Cloud identity authentication service method and system

Abstract

The invention discloses a cloud identity authentication service method and system, and relates to the technical field of computer information security. The method comprises the following steps: when a user accesses a cloud service system for the first time, verifying the identity through a strong identity authentication mechanism (including password, multi-factor or digital certificate authentication); after the authentication is passed, the system collects user operation behavior data during the session, and performs preprocessing and feature extraction to generate a behavior feature vector; constructing a reference behavior fingerprint model according to the plurality of feature vectors in a preset period; when the user accesses again, the system obtains a behavior feature vector of the user, compares the behavior feature vector with the reference model, calculates an authentication matching degree score, and judges identity legality according to a comparison result of the score and a preset threshold value; and dynamically updating the reference model according to the authentication result and the behavior change. The whole authentication process is silently carried out in the background, the user operation experience is consistent with that of a non-authentication system, non-perceptual authentication is realized, and the safety and the use experience are remarkably improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer information security, in particular to a cloud identity authentication service method and system. BACKGROUND

[0002] With the wide application of cloud computing and mobile Internet, the access frequency and business types of users on the cloud platform have significantly increased, and the security of identity authentication has become a basic guarantee for cloud services. Traditional identity authentication methods mainly rely on static passwords, dynamic passwords or hardware tokens. In actual application, static passwords are easy to be stolen or brute-forced, dynamic passwords improve security but can still fail due to phishing attacks or man-in-the-middle attacks. Hardware tokens are highly dependent and require additional equipment support, increasing user use cost and management complexity. A unified authentication center is prone to single point of failure, and once the center server is abnormal, a large number of users will be unable to complete authentication. Based on the above deficiencies, multi-factor authentication strategies are gradually introduced in the prior art.

[0003] However, multi-factor authentication relies on additional physical devices or sensitive information (such as SMS verification codes, biometrics), which to some extent increases the user experience burden. Especially in the cloud high-frequency access scenario, how to balance security and convenience has become a common concern in the industry. SUMMARY

[0004] The purpose of the present application is to provide a cloud identity authentication service method and system to solve the problems raised in the background art.

[0005] In a first aspect, an embodiment of the present application provides a cloud identity authentication service method, which comprises: when a current user first requests to access a cloud service system, verifying the user identity through a strong identity authentication mechanism, the strong identity authentication mechanism including at least one of password-based authentication, multi-factor authentication or authentication based on digital certificates; after authentication, the cloud service system collects operation behavior data of the current user during the user session; pre-processing and feature extraction are performed on the collected operation behavior data to generate a behavior feature vector; the cloud service system collects multiple behavior feature vectors of the current user within a preset period as a training sample set to construct a baseline behavior fingerprint model of the current user; when the current user accesses the cloud service system again, the behavior feature vector of the current user is obtained and uploaded to the cloud service system, and the cloud service system calls the baseline behavior fingerprint model of the current user; the behavior feature vector of the current user is compared with the baseline behavior fingerprint model, an authentication matching score is calculated, and the legality of the user identity is determined according to the comparison result of the authentication matching score and a preset threshold; and the baseline behavior fingerprint model is dynamically updated according to the authentication result and behavior change of the user.

[0006] In conjunction with the first aspect, in some implementations of the first aspect, after preprocessing and extracting features from the collected operational behavior data to generate a behavior feature vector, the method further includes: generating a random symmetric key; using the symmetric key to perform symmetric encryption on the current user's behavior feature vector to generate an encrypted data packet; and uploading the encrypted data packet to the cloud service system through an encrypted channel established by a transport layer security protocol.

[0007] In conjunction with the first aspect, in some implementations of the first aspect, when the current user accesses the cloud service system again, the current user's behavioral feature vector is obtained and uploaded to the cloud service system. The cloud service system retrieves the current user's baseline behavioral fingerprint model, including: when the current user accesses the cloud service system again, obtaining the behavioral feature vector of the current session; the cloud service system receives and decrypts the encrypted data packet of the current session to recover the current user's behavioral feature vector; and retrieves the baseline behavioral fingerprint model established by the current user from the cloud database and decrypts it to obtain the model parameters.

[0008] In conjunction with the first aspect, in some implementations of the first aspect, multiple behavioral feature vectors of the current user collected by the cloud service system within a preset period are used as training sample sets to construct a baseline behavioral fingerprint model for the current user. This includes: collecting multiple behavioral feature vectors uploaded by the current user within a preset period as training sample sets; constructing a baseline behavioral fingerprint model based on the training sample set using statistical learning methods, wherein the baseline behavioral fingerprint model includes a feature mean vector, a feature covariance matrix, and feature distribution parameters; and calculating a confidence score for the baseline behavioral fingerprint model based on the number of training sample sets, the dispersion of the sample distribution, and the time span of sample collection.

[0009] In conjunction with the first aspect, in certain implementations of the first aspect, the current user's behavioral feature vector is compared with the baseline behavioral fingerprint model to calculate an authentication matching score. The legitimacy of the user's identity is then determined based on the comparison result of the authentication matching score and a preset threshold. This includes: employing a multi-level comparison strategy to compare the current user's behavioral feature vector with the baseline behavioral fingerprint model and calculate the authentication matching score; comparing the authentication matching score with a preset threshold; if the authentication matching score meets a first preset condition, the user is determined to be legitimate and allowed to access cloud services; if the authentication matching score meets a second preset condition, a secondary verification process is triggered; if the authentication matching score meets a third preset condition, the user is determined to have unauthorized access, the access request is rejected, and a security response is triggered.

[0010] In conjunction with the first aspect, in some implementations of the first aspect, the baseline behavioral fingerprint model is dynamically updated based on the user's authentication results and behavioral changes, including: when a user passes authentication, the behavioral feature vector of this authentication is used as a new sample and integrated into the existing baseline behavioral fingerprint model according to the weight coefficients; and / or, when a change in user behavior pattern is detected, user behavior data is re-collected and the baseline behavioral fingerprint model is reconstructed.

[0011] In conjunction with the first aspect, in certain implementations of the first aspect, the collected operational behavior data is preprocessed and features are extracted to generate a behavioral feature vector. This includes: for keyboard operations in the operational behavior data, extracting statistical features of key press duration, statistical distribution features of consecutive key press intervals, and pattern features of key sequence; for mouse operations in the operational behavior data, extracting curvature distribution features of movement trajectory, frequency domain features of speed changes, time series features of click events, and spatial distribution features of the operation area; for touch operations in the operational behavior data, extracting wavelet transform coefficients of pressure time series curves, shape descriptions of sliding trajectories, and geometric relationship features of multi-touch; for application usage patterns in the operational behavior data, extracting application transformation matrices, time series patterns of usage duration, and Markov chain features of function access; for system interaction behaviors in the operational behavior data, extracting periodic features of login time, fluctuation features of session activity, and entropy features of operation rhythm; generating a high-dimensional behavioral feature vector, and using a dimensionality reduction algorithm to map the high-dimensional behavioral feature vector to a low-dimensional feature space, retaining the maximum feature discriminative information, to obtain the user behavior feature vector.

[0012] In conjunction with the first aspect, in certain implementations of the first aspect, the cloud service system collects the current user's operational behavior data during the user session, including: continuously collecting the current user's operational behavior data during normal use after the current user completes initial authentication, the operational behavior data includes keyboard operation feature data, mouse operation feature data, touch screen operation feature data, application usage pattern data, and system interaction behavior data; keyboard operation feature data includes key press time features, key press sequence features, and key press operation habit features; mouse operation feature data includes mouse movement features, mouse click features, and mouse interaction features; touch screen operation feature data includes touch pressure features, touch motion features, and touch gesture features; application usage pattern data includes application usage timing features and application operation habit features; system interaction behavior data includes user session features and system operation features.

[0013] Secondly, one embodiment of this application provides a cloud-based identity authentication service system, which includes: a client subsystem deployed on a user's cloud service system, comprising: a behavior data collection module configured to continuously collect the user's keyboard operation feature data, mouse operation feature data, touch screen operation feature data, application usage pattern data, and system interaction behavior data during the user's access to the cloud service platform, wherein the collection process adopts a non-intrusive background operation mode; a feature extraction module, communicatively connected to the behavior data collection module, configured to preprocess and extract features from the collected operation behavior data, wherein the preprocessing includes data cleaning, outlier filtering, normalization processing, and time window division to generate a user behavior feature vector; an encryption module, communicatively connected to the feature extraction module, configured to encrypt the user behavior feature vector to generate an encrypted data packet; and a communication module, communicatively connected to the encryption module, configured to upload the encrypted data packet to the cloud service subsystem through an encrypted channel; the cloud service subsystem is deployed on the cloud service platform. The unified identity authentication server includes: a receiving / decryption module, configured to receive and decrypt encrypted data packets to recover user behavior feature vectors; a behavior fingerprint modeling module, communicating with the receiving / decryption module, configured to collect multiple user behavior feature vectors as training samples to construct a baseline behavior fingerprint model for the user, the baseline behavior fingerprint model including feature mean vector, feature covariance matrix, and feature distribution parameters; an authentication comparison module, communicating with the receiving / decryption module and the behavior fingerprint modeling module, configured to retrieve the user's baseline behavior fingerprint model when the user accesses the cloud service system again, compare the current user behavior feature vector with the baseline behavior fingerprint model, and calculate the authentication matching score; an authentication decision module, communicating with the authentication comparison module, configured to determine the legitimacy of the user's identity based on the comparison result of the authentication matching score and a preset threshold; and a model update module, communicating with the behavior fingerprint modeling module and the authentication decision module, configured to dynamically update the baseline behavior fingerprint model based on the user's authentication results and behavior changes.

[0014] In conjunction with the second aspect, in some implementations of the second aspect, the cloud service subsystem further includes: an anomaly detection module, which communicates with the authentication comparison module and the authentication decision module, and is configured to perform single-user anomaly detection and global anomaly detection. Single-user anomaly detection analyzes changes in the authentication matching score of individual users, deviations in access time periods, anomalies in geographical location, and anomalies in access frequency. Global anomaly detection analyzes the authentication failure rate, behavioral feature pattern distribution, and access request distribution of the overall user group, and triggers corresponding security responses based on the detected anomaly type and severity; a communication optimization module, which communicates with the receiving and decryption module and the authentication decision module, and is configured to perform lightweight communication optimization; and a data storage module, which communicates with the behavior fingerprint modeling module, the model update module, and the anomaly detection module respectively, and is configured to store user behavior fingerprint models, historical authentication records, abnormal access logs, and model version information in encrypted form.

[0015] Compared with the prior art, the beneficial effects of this application are: 1. This application uses users' natural behavioral characteristics during daily operations for identity authentication. Users do not need to carry additional hardware devices (such as USB keys or hardware tokens), input additional verification information (such as SMS verification codes or security question answers), or perform any additional steps (such as fingerprint scanning or facial recognition). The entire authentication process is conducted silently in the background, and the user's workflow is completely consistent with a system without authentication, achieving seamless authentication and significantly improving user experience and work efficiency.

[0016] 2. This application constructs a unique user behavioral fingerprint through comprehensive collection and modeling of behavioral characteristics. This behavioral fingerprint possesses high individual variability and is difficult to forge. Even if an attacker steals a user's static password, they cannot imitate the user's natural behavioral characteristics (such as keystroke rhythm, mouse trajectory, and operating habits), thus preventing the system from identifying unauthorized access during the behavioral authentication process. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the structure of a cloud-based identity authentication service system provided in an embodiment of this application; Figure 2 A schematic diagram of the structure of a cloud-based identity authentication service system provided in another embodiment of this application; Figure 3 A flowchart illustrating a cloud-based identity authentication service method provided in an embodiment of this application; Figure 4 A flowchart illustrating a cloud-based identity authentication service method provided in another embodiment of this application; Figure 5This is a flowchart illustrating the process of obtaining the current user's behavioral feature vector and uploading it to the cloud service system when the current user accesses the cloud service system again, and the cloud service system retrieving the current user's baseline behavioral fingerprint model, as provided in one embodiment of this application. Figure 6 This is a flowchart illustrating a process for constructing a baseline behavioral fingerprint model of the current user by using multiple behavioral feature vectors of the current user collected by the cloud service system within a preset period as a training sample set, as an embodiment of this application. Figure 7 This is a flowchart illustrating the process of comparing the current user's behavioral feature vector with a benchmark behavioral fingerprint model, calculating the authentication matching score, and determining the legitimacy of the user's identity based on the comparison result of the authentication matching score and a preset threshold, according to an embodiment of this application. Figure 8 A flowchart illustrating the process of dynamically updating a baseline behavioral fingerprint model based on user authentication results and behavioral changes, provided as an embodiment of this application; Figure 9 This is a flowchart illustrating the process of preprocessing and extracting features from collected operational behavior data to generate behavioral feature vectors, as provided in an embodiment of this application. Detailed Implementation

[0018] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0019] Figure 1 This is a schematic diagram of the structure of a cloud-based identity authentication service system provided in one embodiment of this application. Figure 1 The cloud-based identity authentication service system provided in this application embodiment includes a client subsystem deployed on a cloud service system, comprising a behavior data acquisition module 800, a feature extraction module 801, an encryption module 802, and a communication module 803.

[0020] The behavior data collection module 800 is configured to continuously collect user keyboard operation feature data, mouse operation feature data, touch screen operation feature data, application usage pattern data, and system interaction behavior data during the user's access to the cloud service platform. The collection process adopts a non-intrusive background operation mode, which does not interfere with the user's normal operation process.

[0021] The behavior data acquisition module 800 acquires data by attaching an event listener and stores the acquired raw operation behavior data in the local memory buffer of the client device. When the amount of data in the buffer reaches a preset threshold or the time window ends, the data is transmitted to the feature extraction module 801.

[0022] The feature extraction module 801 is communicatively connected to the behavior data acquisition module 800 and is configured to preprocess and extract features from the acquired operation behavior data.

[0023] The feature extraction module 801 reads raw operation behavior data from the memory buffer of the behavior data acquisition module 800. Preprocessing includes data cleaning, outlier filtering, normalization, and time window segmentation. Based on multi-dimensional feature engineering methods, the feature extraction module 801 extracts distinctive behavioral features from keyboard operations, mouse operations, touch operations, application usage patterns, and system interaction behaviors, generating high-dimensional behavioral feature vectors. A dimensionality reduction algorithm is then used to map these high-dimensional behavioral feature vectors to a low-dimensional feature space, generating user behavior feature vectors. The feature extraction module 801 transmits the generated user behavior feature vectors to the encryption module 802 via inter-process communication.

[0024] Encryption module 802, communicatively connected to feature extraction module 801, is configured to encrypt user behavior feature vectors and generate encrypted data packets. After receiving user behavior feature vectors from feature extraction module 801, encryption module 802 generates a random symmetric key, uses the symmetric key to symmetrically encrypt the user behavior feature vectors, and uses a public key pre-distributed by the cloud service system to asymmetricly encrypt the symmetric key. The encrypted symmetric key and the ciphertext of the feature vectors are then encapsulated into an encrypted data packet. The encrypted data packet also includes a timestamp, client device identifier, user identifier, and data integrity checksum. Encryption module 802 transmits the encrypted data packet to communication module 803 for secure transmission.

[0025] The communication module 803, connected to the encryption module 802, is configured to upload encrypted data packets to the cloud service subsystem via an encrypted channel. The communication module 803 establishes an encrypted channel with the cloud service subsystem based on a transport layer security protocol, transmits encrypted data packets to the receiving / decryption module 804 of the cloud service subsystem via a hypertext transfer security protocol, and receives the authentication result response returned by the cloud service subsystem. After sending the data packet, the communication module 803 waits for an acknowledgment response; if no acknowledgment is received within the timeout period, a retransmission operation is performed.

[0026] The cloud service subsystem, deployed on the identity authentication server of the cloud service system, includes: a receiving and decryption module 804, a behavior fingerprint modeling module 805, an authentication comparison module 806, an authentication decision module 807, and a model update module 808.

[0027] The receive / decryption module 804 is configured to receive and decrypt encrypted data packets to recover the user behavior feature vector. The receive / decryption module 804 receives encrypted data packets from the client subsystem via a network interface, performs integrity verification and timestamp verification on the encrypted data packets, decrypts the symmetric key using the private key held by the cloud server, and uses the decrypted symmetric key to decrypt the ciphertext of the feature vector, recovering the user behavior feature vector. The receive / decryption module 804 then transmits the recovered user behavior feature vector to the behavior fingerprint modeling module 805 and the authentication comparison module 806 for further processing.

[0028] The behavioral fingerprint modeling module 805, communicatively connected to the receiving / decryption module 804, is configured to collect multiple user behavior feature vectors as training samples to construct a baseline behavioral fingerprint model for the user. The baseline behavioral fingerprint model includes a feature mean vector, a feature covariance matrix, and feature distribution parameters. The behavioral fingerprint modeling module 805 receives user behavior feature vectors from the receiving / decryption module 804, collects multiple behavioral feature vectors within a preset period as a training sample set during the user initialization phase, constructs the baseline behavioral fingerprint model using statistical learning methods, calculates a confidence score, and stores the baseline behavioral fingerprint model in encrypted form in a cloud database.

[0029] The behavioral fingerprint modeling module 805 provides a query interface for the baseline behavioral fingerprint model to the authentication comparison module 806, responds to the retrieval request of the authentication comparison module, reads and decrypts the baseline behavioral fingerprint model of the corresponding user from the cloud database, and transmits the model parameters to the authentication comparison module 806.

[0030] The authentication comparison module 806, communicatively connected to the receiving / decryption module 804 and the behavior fingerprint modeling module 805, is configured to retrieve the user's baseline behavior fingerprint model when the user revisits the cloud service system. It then compares the current user's behavior feature vector with the baseline behavior fingerprint model to calculate the authentication matching score. The authentication comparison module 806 receives the current user's behavior feature vector from the receiving / decryption module 804, retrieves the user's baseline behavior fingerprint model through the communication interface with the behavior fingerprint modeling module, and performs feature comparison using a multi-level comparison strategy. This multi-level comparison strategy includes coarse-grained rapid screening, fine-grained statistical testing, and dynamic pattern matching, comprehensively calculating the authentication matching score. The authentication comparison module 806 then transmits the authentication matching score and related comparison results to the authentication decision module 807 for identity verification.

[0031] The authentication decision module 807, communicatively connected to the authentication comparison module 806, is configured to determine the legitimacy of a user's identity based on a comparison of the authentication matching score with a preset threshold. The authentication decision module 807 receives the authentication matching score from the authentication comparison module 806, compares the score with the authentication threshold and a warning threshold, and generates an authentication decision based on the comparison result. The authentication decision includes passing authentication, triggering secondary verification, or denying access. The authentication decision module 807 returns the authentication decision result to the client subsystem via a network interface, and simultaneously transmits the authentication result information to the model update module 808 to support dynamic model updates, and records authentication logs for subsequent auditing and anomaly detection.

[0032] The model update module 808, communicatively connected to the behavior fingerprint modeling module 805 and the authentication decision module 807, is configured to dynamically update the baseline behavior fingerprint model based on the user's authentication results and behavioral changes. The model update module 808 receives authentication result information from the authentication decision module 807. When user authentication is successful, it executes a progressive update process, integrating the behavioral feature vector of this authentication into the existing baseline behavior fingerprint model according to weighted coefficients. When a significant change in user behavior pattern is detected, a triggered update process is executed, re-collecting user behavior data and reconstructing the baseline behavior fingerprint model. The model update module 808 transmits the updated model parameters to the behavior fingerprint modeling module 805 through a communication interface. The behavior fingerprint modeling module 805 then writes the updated model in encrypted form to a cloud database and maintains historical model version records.

[0033] The client subsystem and the cloud service subsystem communicate via an interconnected network. All communication processes are encrypted using transport layer security protocols to ensure the confidentiality and integrity of data transmission. Modules within the client subsystem exchange data through local inter-process communication, while modules within the cloud service subsystem exchange data through the server's internal communication bus or application programming interfaces (APIs).

[0034] The beneficial effects of this embodiment are as follows: through the collaboration of non-intrusive behavioral data collection, end-to-end encrypted transmission, and cloud-based behavioral fingerprint modeling, continuous monitoring of identity legitimacy is achieved without increasing the user's operational burden, effectively preventing account theft while significantly improving user experience and system security.

[0035] Figure 2 This is a schematic diagram of the structure of a cloud-based identity authentication service system provided in another embodiment of this application. (See diagram below.) Figure 2The cloud-based identity authentication service system provided in this embodiment of the application includes a cloud service subsystem: an anomaly detection module 900, which is communicatively connected to the authentication comparison module 806 and the authentication decision module 807. This module is configured to perform single-user anomaly detection and global anomaly detection. Single-user anomaly detection analyzes changes in an individual user's authentication matching score, access time deviation, geographic location anomalies, and access frequency anomalies. Global anomaly detection analyzes the authentication failure rate, behavioral characteristic pattern distribution, and access request distribution of the overall user group. Based on the detected anomaly type and severity, it triggers corresponding security responses. The anomaly detection module 900 receives authentication matching scores and behavioral feature vector information from the authentication comparison module 806, analyzes the score change trend of individual users, calculates the moving average and moving standard deviation of the score sequence, and identifies score anomaly patterns. The anomaly detection module 900 receives authentication decision results, access timestamps, the Internet Protocol address of the access source, and authentication failure information from the authentication decision module 807. By performing geographic location positioning on the Internet Protocol address, it detects abnormal access geographic locations and impossible geographic displacements, statistically analyzes access frequencies and identifies frequency anomalies, and analyzes the access time distribution and detects time deviations. The anomaly detection module 900 performs macro-analysis of the authentication data of the entire user group, calculates the hourly and daily authentication failure rates, performs cluster analysis on the behavioral feature vectors of all users to identify concentrated behavioral patterns, and counts the number of access requests from various Internet Protocol address ranges to identify abnormal access distribution. When the anomaly detection module 900 detects an anomaly, it generates a security response command based on the severity of the anomaly and sends the security response command to the authentication decision module 807 to adjust the authentication policy or block access. At the same time, the anomaly event information is transmitted to the data storage module 902 for logging and an alarm notification is sent to the security administrator through the alarm interface.

[0036] The communication optimization module 901, communicatively connected to the receiving / decryption module 804 and the authentication decision module 807, is configured to perform lightweight communication optimization, including compressing and encoding feature vectors, implementing incremental uploads, dynamically adjusting the sampling frequency based on user risk levels, and performing batch processing and asynchronous communication. The communication optimization module 901 communicates bidirectionally with the receiving / decryption module 804. After receiving user behavior feature vectors from the receiving / decryption module 804, it compresses the feature vectors to reduce data transmission volume, employing quantization encoding, differential encoding, or wavelet compression algorithms to achieve data compression, and maintains a copy of the baseline feature vector for each user to support incremental uploads. When incremental data is received, the communication optimization module 901 reconstructs the complete current feature vector based on the stored baseline feature vector and transmits the reconstructed feature vector to the receiving / decryption module 804 for further processing. The communication optimization module 901 receives user risk level assessment information from the authentication decision module 807, dynamically calculates sampling frequency parameters based on the risk level, and transmits the sampling frequency parameters to the client subsystem through an authentication response message, guiding the client to adjust the frequency of behavior data collection and upload. The communication optimization module 901 implements batch processing, caching multiple feature vectors from the same user before batch decryption and transmission, and accelerating processing using single-instruction multiple-data parallel computing technology. The communication optimization module 901 configures an asynchronous communication queue to place non-real-time data processing tasks into a background queue for execution, avoiding blocking the real-time authentication process. It processes backlogged tasks in batches during periods of system resource idleness, achieving time reuse and load balancing of computing resources.

[0037] The data storage module 902 is communicatively connected to the behavior fingerprint modeling module 805, the model update module 808, and the anomaly detection module 900. It is configured to store user behavior fingerprint models, historical authentication records, abnormal access logs, and model version information in encrypted form. The data storage module 902 provides data persistence services for the behavior fingerprint modeling module 805. After the behavior fingerprint modeling module 805 completes the construction of the baseline behavior fingerprint model, the data storage module receives the model parameter data, encrypts the model parameters using the data encryption key provided by the key management system, and employs dual protection of database-level encryption and field-level encryption before writing the encrypted model data to the cloud database. When the behavior fingerprint modeling module 805 needs to query the user's baseline behavior fingerprint model, the data storage module 902 retrieves the encrypted model data from the cloud database based on the user identifier, decrypts it, and returns the model parameters to the behavior fingerprint modeling module 805. The data storage module 902 communicates with the model update module 808, receiving model update requests. When the model update module 808 performs a gradual or triggered update, the data storage module writes the updated model parameters to the database, overwriting the original data. Simultaneously, it archives the old model version in the historical version table, maintaining a record of model version information including model parameters, creation time, sample size, and confidence score, supporting version backtracking and comparative analysis. The data storage module 902 also communicates with the anomaly detection module 900, receiving and storing anomaly access logs. These logs include the anomaly detection time, anomaly type, severity, user identifier, Internet Protocol address, geographic location, authentication match score, and complete behavioral feature vector. The data storage module 902 also stores historical authentication records, recording the timestamp, authentication result, authentication match score, and client device identifier for each authentication, providing data support for subsequent behavioral analysis, audit tracing, and statistical report generation. The data storage module 902 implements access control policies, allowing only authorized modules and processes to access stored sensitive data. It prevents unauthorized access through authentication and permission checks, and is configured for data backup and disaster recovery, regularly backing up critical data to ensure data reliability and recoverability.

[0038] The beneficial effects of this embodiment are as follows: by introducing an anomaly detection module, a communication optimization module, and a data storage module, multi-level anomaly warning and security response are achieved, while lightweight communication and data compression technologies reduce system resource overhead, and encrypted storage and version management ensure data security and system traceability.

[0039] Figure 3 This is a flowchart illustrating a cloud-based identity authentication service method provided in one embodiment of this application. Figure 3 As shown in the embodiments of this application, the cloud-based identity authentication service method includes the following steps: Step 100: When a user requests access to the cloud service system for the first time, the user's identity is verified through a strong authentication mechanism. The strong authentication mechanism includes at least one of password-based, multi-factor authentication, or digital certificate-based authentication.

[0040] It should be understood that a cloud service system refers to a backend server system deployed on a cloud computing platform to provide users with various online service functions. A strong authentication mechanism refers to an authentication system that uses highly secure verification methods to confirm the authenticity of a user's identity, requiring users to provide multiple credentials such as passwords, biometrics, or hardware tokens.

[0041] Step 101: After successful authentication, the cloud service system collects the current user's operational behavior data during the user session.

[0042] It should be understood that operational behavior data refers to the records of various operational activities generated by users during the use of computer systems, including time-series data of behaviors such as keyboard input, mouse movement, touch interaction, application usage, and system interaction.

[0043] Step 102: Preprocess and extract features from the collected operational behavior data to generate behavioral feature vectors.

[0044] It should be understood that a behavioral feature vector is a numerical vector composed of multi-dimensional features of user operation behavior, and each element in the vector corresponds to a specific behavioral feature index.

[0045] Step 103: Use the multiple behavioral feature vectors of the current user collected by the cloud service system within a preset period as a training sample set to construct the current user's baseline behavioral fingerprint model.

[0046] It should be understood that a benchmark behavioral fingerprint model refers to a statistical learning model based on a user's historical behavioral data that can characterize the user's unique operating habits and behavioral patterns, and is used as a reference benchmark for identity authentication.

[0047] Step 104: When the current user accesses the cloud service system again, the current user's behavior feature vector is obtained and uploaded to the cloud service system. The cloud service system then retrieves the current user's baseline behavior fingerprint model.

[0048] Step 105: Compare the current user's behavioral feature vector with the baseline behavioral fingerprint model, calculate the authentication matching score, and determine the legitimacy of the user's identity based on the comparison result of the authentication matching score and the preset threshold.

[0049] Step 106: Dynamically update the baseline behavioral fingerprint model based on the user's authentication results and behavioral changes.

[0050] It should be understood that the authentication result refers to the identity verification decision made by the cloud service system based on behavioral feature comparison and matching score. The result types include authentication passed, triggering secondary verification, or authentication failed.

[0051] The beneficial effects of this embodiment are as follows: By using strong identity authentication, behavioral fingerprint modeling, and continuous comparison authentication methods, a personalized behavioral model is automatically built after the user logs in for the first time and identity verification is silently completed in subsequent visits. This achieves high-security identity protection with zero user awareness, which not only prevents account theft but also avoids the impact of repeated authentication on user experience.

[0052] Figure 4 This is a flowchart illustrating a cloud-based identity authentication service method provided in another embodiment of this application. Figure 4 As shown in the embodiment of this application, after preprocessing and extracting features from the collected operational behavior data to generate a behavior feature vector, the following steps are also included: Step 200: Generate a random symmetric key.

[0053] Specifically, in the encryption module of the client subsystem, a cryptographically secure pseudo-random number generator is invoked to generate a random symmetric key. The symmetric key uses the 256-bit key length required by the encryption standard. In one embodiment, the generation of the random symmetric key is based on a system entropy source, including a combination of the current timestamp, hardware device identifier, and the system random number generator, to ensure the unpredictability and uniqueness of the key. The generated symmetric key is stored only in the memory space of the current session and is used to encrypt the behavioral feature vector of a single upload. It is automatically destroyed after the session ends and is not persistently stored, thereby ensuring that a different encryption key is used for each data transmission, improving the security of data transmission.

[0054] Step 201: Use a symmetric key to perform symmetric encryption on the current user's behavior feature vector to generate an encrypted data packet.

[0055] Specifically, the encryption module employs a symmetric key and uses either the cipher block chaining mode or the Galois / counter mode of the encryption algorithm to perform symmetric encryption on the current user's behavioral feature vector. Before encryption, a random initialization vector is generated to ensure that the same plaintext produces different ciphertexts in different encryption operations. The encryption module serializes the behavioral feature vector into a byte stream, pads it according to the selected encryption mode, and then performs encryption operations to generate ciphertext data. The encrypted data packet includes ciphertext data, the initialization vector, and a message authentication code, which is used to verify the integrity of the data during transmission. The encryption module encapsulates these components into an encrypted data packet according to a predetermined format, preparing for subsequent secure transmission.

[0056] Step 202: Upload the encrypted data packet to the cloud service system through the encrypted channel established by the transport layer security protocol.

[0057] Specifically, the communication module first establishes an encrypted channel with the cloud service system based on a transport layer security protocol version. It verifies the identity of the cloud service system using a digital certificate, completes the secure handshake process, and negotiates the encryption algorithm and session key. After the encrypted channel is established, the communication module transmits encrypted data packets to the designated interface of the cloud service system via the protocol. During data transmission, the encrypted data packets are encrypted at the application layer and then again at the transport layer, forming double encryption. This ensures that even if the transport layer is compromised, attackers cannot directly obtain the plaintext information of the behavioral feature vector. After transmission is complete, the communication module receives an acknowledgment response from the cloud service system to verify that the data packet has been successfully received. If transmission fails, it performs a retransmission until successful upload is confirmed or the maximum number of retries is reached.

[0058] The beneficial effects of this embodiment are as follows: By generating a session-level random symmetric key to encrypt the behavior feature vector and combining it with an encrypted channel established by the transport layer security protocol for data transmission, dual encryption protection of the application layer and the transport layer is achieved. This ensures that even if the transport layer is compromised, attackers cannot obtain the plaintext information of user behavior features. At the same time, by automatically destroying the key after the session ends, different encryption keys are used for each data transmission, which significantly improves the security and anti-attack capability of user behavior data transmission during cloud identity authentication.

[0059] Figure 5 This is a flowchart illustrating the process of obtaining the current user's behavioral feature vector and uploading it to the cloud service system when the current user accesses the cloud service system again, and the cloud service system retrieving the current user's baseline behavioral fingerprint model, as provided in one embodiment of this application. Figure 5 As shown in the embodiment of this application, when the current user accesses the cloud service system again, the system obtains the current user's behavioral feature vector and uploads it to the cloud service system. The cloud service system then retrieves the current user's baseline behavioral fingerprint model, including the following steps: Step 300: When the current user accesses the cloud service system again, obtain the behavioral feature vector of the current session.

[0060] Specifically, when the current user accesses the cloud service system again, the behavior data acquisition module of the client subsystem continuously collects the user's operational behavior data during the current session. This data includes keyboard operation feature data, mouse operation feature data, touchscreen operation feature data, application usage pattern data, and system interaction behavior data. The feature extraction module preprocesses and extracts features from the collected operational behavior data. Preprocessing includes data cleaning, outlier filtering, normalization, and time window segmentation to generate a behavior feature vector for the current session. The encryption module encrypts the behavior feature vector using a randomly generated symmetric key and then uses the cloud service system's public key for asymmetric encryption, generating an encrypted data packet containing the encrypted symmetric key and the ciphertext of the feature vector. The encrypted data packet also includes a timestamp, client device identifier, user identifier, and data integrity checksum. The communication module uploads the encrypted data packet to the cloud service system through an encrypted channel established by a transport layer security protocol.

[0061] Step 301: The cloud service system receives and decrypts the encrypted data packet of the current session and recovers the behavioral feature vector of the current user.

[0062] Specifically, after receiving the encrypted data packet uploaded by the client, the cloud service system's receiving and decrypting module first performs data integrity verification and timestamp verification. It calculates the hash message authentication code of the encrypted data packet using a pre-negotiated shared key and compares it with the data integrity verification code carried in the data packet to confirm that the data has not been tampered with. It also verifies whether the timestamp is within a preset time window to prevent replay attacks. After verification, the receiving and decrypting module uses the private key held by the cloud server to perform asymmetric decryption of the encrypted symmetric key in the encrypted data packet to recover the symmetric key. Then, it uses the decrypted symmetric key to perform symmetric decryption of the feature vector ciphertext to recover the current user's behavior feature vector.

[0063] Step 302: Retrieve the baseline behavioral fingerprint model established by the current user from the cloud database and decrypt it to obtain the model parameters.

[0064] Specifically, the cloud service system retrieves the user's established baseline behavioral fingerprint model from the cloud database based on the user identifier in the encrypted data packet. The baseline behavioral fingerprint model is stored in encrypted form in the cloud database, employing dual protection of database-level encryption and field-level encryption. The cloud service system obtains the data encryption key through the key management system, uses this key to decrypt the stored encrypted model, and recovers the model parameters of the baseline behavioral fingerprint model. These parameters include the feature mean vector, feature covariance matrix, and feature distribution parameters. The decrypted model parameters are loaded into the memory space of the authentication comparison module for feature comparison with the current behavioral feature vector.

[0065] The beneficial effects of this embodiment are as follows: By continuously collecting and encrypting the behavioral feature vector of the current session when the user visits again, and combining cloud-based security decryption verification and database dual encryption protection, continuous identity authentication capability based on behavioral biometrics is realized. At the same time, through data integrity verification, timestamp verification and multi-layer encryption system, security threats such as data tampering, replay attacks and man-in-the-middle attacks are effectively defended. By comparing the current behavioral features with the established benchmark behavioral fingerprint model, reliable continuous user identity verification is provided for the cloud service system, significantly improving the security of identity authentication and user experience.

[0066] Figure 6 This is a flowchart illustrating an embodiment of the present application, illustrating the process of constructing a baseline behavioral fingerprint model of the current user by using multiple behavioral feature vectors collected by a cloud service system within a preset period as a training sample set. Figure 6 As shown in the embodiment of this application, the method of constructing a baseline behavioral fingerprint model for the current user by using multiple behavioral feature vectors of the current user collected by the cloud service system within a preset period as a training sample set includes the following steps: Step 400: Collect multiple behavioral feature vectors uploaded by the current user within a preset period as a training sample set.

[0067] Specifically, the behavioral fingerprinting module of the cloud service system enters the model initialization phase after the current user successfully passes strong authentication for the first time. During this phase, it collects multiple behavioral feature vectors uploaded by the current user within a preset period as a training sample set. The preset period is adaptively determined based on the user's access activity level: seven consecutive days for high-frequency users, fourteen consecutive days for medium-frequency users, and thirty consecutive days for low-frequency users. The minimum number of samples in the training sample set is set to a preset threshold of twenty valid samples to ensure the reliability of subsequent statistical learning. The behavioral fingerprinting module validates the validity of each received behavioral feature vector, discarding invalid samples that fail data integrity verification, have abnormal timestamps, or incomplete feature dimensions, and only including valid samples that pass the validation into the training sample set.

[0068] Step 401: Based on the training sample set, a baseline behavioral fingerprint model is constructed using statistical learning methods. The baseline behavioral fingerprint model includes the feature mean vector, the feature covariance matrix, and the feature distribution parameters.

[0069] Specifically, the behavioral fingerprint modeling module constructs a baseline behavioral fingerprint model for the current user based on a training sample set using statistical learning methods. These statistical learning methods include multivariate Gaussian distribution modeling or Gaussian mixture modeling. When using multivariate Gaussian distribution modeling, it is assumed that the current user's behavioral feature vector follows a multivariate normal distribution. The feature mean vector is obtained by calculating the arithmetic mean of all samples in the training sample set, and the feature covariance matrix is ​​obtained by calculating the sample covariance of the training sample set. A regularization term is added when calculating the feature covariance matrix to prevent matrix singularity. When using Gaussian mixture modeling, it is assumed that the current user's behavioral features are generated by a weighted combination of multiple Gaussian components. The weight coefficients, mean vectors, and covariance matrices of each Gaussian component are obtained through iterative optimization using an expectation-maximization algorithm. Feature distribution parameters include skewness, kurtosis, peak position of the probability density function, and peak width, which are extracted from the training sample set using kernel density estimation or parameter fitting methods. After the baseline behavioral fingerprint model is constructed, it is stored in encrypted form in a cloud database.

[0070] Step 402: Calculate the confidence score for the baseline behavioral fingerprint model based on the number of training samples, the dispersion of the sample distribution, and the time span of sample collection.

[0071] Specifically, the behavioral fingerprint modeling module calculates a confidence score for the behavioral fingerprint model based on the quality metrics of the training sample set. These quality metrics include the number of samples in the training sample set, the dispersion of the sample distribution, and the time span of sample collection. (Confidence score) The calculation formula is as follows: (Calculated using a weighted summation method) ; in, This is the normalized value for the sample size. This is the evaluation value for the degree of dispersion. Normalized values ​​for the time span The first weighting coefficient, For the second weighting coefficient, This is the third weighting coefficient. The normalized sample size value is obtained by truncating the ratio of the actual sample size to the preset reference size; a value of 1 is taken when the ratio is greater than 1. The dispersion evaluation value is obtained by calculating the trace or determinant of the feature covariance matrix, comparing it with the preset reference dispersion, and then normalizing it. The smaller the dispersion, the more concentrated the sample distribution, and the higher the dispersion evaluation value. The normalized time span value is obtained by truncating the ratio of the actual collection time span to the preset reference time span; a value of 1 is taken when the ratio is greater than 1. The confidence score ranges from 0 to 1. A high confidence score indicates that the baseline behavioral fingerprint model is built based on sufficient, stable, and long-term training data, and a stricter authentication threshold can be set in subsequent authentication decisions. A low confidence score indicates that the baseline behavioral fingerprint model is still in the learning and improvement stage, and a more lenient authentication threshold and additional auxiliary verification measures should be set in subsequent authentication decisions.

[0072] The beneficial effects of this embodiment are as follows: By adaptively determining the training period based on user access activity and collecting valid behavioral feature vector samples, a benchmark behavioral fingerprint model containing feature mean vectors, covariance matrices, and distribution parameters is constructed using statistical learning methods. Confidence scores are calculated based on quality indicators such as sample size, distribution dispersion, and time span. This achieves dynamic adaptive authentication that can set strict authentication thresholds for high-quality training data to enhance security, while also setting lenient thresholds for the model during the learning phase to assist in verification and ensure user experience. Thus, while ensuring the accuracy and security of identity authentication, system availability and user experience are effectively balanced.

[0073] Figure 7 This is a schematic diagram illustrating a process in one embodiment of the present application for comparing the current user's behavioral feature vector with a baseline behavioral fingerprint model, calculating an authentication matching score, and determining the legitimacy of the user's identity based on the comparison result of the authentication matching score and a preset threshold. Figure 7 As shown in the embodiments of this application, the method of comparing the current user's behavioral feature vector with a benchmark behavioral fingerprint model, calculating an authentication matching score, and determining the legitimacy of the user's identity based on the comparison result of the authentication matching score and a preset threshold includes the following steps: Step 500: A multi-level comparison strategy is used to compare the current user's behavioral feature vector with the baseline behavioral fingerprint model and calculate the authentication matching score.

[0074] Specifically, after receiving the current user's behavioral feature vector, the authentication and comparison module of the cloud service system retrieves the current user's baseline behavioral fingerprint model and performs feature comparison using a multi-level comparison strategy. This multi-level comparison strategy includes a first-level coarse-grained rapid screening, a second-level fine-grained statistical test, and a third-level dynamic pattern matching. In the first-level coarse-grained rapid screening, the Euclidean distance or Manhattan distance between the current user's behavioral feature vector and the mean feature vector of the baseline behavioral fingerprint model is calculated. The calculated distance is compared with a coarse screening threshold, and the comparison result determines whether to proceed to the next level of comparison. In the second-level fine-grained statistical test, the Mahalanobis distance between the current user's behavioral feature vector and the baseline behavioral fingerprint model is calculated, along with the likelihood probability of the current user's behavioral feature vector under the probability distribution of the baseline behavioral fingerprint model. The Mahalanobis distance considers the correlation between features and the variance differences of each feature, while the likelihood probability reflects the statistical consistency between the current behavioral pattern and historical behavioral patterns. In the third-level dynamic pattern matching, for temporally sequential behavioral features, a dynamic time warping algorithm is used to calculate the similarity between the current behavioral sequence and historical reference sequences. The authentication comparison module integrates the comparison results from the three levels and calculates the authentication matching score using a weighted summation method. The authentication matching score ranges from 0 to 1, with a higher score indicating a higher degree of similarity between the current behavioral characteristics and historical behavioral patterns.

[0075] Step 501: Compare the authentication matching score with a preset threshold.

[0076] Specifically, after receiving the authentication matching score, the authentication decision module of the cloud service system compares the score with preset thresholds. These preset thresholds include an authentication threshold and a warning threshold. The warning threshold is lower than the authentication threshold. For high-security scenarios (high-confidence model and low-risk user), the authentication threshold is set between 0.85 and 0.95, and the warning threshold is set between 0.70 and 0.80. For standard-security scenarios (medium-confidence model and medium-risk user), the authentication threshold is set between 0.75 and 0.85, and the warning threshold is set between 0.60 and 0.70. For lenient-security scenarios (low-confidence model or high-risk user), the authentication threshold is set between 0.65 and 0.75, and the warning threshold is set between 0.50 and 0.60. The authentication and warning thresholds are dynamically set based on the confidence score of the baseline behavioral fingerprint model, the current user's risk level, and the business security requirements of the cloud service. For high-confidence models and low-risk users, higher authentication and alert thresholds are set to improve security; for low-confidence models or high-risk users, lower authentication and alert thresholds are set to reduce the false rejection rate, while increasing the probability of triggering secondary verification to ensure security. The authentication decision module determines the current user's authentication decision type based on the comparison between the authentication matching score and the authentication and alert thresholds.

[0077] Step 502: If the authentication matching score meets the first preset condition, the user is determined to be a legitimate user and is allowed to access the cloud service.

[0078] Specifically, the first preset condition is that the authentication matching score is greater than or equal to the authentication threshold. When the authentication matching score meets the first preset condition, the authentication decision module determines that the current user is a legitimate user, indicating that the current user's behavioral characteristics highly match the baseline behavioral fingerprint model and conform to historical behavioral patterns. The authentication decision module generates an authentication pass decision, allowing the current user to continue accessing the cloud service system, and returns an authentication success response and access token to the client. At the same time, the model update module of the cloud service system incorporates the behavioral feature vector of this authentication as a new sample into the dynamic model update process, integrating it into the baseline behavioral fingerprint model according to preset weight coefficients to achieve progressive model updates. The cloud service system records a success log for this authentication, including authentication time, authentication matching score, client device identifier, and access source information, for subsequent behavioral analysis and audit traceability.

[0079] Step 503: If the authentication matching score meets the second preset condition, the secondary verification process is triggered.

[0080] Specifically, the second preset condition is that the authentication matching score is less than the authentication threshold but greater than or equal to the warning threshold. When the authentication matching score meets the second preset condition, the authentication decision module determines that the current user's behavioral characteristics have a suspicious deviation and further verification of the user's identity is required. The authentication decision module triggers a secondary verification process, sending an identity verification request to the current user. The identity verification request includes at least one of SMS verification code verification, email verification code verification, or security question verification. The cloud service system sends a verification message containing a randomly generated verification code to the current user through a reserved communication channel, or pushes security questions to the client for the user to answer. After the current user completes the secondary verification within a preset time window, the authentication decision module verifies the correctness of the verification information submitted by the user. If the verification passes, the current user is allowed to access the cloud service system, and the system decides whether to include the current behavioral feature vector in the model update based on the verification result. If the verification fails, the access request is rejected, and the account is temporarily locked for a preset time to prevent brute-force attacks. The cloud service system records an event log of the secondary verification, including the authentication matching score, the triggering reason, the secondary verification method, and the verification result, for abnormal behavior analysis.

[0081] Step 504: If the authentication matching score meets the third preset condition, it is determined to be an illegal access, the access request is rejected and a security response is triggered.

[0082] Specifically, the third preset condition is that the authentication matching score is less than the warning threshold. When the authentication matching score meets the third preset condition, the authentication decision module determines that the current user's behavioral characteristics are severely mismatched with the baseline behavioral fingerprint model, indicating a high risk of account theft or unauthorized access. The authentication decision module generates an access denial decision, immediately blocking the access request, returning an authentication failure response to the client, and refusing to provide an access token. Simultaneously, the cloud service system triggers a security response, including freezing the current user's account, recording detailed abnormal access logs, and sending a security alert notification to the current user. The abnormal access log includes the access time, authentication matching score, client device identifier, IP address of the access source, geographical location information, and a complete behavioral feature vector, for the security team to conduct in-depth investigation and forensic analysis. The security alert notification is sent to the current user through various channels such as SMS, email, or in-app push notifications, indicating that the account may be at security risk and suggesting that the user immediately change their password and check their account activity records. The cloud service system's anomaly detection module further analyzes the events determined to be unauthorized access to determine whether they are part of a batch attack or a coordinated attack. If a platform-level security threat is detected, the emergency response plan is activated.

[0083] The beneficial effects of this embodiment are as follows: By employing a three-tiered comparison strategy of coarse-grained rapid screening, fine-grained statistical testing, and dynamic pattern matching to calculate the authentication matching score, and dynamically setting authentication and warning thresholds based on the confidence level of the baseline behavioral fingerprint model and the user's risk level, a tiered security response is achieved, ranging from direct authentication approval and triggering secondary verification to complete access denial. This approach can accurately identify and effectively block high-risk illegal access behaviors such as account theft and trigger security emergency responses. It can also reduce the false rejection rate of legitimate users by using secondary verification for suspicious deviation behaviors instead of direct denial. Furthermore, detailed tiered log recording and anomaly detection analysis provide complete data support for security auditing and threat tracing, thereby significantly improving the security protection capabilities of cloud-based identity authentication while effectively ensuring a balance between system availability and user experience.

[0084] Figure 8 This is a flowchart illustrating a process for dynamically updating a baseline behavioral fingerprint model based on user authentication results and behavioral changes, as provided in one embodiment of this application. Figure 8 As shown in the embodiments of this application, the method for dynamically updating the baseline behavioral fingerprint model based on the user's authentication results and behavioral changes includes the following steps: Step 600: After the user passes the identity authentication, the behavioral feature vector of this authentication is used as a new sample and integrated into the existing benchmark behavioral fingerprint model according to the weight coefficient.

[0085] Specifically, after a user's authentication, the model update module of the cloud service system performs a progressive update of the baseline behavioral fingerprint model. The module uses the behavioral feature vector from the current authentication as a new sample and incorporates it into the existing baseline behavioral fingerprint model using an exponentially weighted moving average method with weighted coefficients. The weighted coefficients are dynamically determined based on the consistency between the new sample and the existing baseline behavioral fingerprint model. The consistency is assessed by calculating the Mahalanobis distance between the feature mean vectors of the new sample and the baseline behavioral fingerprint model. When the Mahalanobis distance is less than the stability threshold, it indicates that the new sample is highly consistent with the model, and a smaller weighted coefficient is used to maintain model stability. When the Mahalanobis distance is between the stability threshold and the appropriate threshold, it indicates that the new sample is within a reasonable fluctuation range, and a medium weighted coefficient is used to appropriately track behavioral changes. When the Mahalanobis distance is greater than or equal to the appropriate threshold but does not exceed the warning threshold, it indicates that the behavior has fluctuated significantly but may still be a legitimate change, and a larger weighted coefficient is used to quickly adapt to the new pattern. The model update module uses weight coefficients to update the feature mean vector and feature covariance matrix. The model update module maintains a sample queue of fixed length and uses a sliding window to retain the most recent preset number of behavior samples. Each time it is updated, the new sample is added to the tail of the queue. When the queue is full, the oldest sample at the head of the queue is removed to ensure that the baseline behavior fingerprint model always reflects the recent behavior characteristics of the current user.

[0086] Step 601: When a change in user behavior pattern is detected, user behavior data is collected again and the baseline behavior fingerprint model is reconstructed.

[0087] Specifically, the model update module continuously monitors changes in the current user's behavior patterns. When a significant change in behavior pattern is detected, a triggered update process is executed to reconstruct the baseline behavioral fingerprint model. The criteria for determining a significant change in behavior pattern include: a continuous decrease in the authentication matching score for a preset number of consecutive times, with the decrease exceeding a preset threshold; the current user actively reporting a change in input device or adjustment of operating habits; or the system detecting a change in the client device identifier. When these criteria are met, the model update module initiates the model reconstruction process, switching the baseline behavioral fingerprint model to reconstruction mode. During reconstruction mode, the authentication decision module adopts a relaxed authentication strategy, temporarily lowering the authentication threshold to the reconstruction threshold while increasing the trigger frequency of secondary verification, requiring the current user to undergo additional authentication on each visit to ensure security during reconstruction. The model update module re-collects multiple behavioral feature vectors uploaded by the current user under the new conditions as a new training sample set. After the number of samples in the new training sample set reaches the preset number of reconstruction samples, the baseline behavioral fingerprint model is reconstructed based on the new training sample set using statistical learning methods. The reconstructed baseline behavioral fingerprint model includes a new feature mean vector, a new feature covariance matrix, and new feature distribution parameters. After reconstruction, the model update module replaces the original model with the reconstructed baseline behavioral fingerprint model and restores the normal authentication strategy, reverting the authentication threshold to the standard value. The model update module maintains a record of historical model versions for the current user, archiving and storing the old model version each time a model is updated or rebuilt. This historical model version record includes model parameters, creation time, number of samples, and confidence score, supporting a rollback to a stable historical version when a performance degradation of the new model is detected or user feedback indicates authentication anomalies.

[0088] The beneficial effects of this embodiment are as follows: By using an exponentially weighted moving average method based on dynamic weight coefficients to progressively fuse and update the authenticated behavioral feature vectors, combined with a sliding window to maintain the timeliness of the model for recent behavioral features, and by continuously monitoring changes in behavioral patterns and triggering the model reconstruction process when significant deviations are detected, while employing a relaxed authentication strategy and enhanced secondary verification to ensure security during reconstruction, and maintaining historical model version records to support version rollback when performance degrades, this embodiment achieves dynamic adaptive behavioral fingerprint model maintenance. It can maintain the long-term effectiveness of the model by progressively updating to adapt to the natural evolution of user operating habits, quickly adapt to fundamental changes in user behavior by triggering reconstruction, and ensure system reliability through version management. Thus, it effectively balances the relationship between model stability and adaptability, authentication security and user experience while significantly improving the robustness and timeliness of the baseline behavioral fingerprint model.

[0089] Figure 9This is a flowchart illustrating the process of preprocessing and extracting features from collected operational behavior data to generate behavioral feature vectors, as provided in one embodiment of this application. Figure 9 As shown in the embodiments of this application, the preprocessing and feature extraction of collected operational behavior data to generate behavioral feature vectors includes the following steps: Step 700: For keyboard operations in the operation behavior data, extract the statistical features of key press duration, the statistical distribution features of consecutive key press intervals, and the pattern features of key sequence.

[0090] Specifically, the feature extraction module of the client subsystem extracts features from the keyboard operation feature data in the operation behavior data. For key press duration, it captures key press and release events, records the timestamp of each key event, calculates the time difference between the key press and release events, and obtains the key press duration sequence for each key. Statistical features are extracted from the key press duration sequence, including the mean, variance, standard deviation, skewness, and kurtosis of the key press duration. For consecutive key press intervals, it calculates the timestamp difference between two adjacent key press events to obtain a consecutive key press interval sequence. The distribution characteristics of the consecutive key press interval sequence are statistically analyzed, including the probability distribution histogram of the key press intervals, the frequency of occurrence in different time intervals, and the quartiles of the interval time. For the pattern features of the key sequence, it employs... The meta-grammar model extracts commonly used key combination patterns, among which... The value range is 2 to 5, and the statistics for each type are... The frequency of key combinations appearing in the input sequence reflects the current user's input habits. The pattern characteristics of the key sequence also include the frequency of use of specific function key combinations, the frequency of use of the backspace key, and the habit of switching between uppercase and lowercase.

[0091] Step 701: For mouse operations in the operation behavior data, extract the curvature distribution features of the movement trajectory, the frequency domain features of the speed change, the time series features of the click event, and the spatial distribution features of the operation area.

[0092] Specifically, the feature extraction module extracts features from mouse operation data within the operation behavior data. For the curvature distribution feature of the movement trajectory, the mouse movement trajectory is generated by recording the coordinates and timestamps in the mouse movement event sequence. The angle change formed by adjacent coordinates is calculated to obtain the trajectory curvature sequence, and the distribution histogram of the trajectory curvature sequence is used as the curvature distribution feature. For the frequency domain feature of speed changes, the mouse movement speed sequence is obtained by calculating the distance-to-time ratio between adjacent coordinates. Fourier transform or wavelet transform is performed on the movement speed sequence to extract the dominant frequency, spectral energy distribution, and bandwidth power in the frequency domain space as the frequency domain feature of speed changes. For the time series feature of click events, the click frequency is obtained by counting the number of click events per unit time. The double-click time interval feature is obtained by measuring the time interval between two clicks in a double-click event. The click rhythm feature is obtained by analyzing the distribution pattern of click events on the time axis. For the spatial distribution feature of the operation area, the display screen is divided into multiple spatial regions. The frequency distribution of mouse clicks and movements in each spatial region is counted, and the spatial concentration and dispersion of operations are calculated. The spatial distribution feature of the operation area reflects the current user's screen usage habits and operation range preferences.

[0093] Step 702: For touch operations in the operation behavior data, extract the wavelet transform coefficients of the pressure time series curve, the shape description of the sliding trajectory, and the geometric relationship features of multi-touch.

[0094] Specifically, the feature extraction module extracts features from the touchscreen operation feature data in the operation behavior data. For the wavelet transform coefficients of the pressure time series curve, the pressure attribute value of the touch event is read, and the time series curve of pressure changing with time during the touch process is recorded. Wavelet transform is performed on the pressure time series curve, and wavelet transform coefficients at different scales and different time positions are extracted as pressure features. The wavelet transform coefficients can simultaneously capture the time domain information and frequency domain information of pressure changes. For the shape description of the sliding trajectory, the coordinate points in the touch sliding event sequence are recorded to generate the sliding trajectory curve. The shape descriptor is used to extract features from the sliding trajectory curve. The shape descriptor includes Fourier descriptors or curvature scale space descriptors to extract the shape features, curvature change features, and sliding direction distribution features of the sliding trajectory. For the geometric relationship features of multi-touch, by analyzing the touch point array of touch events, multi-touch gesture patterns are identified, and the number of touch points, the relative positional relationship between touch points, the distance change between touch points, and the cooperative movement mode of touch points are extracted. Common multi-touch gesture types are identified, including two-finger zoom, two-finger rotation, three-finger swipe, and four-finger switching. The geometric relationship features of multi-touch also include the accuracy distribution of the touch click position relative to the center of the target interface element and the statistical features of the touch duration.

[0095] Step 703: For the application usage patterns in the operation behavior data, extract the application conversion matrix, the time-series pattern of usage duration, and the Markov chain features of function access.

[0096] Specifically, the feature extraction module extracts features from application usage pattern data within the operational behavior data. For the application transition matrix, by monitoring the foreground and background state switching events of applications and recording the application activation sequence, an application transition matrix is ​​constructed. The rows and columns of the application transition matrix represent different applications, and the matrix elements represent the frequency or probability of switching from one application to another. The application transition matrix reflects the current user's application usage habits and workflow patterns. For the time-series pattern of usage duration, the activation and deactivation timestamps of each application are recorded, the usage duration of each application is calculated, and the distribution pattern of usage duration on the time axis is analyzed. Statistical, periodic, and trend characteristics of usage duration are extracted. The time-series pattern includes usage preferences for specific applications at different times and the changing patterns of application usage duration. For the Markov chain features of function access, the current user's access path to function modules within the application is recorded. The function modules are used as state nodes of the Markov chain, and the transition probability from one function module to another is calculated to construct the Markov transition matrix of function access. The Markov chain features reflect the current user's function usage habits and operation path preferences. The application usage pattern features also include file operation habit features. By monitoring file opening, saving, renaming, and deleting operation events, the operation frequency and operation preference for different file types are calculated.

[0097] Step 704: For system interaction behavior in the operation behavior data, extract the periodicity feature of login time, the fluctuation feature of session activity, and the entropy feature of operation rhythm.

[0098] Specifically, the feature extraction module extracts features from system interaction behavior data within the operational behavior data. For the periodicity of login time, it records the current user's historical login timestamp sequence and statistically analyzes the current user's login frequency distribution across different time periods throughout the day and week. By performing periodic analysis on the login time sequence, it extracts daily and weekly periodic features to identify the current user's habitual login times. These periodic features reflect the current user's work-rest patterns and work time preferences. For the fluctuation characteristics of session activity, it calculates the session duration by measuring the time span between login and logout timestamps, statistically analyzes the frequency of operational events during the session to obtain the session activity index, and analyzes the fluctuations in session activity across different sessions. It calculates the standard deviation, coefficient of variation, and fluctuation amplitude of the session activity sequence as fluctuation features, reflecting changes in the current user's workload and the stability of their operational patterns. For the entropy characteristics of operation rhythm, we analyze the time interval distribution of current user operation events and calculate the information entropy of the operation time interval sequence. Information entropy quantifies the regularity of operation rhythm. The lower the entropy value, the more regular and stable the operation rhythm is, and the higher the entropy value, the more random and variable the operation rhythm is. The entropy characteristics of operation rhythm also include operation density characteristics and operation interval distribution characteristics. The system interaction behavior characteristics also include abnormal operation response patterns. By recording the response behavior of the current user when encountering error prompts or system warnings, we extract features such as the number of retries, response speed, and processing strategies.

[0099] Step 705: Generate a high-dimensional behavior feature vector. Use a dimensionality reduction algorithm to map the high-dimensional behavior feature vector to a low-dimensional feature space, retaining the maximum feature discriminative information, to obtain the user behavior feature vector.

[0100] Specifically, the feature extraction module concatenates all features extracted from keyboard operations, mouse operations, touch operations, application usage patterns, and system interaction behaviors to generate a high-dimensional behavioral feature vector. This high-dimensional feature vector contains dozens to hundreds of feature dimensions, each corresponding to a specific behavioral feature quantization value. To reduce feature dimensionality, improve subsequent processing efficiency, and mitigate the curse of dimensionality, the feature extraction module employs dimensionality reduction algorithms to process the high-dimensional behavioral feature vector. Dimensionality reduction algorithms include at least one of principal component analysis (PCA), linear discriminant analysis (LDA), kernel principal component analysis (KPA), or autoencoders. When using PCA, the original features are projected onto a new orthogonal coordinate system through linear transformation. The top few principal components whose cumulative variance contribution rate reaches a preset percentage (ranging from 85% to 95%) are selected, reducing the feature dimensionality to a preset target dimension. When using LDA, given labeled samples, the projection direction that maximizes inter-class variance and minimizes intra-class variance is found, improving the discriminative power of the features. When using kernel principal component analysis (KPI), the data is mapped to a high-dimensional feature space using a kernel function before KPI analysis is performed, capturing the nonlinear relationships between features. When using an autoencoder, the encoder of a neural network compresses the high-dimensional input into a low-dimensional hidden layer representation, and the decoder reconstructs the input to ensure information preservation. The activation values ​​of the hidden layer serve as the feature representation after dimensionality reduction. The resulting user behavior feature vector retains the core discriminative information of the original behavior data while significantly reducing the data volume, providing a lightweight data foundation for subsequent encrypted transmission and cloud comparison. The dimensionality of the user behavior feature vector ranges from thirty to fifty dimensions.

[0101] The beneficial effects of this embodiment are as follows: By performing deep feature extraction on multimodal operation data such as keyboard operation, mouse operation, touch operation, application usage patterns, and system interaction behavior, and comprehensively applying various mathematical and signal processing methods to quantify user behavior characteristics, and by using dimensionality reduction algorithms such as principal component analysis, linear discriminant analysis, or autoencoders to map high-dimensional behavioral feature vectors to low-dimensional feature spaces while retaining the maximum feature discriminative information, this embodiment achieves highly efficient and accurate behavioral biometric extraction. It can comprehensively capture subtle differences in user operating habits and multi-level features of behavioral patterns, thereby significantly improving the accuracy and robustness of identity recognition. At the same time, it can significantly reduce feature dimensions and data volume through dimensionality reduction processing, thereby reducing encryption transmission overhead and cloud comparison computation complexity and improving the overall system operating efficiency. This lays a solid data foundation for building a stable and reliable benchmark behavioral fingerprint model and achieving highly secure continuous identity authentication.

[0102] It should be understood that during normal use after the current user completes initial authentication, the behavior data collection module begins operation, continuously collecting the current user's operational behavior data through the cloud service system. This operational behavior data includes keyboard operation characteristic data, mouse operation characteristic data, touchscreen operation characteristic data, application usage pattern data, and system interaction behavior data. The behavior data collection module employs a non-intrusive background operation mode for data collection, without interfering with the current user's normal operation flow, without popping up any prompt windows, and without adding any steps for the user. During the collection process, all raw behavior data is only temporarily stored and preliminarily processed in the client device's local memory, without involving the collection of sensitive personal information, without obtaining the specific content of user input, and only extracting statistical and pattern characteristics of the operational behavior.

[0103] Keyboard operation feature data includes key press duration, key sequence characteristics, and key operation habit characteristics. Key press duration features include key press duration, time interval between consecutive key presses, key pressure distribution, and input rate variation curves. This is achieved by capturing key press and release events using a keyboard event listener, recording the timestamp of each key event with millisecond precision. Key sequence characteristics include key combination patterns, key input order, and the statistical distribution of commonly used key sequences. Key operation habit characteristics include backspace key usage frequency, Caps Lock usage habits, function key usage preferences, and the stability of input rhythm.

[0104] Mouse operation feature data includes mouse movement features, mouse click features, and mouse interaction features. Mouse movement features include the curvature of the mouse movement trajectory, movement speed distribution, changes in movement acceleration, and movement direction distribution, generated by capturing coordinate points and timestamps in the mouse movement event sequence using mouse event listeners. Mouse click features include click frequency, double-click interval, click position accuracy distribution, and the ratio of single to double clicks. Mouse interaction features include the force and direction of drag operations, scroll wheel usage frequency and scroll amplitude, mouse hover duration, and the spatial distribution of the operation area.

[0105] Touchscreen operation feature data includes touch pressure features, touch motion features, and touch gesture features. Touch pressure features include the pressure distribution of touch points, pressure timing curves, and dynamic characteristics of pressure changes. These are obtained by reading the pressure attribute values ​​of touch events, and indirectly inferred from the touch area size on devices that do not support pressure sensing. Touch motion features include sliding speed and acceleration, curvature changes in the sliding trajectory, sliding direction distribution, and touch duration. Touch gesture features include multi-touch gesture patterns, the number of touch points, the relative positional relationships and distance changes between touch points, and the accuracy distribution of the click position relative to the target interface element. Common gestures recognized include two-finger zoom, two-finger rotation, three-finger swipe, and four-finger toggle.

[0106] Application usage pattern data includes application usage time-series characteristics and application operation habit characteristics. Application usage time-series characteristics include application launch order, usage duration distribution, application switching frequency, usage time period preferences, and time-series patterns of application usage duration. This is obtained by monitoring the foreground and background state switching events of each application and recording the activation and deactivation timestamps. Application operation habit characteristics include functional module access paths, function button click preferences, file operation habits, application switching patterns, and workflow characteristics. This is obtained by recording the user's navigation paths and operation sequences within the application.

[0107] System interaction behavior data includes user session characteristics and system operation characteristics. User session characteristics include login timestamps, logout timestamps, login time preferences, session duration, session activity, and the stability of operation rhythm, obtained by recording user login and logout events and the frequency of operations during the session. System operation characteristics include response patterns to abnormal operations, error message handling methods, system resource usage characteristics, entropy values ​​of operation rhythm, and fluctuations in operation intensity, obtained by monitoring user response behavior when encountering system prompts and system-level metrics during the session.

[0108] It will be apparent to those skilled in the art that this application is not limited to the details of the exemplary embodiments described above, and that this application can be implemented in other specific forms without departing from the spirit or essential characteristics of this application. Therefore, the embodiments should be considered illustrative and non-limiting in all respects, and the scope of this application is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within this application. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. A cloud-based identity authentication service method, characterized in that, include: When a user makes their first request to access the cloud service system, their identity is verified through a strong authentication mechanism, which includes at least one of password-based, multi-factor authentication, or digital certificate-based authentication. After successful authentication, the cloud service system collects the current user's operational behavior data during the user session; The collected operational behavior data is preprocessed and features are extracted to generate behavioral feature vectors; The current user's baseline behavioral fingerprint model is constructed by using multiple behavioral feature vectors of the current user within a preset period collected by the cloud service system as a training sample set. When the current user accesses the cloud service system again, the current user's behavioral feature vector is obtained and uploaded to the cloud service system, and the cloud service system retrieves the current user's baseline behavioral fingerprint model; The current user's behavioral feature vector is compared with the baseline behavioral fingerprint model to calculate the authentication matching score, and the legitimacy of the user's identity is determined based on the comparison result of the authentication matching score and the preset threshold. The baseline behavioral fingerprint model is dynamically updated based on the user's authentication results and behavioral changes.

2. The cloud-based identity authentication service method according to claim 1, characterized in that, After preprocessing and extracting features from the collected operational behavior data to generate behavioral feature vectors, the process further includes: Generate random symmetric keys; The symmetric key is used to perform symmetric encryption on the current user's behavior feature vector to generate an encrypted data packet; The encrypted data packet is uploaded to the cloud service system through an encrypted channel established by a transport layer security protocol.

3. The cloud-based identity authentication service method according to claim 2, characterized in that, When the current user accesses the cloud service system again, the system obtains the current user's behavioral feature vector and uploads it to the cloud service system. The cloud service system retrieves the current user's baseline behavioral fingerprint model, including: When the current user accesses the cloud service system again, the behavioral feature vector of the current session is obtained; The cloud service system receives and decrypts the encrypted data packets of the current session, and recovers the behavioral feature vector of the current user; The baseline behavioral fingerprint model established by the current user is retrieved from the cloud database, and the model parameters are obtained by decryption.

4. A cloud-based identity authentication service method according to any one of claims 1 to 3, characterized in that, The step of using multiple behavioral feature vectors of the current user collected by the cloud service system within a preset period as a training sample set to construct a baseline behavioral fingerprint model of the current user includes: Collect multiple behavioral feature vectors uploaded by the current user within a preset period as a training sample set; Based on the training sample set, a baseline behavioral fingerprint model is constructed using statistical learning methods. The baseline behavioral fingerprint model includes a feature mean vector, a feature covariance matrix, and feature distribution parameters. The confidence score is calculated for the baseline behavioral fingerprint model based on the number of training samples, the dispersion of the sample distribution, and the time span of sample collection.

5. A cloud-based identity authentication service method according to any one of claims 1 to 3, characterized in that, The step of comparing the current user's behavioral feature vector with a benchmark behavioral fingerprint model, calculating an authentication matching score, and determining the legitimacy of the user's identity based on the comparison result of the authentication matching score and a preset threshold includes: A multi-level comparison strategy is used to compare the current user's behavioral feature vector with the baseline behavioral fingerprint model, and the authentication matching score is calculated. The authentication matching score is compared with a preset threshold. If the authentication matching score meets the first preset condition, the user is determined to be a legitimate user and is allowed to access cloud services. If the authentication matching score meets the second preset condition, a secondary verification process is triggered; If the authentication matching score meets the third preset condition, it is determined to be an illegal access, the access request is rejected and a security response is triggered.

6. A cloud-based identity authentication service method according to any one of claims 1 to 3, characterized in that, The step of dynamically updating the baseline behavioral fingerprint model based on the user's authentication results and behavioral changes includes: Once a user has successfully authenticated their identity, the behavioral feature vector from this authentication will be used as a new sample and incorporated into the existing baseline behavioral fingerprint model according to the weight coefficients. And / or, When a change in user behavior pattern is detected, user behavior data is collected again and the baseline behavior fingerprint model is reconstructed.

7. A cloud-based identity authentication service method according to any one of claims 1 to 3, characterized in that, The process of preprocessing and feature extraction of the collected operational behavior data to generate a behavior feature vector includes: For the keyboard operations in the operation behavior data, extract the statistical features of key press duration, the statistical distribution features of consecutive key press intervals, and the pattern features of key sequence. For mouse operations in the operation behavior data, extract the curvature distribution features of the movement trajectory, the frequency domain features of the speed change, the time series features of the click event, and the spatial distribution features of the operation area. For touch operations in the operation behavior data, extract the wavelet transform coefficients of the pressure time series curve, the shape description of the sliding trajectory, and the geometric relationship features of multi-touch. For the application usage patterns in the operational behavior data, extract the application conversion matrix, the temporal pattern of usage duration, and the Markov chain features of function access; For the system interaction behavior in the operation behavior data, extract the periodicity feature of login time, the fluctuation feature of session activity, and the entropy feature of operation rhythm. A high-dimensional behavioral feature vector is generated, and a dimensionality reduction algorithm is used to map the high-dimensional behavioral feature vector to a low-dimensional feature space, retaining the maximum feature discriminative information, to obtain the user behavior feature vector.

8. A cloud-based identity authentication service method according to any one of claims 1 to 3, characterized in that, The cloud service system collects the current user's operational behavior data during the user session, including: During normal use after the current user completes initial authentication, the cloud service system continuously collects the current user's operational behavior data. This operational behavior data includes keyboard operation characteristic data, mouse operation characteristic data, touchscreen operation characteristic data, application usage pattern data, and system interaction behavior data. The keyboard operation characteristic data includes key press timing characteristics, key press sequence characteristics, and key press operation habit characteristics. The mouse operation characteristic data includes mouse movement characteristics, mouse click characteristics, and mouse interaction characteristics. The touchscreen operation characteristic data includes touch pressure characteristics, touch motion characteristics, and touch gesture characteristics. The application usage pattern data includes application usage timing characteristics and application operation habit characteristics. The system interaction behavior data includes user session characteristics and system operation characteristics.

9. A cloud-based identity authentication service system, comprising: The client subsystem, deployed on the user's cloud service system, includes: The behavior data collection module is configured to continuously collect the user's keyboard operation feature data, mouse operation feature data, touch screen operation feature data, application usage pattern data, and system interaction behavior data during the user's access to the cloud service platform. The collection process adopts a non-intrusive background operation mode. The feature extraction module is communicatively connected to the behavior data acquisition module and is configured to preprocess and extract features from the acquired operation behavior data. The preprocessing includes data cleaning, outlier filtering, normalization, and time window division to generate user behavior feature vectors. An encryption module, which is communicatively connected to the feature extraction module, is configured to encrypt user behavior feature vectors and generate encrypted data packets. A communication module, which is connected to the encryption module, is configured to upload the encrypted data packet to the cloud service subsystem through an encryption channel; The cloud service subsystem, deployed on the identity authentication server of the cloud service system, includes: The receiving and decryption module is configured to receive the encrypted data packet and decrypt it to recover the user behavior feature vector. The behavioral fingerprint modeling module is communicatively connected to the receiving and decryption module and is configured to collect multiple user behavioral feature vectors as training samples to construct a user's baseline behavioral fingerprint model. The baseline behavioral fingerprint model includes a feature mean vector, a feature covariance matrix, and feature distribution parameters. The authentication comparison module is communicatively connected to the receiving and decryption module and the behavior fingerprint modeling module. It is configured to retrieve the user's baseline behavior fingerprint model when the user accesses the cloud service system again, compare the current user's behavior feature vector with the baseline behavior fingerprint model, and calculate the authentication matching score. The authentication decision module is communicatively connected to the authentication comparison module and is configured to determine the legitimacy of the user's identity based on the comparison result of the authentication matching score and a preset threshold. The model update module is communicatively connected to the behavior fingerprint modeling module and the authentication decision module, and is configured to dynamically update the baseline behavior fingerprint model based on the user's authentication results and behavior changes.

10. A cloud-based identity authentication service system according to claim 9, characterized in that, The cloud service subsystem also includes: An anomaly detection module is communicatively connected to the authentication comparison module and the authentication decision module. It is configured to perform single-user anomaly detection and global anomaly detection. The single-user anomaly detection analyzes changes in the authentication matching score of individual users, deviations in access time periods, anomalies in geographical location, and anomalies in access frequency. The global anomaly detection analyzes the authentication failure rate, behavioral feature pattern distribution, and access request distribution of the overall user group. Based on the detected anomaly type and severity, it triggers corresponding security responses. The communication optimization module is communicatively connected to the receiving decryption module and the authentication decision module, and is configured to perform lightweight communication optimization. The data storage module is communicatively connected to the behavior fingerprint modeling module, the model update module, and the anomaly detection module, and is configured to store user behavior fingerprint models, historical authentication records, abnormal access logs, and model version information in encrypted form.

Images