Self-adaptive identity authentication method and system based on intelligent risk quantification
By introducing client-side and server-side intelligent agents into the OIDC protocol, multi-dimensional contextual data is collected and analyzed in real time, the identity authentication strength is dynamically adjusted, and user behavior is continuously monitored. This solves the static problem of the OIDC identity authentication process and achieves a more intelligent and dynamic authentication effect.
Patent Information
- Application Number
- CN202511938443.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-22
- Publication Date
- 2026-03-17
AI Technical Summary
The existing OIDC identity authentication process relies on static rules, making it difficult to achieve real-time dynamic risk adjustment and seamless integration with advanced intelligent agents, resulting in a less intelligent and dynamic authentication process.
By introducing client-side and server-side intelligent agents into the OIDC protocol, multi-dimensional contextual data is collected and analyzed in real time to conduct risk quantification assessment, dynamically adjust the strength of identity authentication, continuously monitor user behavior during the session, and identify anomalies by comparing behavioral baselines.
It achieves a smarter and more dynamic identity authentication process, improves the accuracy of risk assessment, reduces the false alarm rate, and enhances security and session protection without the legitimate user experiencing it.
Smart Images
Figure CN121690795A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of computer information security, and in particular to an adaptive identity authentication method and system based on intelligent risk quantification. Background Technology
[0002] With the widespread adoption of internet services, single sign-on (SSO) has become a core supporting technology for enterprise digital transformation and cross-platform user access. OpenID Connect (OIDC), an identity layer protocol based on the OAuth 2.0 framework, has become one of the mainstream standards for implementing SSO due to its standardization and good interoperability. The OIDC protocol enables resource owners to securely and conveniently access multiple mutually trusted applications by centrally authenticating users on the authorization server and issuing identity tokens (ID tokens) and access tokens to client applications.
[0003] The standard OIDC identity authentication process is essentially a relatively static process, with its authentication decisions relying on pre-configured static rules. This static model has limitations. In recent years, artificial intelligence technology, especially agent technology with environmental perception, autonomous decision-making, and real-time response capabilities, has provided new ideas for the field of identity authentication. Agents can continuously collect and analyze multi-dimensional contextual information and make inferences and decisions based on this information.
[0004] However, in existing technical solutions, how to deeply and seamlessly integrate such intelligent agents with advanced cognitive and decision-making capabilities into standardized protocols like OIDC to build a new identification framework that dynamically adjusts the identification strength based on real-time risks and can transform passive behavioral characteristics into continuously effective identification factors remains a technical problem that urgently needs to be solved. Summary of the Invention
[0005] In view of this, the purpose of this application is to provide an adaptive identity authentication method and system based on intelligent risk quantification, which can seamlessly embed advanced intelligent agents into the OIDC protocol authentication process, thereby achieving a more intelligent, dynamic, and flexible identity authentication process. The specific solution is as follows:
[0006] Firstly, this application provides an adaptive identity authentication method based on intelligent risk quantification, including:
[0007] In the Open Identity Connection Protocol (OSIP) interaction, when a user accesses a target resource, a lightweight client agent embedded in the client application collects the user's context data, and the client application sends an authorization request containing the context data to the authorization server; the context data includes behavioral feature data during the login process, device fingerprint data, and network environment data.
[0008] The server agent deployed within the authorization server performs a risk quantification assessment on the context data to obtain a risk score, and determines a corresponding target identity authentication strength from a preset range of identity authentication strengths based on the risk score; wherein the target identity authentication strength and the risk score are positively correlated.
[0009] The authorization server provides the user with an identity authentication module corresponding to the target identity authentication strength, so as to authenticate the user's identity when logging in. Once the user's identity is successfully authenticated, the current session is started.
[0010] During the duration of this session, the client agent continuously collects user behavior feature data as interaction behavior data and sends the interaction behavior data to the server agent. The server agent then compares and analyzes the interaction behavior data with the user's corresponding behavior baseline to obtain analysis results. The behavior baseline is established when the user logs in for the first time.
[0011] If the analysis results indicate an anomaly, the session will be terminated, and the user will be guided to re-authenticate their identity.
[0012] Optionally, the step of performing a risk quantification assessment on the context data to obtain a risk score includes:
[0013] The context data is standardized, and the standardized context data is input in parallel to each dedicated analysis engine. The dedicated analysis engines include a device trust analysis engine for evaluating the reliability of client devices, a behavioral feature analysis engine for comparing the deviation between current behavioral characteristics and historical behavioral baselines, a contextual intelligence analysis engine for analyzing network environment characteristics, and a threat intelligence analysis engine for matching known attack patterns.
[0014] The analysis results output by each of the dedicated analysis engines are comprehensively calculated to obtain the corresponding risk score.
[0015] Optionally, the preset identity authentication strength includes a first risk strength that meets the preset high-risk authentication strength standard, a second risk strength that meets the preset medium-risk authentication strength standard, and a third risk strength that meets the preset low-risk authentication strength standard;
[0016] Accordingly, the step of providing the user with an identity authentication module corresponding to the target identity authentication strength includes:
[0017] Present the user with an identity authentication interface corresponding to the target identity authentication strength;
[0018] Wherein, if the target identity authentication strength is the third risk level, the identity authentication interface only requires the user to provide a username and a static password; if the target identity authentication strength is the second risk level, the identity authentication interface requires the user to provide a username, a static password, and a short-term one-time dynamic password; if the target identity authentication strength is the first risk level, the identity authentication interface requires the user to provide at least two different types of strong authentication factors; the strong authentication factors include one-time dynamic passwords, biometric information, and digital certificates.
[0019] Optionally, after obtaining the analysis results, the method further includes:
[0020] The current behavioral baseline is optimized using a pre-trained behavioral baseline model to obtain a new behavioral baseline, which is then compared and analyzed with the subsequently collected interaction behavior data. The behavioral baseline model is a model trained based on behavioral feature data of users' successful login sessions in the past.
[0021] Within a preset verification period, the accuracy of the analysis results corresponding to the new behavioral baseline is determined. If the accuracy of the analysis results corresponding to the new behavioral baseline is better than or equal to the accuracy of the analysis results corresponding to the previous behavioral baseline, the optimization is deemed effective; otherwise, it is rolled back to the previous effective version of the behavioral baseline.
[0022] Optionally, the interactive behavior data includes the user's typing rhythm, mouse movement trajectory, page scrolling speed, and operation interval time;
[0023] Accordingly, the step of comparing and analyzing the interaction behavior data with the user's corresponding behavior baseline to obtain the analysis results includes:
[0024] Feature extraction is performed on the interactive behavior data to obtain the corresponding behavior feature vector;
[0025] A similarity calculation is performed on the behavioral feature vector and the user's corresponding behavioral baseline. Based on the similarity calculation result, the deviation degree between the behavioral feature vector and the behavioral baseline is determined, and the deviation degree is converted into a comparable anomaly quantification value.
[0026] The abnormal quantification value is compared with a preset security threshold. If the abnormal quantification value is greater than the preset security threshold, the interaction behavior data is determined to be abnormal.
[0027] Optionally, if the analysis results indicate an anomaly, the current session will be terminated, and the user will be guided to re-authenticate their identity, including:
[0028] If the interaction behavior data is abnormal, a preset security decision is sent to the authorization server through the server agent, so that the authorization server can execute the preset security decision; the preset security decision includes revoking the access token of the current session;
[0029] Based on the authorization server, the access token has expired information is notified to the corresponding resource server through a pre-established reverse control channel;
[0030] The server agent sends a control command to the client agent to re-authenticate, so that the client agent can control the client application to interrupt the user's current session and push security warning information and re-login guidance information to the user interface according to the control command.
[0031] Optionally, after the resource server receives information that the access token has expired, it also includes:
[0032] Mark the corresponding access token as invalid;
[0033] If a resource access request carrying the invalid token is received, the resource access request is rejected and an error response is returned to the client application so that the client application can guide the user to re-authenticate.
[0034] Secondly, this application provides an adaptive identity authentication system based on intelligent risk quantification, comprising:
[0035] The data collection module is used to collect the user's context data through a lightweight client agent embedded in the client application when the user accesses the target resource during the interaction of the Open Identity Connection Protocol. The client application then sends an authorization request containing the context data to the authorization server. The context data includes behavioral feature data during the login process, device fingerprint data, and network environment data.
[0036] The risk assessment module is used to perform risk quantification assessment on the context data based on the server intelligence agent deployed inside the authorization server, obtain a risk score, and determine the corresponding target identity authentication strength from the preset identity authentication strengths according to the risk score; wherein, the target identity authentication strength and the risk score are positively correlated;
[0037] The first identity authentication module is used to provide the user with an identity authentication module corresponding to the target identity authentication strength through the authorization server, so as to authenticate the user's identity when logging in, and start the current session when the user's identity is successfully authenticated;
[0038] The analysis module is used to continuously collect user behavior feature data as interaction behavior data using the client agent during the duration of the current session, and send the interaction behavior data to the server agent, so that the server agent can compare and analyze the interaction behavior data with the user's corresponding behavior baseline to obtain analysis results; wherein, the behavior baseline is established when the user logs in for the first time;
[0039] The second identity authentication module is used to terminate the current session and guide the user to re-authenticate their identity if the analysis results indicate an anomaly.
[0040] Optionally, the risk assessment module includes:
[0041] The data input unit is used to standardize the context data and input the standardized context data in parallel to each dedicated analysis engine. The dedicated analysis engines include a device trust analysis engine for evaluating the reliability of client devices, a behavioral feature analysis engine for comparing the deviation between current behavioral characteristics and historical behavioral baselines, a contextual intelligence analysis engine for analyzing network environment characteristics, and a threat intelligence analysis engine for matching known attack patterns.
[0042] The risk scoring unit is used to comprehensively calculate the analysis results output by each of the dedicated analysis engines to obtain the corresponding risk score.
[0043] Optionally, the analysis module includes:
[0044] The analysis unit is used to optimize the current behavior baseline using a pre-trained behavior baseline model to obtain a new behavior baseline, and to compare and analyze the subsequently collected interaction behavior data with the new behavior baseline; the behavior baseline model is a model trained based on the behavioral feature data of users' successful login sessions in the past.
[0045] The determination unit is used to determine the accuracy of the analysis results corresponding to the new behavior baseline within a preset verification period. If the accuracy of the analysis results corresponding to the new behavior baseline is better than or equal to the accuracy of the analysis results corresponding to the previous behavior baseline, the optimization is determined to be effective; otherwise, it is rolled back to the behavior baseline of the previous effective version.
[0046] In this application, during the interaction of the Open Identity Connection Protocol, when a user accesses a target resource, a lightweight client agent embedded in the client application collects the user's context data, and the client application sends an authorization request containing the context data to the authorization server. The context data includes behavioral characteristic data from the login process, device fingerprint data, and network environment data. A server agent deployed within the authorization server performs a risk quantification assessment on the context data to obtain a risk score, and determines the corresponding target identity authentication strength from a preset range of identity authentication strengths based on the risk score. The target identity authentication strength and the risk score are positively correlated. The system utilizes the authorization server to provide users with an identity authentication module corresponding to the target identity authentication strength, enabling identity authentication during user login. Upon successful authentication, the session is initiated. During the session, the client-side agent continuously collects user behavioral characteristic data as interaction behavior data and sends this data to the server-side agent. The server-side agent then compares and analyzes this data against the user's corresponding behavioral baseline to obtain analysis results. This behavioral baseline is established upon the user's first login. If the analysis results indicate an anomaly, the session is terminated, and the user is guided to re-authenticate. As can be seen, in the initial stage of a user's login request, this application utilizes the collaborative work of client-side and server-side agents: firstly, multi-dimensional contextual data is collected in real-time; then, the server-side agent immediately analyzes this data and generates a quantified risk score. Next, based on the risk score, the corresponding authentication process is automatically selected and triggered from a preset authentication strength level. This mechanism tightly binds the strength of identification to the instantaneous risk situation, enabling real-time perception and dynamic decision-making, breaking the static identification model. Throughout the entire session lifecycle, the client agent continuously and silently collects user interaction behavior data in the background and uploads it to the server agent for real-time comparison and analysis against the user's corresponding behavioral baseline. This process transforms the previously ignored and passive user interaction pattern into a continuously effective, invisible identification lock. Any behavior that significantly deviates from the behavioral baseline will be judged as abnormal and trigger a security response, thus making implicit behavioral features a powerful and user-unnoticed continuous identification factor. Attached Figure Description
[0047] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.
[0048] Figure 1 This is a flowchart of an adaptive identity authentication method based on intelligent risk quantification disclosed in this application;
[0049] Figure 2 This is a flowchart illustrating the stages of a specific adaptive identity authentication method based on intelligent risk quantification disclosed in this application.
[0050] Figure 3 This is a flowchart of another specific adaptive identity authentication method based on intelligent risk quantification disclosed in this application.
[0051] Figure 4 This is a flowchart illustrating the stages of another specific adaptive identity authentication method based on intelligent risk quantification disclosed in this application.
[0052] Figure 5 This is a schematic diagram of the structure of an adaptive identity authentication system based on intelligent risk quantification disclosed in this application. Detailed Implementation
[0053] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0054] In existing technical solutions, how to deeply and seamlessly integrate intelligent agents with advanced cognitive and decision-making capabilities into standardized protocols like OIDC to construct a novel authentication framework that dynamically adjusts authentication strength based on real-time risk and transforms passive behavioral characteristics into continuously effective authentication factors remains a pressing technical problem. To address this, this application provides an adaptive identity authentication method based on intelligent risk quantification, which can seamlessly embed advanced intelligent agents into the OIDC protocol authentication process, thereby achieving a more intelligent, dynamic, and flexible identity authentication process.
[0055] See Figure 1 As shown in the figure, this application discloses an adaptive identity authentication method based on intelligent risk quantification, including:
[0056] Step S11: In the Open Identity Connection Protocol interaction, when a user accesses a target resource, the user's context data is collected by a lightweight client agent embedded in the client application, and the client application sends an authorization request containing the context data to the authorization server; the context data includes behavioral feature data during the login process, device fingerprint data, and network environment data.
[0057] This embodiment adds a client agent and a server agent to the open identity connection protocol to realize an end-to-end dynamic adaptive identity authentication process.
[0058] like Figure 2 As shown, users can access protected resources through a browser or application client. The client application activates the embedded client agent and initiates context data collection. The collected data mainly includes:
[0059] 1. Behavioral characteristics data: (1) Keyboard dynamics, such as key press interval and key press duration; (2) Pointer device behavior, such as mouse movement speed and click frequency.
[0060] 2. Device fingerprint data: (1) Hardware information, such as the number of CPU (Central Processing Unit) cores and memory size; (2) Software environment, such as operating system version and browser / client version.
[0061] 3. Network environment data: (1) Connection information, such as IP address, network type, etc.; (2) Location information, such as country / city information, etc.
[0062] It should be noted that the aforementioned process of collecting contextual data can employ a modular and lightweight design to ensure low invasiveness and high stability. Data collection should adhere to the principles of minimization, anonymization, and encryption, running silently in the background without the user's awareness. Furthermore, to protect user privacy, the purpose, scope, and method of data collection should be clearly explained to the user upon their first use, and their explicit consent should be obtained.
[0063] Furthermore, the client application sends a standard OIDC authorization request to the authorization server, which includes the collected context data via a custom parameter (such as intelligent_context).
[0064] Step S12: Based on the server intelligence agent deployed inside the authorization server, perform risk quantification assessment on the context data to obtain a risk score, and determine the corresponding target identity authentication strength from the preset identity authentication strength according to the risk score; wherein, the target identity authentication strength and the risk score are positively correlated.
[0065] like Figure 2As shown, after receiving an authorization request, the authorization server invokes its internal server intelligence agent to perform a multi-dimensional risk quantification assessment of the context data. Specifically, the risk assessment of the context data to obtain a risk score may include: firstly, standardizing the context data, and then inputting the standardized context data in parallel into various dedicated analysis engines; these dedicated analysis engines include, but are not limited to, a device trust analysis engine for assessing client device reliability, a behavioral feature analysis engine for comparing the deviation between current behavioral characteristics and historical behavioral baselines, a contextual intelligence analysis engine for analyzing network environment characteristics, and a threat intelligence analysis engine for matching known attack patterns. Then, the analysis results output by each dedicated analysis engine are comprehensively calculated to obtain the corresponding risk score.
[0066] Specifically, the analysis results output by each dedicated analysis engine can be comprehensively calculated using a user session baseline determined based on the user's typing rhythm during normal operation, common devices / networks, etc., to obtain a corresponding risk score. Then, based on the risk score, a corresponding target identity authentication strength can be determined from preset identity authentication strengths, and the target identity authentication strength can be returned to the authorization server.
[0067] The preset identity verification strength may include a first risk strength that meets the preset high-risk verification strength standard, a second risk strength that meets the preset medium-risk verification strength standard, and a third risk strength that meets the preset low-risk verification strength standard.
[0068] Step S13: Use the authorization server to provide the user with an identity authentication module corresponding to the target identity authentication strength, so as to authenticate the user's identity when logging in. When the user's identity is successfully authenticated, start the current session.
[0069] In this embodiment, as Figure 2 As shown, the authorization server presents an identity authentication interface to the user based on the received target identity authentication strength. Specifically, if the target identity authentication strength is the third risk level, the identity authentication interface may only require the user to provide a username and static password. If the target identity authentication strength is the second risk level, the identity authentication interface may require the user to provide a username, static password, and a short-term, one-time dynamic password. If the target identity authentication strength is the first risk level, the identity authentication interface may require the user to provide at least two different types of strong authentication factors. Strong authentication factors include, but are not limited to, one-time dynamic passwords, biometric information such as fingerprints and irises, and digital certificates.
[0070] Furthermore, the user provides the authentication credentials required for the identity verification interface, and the authentication credentials are verified using the authorization server. Once the user's identity verification is successful, the current session is initiated, and simultaneously, if... Figure 2As shown, the authorization server issues an ID Token and an Access Token to the client application. The ID Token contains a custom claim (such as adaptive_auth_context) that specifies the initial risk level and authentication strength of the current session. Furthermore, the client application notifies the client agent that login has been successful, allowing the client agent to begin continuous monitoring throughout the entire session.
[0071] Step S14: During the duration of this session, the client agent continuously collects user behavior feature data as interaction behavior data and sends the interaction behavior data to the server agent. The server agent then compares and analyzes the interaction behavior data with the user's corresponding behavior baseline to obtain the analysis results. The behavior baseline is established when the user logs in for the first time.
[0072] like Figure 3 As shown, during this session, the client agent continuously collects interactive behavior data such as the user's typing rhythm, mouse movement trajectory, page scrolling speed, and operation interval time in the background, and reports the data to the server agent in the authorization server through a dedicated channel that is independent, secure, and different from the channel that interacts with the OIDC protocol.
[0073] The server-side intelligent agent compares and analyzes real-time interactive behavior data with the user's corresponding behavioral baseline to obtain analysis results, thereby dynamically updating the real-time risk status of the session. Specifically, this may include: first, extracting features from the interactive behavior data to obtain corresponding behavioral feature vectors; then, calculating the similarity between the behavioral feature vectors and the user's corresponding behavioral baseline, determining the deviation between the behavioral feature vectors and the behavioral baseline based on the similarity calculation results, and converting the deviation into a comparable anomaly quantification value; finally, comparing the anomaly quantification value with a preset safety threshold. If the anomaly quantification value is greater than the preset safety threshold, the interactive behavior data is determined to be abnormal.
[0074] Each user has a corresponding behavior baseline, which remains valid in subsequent user login sessions. Users can actively delete this behavior baseline.
[0075] Furthermore, after obtaining the analysis results, the process may include: optimizing the current behavioral baseline using a pre-trained behavioral baseline model to obtain a new behavioral baseline, and then comparing and analyzing subsequently collected interaction behavior data with the new behavioral baseline; wherein, the behavioral baseline model is a model trained based on behavioral feature data of users' successful login sessions in history. Within a preset verification period, the accuracy of the analysis results corresponding to the new behavioral baseline is determined. If the accuracy of the analysis results corresponding to the new behavioral baseline is better than or equal to the accuracy of the analysis results corresponding to the previous behavioral baseline, then the optimization is deemed effective; otherwise, it is rolled back to the previous effective version of the behavioral baseline.
[0076] Step S15: If the analysis results indicate an anomaly, terminate the current session and guide the user to re-authenticate their identity.
[0077] like Figure 4 As shown, if anomalies are detected in the interaction data, a preset security decision can be sent to the authorization server via the server agent. This preset security decision can then be executed by the authorization server. The preset security decision includes, but is not limited to, revoking the access token for the current session and shortening its validity period. Then, based on a pre-established reverse control channel, such as an extended Token Introspection endpoint or a pre-configured callback URL (Uniform Resource Locator), the authorization server can notify the corresponding resource server that the access token has expired. Next, the server agent can send a control command for re-authentication to the client agent via a dedicated channel for context data reporting. This allows the client agent to control the client application to interrupt the user's current session and push security warnings and re-login guidance to the user interface.
[0078] The mechanism, upon receiving information that an access token has expired, may further include marking the corresponding access token as invalid. If the user ignores the security warning and login instructions and sends another resource access request with an invalid token to the resource server, the resource server will reject the request and return an error response, such as 401 Unauthorized, to the client application, prompting the user to re-authenticate.
[0079] It should be noted that this embodiment achieves compatibility with the OIDC standard protocol by designing a series of non-intrusive extension points, ensuring that existing compliant client applications and resource servers can function normally without modification. However, client applications that enable the new features will gain enhanced dynamic security authentication capabilities. Specific integration points include:
[0080] 1. Enhanced Authentication Request: Allows client applications to upload collected context data via a new optional parameter. Standard client applications can ignore this parameter, and the process reverts to the standard OIDC protocol.
[0081] 2. Embedded Intelligent Decision-Making: The server intelligent agent is an internal service of the authorization server and is called before user credential verification. Its decision results are only used for the internal routing authentication process and do not change the external interaction steps of the protocol.
[0082] 3. Context-Enhanced Tokens: A custom claim is added to the standard structure of the returned ID Token to carry information such as risk level and authentication strength. The resource server can parse this information to make more dynamic authorization decisions, but even without parsing, the token itself remains fully valid.
[0083] As can be seen from the above, this embodiment, in terms of authentication strategy, introduces an intelligent agent for real-time multi-dimensional risk assessment, transforming traditional static, preset authentication rules into dynamic, adaptive intensity adjustments, achieving precise matching of security and scenario; in terms of authentication factors, it creatively transforms the user's passive, implicit behavioral characteristics into continuously effective authentication factors, improving security while achieving a "seamless" experience for legitimate users; in terms of decision-making basis, it adopts multi-dimensional contextual information fusion analysis, overcoming the limitations of existing technologies that rely on a single signal, significantly improving the accuracy of risk assessment and reducing the false alarm rate; in terms of session security, by establishing a behavioral baseline and a continuous monitoring mechanism, it extends one-time login authentication to continuous identity verification throughout the entire lifecycle, proactively detecting and blocking post-login attacks such as session hijacking; in terms of protocol compatibility, by designing non-intrusive extension points, it achieves seamless integration with existing OIDC standard protocols, ensuring compatibility with existing systems without modification, greatly reducing deployment costs and facilitating technology promotion.
[0084] See Figure 5 As shown in the embodiments, this application also discloses an adaptive identity authentication system based on intelligent risk quantification, including:
[0085] The data collection module 11 is used to collect the user's context data through a lightweight client agent embedded in the client application when the user accesses the target resource during the interaction of the Open Identity Connection Protocol, and to send an authorization request containing the context data to the authorization server through the client application; the context data includes behavioral feature data, device fingerprint data and network environment data during the login process.
[0086] The risk assessment module 12 is used to perform risk quantification assessment on the context data based on the server intelligence agent deployed inside the authorization server, obtain a risk score, and determine a corresponding target identity authentication strength from the preset identity authentication strengths according to the risk score; wherein, the target identity authentication strength and the risk score are positively correlated.
[0087] The first identity authentication module 13 is used to provide the user with an identity authentication module corresponding to the target identity authentication strength through the authorization server, so as to authenticate the user's identity when logging in, and start the current session after the user's identity authentication is successful;
[0088] Analysis module 14 is used to continuously collect user behavior feature data as interaction behavior data using the client agent during the duration of the current session, and send the interaction behavior data to the server agent so that the server agent can compare and analyze the interaction behavior data with the user's corresponding behavior baseline to obtain analysis results; wherein, the behavior baseline is established when the user logs in for the first time;
[0089] The second identity authentication module 15 is used to terminate the current session and guide the user to re-authenticate their identity if the analysis result indicates an anomaly.
[0090] In some specific embodiments, the risk assessment module 12 includes:
[0091] The data input unit is used to standardize the context data and input the standardized context data in parallel to each dedicated analysis engine. The dedicated analysis engines include a device trust analysis engine for evaluating the reliability of client devices, a behavioral feature analysis engine for comparing the deviation between current behavioral characteristics and historical behavioral baselines, a contextual intelligence analysis engine for analyzing network environment characteristics, and a threat intelligence analysis engine for matching known attack patterns.
[0092] The risk scoring unit is used to comprehensively calculate the analysis results output by each of the dedicated analysis engines to obtain the corresponding risk score.
[0093] In some specific implementations, the preset identity verification strength includes a first risk strength that meets the preset high-risk verification strength standard, a second risk strength that meets the preset medium-risk verification strength standard, and a third risk strength that meets the preset low-risk verification strength standard.
[0094] In some specific embodiments, the first identity authentication module 13 includes:
[0095] The first identity authentication unit is used to present an identity authentication interface to the user that corresponds to the target identity authentication strength;
[0096] Wherein, if the target identity authentication strength is the third risk level, the identity authentication interface only requires the user to provide a username and a static password; if the target identity authentication strength is the second risk level, the identity authentication interface requires the user to provide a username, a static password, and a short-term one-time dynamic password; if the target identity authentication strength is the first risk level, the identity authentication interface requires the user to provide at least two different types of strong authentication factors; the strong authentication factors include one-time dynamic passwords, biometric information, and digital certificates.
[0097] In some specific embodiments, the analysis module 14 includes:
[0098] The analysis unit is used to optimize the current behavior baseline using a pre-trained behavior baseline model to obtain a new behavior baseline, and to compare and analyze the subsequently collected interaction behavior data with the new behavior baseline; the behavior baseline model is a model trained based on the behavioral feature data of users' successful login sessions in the past.
[0099] The determination unit is used to determine the accuracy of the analysis results corresponding to the new behavior baseline within a preset verification period. If the accuracy of the analysis results corresponding to the new behavior baseline is better than or equal to the accuracy of the analysis results corresponding to the previous behavior baseline, the optimization is determined to be effective; otherwise, it is rolled back to the behavior baseline of the previous effective version.
[0100] In some specific implementations, the interactive behavior data includes the user's typing rhythm, mouse movement trajectory, page scrolling speed, and operation interval time.
[0101] In some specific embodiments, the analysis module 14 includes:
[0102] The feature extraction unit is used to extract features from the interactive behavior data to obtain the corresponding behavior feature vector.
[0103] The deviation determination unit is used to perform similarity calculation on the behavior feature vector and the user's corresponding behavior baseline, determine the deviation between the behavior feature vector and the behavior baseline based on the similarity calculation result, and convert the deviation into a comparable anomaly quantification value.
[0104] An anomaly determination unit is used to compare the anomaly quantification value with a preset security threshold. If the anomaly quantification value is greater than the preset security threshold, the interaction behavior data is determined to be abnormal.
[0105] In some specific embodiments, the second identity authentication module 15 includes:
[0106] An exception handling unit is configured to send a preset security decision to the authorization server through the server agent if the interaction behavior data is abnormal, so that the authorization server can execute the preset security decision; the preset security decision includes revoking the access token of the current session;
[0107] The information sending unit is used to notify the corresponding resource server that the access token has expired based on the authorization server through a pre-established reverse control channel;
[0108] The second identity authentication unit is used to send a control command to the client agent to re-authenticate through the server agent, so that the client agent can control the client application to interrupt the user's current session according to the control command, and push security warning information and re-login guidance information to the user interface.
[0109] In some specific embodiments, the second identity authentication module 15 further includes:
[0110] A token marking unit is used to mark the corresponding access token as an invalid token;
[0111] The third identity authentication unit is used to reject the resource access request and return an error response to the client application when it receives a resource access request carrying the invalid token, so that the client application can guide the user to re-authenticate.
[0112] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.
[0113] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.
[0114] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.
[0115] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0116] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.
Claims
1. An adaptive identity authentication method based on intelligent risk quantification, characterized in that, The application comprises the following technical solutions: In an open identity connection protocol interaction, when a user accesses a target resource, context data of the user is collected by a lightweight client agent embedded in a client application, and an authorization request containing the context data is sent to an authorization server by using the client application; the context data includes behavior characteristic data, device fingerprint data and network environment data in a login process; Risk quantitative evaluation is performed on the context data by a server agent deployed in the authorization server, a risk score is obtained, and a corresponding target identity authentication strength is determined from preset identity authentication strengths according to the risk score; wherein the target identity authentication strength and the risk score are positively correlated; An identity authentication module corresponding to the target identity authentication strength is provided to the user by using the authorization server, so as to perform identity authentication when the user logs in, and the current session is started after the user identity authentication is successful; During the duration of the current session, behavior characteristic data of the user is continuously collected as interaction behavior data by the client agent, and the interaction behavior data is sent to the server agent, so that the interaction behavior data is compared and analyzed with a behavior baseline corresponding to the user by the server agent to obtain an analysis result; wherein the behavior baseline is established when the user logs in for the first time; If the analysis result indicates that there is an anomaly, the current session is terminated, and the user is guided to perform identity authentication again. 2.The self-adaptive identity authentication method based on intelligent risk quantification according to claim 1, characterized in that, The risk quantitative evaluation on the context data to obtain the risk score comprises the following steps: The context data is standardized, and the standardized context data is input into each special analysis engine in parallel; the special analysis engine includes a device trust analysis engine for evaluating the reliability of a client device, a behavior characteristic analysis engine for comparing the deviation degree of current behavior characteristics and historical behavior baseline, a context intelligent analysis engine for analyzing network environment characteristics, and a threat intelligence analysis engine for matching known attack patterns; The analysis results output by each special analysis engine are comprehensively calculated to obtain a corresponding risk score. 3.The self-adaptive identity authentication method based on intelligent risk quantification according to claim 1, characterized in that, The preset identity authentication strengths include a first risk strength meeting a preset high-risk authentication strength standard, a second risk strength meeting a preset medium-risk authentication strength standard and a third risk strength meeting a preset low-risk authentication strength standard; Correspondingly, the identity authentication module corresponding to the target identity authentication strength provided to the user comprises the following steps: An identity authentication interface corresponding to the target identity authentication strength is presented to the user; If the target identity authentication strength is the third risk strength, the identity authentication interface only requires the user to provide a username and a static password, if the target identity authentication strength is the second risk strength, the identity authentication interface requires the user to provide a username, a static password and a short-time one-time dynamic password, and if the target identity authentication strength is the first risk strength, the identity authentication interface requires the user to provide at least two different types of strong authentication factors; the strong authentication factors include a one-time dynamic password, biological feature information and a digital certificate. 4.The smart risk quantification based adaptive identity authentication method of claim 1, wherein, The analysis result obtained further comprises: optimizing the current behavior baseline by using a pre-trained behavior baseline model to obtain a new behavior baseline for comparing and analyzing the subsequently collected interaction behavior data with the new behavior baseline; the behavior baseline model is a model trained based on behavior feature data of a user's successful login session in a historical process; In a preset verification period, the accuracy of the analysis result corresponding to the new behavior baseline is determined, and if the accuracy of the analysis result corresponding to the new behavior baseline is better than or equal to the accuracy of the analysis result corresponding to the last behavior baseline, it is determined that the current optimization is effective, otherwise, it is rolled back to the last effective version of the behavior baseline. 5.The self-adaptive identity authentication method based on intelligent risk quantification according to claim 1, characterized in that, The interaction behavior data includes the user's typing rhythm, mouse movement trajectory, page sliding speed and operation interval time; Correspondingly, the comparison and analysis of the interaction behavior data and the behavior baseline corresponding to the user to obtain the analysis result comprises: extracting features from the interaction behavior data to obtain a corresponding behavior feature vector; performing similarity calculation on the behavior feature vector and the behavior baseline corresponding to the user, determining the deviation degree between the behavior feature vector and the behavior baseline according to the similarity calculation result, and converting the deviation degree into a comparable abnormal quantization value; comparing the abnormal quantization value with a preset safety threshold, if the abnormal quantization value is greater than the preset safety threshold, it is determined that the interaction behavior data is abnormal. 6.The self-adaptive identity authentication method based on intelligent risk quantification according to claim 5, characterized in that, If the analysis result indicates that there is an abnormality, terminate the current session and guide the user to re-perform identity authentication, comprising: If the interaction behavior data is abnormal, the server agent sends a preset security decision to the authorization server to execute the preset security decision by using the authorization server; the preset security decision includes revoking the access token of the current session; Based on the authorization server, the authorization server notifies the corresponding resource server that the access token has been invalidated through a pre-established reverse control channel; The server agent sends a control instruction to re-perform identity authentication to the client agent to control the client agent to interrupt the user's current session in the client application according to the control instruction, and push security warning information and re-login guide information to the user interface.
7. The self-adaptive identity authentication method based on intelligent risk quantification according to claim 6, characterized in that, When the resource server receives the information that the access token has been invalidated, it further comprises: Mark the corresponding access token as an invalid token; If a resource access request carrying the invalid token is received, the resource access request is rejected and an error response is returned to the client application, so that the client application guides the user to re-perform identity authentication.
8. An adaptive identity authentication system based on intelligent risk quantification, characterized in that, Comprise: a data collection module for collecting context data of a user through a lightweight client agent embedded in a client application when the user accesses a target resource in an open identity connection protocol interaction, and sending an authorization request containing the context data to an authorization server by using the client application; the context data includes behavior feature data in the login process, device fingerprint data and network environment data; The risk assessment module is configured to perform risk quantitative assessment on the context data based on a server agent deployed in the authorization server, to obtain a risk score, and to determine a target identity authentication strength from preset identity authentication strengths according to the risk score; wherein the target identity authentication strength and the risk score are positively correlated. The first identity authentication module is configured to provide an identity authentication module corresponding to the target identity authentication strength to the user by using the authorization server, so as to perform identity authentication when the user logs in, and to start the current session when the user identity authentication is successful. The analysis module is configured to continuously collect behavior feature data of the user as interaction behavior data during the duration of the current session by using the client agent, and to send the interaction behavior data to the server agent, so as to compare and analyze the interaction behavior data with the behavior baseline corresponding to the user by using the server agent, to obtain an analysis result; wherein the behavior baseline is established when the user logs in for the first time. The second identity authentication module is configured to terminate the current session and guide the user to perform identity authentication again if the analysis result indicates that there is an anomaly. 9.The smart risk quantification based adaptive identity authentication system of claim 8, wherein, The risk assessment module comprises: The data input unit is configured to perform standardization processing on the context data, and to input the context data after the standardization processing into each special analysis engine in parallel; the special analysis engine comprises a device trust analysis engine configured to assess the reliability of a client device, a behavior feature analysis engine configured to compare the deviation degree of current behavior features and historical behavior baseline, a context intelligent analysis engine configured to analyze network environment features, and a threat intelligence analysis engine configured to match known attack patterns. The risk score unit is configured to comprehensively calculate analysis results output by each special analysis engine, to obtain a corresponding risk score. 10.The smart risk quantification based adaptive identity authentication system of claim 8, wherein, The analysis module comprises: The analysis unit is configured to optimize a current behavior baseline by using a pre-trained behavior baseline model, to obtain a new behavior baseline, and to compare and analyze subsequently collected interaction behavior data with the new behavior baseline; the behavior baseline model is a model trained based on behavior feature data of a successful login session in a historical process. The determination unit is configured to determine the analysis result accuracy corresponding to the new behavior baseline within a preset verification period, and to determine that the current optimization is effective if the analysis result accuracy corresponding to the new behavior baseline is better than or equal to the analysis result accuracy corresponding to a previous behavior baseline, otherwise to roll back to a previous effective version of the behavior baseline.