authentication decision unit selects whether to add an authentication factor according to the risk assessment result, and sends an additional authentication requirement to the client through the server when the additional authentication factor is needed, and the client collects additional authentication information according to the additional authentication requirement, and forwards the additional authentication information to the authentication server through the server for verification until the risk assessment result is not needed Additional authentication factor, or the server rejects the service request again.

[0039] Further, the specific method for the risk assessment unit to perform risk assessment on the interaction behavior of the client invoker is:

[0040] When K> Y and 0≤H≤X or H>X and 0≤K≤Y:

[0041] According to 1-exp(-K) or 1-exp(-H), the risk assessment value W of the client invoker is quantitatively processed;

[0042] When K> Y and H>X:

[0043] According to 1-exp(-K×H), the risk assessment value W of the client invoker is quantitatively processed;

[0044] If 0≤W≤0.3, it indicates that the risk assessment level of the client invoker is level one;

[0045] If 0.3

[0046] If 0.6

[0047] Wherein, exp() represents the exponential function with e as the base and e=2.73.

[0048] Further, the additional authentication factor includes a static authentication factor and a dynamic authentication factor, the static authentication factor includes face recognition verification and target service interface re-verification, and the dynamic authentication factor is interaction information re-verification.

[0049] An intelligent management method applied to an interactive authentication platform, the method comprising:

[0050] S10: Integrate several authentication factors to verify the identity of the client invoker;

[0051] S20: Collect and analyze the historical interaction data of the client invoker to build a behavior pattern model;

[0052] S30: quantitatively assess the risk level of each service interaction, and feed back the assessment result as an authentication result to the service end;

[0053] S40: the service end selects whether to execute the service request initiated by the client according to the feedback result.

[0054] Compared with the prior art, the beneficial effects of the present application are:

[0055] 1、The present application dynamically generates an authentication strategy according to the permission level of the target service interface and the service request type initiated by the client, obtains a plurality of sets of authentication factor combinations based on the authentication strategy, realizes the special protection of various service requests, constructs a behavior pattern model by combining the dynamic behavior characteristics and static behavior characteristics obtained through the interaction information, accurately verifies the identity of the client invoker, effectively avoids the execution of information theft or malicious operation through multiple protection mechanisms, and realizes the accurate protection of the system on the interaction information.

[0056] 2、The present application obtains dynamic behavior characteristics and static behavior characteristics, effectively supervises the interaction behavior of the client invoker, and is beneficial to timely discover potential malicious attacks suffered by the client.

[0057] 3、The behavior pattern model obtained by continuously optimizing the present application not only can ensure that the normal service request initiated by the client can be quickly authenticated, but also can reduce the interference of the verification steps corresponding to the additional authentication factors on the service request process, and realizes the balance between work efficiency and safety. BRIEF DESCRIPTION OF DRAWINGS

[0058] Figure 1 It is a working principle structure schematic diagram of the intelligent management system applied to the interactive authentication platform of the present application. DETAILED DESCRIPTION

[0059] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0060] Embodiment: as shown in the figure, the present application provides an intelligent management system and method technical scheme applied to an interactive authentication platform, an intelligent management system applied to an interactive authentication platform, the system comprising a client, a service end and an authentication server; Figure 1

[0061] ​The client and the server interact with each other, the client is used to initiate a service request to the server, and according to the authentication requirements sent by the server, the authentication information is collected and submitted to the server, and the client includes but is not limited to mobile application client, desktop application client, Internet of Things device client, etc., and the collection process of the authentication information is executed after the client calling party authorization;

[0062] The server and the authentication server interact with each other, the server is used to send authentication requirements to the client according to the authentication strategy fed back by the authentication server, and forward the service request initiated by the client and the submitted authentication information to the authentication server, and decide whether to allow the service request to continue execution according to the authentication result of the authentication server, and the server includes but is not limited to Web server, mobile application backend server, service node in microservice architecture, etc.;

[0063] The authentication server is used to generate an authentication strategy according to the client information and feed it back to the server, and perform authentication processing on the authentication information forwarded by the server, and feed back the authentication processing result to the server;

[0064] The authentication server is built-in multi-factor dynamic authentication module, behavior pattern analysis module and risk assessment and decision module;

[0065] The multi-factor dynamic authentication module is used to integrate several authentication factors to verify the identity of the client calling party;

[0066] The multi-factor dynamic authentication module includes an authentication strategy generation unit, an authentication information analysis unit and a dynamic authentication unit;

[0067] The authentication strategy generation unit determines the target service interface of the server according to the application identifier of the client and the service request initiated by the client, and dynamically generates an authentication strategy according to the permission level of the determined target service interface and the service request type initiated by the client, and the service request type includes transfer transaction, content publishing, etc.;

[0068] For example, when a user calls the transfer transaction interface of the bank background system (server) through the mobile bank client to complete the fund transfer operation:

[0069] The user initiates a transfer transaction request in the mobile bank client, the bank background system sends the application identifier of the client to the authentication server, the application identifier includes the bank APP version number, and the device model used by the user, etc., the authentication server generates an authentication strategy according to the high permission level of the transfer transaction interface (target service interface), and the authentication strategy is: requiring the calling party of the mobile bank client to provide username and password, fingerprint, device geographic location, etc.

[0070] When a user uploads multimedia content such as an article, a picture, a video, etc. through a customized publishing client by calling a publishing interface of a platform content management server:

[0071] When the user initiates a content request using the publishing client, the platform content management server sends an application identifier of the client to an authentication server, the application identifier including a client software version, a device model used by the user, a device operating system version, etc., the authentication server generates an authentication policy according to a medium authority of a platform content publishing interface (a target service interface), the authentication policy including a requirement that a calling party of the publishing client provides a user name and a password, a device fingerprint (the device fingerprint refers to a device hardware serial number), a subject classification of published content, etc.; the medium authority relates to user original content management;

[0072] The authentication information analysis unit matches and analyzes authentication information collected by the client according to the dynamically generated authentication policy, reserved information of the client calling party on the server, and historical interaction information of the client calling party on the server, and verifies the identity of the client calling party based on the matching analysis result, if the identity verification is successful, the authentication result is to execute the service request, if the identity verification is not successful, the authentication result is to reject the service request, the historical interaction information including a commonly used transaction area range of the client calling party, a hardware serial number of a device used by the client calling party in the past;

[0073] For example, when a user calls a bank background system (a server) through a mobile bank client to complete a fund transfer operation:

[0074] The user inputs a user name and a password according to a prompt on the mobile bank client, and performs a fingerprint recognition operation, the client simultaneously collects device geographic location information (such as coordinate data based on GPS or base station positioning), the client sends the authentication information to the bank background system after encryption, the bank background system forwards the authentication information to a multi-factor dynamic authentication module of the authentication server, the authentication information analysis unit first verifies the correctness of the user name and the password, if correct, calls a biological feature recognition service to verify whether the fingerprint information matches fingerprint information reserved by the user in the bank, and simultaneously checks whether the device geographic location information is within a commonly used transaction area range of the user (judged according to historical transaction records), if the user name and the password are correct, the fingerprint matches, and the geographic location is normal, the user identity verification is successful, otherwise, the user identity verification is not successful;

[0075] When a user uploads multimedia content such as an article, a picture, a video, etc. through a customized publishing client by calling a publishing interface of a platform content management server:

[0076] The user inputs a username and password on the publishing client, and allows the publishing client to collect device fingerprint information and select a publishing content theme classification. The publishing client sends the authentication information after being packaged and encrypted to the platform content management server, which forwards it to the authentication server. The multi-factor dynamic authentication module verifies whether the username and password are correct. If they are correct, the device fingerprint information is compared with the device fingerprint record of the user to determine whether they match (to prevent the device from being misused to publish illegal content). At the same time, it is checked whether the publishing content theme classification is within the range allowed by the platform. If the username and password are correct, the device fingerprint matches, and the content theme is within the range allowed by the platform, the user identity verification is successful. Otherwise, the user identity verification is not successful.

[0077] After the identity verification of the client calling party is successful, the dynamic authentication unit generates a dynamic key using an asymmetric encryption algorithm, in combination with the timestamp corresponding to the completion of the identity verification of the client calling party, a random number, and the unique identification code of the device used by the client calling party. The method of generating a dynamic key is a prior art, and the generated dynamic key is transmitted to the client and the server. The client encrypts the initiated service request data using the dynamic key, and the server decrypts the service request data using the dynamic key after receiving the service request.

[0078] The behavior pattern analysis module is used to collect and analyze historical interaction data of the client calling party, and to construct a behavior pattern model.

[0079] The behavior pattern analysis module includes a judgment unit, a behavior feature acquisition unit, and a behavior pattern model construction unit.

[0080] The judgment unit performs integrity verification on the decrypted data obtained by the server, and determines whether re-authentication of the service request initiated by the client is needed according to the verification result. When the integrity of the decrypted data obtained by the server is 1, re-authentication of the service request initiated by the client is not needed. When the integrity of the decrypted data obtained by the server is not 1, re-authentication of the service request initiated by the client is needed according to the multi-factor authentication module. The method of performing integrity verification on the decrypted data is a prior art.

[0081] The behavior feature acquisition unit acquires the behavior features of the client calling party in each service request process when the judgment result is that re-authentication of the service request initiated by the client is not needed. The specific method is as follows:

[0082] The key timestamps of the client calling party in the service request process are acquired. The key timestamps include the time T1 at which the client initiates the service request, the start time T2 and the end time T3 at which the client collects authentication information.

[0083] Determine the type of service request initiated by the client at T1, obtain the request frequency f of the client caller for the determined type of service request, construct a linear relationship model R between the request frequency and the collection time of authentication information with the request frequency as the independent variable and the collection time of authentication information as the dependent variable, input the request frequency f into the linear relationship model R to obtain the collection time R of authentication information f The deviation R of the collection time of authentication information of the client caller f -(T3-T2) as the first static behavior feature of the client caller, and the collection time of authentication information = T3-T2.

[0084] Determine the target service interface called by the client at T1, number the target service interfaces in descending order of the number of times of calling each type of target service interface by the client caller, and the numbering result is: i = 1, 2, …, n; n represents the total number of target service interfaces, calculate the difference value s between the number of the historical target service interface called by the client caller when initiating the determined type of service request and the number of the determined target service interface, and take the difference value g between the value 1 and 1 / |s| as the second static behavior feature of the client caller.

[0085] When the server executes the determined type of service request, obtain the interaction information of the client caller, and the interaction information includes the interaction object, the interaction level and the interaction type.

[0086] According to the historical interaction information of the client caller, determine the interaction level and the interaction type of each interaction object, and assign the same weight value to the same interaction level or the same interaction type, and number each interaction object, and the numbering result is: j = 1, 2, …, m; m represents the total number of interaction objects.

[0087] According to the obtained interaction information of the client caller, determine the weight value d1p corresponding to the interaction level of the interaction object p and the weight value d2p corresponding to the interaction type, p = 1, 2, …, m.

[0088] According to the historical interaction information, obtain the weight value mean d1´p corresponding to the interaction level of the interaction object p and the weight value mean d2´p corresponding to the interaction type.

[0089] Take d1p-d1´p as the first dynamic behavior feature of the client caller, and take d2p-d2´p as the second dynamic behavior feature of the client caller.

[0090] The behavior pattern model construction unit constructs a behavior pattern model according to the obtained behavior features, and the specific method is:

[0091] H = a1×g + a2×ln[1+|R f-(T3-T2)|] as the first behavior pattern model of the client invoker, where a1 and a2 each represent a proportional coefficient and a1+a2=1, H represents the first behavior characteristic value of the client invoker, and ln[] represents a logarithmic function with a natural constant e as the base and e=2.73;

[0092] K=a3×(d1p-d1´p)+a4×(d2p-d2´p) as the second behavior pattern model of the client invoker, where a3 and a4 each represent a proportional coefficient and a3+a4=1, and K represents the second behavior characteristic value of the client invoker;

[0093] When K>Y or H>X, the interaction information of the client invoker is abnormal behavior information, and when 0≤K≤Y and 0≤H≤X, the interaction information of the client invoker is normal behavior information, where X and Y are both artificial threshold values;

[0094] The risk assessment and decision module is configured to quantitatively evaluate the risk level of each service interaction and feed back the evaluation result as an authentication result to the server;

[0095] The risk assessment and decision module includes a risk assessment unit and an authentication decision unit;

[0096] When the risk assessment unit determines that the interaction information of the client invoker is abnormal behavior information, the risk assessment unit performs risk assessment on the interaction behavior of the client invoker according to the first behavior characteristic value and the second behavior characteristic value, and the specific method is as follows:

[0097] When K>Y and 0≤H≤X or H>X and 0≤K≤Y:

[0098] The risk assessment value W of the client invoker is quantitatively processed according to 1-exp(-K) or 1-exp(-H);

[0099] When K>Y and H>X:

[0100] The risk assessment value W of the client invoker is quantitatively processed according to 1-exp(-K×H);

[0101] If 0≤W≤0.3, the risk assessment level of the client invoker is level one;

[0102] If 0.3

[0103] If 0.6

[0104] where exp() represents an exponential function with e as the base and e=2.73, and the greater the risk assessment value, the higher the corresponding risk assessment level;

[0105] The authentication decision unit selects whether to add an authentication factor according to the risk assessment result, and when it is necessary to add an authentication factor, sends an additional authentication requirement to the client through the server, the client collects additional authentication information according to the additional authentication requirement, and forwards the additional authentication information to the authentication server through the server for verification until the risk assessment result is that no additional authentication factor is needed, or the server rejects the service request again;

[0106] The additional authentication factor includes a static authentication factor and a dynamic authentication factor, the static authentication factor includes face recognition verification and target service interface re-verification, and the dynamic authentication factor is interactive information re-verification.

[0107] An intelligent management method applied to an interactive authentication platform, the method comprising:

[0108] S10: integrating several authentication factors to verify the identity of the client calling party;

[0109] S20: collecting and analyzing the historical interaction data of the client calling party to build a behavior pattern model;

[0110] S30: quantitatively evaluating the risk level of each service interaction, and feeding back the evaluation result as an authentication result to the server;

[0111] S40: the server selects whether to execute the service request initiated by the client according to the feedback result.

[0112] It is apparent to those skilled in the art that the present application is not limited to the details of the foregoing exemplary embodiments, but can be implemented in other concrete forms without departing from the spirit or essential characteristics of the present application. Therefore, the embodiments should be considered in all respects as illustrative and not restrictive, and the scope of the present application is defined by the appended claims rather than the foregoing description, and therefore all changes falling within the meaning and range of the equivalent elements of the claims are intended to be embraced in the present application. Any reference signs in the claims should not be considered as limiting the claims involved.

Claims

1. An intelligent management system applied to an interactive authentication platform, characterized in that: The system comprises a client, a server and an authentication server; The client and the server exchange information, the client is configured to initiate a service request to the server, collect authentication information according to an authentication requirement sent by the server, and submit the collected authentication information to the server; The server and the authentication server exchange information, the server is configured to send an authentication requirement to the client according to an authentication policy fed back by the authentication server, forward the service request initiated by the client and the submitted authentication information to the authentication server, and determine whether to allow the service request to continue execution according to an authentication result of the authentication server; The authentication server is configured to generate an authentication policy according to client information and feed back to the server, and perform authentication processing on the authentication information forwarded by the server, and feed back an authentication processing result to the server; The authentication server is internally provided with a multi-factor dynamic authentication module, a behavior pattern analysis module and a risk assessment and decision module; The behavior pattern analysis module comprises a judgment unit, a behavior feature acquisition unit and a behavior pattern model construction unit; The judgment unit performs integrity check on the decrypted data obtained by the server, and determines whether to perform re-authentication on the service request initiated by the client according to the check result, when the integrity of the decrypted data obtained by the server is 1, the service request initiated by the client does not need to be re-authenticated, when the integrity of the decrypted data obtained by the server is not 1, the service request initiated by the client is re-authenticated according to the multi-factor authentication module; The behavior feature acquisition unit acquires the behavior features of the client invoker in each service request process when the judgment result is that the service request initiated by the client does not need to be re-authenticated, and the specific method is as follows: Acquire the key time stamp of the client invoker in the service request process, the key time stamp includes the time T1 when the client initiates the service request, the start time T2 and the end time T3 when the client collects the authentication information; Determine the type of service request initiated by the client at T1, obtain the request frequency f of the client caller to the determined type of service request, construct a linear relationship model R between the request frequency and the collection time of the authentication information with the request frequency as the independent variable and the collection time as the dependent variable, input the request frequency f into the linear relationship model R to obtain the collection time R f The authentication information collection time deviation R of the client caller f -(T3-T2) as the first static behavior feature of the client caller; Determine the target service interface called by the client at the time T1, number the various target service interfaces in descending order of the number of times of calling the various target service interfaces by the client invoker, the numbering result is: i = 1, 2, …, n; n represents the total number of target service interfaces, calculate the difference value s between the number of the historical target service interface called by the client invoker when initiating the service request of a certain type and the number of the determined target service interface, and take the difference value g between the value 1 and 1 / |s| as the second static behavior feature of the client invoker; Acquire the interaction information of the client invoker when the server executes the service request of a certain type, the interaction information includes the interaction object, the interaction level and the interaction type; Determine the interaction level and the interaction type of each interaction object according to the historical interaction information of the client invoker, and assign the same weight value to the same interaction level or the same interaction type, and number each interaction object, the numbering result is: j = 1, 2, …, m; m represents the total number of interaction objects; According to the obtained interaction information of the client invoker, a weight value d1p corresponding to an interaction level of the interaction object p and a weight value d2p corresponding to an interaction type are determined, p=1, 2, …, m; According to the historical interaction information, a mean value d1´p of the weight value corresponding to the interaction level of the interaction object p and a mean value d2´p of the weight value corresponding to the interaction type are obtained; d1p-d1´p is taken as a first dynamic behavior feature of the client invoker, and d2p-d2´p is taken as a second dynamic behavior feature of the client invoker; The behavior pattern model construction unit constructs a behavior pattern model according to the obtained behavior features.

2. The intelligent management system applied to the interactive authentication platform according to claim 1, characterized in that: The multi-factor dynamic authentication module is used for integrating several authentication factors to verify the identity of the client invoker; The behavior pattern analysis module is used for collecting and analyzing historical interaction data of the client invoker to construct a behavior pattern model; The risk assessment and decision module is used for quantitatively evaluating the risk level of each service interaction and feeding back the evaluation result as an authentication result to the server.

3. The intelligent management system applied to the interactive authentication platform according to claim 2, characterized in that: The multi-factor dynamic authentication module includes an authentication strategy generation unit, an authentication information analysis unit and a dynamic authentication unit; The authentication strategy generation unit determines a target service interface of the server according to the application identifier of the client and the initiated service request, and dynamically generates an authentication strategy according to the permission level of the determined target service interface and the service request type initiated by the client; The authentication information analysis unit matches and analyzes the authentication information collected by the client according to the dynamically generated authentication strategy, the reserved information of the client invoker on the server and the historical interaction information of the client invoker on the server, verifies the identity of the client invoker based on the matching analysis result, and if the identity verification is successful, the authentication result is to execute the service request, and if the identity verification is unsuccessful, the authentication result is to reject the service request; The dynamic authentication unit generates a dynamic key by using an asymmetric encryption algorithm in combination with the timestamp corresponding to the completion of the identity verification of the client invoker, the random number and the unique identification code of the device used by the client invoker after the identity verification of the client invoker is successful, and transmits the generated dynamic key to the client and the server. The client encrypts the initiated service request data using the dynamic key, and the server decrypts the service request data using the dynamic key after receiving the service request.

4. The intelligent management system applied to the interactive authentication platform according to claim 2, characterized in that: The specific method for constructing the behavior pattern model by the behavior pattern model construction unit according to the obtained behavior features is: H = a1 x g + a2 x ln[1 + |R f -(T3-T2)|] as the first behavior pattern model of the client invoker, wherein a1 and a2 each represent a proportional coefficient and a1+a2=1, and H represents the first behavior characteristic value of the client invoker. K=a3×(d1p-d1´p)+a4×(d2p-d2´p) is taken as a second behavior pattern model of the client invoker, wherein a3 and a4 both represent proportional coefficients and a3+a4=1, and K represents a second behavior feature value of the client invoker; When K>Y or H>X, it indicates that the interaction information of the client invoker is abnormal behavior information, and when 0≤K≤Y and 0≤H≤X, it indicates that the interaction information of the client invoker is normal behavior information.

5. The intelligent management system applied to the interactive authentication platform according to claim 4, characterized in that: The risk assessment and decision module includes a risk assessment unit and an authentication decision unit; The risk assessment unit performs risk assessment on the interaction behavior of the client invoker according to the first behavior characteristic value and the second behavior characteristic value when the interaction information of the client invoker is determined as abnormal behavior information; The authentication decision unit selects whether to add an authentication factor according to the risk assessment result, and sends an additional authentication requirement to the client through the server when the additional authentication factor is needed, and the client collects additional authentication information according to the additional authentication requirement and forwards the additional authentication information to the authentication server through the server for verification until the risk assessment result is not needed to add the authentication factor, or the server rejects the service request again.

6. The intelligent management system applied to the interactive authentication platform according to claim 5, characterized in that: The specific method of the risk assessment unit for risk assessment on the interaction behavior of the client invoker is: When K>Y and 0≤H≤X or H>X and 0≤K≤Y: According to 1-exp(-K) or 1-exp(-H), the risk assessment value W of the client invoker is quantitatively processed; When K>Y and H>X: According to 1-exp(-K×H), the risk assessment value W of the client invoker is quantitatively processed; If 0≤W≤0.3, it indicates that the risk assessment level of the client invoker is level one; If 0.3 If 0.6 Wherein, exp() represents the exponential function with e as the base and e=2.

73.

7. The intelligent management system applied to the interactive authentication platform according to claim 6, characterized in that: The additional authentication factor includes a static authentication factor and a dynamic authentication factor, the static authentication factor includes face recognition verification and target service interface re-verification, and the dynamic authentication factor is interaction information re-verification.

8. The intelligent management method applied to the interactive authentication platform of any one of claims 1-7, characterized in that: The method comprises: S10: integrating several authentication factors to verify the identity of the client invoker; S20: collecting and analyzing historical interaction data of the client invoker to build a behavior pattern model; S30: quantitatively evaluating the risk level of each service interaction, and feeding back the evaluation result as an authentication result to the server; S40: the server selects whether to execute the service request initiated by the client according to the feedback result.

Images