Authentication method and device for location privacy in communication link and electronic equipment

Abstract

The embodiment of the invention provides an authentication method and device for location privacy in a communication link and electronic equipment, and the method comprises the steps: determining a location fingerprint according to the location information of the communication link; generating a private protection position label according to the position fingerprint, wherein the protection position label comprises confusion data of the position fingerprint; associating the protection position label with the attribute characteristic of the communication link; and adjusting a management strategy of the position information of the communication link according to the protection position label.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to authentication methods, apparatus and electronic devices for location privacy in communication links. Background Technology

[0002] When implementing location-privacy-protected multi-mode authentication in communication links, the challenge lies in controlling the granularity of privacy protection strategies. On one hand, reasonable privacy protection strategies need to be formulated, specifying rules for the collection, storage, use, and sharing of location information to achieve fine-grained management and protection. However, overly strict privacy protection strategies may affect service quality and user experience, while overly lenient strategies may increase the risk of privacy leaks. On the other hand, different network environments and security threats require different authentication modes, such as password authentication, biometric authentication, and location authentication. However, frequent switching of authentication modes may lead to complexity and inconsistency in the authentication process, affecting efficiency and reliability. Simultaneously, the selection of authentication modes must also consider privacy protection needs to avoid excessive leakage of private information during authentication. Therefore, when implementing location-privacy-protected multi-mode authentication in communication links, balancing the relationship between privacy protection and service quality, selecting appropriate authentication modes under different network environments and security threats, and minimizing privacy leakage during authentication is a complex technical challenge. It requires comprehensive consideration of granular control of privacy protection strategies and adaptive switching of authentication modes to balance the needs of privacy protection and service quality, ensuring the security, reliability, and consistency of the authentication process. Summary of the Invention

[0003] The purpose of this application is to provide authentication methods, apparatus, and electronic devices for location privacy in communication links, which can ensure the security, reliability, and consistency of the authentication process.

[0004] To solve the above-mentioned technical problems, the embodiments of this application are implemented through the following aspects.

[0005] In a first aspect, embodiments of this application provide an authentication method for location privacy in a communication link, comprising: determining a location fingerprint based on location information of the communication link; generating a privacy-protected location tag based on the location fingerprint, the privacy-protected location tag including obfuscated data of the location fingerprint; associating the privacy-protected location tag with attribute features of the communication link; and adjusting the management strategy of the location information of the communication link based on the privacy-protected location tag.

[0006] Secondly, embodiments of this application provide an authentication mechanism for location privacy in a communication link, comprising: a determination module for determining a location fingerprint based on location information of the communication link; a generation module for generating a privacy-protected location tag based on the location fingerprint, wherein the privacy-protected location tag includes obfuscated data of the location fingerprint; an association module for associating the privacy-protected location tag with attribute features of the communication link; and an adjustment module for adjusting the management strategy of the location information of the communication link based on the privacy-protected location tag.

[0007] Thirdly, embodiments of this application provide an electronic device, including: a memory, a processor, and computer-executable instructions stored in the memory and executable on the processor, wherein the computer-executable instructions, when executed by the processor, implement the steps of the method described in the first aspect. Fourthly, embodiments of this application provide a computer-readable storage medium for storing computer-executable instructions that, when executed by a processor, implement the steps of the method described in the first aspect. In this embodiment of the application, by determining a location fingerprint based on the location information of the communication link; generating a private protected location tag based on the location fingerprint, the protected location tag including obfuscated data of the location fingerprint; associating the protected location tag with the attribute features of the communication link; and adjusting the management strategy of the location information of the communication link based on the protected location tag, the security, reliability and consistency of the authentication process can be ensured. Attached Figure Description

[0008] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0009] Figure 1 This illustration shows a flowchart of a location privacy authentication method in a communication link provided in an embodiment of this application; Figure 2 This illustration shows a flowchart of a location privacy authentication method in a communication link provided in an embodiment of this application; Figure 3 This illustration shows a flowchart of a location privacy authentication device in a communication link provided in an embodiment of this application; Figure 4 A schematic diagram of the hardware structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0010] To enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this application.

[0011] Figure 1 This diagram illustrates a flowchart of a session method provided in an embodiment of this application. This method can be executed by an electronic device, such as a terminal device or a server device. In other words, the method can be executed by software or hardware installed on the terminal device or server device. The server includes, but is not limited to, a single server, a server cluster, a cloud server, or a cloud server cluster. As shown, the method may include the following steps.

[0012] Step S102: Determine the location fingerprint based on the location information of the communication link.

[0013] In one possible implementation, this step may include acquiring the location information of the communication link; and fusing multi-source heterogeneous location data using a Kalman filter algorithm to generate a comprehensive location fingerprint.

[0014] Specifically, multi-granularity location data from communication links can be acquired, including base station location coordinate data obtained through cooperation with communication operators, and user-authorized GPS location data and WiFi hotspot data obtained through mobile applications, forming a multi-source heterogeneous location dataset. The acquired location data is preprocessed to clean invalid or abnormal data points and unify the coordinate system and format of data from different sources. Based on the accuracy and update frequency of the location data, the parameters of the Kalman filter algorithm are set, including the process noise covariance matrix and the measurement noise covariance matrix. The preprocessed multi-source location data is input into the Kalman filter algorithm to fuse location data of different granularities. The Kalman filter estimates the optimal location value through prediction and updating. Prediction estimates the current location based on the position and velocity at the previous moment, and updating corrects the predicted value based on the current observation value. Continuous iteration of prediction and updating yields the optimal location estimate. The location data fused by the Kalman filter algorithm contains information from different data sources, forming a comprehensive location fingerprint. This fingerprint includes not only location coordinates but also metadata such as the location timestamp, accuracy, and source. The accuracy of the fused location fingerprint can be evaluated by comparing it with high-precision GPS data and calculating metrics such as the mean and variance of the location error. The parameters of the Kalman filter algorithm are continuously adjusted to optimize the location data fusion effect. Finally, the generated fused location fingerprint data is saved to a database as the foundation for subsequent location-related applications. The database needs to support geographic location indexing and querying, such as PostGIS.

[0015] For example, when acquiring communication base station location data, one can cooperate with telecommunications operators such as China Mobile and China Unicom to obtain their nationwide base station location databases. This database contains information such as the latitude and longitude coordinates, coverage radius, and address of each base station. Simultaneously, by developing a mobile application and obtaining user authorization, GPS location data and WiFi hotspot data from the user's mobile phone can be collected. The mobile application can collect GPS location data every minute, with an accuracy within 10 meters. For WiFi hotspot data, surrounding WiFi signals can be scanned to obtain the MAC address, signal strength, etc., of each WiFi hotspot. Through these methods, a multi-source heterogeneous location dataset can be formed. During the preprocessing of the location data, data points with GPS location accuracy below 50 meters and WiFi signal strength below -80dBm can be filtered out, as these data may contain significant noise. Then, topology checking algorithms, such as the DBSCAN algorithm, can be used to detect and remove outliers. For data from different coordinate systems, a coordinate transformation library such as proj.4 can be used to uniformly convert them to the WGS84 coordinate system. When setting the parameters of the Kalman filter algorithm, different process noise covariance matrices and measurement noise covariance matrices can be set according to the characteristics of different data sources. For example, for GPS data, the process noise covariance matrix can be set to a variance of 10 meters, and the measurement noise covariance matrix to a variance of 5 meters. For WiFi hotspot data, due to the relatively low positioning accuracy, the process noise covariance matrix can be set to a variance of 50 meters, and the measurement noise covariance matrix to a variance of 30 meters. In the Kalman filter prediction, the position and velocity at the previous moment, as well as the accelerometer data at the current moment, can be used to estimate the current position. In the update, the current GPS position and WiFi hotspot position can be used to correct the predicted position. By continuously iterating through this update and prediction, an optimal position estimate can be obtained. For the generated comprehensive location fingerprint, the GeoHash algorithm can be used to encode it, generating a unique location identifier. This identifier not only contains location coordinate information but also metadata such as timestamp, accuracy, and source. Through GeoHash encoding, it is convenient to compare the distances between different locations and to perform location clustering analysis. When evaluating the accuracy of location fingerprints, high-precision differential GPS data can be used as a reference to calculate the Euclidean distance between the composite location fingerprint and the reference location, thus obtaining the location error. Statistical analysis of the errors from multiple location fingerprints yields indicators such as the mean and variance of the errors. If the error is found to be large, the parameters of the Kalman filter algorithm can be adjusted, such as increasing the value of the measurement noise covariance matrix, to adapt to different noise levels in different environments. Finally, the generated composite location fingerprint data can be stored using a PostgreSQL database, and the PostGIS plugin can be used to support geographic location indexing and querying.In databases, geometric objects such as points, lines, and polygons can be used to represent location information at different granularities. SQL statements allow for convenient querying, statistics, and analysis of location data, such as finding all locations within a given area or calculating the distance between two locations. This location data can serve as the foundation for subsequent location-related applications, such as location recommendation and trajectory mining.

[0016] Step S104: Generate a private protected location tag based on the location fingerprint, wherein the protected location tag includes obfuscated data of the location fingerprint.

[0017] In one possible implementation, this step may include: dynamically selecting location information of appropriate granularity from location fingerprints using a fuzzy C-means clustering algorithm based on the security level and privacy protection requirements of the communication link; performing desensitization processing using a differential privacy algorithm, while encrypting sensitive location data using a homomorphic encryption algorithm; generating location obfuscation data using a generative adversarial network algorithm; and obtaining privacy-protected location tags based on the location obfuscation data.

[0018] In one possible implementation, the security level information of the communication link can be obtained by assessing the type of communication protocol (e.g., 2G, 3G, 4G) and the strength of the encryption algorithm (e.g., AES, RSA). For user privacy protection needs, this information can be obtained through user settings or application permission requests. The strength of privacy protection for location data is determined based on the security level and privacy requirements. Location fingerprint data from multiple sources, such as base station positioning, GPS, and WiFi, is obtained. A fuzzy C-means clustering algorithm is used to divide location data of different granularities into several clusters. The number of clusters is determined by the parameter C of the fuzzy C-means algorithm; the larger the C value, the more clusters are generated, and the finer the granularity of the retained location data. The location granularity is adaptively selected by adjusting the C value. Fuzzy C-means clustering updates the membership matrix and cluster centers by minimizing the objective function, iteratively optimizing the clustering effect. For each clustered location data cluster, a differential privacy algorithm is used for de-identification. The core idea of ​​differential privacy is to add random noise to the original data, making it difficult for attackers to distinguish between two adjacent datasets, thereby protecting privacy. Commonly used differential privacy algorithms include the Laplace mechanism and the exponential mechanism. The Laplace mechanism adds noise following a Laplace distribution to the original data; the magnitude of the noise is determined by the parameters of the Laplace distribution. The exponential mechanism is suitable for protecting non-numerical data, introducing randomness through an exponential function. Differential privacy protects privacy while ensuring data availability. Building upon differential privacy, homomorphic encryption is also needed for important and highly sensitive location data. Homomorphic encryption allows computation on the ciphertext, and the decrypted result is identical to the result of the same computation on the plaintext. Common homomorphic encryption algorithms include semi-homomorphic and fully homomorphic encryption. Semi-homomorphic encryption only supports addition or multiplication operations on the ciphertext; representative algorithms include Paillier encryption and ElGamal encryption. Fully homomorphic encryption supports arbitrary polynomial computation on the ciphertext; a representative algorithm is lattice-based encryption. Location data encrypted with homomorphism can be aggregated for analysis without revealing the original location information. Generative Adversarial Networks (GANs) are used to generate location obfuscation data similar to real location data, further enhancing privacy protection. A Generative Adversarial Network (GAN) consists of a generator and a discriminator. The generator generates fake data, and the discriminator determines whether the data is real or fake. Through game-like training between the two networks, the generated fake data becomes difficult to distinguish from real data. By mixing the generated obfuscated location data with anonymized and homomorphically encrypted real location data, attackers will find it difficult to identify which locations are real, thus achieving privacy protection. The mixed location data is then integrated to form a privacy-preserving location dataset. This integration requires a well-designed data format and storage structure that facilitates data management and use while minimizing the risk of privacy breaches.The privacy of the generated privacy-preserving location dataset is evaluated using a privacy attack simulation method to test the risk of privacy leakage under different background knowledge and attack strengths. Common privacy attacks include linking attacks and differential attacks. Based on the evaluation results, weaknesses in privacy protection are analyzed, and targeted improvements are made to the strategies and algorithms for location data anonymization, encryption, and obfuscation. Further improvements to privacy protection performance are achieved through iterative optimization.

[0019] For example, when obtaining security level information of a communication link, this can be achieved by analyzing the message format and encryption algorithm of the communication protocol. For instance, for a 4G network, the AES-128 encryption algorithm used can be detected, and the security level can be determined based on the AES key length; the longer the key length, the higher the security level. Similarly, for user privacy protection needs, a quantitative index can be designed to classify users' emphasis on privacy protection into levels 1-5, where level 1 represents the least emphasis on privacy and level 5 represents the most emphasis on privacy. The final privacy protection level is determined based on the user's choice. When using the fuzzy C-means clustering algorithm to process location fingerprint data, the location fingerprint can first be divided into different granularity levels based on the granularity of the location, such as province, city, district, street, etc. Then, appropriate fuzzy C-means clustering parameters can be selected, such as the cluster number C ranging from [2, 10], the threshold of the membership matrix U being 0.001, and the number of iterations for the cluster center V being 100. By continuously adjusting these parameters, the correspondence between granularity levels and clustering results is obtained, enabling adaptive selection of location granularity. For example, when C=5, clustering results at three granularity levels—province, city, and district—may be obtained. When using differential privacy for location data anonymization, different differential privacy parameters can be set according to the sensitivity of the location. For example, for city-level locations, the privacy budget ε can be set to 0.1, meaning that the probability of distinguishing any two adjacent locations in the dataset does not exceed exp(0.1) when the leakage probability does not exceed exp(0.1). For district-level locations, the privacy budget ε can be appropriately relaxed to 0.5. In specific implementation, a Laplace mechanism can be used to generate corresponding Laplace noise based on the preset privacy budget ε, which is then added to the original location data to achieve anonymization. When using Paillier semi-homomorphic encryption to protect important and sensitive locations, they can first be classified according to their importance, such as level 5 representing the most sensitive location requiring the highest strength of encryption protection, and level 1 representing the least sensitive location. Then, different Paillier encryption parameters are selected based on different sensitivity levels, such as the length of the public key and the choice of random numbers. The encrypted location ciphertext can be directly used for statistical analysis, such as summation and averaging, without decryption. For example, for 100 district-level locations, their encrypted ciphertexts can be summed directly, and then decrypted using the private key to obtain the plaintext sum of these 100 locations without revealing any individual location's privacy information. When using generative adversarial networks to generate location obfuscation data, the Wasserstein GAN (WGAN) model can be chosen, as it can generate more stable and high-quality data samples. WGAN's discriminator removes the Sigmoid function and uses Wasserstein distance as the loss function, which can better measure the distribution difference between the generated data and the real data.During training, the learning rates for the generator and discriminator can be set to 0.0001 and 0.0005, respectively, with a batch size of 64 and 5000 training iterations. By adjusting these parameters, the generator's performance can be continuously optimized to generate obfuscated data that is highly similar to real location data, thereby effectively protecting privacy. When evaluating the privacy of privacy-preserving location datasets, various privacy attack scenarios can be designed, such as background knowledge attacks and member inference attacks, to assess the privacy leakage risk of the dataset from different perspectives. For example, in a background knowledge attack, it is assumed that the attacker possesses some users' location information and infers the locations of other users by linking it to the anonymized location dataset. Therefore, the (ε,δ)-discriminability metric in differential privacy can be used to quantify the privacy leakage risk. In experiments, different scales of background knowledge can be simulated, such as 10%, 20%, and 50% known locations, to evaluate the effectiveness of privacy protection. Based on the evaluation results, the parameters of the location data anonymization algorithm can be optimized, such as increasing the privacy budget ε, to resist stronger privacy attacks. Simultaneously, the usability of the data must also be considered to avoid excessive loss of useful information.

[0020] Step S106: Associate the protected location tag with the attribute characteristics of the communication link.

[0021] Network traffic data from communication links is collected in real time using network probes, and key network environment parameters such as network type, signal strength, bandwidth, and latency are extracted using packet parsing tools. Simultaneously, performance metrics of network devices, such as CPU utilization, memory usage, and packet loss rate of routers and switches, are collected periodically through the network management system. Furthermore, parameters such as the type, priority, and QoS requirements of communication services, as well as user attribute information, such as user type, privacy protection preferences, and location sharing range, need to be obtained. The acquired multi-dimensional data on the communication link network environment, service type, and user attributes are correlated with privacy-preserving location tags to construct a multi-dimensional location privacy protection policy dataset. Each sample in the dataset contains attribute values ​​for multiple dimensions, including network environment, service type, user attributes, and location tags, as well as the corresponding optimal privacy protection policy. A random forest algorithm is used to train the location privacy protection policy dataset, generating a privacy protection policy generation model. Random forests, by constructing multiple decision trees and combining their outputs, can effectively handle high-dimensional attribute data and automatically extract key attribute features. The generalization performance of the model is optimized by setting parameters such as the number of trees and the number of attributes for node splitting. The network environment, service type, and user attributes of the communication link are input into a trained random forest model to automatically generate the optimal location privacy protection strategy for the given scenario. This strategy includes configuration parameters across multiple dimensions, such as location information collection frequency, encryption algorithm, and access permissions, and can be dynamically adjusted according to different scenarios to achieve fine-grained management of location privacy. Based on the generated privacy protection strategy, the management strategy for location information in the communication link is dynamically adjusted. In mobile communication networks, the sampling frequency of location information is changed by adjusting parameters such as the paging cycle and location update cycle of the base station. In situations with poor network conditions and high user privacy protection requirements, the sampling frequency of location information is reduced, for example, from once per minute to once every 10 minutes. Conversely, in situations with good network conditions and high real-time service requirements, the location sampling frequency is increased, for example, to once every 10 seconds, to provide more accurate location services. Different encryption algorithms are selected to encrypt location information according to the privacy protection strategy. For highly sensitive location information, an attribute-based encryption (ABE) algorithm is used, generating a key based on user attributes; only users meeting specific attribute conditions can decrypt the information.

[0022] Step S108: Adjust the management strategy for the location information of the communication link according to the protected location tag.

[0023] The ABE algorithm supports fine-grained access control, enabling encryption control for different users and services. For ordinary location information, symmetric encryption algorithms such as AES are used to improve encryption and decryption efficiency. Access permissions for location information are set for different user groups and service scenarios based on privacy protection policies. In mobile applications, access to location information by different services is controlled through dynamic request and granting of location permissions. For sensitive user groups, such as minors, their location information is only authorized to necessary services like navigation, while access to other services is prohibited. In the database, different levels of location information access permissions are granted to different user groups by setting different granularity database views and access control rules. In public places, location information can be authorized for a wider range of services, while in private places, explicit user authorization is required to access the location, thus achieving hierarchical management of location privacy.

[0024] For example, when collecting network environment parameters for communication links, network traffic analysis tools such as Wireshark can be used to capture transmitted data packets in real time through traffic probes deployed at key nodes of the communication link. Then, using the PCAP packet parsing library, the TOS field in the IP packet header is extracted to determine the network service type; the window size and retransmission count of TCP packets are extracted to estimate network bandwidth and latency; and wireless signal indicators such as RSSI and SNR are analyzed to assess signal strength and coverage quality. Simultaneously, performance parameters of network devices, such as CPU utilization and memory usage, are periodically collected via the SNMP protocol, every 5 minutes. When these indicators exceed a preset threshold, such as 80%, a network congestion warning is triggered, and network resource configuration is dynamically adjusted. When constructing a location privacy protection strategy dataset, more than 20 attribute dimensions can be collected for each sample, including network environment attributes such as network latency and packet loss rate, service attributes such as service type and interaction frequency, user attributes such as age and occupation, and corresponding location privacy protection strategies such as location information sampling frequency and encryption algorithms. Then, data preprocessing methods are used to clean, transform, and standardize data from different sources and formats, constructing a structured multidimensional attribute dataset. When training the privacy-preserving strategy generation model, feature engineering is first performed on the dataset. Feature selection algorithms such as information gain and chi-square test are used to select the Top-N attributes with the highest correlation to the privacy-preserving strategy, reducing the data dimensionality. Then, a random forest algorithm is used for model training. By integrating multiple decision trees and considering the influence of different attributes, the optimal privacy-preserving strategy is predicted. During training, methods such as grid search are used to optimize the hyperparameters of the random forest, such as the number of decision trees and the maximum tree depth, improving the model's accuracy. When the model's accuracy on the test set exceeds 90%, it can be deployed to the production environment. When dynamically adjusting the location information collection frequency, the network status of the communication link and business requirements can be analyzed to set different location update strategies. For example, in 4G networks, the location update cycle can be set to 10 seconds to obtain the user's real-time location; in 2G networks, the location update cycle can be set to 1 minute to reduce power and data consumption; in services with high real-time requirements, such as voice calls, GPS positioning can be used, updating the location once per second; while in background applications, base station positioning can be used, updating the location every 10 minutes. By dynamically adjusting the location information collection strategy, the collection of privacy data can be minimized while meeting business needs. When encrypting and protecting location information, different encryption algorithms can be selected according to the sensitivity level of the location. For example, for GPS locations accurate to the meter level, high-strength algorithms such as homomorphic encryption can be used, supporting aggregation analysis in an encrypted state.Specifically, the Paillier homomorphic encryption algorithm can be used to encrypt the latitude and longitude coordinates of the location, and the encrypted ciphertext is uploaded to the server. On the server side, calculations such as summation and averaging can be performed directly on the ciphertext; the results are still encrypted. Only after decryption with the private key can the plaintext location aggregation result be obtained, thus preventing the leakage of privacy data. When setting access permissions for location information, a role-based access control (RBAC) model can be adopted, setting different location information access policies according to the roles of different subjects. For example, ordinary users can only access their own location information; application developers can only access the location information of authorized users; data analysts can access anonymized location information; and administrators can access the original location information. Simultaneously, a quota management mechanism is used to limit the frequency and quantity of location data accessed by different subjects, such as a maximum of 100 accesses per day, with a maximum of 1000 location records per access. Through fine-grained permission control and quota restrictions, unauthorized access and abuse of location privacy data are prevented.

[0025] The location privacy authentication method in the communication link provided in this application embodiment can ensure the security, reliability and consistency of the authentication process.

[0026] Figure 2 This diagram illustrates a flowchart of a session method provided in an embodiment of this application. This method can be executed by an electronic device, such as a terminal device or a server device. In other words, the method can be executed by software or hardware installed on the terminal device or server device. The server includes, but is not limited to, a single server, a server cluster, a cloud server, or a cloud server cluster. As shown, the method may include the following steps.

[0027] Steps S202-S208 are described in the same way as S102-108, and will not be repeated here. S209: Obtain the device fingerprint, user identity, and access behavior of the communication link as authentication elements; use a convolutional neural network algorithm to extract and fuse features from heterogeneous authentication elements to generate a comprehensive authentication fingerprint.

[0028] By analyzing network device logs in the communication link, information such as device hardware configuration, operating system version, and network protocol stack parameters is collected using protocols such as Syslog and SNMP to generate a device fingerprint combining hardware and software. Simultaneously, device location information and connected base station information are recorded as supplementary data to the device fingerprint. User identity information from the communication link is obtained, including user account, SIM card number, IMSI, IMEI, and biometric information such as fingerprints and iris scans. Considering the real-time requirements of authentication scenarios, the identity information is processed using efficient symmetric encryption algorithms such as AES or hash algorithms such as SHA-256 to generate user authentication elements. The processed identity information is only verified by a trusted third party during authentication to ensure security. User access behavior data from the communication link is collected using technologies such as DPI and NetFlow, including communication behaviors such as the frequency, duration, and data volume of calls, SMS, and data services, as well as application usage behaviors such as the frequency and duration of app usage. Statistical analysis is performed on this behavioral data to extract key features as a digital representation of user behavior, generating user behavior authentication elements. Heterogeneous authentication elements such as device fingerprints, user identities, and access behaviors are aggregated to construct a unified authentication element dataset. Since the data types and formats of different authentication elements vary, data preprocessing techniques are required to clean, transform, and normalize them. Regular expression matching is used to filter out abnormal data, one-hot encoding is used to convert discrete data into vector representations, and max-min normalization is used to scale numerical data to the [0, 1] interval, ultimately forming structured multidimensional heterogeneous authentication element data. A convolutional neural network algorithm is employed to learn and fuse features from the multidimensional heterogeneous authentication element data. A network structure consisting of 3 convolutional layers and 2 fully connected layers is designed. The convolutional layers extract local features with 32, 64, and 128 kernels of 3x3 size and ReLU activation function. The fully connected layers fuse features from various dimensions with 256 and 128 neurons of ReLU activation function. The final fully connected layer has the same number of neurons as the dimension of the authentication fingerprint and uses Sigmoid activation function. The authentication element data is converted into a multi-channel two-dimensional matrix, which is then input into the network for training, ultimately resulting in a compressed, comprehensive authentication fingerprint vector. This authentication fingerprint vector integrates key features from multiple dimensions, including device fingerprint, user identity, and access behavior, uniquely representing a communication entity. During the training of the convolutional neural network, data augmentation, regularization, and cross-validation are employed to improve the model's generalization ability and robustness.The original authentication data is transformed through random rotation, translation, and noise addition to generate more training samples. L1 and L2 regularization terms are added to the model's loss function to limit the size of model parameters and reduce the risk of overfitting. The dataset is divided into multiple mutually exclusive training and validation sets for cross-training and evaluation, and the model with the best generalization performance is selected. Furthermore, adversarial example training techniques are employed to construct various forms of attack samples, such as fake device fingerprints, forged user identities, and simulated abnormal access behaviors, and these are added to the training data to enhance the model's robustness. Simultaneously, an attention mechanism is introduced to dynamically adjust the weights of different authentication elements according to the security requirements of different authentication scenarios, improving authentication accuracy. The trained convolutional neural network model is deployed to the access authentication node of the communication link to perform real-time authentication of accessing communication entities. During authentication, authentication elements such as device fingerprints, user identities, and access behaviors of the communication entity are extracted and input into the model to obtain the entity's comprehensive authentication fingerprint vector. To manage authentication fingerprints, a distributed authentication fingerprint database is constructed, employing a hot-cold separation storage strategy. Authentication fingerprints are divided into hot and cold data, stored separately in memory, SSDs, and HDDs to optimize access performance. Simultaneously, the authentication fingerprint database is version-managed, recording the time, reason, and content of each update for easy problem localization and rollback. During authentication, the extracted authentication fingerprint is compared with fingerprints in the database, and a similarity score is calculated. If the similarity exceeds a preset threshold, such as 0.9, authentication is considered successful, and access is allowed; otherwise, authentication fails, and access is denied. Through authentication fingerprint comparison, rapid authentication of communication entities is achieved within milliseconds, ensuring secure access to the communication link.

[0029] For example, when collecting network device fingerprints, the SNMP protocol can be used to periodically poll the device's MIB database to obtain static attributes such as the device's hardware serial number, model, and number of ports, as well as dynamic attributes such as CPU utilization, memory usage, and packet throughput. Then, the Syslog protocol is used to capture system logs and alarm logs generated by the device in real time, analyzing key events such as device restarts, configuration changes, and link interruptions to generate a profile of the device's operational status. These static attributes, dynamic attributes, and operational status information are combined according to certain rules to generate a 64-byte device fingerprint, serving as the device's unique identifier. If the device fingerprint changes by more than a certain threshold (e.g., 20%), an alarm is triggered, indicating that the device may have been tampered with. For user authentication elements, a one-way hash function based on the SHA-256 algorithm can be used to irreversibly map the user's IMSI, IMEI, and other private information, resulting in a fixed-length 256-bit output. Then, using the AES-256 algorithm and the device fingerprint as the key, the hashed identity information is encrypted to generate a 256-bit authentication password, ensuring that user identity information is not leaked during transmission and storage. During authentication, the access authentication node sends a random challenge, and the user terminal generates a response using the same algorithm. The node verifies whether the response matches the expectation, completing identity confirmation. When extracting user behavior features, NetFlow technology can be used to record information such as the source and destination IP addresses, port numbers, protocol types, number of data packets, and traffic size of user communication on a session-by-session basis. For application layer protocols such as HTTP and DNS, DPI technology can also be used to deeply analyze protocol fields and extract features such as the URL, request method, and UserAgent for HTTP requests, and the domain name and request type for DNS requests. Then, the TF-IDF algorithm is used to perform statistical analysis on various behavioral features, calculate the importance weight of each feature, and select the Top-K (e.g., K=50) features with the highest weights as the user behavior profile. When fusing heterogeneous authentication elements, the data format and numerical range of various elements need to be normalized first. For fixed-length data such as device fingerprints and identity passwords, they can be directly converted into normalized floating-point vectors. For behavioral feature vectors, the Min-Max normalization method can be used to linearly scale the feature values ​​to the [0,1] interval. Then, the various normalized authentication elements are concatenated into a high-dimensional feature vector, which serves as the input to the convolutional neural network. The first layer of the network uses 128 3x3 convolutional kernels to extract local features; the second layer uses 256 3x3 convolutional kernels to further abstract the features; and the third layer uses two 3x3 convolutional kernels to compress the feature dimension. After each convolutional layer, 2x2 max pooling is used to downsample the feature map, and the ReLU activation function is used to increase the non-linearity of the features.Following the convolutional layers, two fully connected layers are used, each containing 512 and 256 neurons respectively, to non-linearly combine the features. The final fully connected layer contains 128 neurons and uses the sigmoid activation function to output a 128-dimensional authentication fingerprint vector. During the training of the convolutional neural network, 80% of the historical authentication data is randomly sampled as the training set and 20% as the validation set, and 10-fold cross-validation is used to evaluate the model performance. Using the authentication accuracy on the validation set as the metric, the model hyperparameters, such as kernel size, number of convolutional layers, number of fully connected layers, and learning rate, are fine-tuned using grid search. An EarlyStopping mechanism is used to automatically terminate training based on validation set performance to avoid overfitting. To address potential authentication attacks, such as man-in-the-middle attacks and replay attacks, 10% adversarial examples are added to the historical authentication data, and an adversarial term is introduced into the loss function to improve the model's resistance to attacks. Furthermore, an L2 regularization term is used to penalize excessively large model parameters, further improving the model's generalization performance. During the model deployment and authentication implementation phases, data such as successfully authenticated device fingerprints, user identities, and behavioral characteristics are extracted from historical data to construct an authentication fingerprint database that supports rapid querying. Data structures such as Bloom filters are used to index the authentication fingerprints, achieving millisecond-level fingerprint matching. For devices authenticating for the first time, their authentication fingerprints are inserted into the fingerprint database, and incremental learning algorithms are used to periodically update model parameters to adapt to dynamic changes in the network environment. For devices that fail authentication, their authentication fingerprints are recorded and compared with a known malicious fingerprint database to achieve real-time early warning of potential threats.

[0030] S210: Associate the integrated authentication fingerprint with the location tag of the communication link, network type, and security threat; construct an authentication policy knowledge base through inference algorithms, and use Markov decision process algorithms to dynamically optimize and adaptively infer the authentication policy to obtain the optimal authentication policy in different scenarios; adjust the authentication mode, authentication protocol, and authentication strength of the communication link in real time according to the policy.

[0031] Location tag information in the communication link is acquired, including the geographical location, coverage area, and location type of the communication. A Kalman filter algorithm is used to fuse multi-source location data to generate a comprehensive location tag. The Kalman filter recursively estimates the state variables of the location through prediction and updating. Prediction uses the previous time-instance location estimate and velocity information to provide a prior estimate of the current location; updating uses the current time-instance location observation to correct the prior estimate, obtaining a posterior estimate. By adjusting the Kalman gain matrix to control the weight between the prior estimate and the observation correction, the optimal location estimate can be obtained. Simultaneously, network type information of the communication link is collected, such as 2G, 3G, 4G, 5G, and other wireless communication networks, as well as short-range communication networks such as WiFi and Bluetooth, to obtain network type tags. Furthermore, security threat information of the communication link needs to be collected. Security threats currently faced by the communication link, such as DDoS attacks, DNS hijacking, and man-in-the-middle attacks, are extracted from security devices such as network intrusion detection systems, malware detection systems, and spam detection systems, generating security threat tags. Security threat labels can be used as one of the observation values ​​of the MDP (Multi-Level Device), dynamically adjusting the MDP's reward function and guiding the agent to choose a more secure authentication strategy. The obtained location labels, network type labels, security threat labels, and comprehensive authentication fingerprints are associated to construct a multi-dimensional communication scenario feature vector. One-Hot encoding and other methods are used to convert discrete label attributes into continuous vector representations, forming attribute features for case reasoning. Authentication strategies are designed for different communication scenarios. The authentication strategy includes multiple elements such as authentication mode, authentication protocol, and authentication strength. Authentication modes are divided into one-way authentication and two-way authentication. One-way authentication only needs to verify the identity of one end of the communication, such as the user equipment; while two-way authentication needs to verify the identities of both parties, such as the user equipment and the access gateway. Authentication protocols include EAP, CHAP, PAP, etc., each with its own advantages and disadvantages in terms of security, latency, and computational overhead. Authentication strength is divided into three levels: weak authentication, medium authentication, and strong authentication. Weak authentication only verifies the legitimacy of the communication device; medium authentication, in addition to device legitimacy, also verifies the authenticity of the user's identity; strong authentication also verifies the compliance of the user's behavior. When designing authentication strategies for different scenarios, a comprehensive utility function U(s, p) needs to be defined, where s represents security, p represents performance, and the function value represents the overall score between security and performance. The utility function can be in the form of a weighted sum, i.e., U(s, p) = w1s + w2p, where w1 and w2 are the weight coefficients for security and performance. When designing authentication strategies, the strategy with the highest comprehensive utility is selected as the candidate. A case-based reasoning algorithm is used to construct an authentication strategy knowledge base. Representative communication scenarios, such as high-risk areas, high-traffic services, and critical time periods, are selected from historical communication data, and the authentication process under these scenarios is analyzed to summarize successful and unsuccessful cases.For successful authentication cases, extract the authentication strategies, processes, and key nodes used to create a case template. For failed authentication cases, analyze the reasons for failure, summarize improvement measures, and create a negative case. Organize these case templates and negative cases into a hierarchical case library and establish an association index between cases to facilitate subsequent rapid retrieval and matching. When performing case reasoning, an attribute-weighted similarity measurement method is used, defining the similarity between two cases as sim(C1, C2) = sum_{i=1}^{n}w_i*sim_i(C1, C2), where C1 and C2 are two cases, n is the number of attributes in the cases, w_i is the weight of the i-th attribute, and sim_i(C1, C2) is the local similarity of the i-th attribute. Local similarity can be calculated using different methods depending on the attribute type; for numerical attributes, normalized Euclidean distance can be used; for Boolean attributes, XOR operation can be used; and for enumerated attributes, a semantic similarity dictionary can be used. In the actual authentication strategy selection process, a Markov Decision Process (MDP) algorithm is employed to dynamically evaluate and optimize candidate authentication strategies. MDP models the authentication process as a discrete-time, finite-state stochastic process, comprising five core elements: a set of states S, a set of actions A, a transition probability matrix P, a reward function R, and a discount factor γ. States can be defined as different stages of the authentication process, such as device authentication, user authentication, and behavioral authentication; actions are defined as the authentication strategies that can be chosen in each state; transition probabilities represent the probability of transitioning to the next state after choosing an action in the current state; the reward function represents the combined security and performance gains obtained after choosing an action in the current state; and the discount factor represents the degree of decay of future gains, reflecting the impact of the current decision on long-term benefits. The goal of MDP is to find an optimal strategy sequence that achieves the best balance between authentication security and performance. Specifically, the MDP performs policy optimization. First, based on the characteristics of the current communication scenario, it retrieves the Top-N cases with the highest similarity from the authentication policy knowledge base. Then, for each of these N candidate policies, it evaluates its security score and performance score in the current scenario. Next, it uses the MDP to calculate the long-term expected return of each policy, weighing security and performance, and selects the policy with the highest return. Finally, it applies the selected optimal policy to the actual authentication process and updates the expected return value of the policy based on the authentication results, forming a closed-loop reinforcement learning process. In the policy selection process of the MDP, an adaptive mechanism is introduced to dynamically adjust the state transition probability and reward function of the MDP. Specifically, the UpperConfidenceBound (UCB) algorithm can be used to balance "exploration" (trying new policies) and "exploitation" (selecting the current optimal policy), continuously updating the expected return estimate of each policy, and thus selecting the globally optimal policy.The specific formula for calculating UCB is UCB(a) = Q(a) + c * sqrt{frac{logt}{N(a)}}, where a is an optional policy, Q(a) is the estimated expected return of policy a, t is the current time step, N(a) is the number of times policy a is selected, and c is the exploration factor. The UCB algorithm selects the policy with the largest current UCB value as the optimal policy. Furthermore, an active learning mechanism can be introduced to proactively initiate authentication requests for candidate policies with high uncertainty, collect feedback data, and reduce the uncertainty of policy evaluation. Considering the dynamic changes in the network environment, a forgetting mechanism is also needed to attenuate past decision data, reduce the impact of outdated data, and improve the timeliness of MDP decision-making. Based on the optimal authentication policy obtained by the MDP algorithm, the authentication parameter configuration of the communication link is dynamically adjusted. A policy execution function E(M, C, P) is defined, where M is the MDP model, C is the current communication scenario, and P is the authentication parameter. After selecting the optimal policy according to the MDP model, the execution function extracts the authentication parameter configuration from the policy and fine-tunes the parameter values ​​according to the communication scenario. For example, if the current network type is WiFi, the computational intensity of the authentication protocol can be appropriately reduced to decrease authentication latency; if the current location is a home environment, the security level of the authentication mode can be appropriately lowered to improve user experience. The range of parameter fine-tuning can be preset, for example, the reduction in computational intensity should not exceed 20%, and the reduction in security level should not exceed one level.

[0032] For example, when fusing multi-source location data to generate a comprehensive location tag, the Extended Kalman Filter (EKF) algorithm can be used to construct a nonlinear state-space model by using location data from different sources such as GPS, base station positioning, and WiFi positioning as observations. State variables can include position, velocity, acceleration, etc., while observation variables are various measured location data. EKF transforms the nonlinear model into a linear model by linearizing the state transition function and observation function, and then uses the standard Kalman Filter algorithm for prediction and updating. For example, GPS location can be used as an observation with an observation noise variance of 10 meters; base station positioning location can be used as an observation with an observation noise variance of 100 meters; and WiFi positioning location can be used as an observation with an observation noise variance of 50 meters. By adjusting the process noise covariance matrix and observation noise covariance matrix in EKF, the model's trust level in various observations can be controlled, thereby obtaining the optimal location estimate. When constructing the utility function of the authentication strategy, the security index can be quantified as an authentication strength level, with a value range of [0,1], where 0 represents no authentication and 1 represents the highest level of authentication. The performance metric is quantified as authentication latency in milliseconds. The utility function can then be expressed as U(s,t) = w1s - w2t, where s is the authentication strength, t is the authentication latency, and w1 and w2 are the weighting coefficients for security and performance, respectively. For example, a w1 value of 0.6 and a w2 value of 0.4 indicate a greater emphasis on authentication security. If an authentication strategy has an authentication strength of 0.8 and an authentication latency of 500 milliseconds, its utility score is 0.6 * 0.8 - 0.4 * 0.5 = 0.28. During strategy design, the strategy with the highest utility score can be selected from the candidate strategies. When constructing an authentication strategy knowledge base based on case-based reasoning, case similarity can be calculated by multiplying attribute vectors and weight vectors, i.e., sim(C1,C2) = C1 * W, where W is the weight vector of each attribute. Taking network access authentication as an example, the attributes of a case can include network type, access location, authentication time, user role, device type, etc. Accordingly, the weight vector W can be set to [0.3, 0.2, 0.1, 0.2, 0.2], indicating that network type and user role are key attributes determining the authentication strategy. Given a new access authentication request, its attribute feature vector C1=[4G, office, working hours, employee, mobile phone] is extracted. Then, its similarity score with each case in the knowledge base can be calculated, and the top 3 cases with the highest similarity are selected as candidate authentication strategies. When implementing MDP to dynamically optimize the authentication strategy, the transition frequency and cumulative reward of each state-action pair can be statistically analyzed based on historical authentication data to construct an MDP model.Taking the two-way authentication process as an example, the state can be defined as {Device not authenticated, Device authenticated, User not authenticated, User authenticated, Authentication failed, Authentication successful}, and the action can be defined as {Request device authentication, Request user authentication, Use device fingerprint authentication, Use username and password authentication, Use biometric authentication, End authentication}. By statistically analyzing historical authentication logs, the state transition frequency can be obtained. For example, under the action "Request device authentication," the state "Device not authenticated" transitions to the state "Device authenticated" 80% of the time, and to the state "Authentication failed" 20% of the time. Simultaneously, a reward value can be assigned to each state-action pair based on the authentication result. For example, under the action "Use biometric authentication," the state "User not authenticated" receives a reward of 1 if authentication is successful, and a reward of -1 if authentication fails. Based on the transition frequency and reward value, the expected benefit of each action can be calculated. In actual authentication decision-making, the MDP model selects the action with the highest expected benefit based on the current state to guide the next authentication operation. When dynamically fine-tuning authentication parameters, a base value and an adjustment threshold can be preset for parameter adjustment. Taking the computational strength of an authentication protocol as an example, assuming the default computational strength is 128 bits and the parameter adjustment threshold is 20%, the computational strength can be adjusted between 102 and 154 bits. If the current network type is 5G, the computational strength is adjusted to 154 bits to ensure sufficient security; if the current network type is 2G and the current location is at home, the computational strength is adjusted to 102 bits to achieve a balance between security and performance. The rules for parameter fine-tuning can be based on pre-defined settings or automatically learned from historical data using machine learning algorithms. For example, a decision tree algorithm can be used, using network type, location type, time period, etc., as features, and authentication result quality as labels, to train an authentication parameter adjustment strategy. When a new authentication request arrives, its contextual features are extracted and input into the decision tree to obtain the corresponding parameter adjustment value.

[0033] S211: Employs a Hidden Markov Model algorithm to monitor real-time changes in the location and abnormal behavior of the communication link; if a high-risk situation such as a sudden change in location or abnormal behavior is detected, authentication or disconnection of the link is triggered.

[0034] A location state model and a behavior state model of the communication link are constructed. The location state includes attributes such as location coordinates, movement speed, and acceleration, while the behavior state includes attributes such as communication frequency, communication duration, and data volume. Each state attribute is discretized according to a certain time granularity, forming a finite state space. Based on historical location and behavior change data, the transition probability matrix between each state and the observation probability matrix under each state are statistically analyzed, thereby constructing a Hidden Markov Model for the location and behavior states. During the authentication process, location and behavior information of the communication link are collected in real time, including location data such as GPS coordinates, base station positioning, and WiFi positioning, as well as behavior data such as various header fields and payload fields of the communication messages. For the collected location data, Kalman filtering, particle filtering, and other methods are used for data fusion and noise reduction to extract statistical features such as mean, variance, and velocity. For the behavior data, bag-of-words model, TF-IDF, and other methods are used to extract key fields and statistical features of the communication messages, such as source address, destination address, communication frequency, and data volume. The extracted features are mapped to the discretized state space to form an observation sequence. The forward algorithm is used to calculate the likelihood probability of the observed sequence in both the position-state Hidden Matrix (HMM) and the behavior-state Hidden Matrix (HMM). The forward algorithm recursively calculates the forward probability variable, i.e., the probability of the observed sequence being in each state at each time step, with a time complexity of O(N^2T), where N is the number of states and T is the length of the observed sequence. By comparing the forward probabilities of the position and behavior states, it is determined whether the current link's position and behavior are abnormal. The Viterbi algorithm is used to calculate the most probable hidden state sequence of the observed sequence in both the position-state and behavior-state HMMs. The Viterbi algorithm recursively calculates the maximum probability of each state at each time step, while simultaneously recording the predecessor state with the maximum probability, also with a time complexity of O(N^2T). By analyzing the most probable state sequence, it is determined whether the link's position change trajectory and behavior change pattern are reasonable. Finally, by combining multiple factors such as the position-state likelihood probability, the behavior-state likelihood probability, the most probable position-state sequence, and the most probable behavior-state sequence, a comprehensive assessment of the communication link's risk level is performed. For location status, risk is quantified by calculating the deviation between the current location and historical locations. The degree of deviation can be measured using metrics such as Mahalanobis distance and KL divergence; a larger deviation results in a higher risk score. For behavioral status, risk is quantified by calculating the difference between current behavioral characteristics and normal behavioral characteristics. The degree of difference can be measured using metrics such as Euclidean distance and cosine similarity; a larger difference results in a higher risk score. When calculating the overall risk score, location risk and behavioral risk can be assigned different weights. For example, if the weight of location risk is 0.6 and the weight of behavioral risk is 0.4, then the overall risk score = location risk score 0.6 + behavioral risk score 0.4. If the overall risk score exceeds a preset threshold, such as 0.8, it is considered a high-risk situation. Based on the risk assessment results, the authentication strategy is adaptively adjusted.If the overall risk score is low, such as less than 0.3, the original authentication strategy remains unchanged. If the overall risk score is at a medium level, such as 0.3 to 0.8, a secondary authentication mechanism is triggered to increase authentication strength, such as adding a behavioral authentication step on top of device authentication and user authentication, or using a stronger encryption algorithm. If the overall risk score is very high, such as greater than 0.8, the communication link is directly disconnected, and service is refused until the risk score decreases to an acceptable range. While adjusting the authentication strategy, the parameters of the HMM model also need to be updated to adapt to the dynamic changes in the network environment. The Baum-Welch algorithm is used to iteratively optimize the HMM parameters, that is, to continuously adjust the state transition probability matrix and observation probability matrix based on the newly added observation sequences, so that the likelihood probability of the model for new data continuously increases. Specifically, the forward-backward algorithm is used to calculate the forward and backward probabilities, and then the expected number of transitions for each pair of states at each time step and the expected number of occurrences of each state at each time step are calculated based on the product of the forward and backward probabilities, thereby updating the state transition matrix and observation matrix. The number of iterations can be dynamically adjusted based on the trend of the likelihood probability. The iteration terminates when the increase in the likelihood probability falls below a certain threshold, such as 0.001. Meanwhile, to balance the stability and adaptability of the model, a forgetting factor is introduced, weighting past data according to a certain decay rate, with earlier data having smaller weights and newer data having larger weights.

[0035] For example, when constructing a positional state HMM, the location space can be divided into MN grids, each grid representing a discrete state. For instance, a 100m x 100m area can be divided into 10 x 10 grids, each with a size of 10m x 10m. Based on historical trajectory data, the transition frequency matrix between each grid is calculated, i.e., the frequency of transition from grid i to grid j. The frequency matrix is ​​then normalized to obtain the state transition probability matrix. Simultaneously, based on statistics such as average velocity and average acceleration within each grid, a transmission probability matrix from grid state to observation value is established. When constructing a behavioral state HMM, the communication frequency can be divided into intervals such as [0,0.1), [0.1,1), [1,10), and [10,+∞) as discrete states, and the communication duration can be divided into intervals such as [0,10), [10,60), [60,600), and [600,+∞) as discrete states. Then, based on historical communication records, the transition probabilities between different behavioral states and the observation probability corresponding to each state are calculated. When calculating the forward probability, assuming the observation sequence length T = 100 and the number of states N = 10, a 10x100 forward probability matrix needs to be maintained. The (i,j)th element in the matrix represents the probability that the first j values ​​of the observation sequence are generated by state i. Using a recursive formula, the entire matrix can be filled in O(N^2T) time complexity. If the maximum probability value in the last column is less than a given threshold, such as 0.001, it is considered an anomaly. Similarly, when calculating the optimal state sequence, a 10x100 probability matrix and transition matrix also need to be maintained. The maximum probability of each state at each time step is calculated recursively, and its predecessor state is recorded. Finally, the optimal state sequence is obtained through backtracking. If the average transition probability of the optimal state sequence is less than a given threshold, such as 0.01, it is considered an anomaly. When conducting risk assessment, weighted Euclidean distance can be used to calculate the degree of location deviation, i.e., d = sqrt{sum_{i=1}^{n}w_i(x_i-mu_i)^2}, where x_i is the coordinate of the current location in the i-th dimension, mu_i is the mean of historical locations in the i-th dimension, w_i is the weight of the i-th dimension, and n is the number of location dimensions. The weights can be set according to the importance of different dimensions, such as latitude with a weight of 0.6 and longitude with a weight of 0.4. When d exceeds a threshold such as 10m, the location risk score is d / 100; otherwise, the location risk score is 0. Similarly, weighted KL divergence can be used to calculate the degree of behavioral deviation, i.e., D = sum_{i=1}^{m}w_ip_ilog(p_i / q_i), where p_i is the probability of the current behavioral feature in the i-th discrete state, q_i is the probability of the normal behavioral feature in the i-th discrete state, w_i is the weight of the i-th state, and m is the number of behavioral states. When D exceeds a threshold such as 1, the behavioral risk score is D; otherwise, the behavioral risk score is 0.Finally, the weighted average of the location risk score and the behavior risk score is calculated as the comprehensive risk score, i.e., R = 0.6R_loc + 0.4R_beh, where R_loc is the location risk score and R_beh is the behavior risk score. If R > 0.8, it is judged as high risk, and measures such as secondary authentication or link disconnection are initiated. When updating HMM parameters using the Baum-Welch algorithm, the batch size can be set to 100, that is, every 100 new observation sequences are received, and the model parameters are updated once using these 100 sequences. First, the forward-backward algorithm is used to calculate the forward probability alpha and the backward probability beta on the new sequence, and then gamma(i,j) = alpha_{t}(i)*a_{ij}b_j(o_{t+1})beta_{t+1}(j) is calculated, which represents the probability of transitioning from state i to state j and generating observation o_{t+1}. Next, calculate xi_t(i) = sum_{j=1}^{N}gamma_t(i,j), representing the probability of being in state i at time t. Finally, based on the expected values ​​of gamma and xi, update the state transition matrix A and the observation probability matrix B, i.e., a_{ij} = sum_{t=1}^{T-1}gamma_t(i,j) / sum_{t=1}^{T-1}xi_t(i), b_j(k) = sum_{t=1,o_t=v_k}^{T}gamma_t(j) / sum_{t=1}^{T}xi_t(j), where a_{ij} is the probability of transitioning from state i to state j, and b_j(k) is the probability of observing value v_k in state j. After multiple iterations, if the increase in the log-likelihood probability is less than 0.001, the iteration stops. When introducing the forgetting factor, the decay rate can be set to 0.98, that is, the weight of the parameters in the previous round is 0.98 and the weight of the parameters in the current round is 0.02, so as to maintain the stability of the model while adapting to new data.

[0036] S212: After differential privacy processing of the location information and authentication log data of the communication link, upload them to the cloud security big data platform; use association rule mining algorithm and sequence pattern mining algorithm for threat intelligence analysis and risk warning; and use incremental learning algorithm to continuously optimize the location privacy protection strategy and adaptive authentication model.

[0037] Location information and authentication log data from the communication link are collected. Location information includes the geographical location of the communication, location type, and nearby base station information. Authentication logs include the authentication request time, frequency, device identifier, and user identifier. Differential privacy algorithms are used to anonymize the collected location information and authentication logs. For numerical data such as location coordinates, a Laplace mechanism is used to achieve differential privacy. Laplace noise eta, following the parameter lambda, is added to the original location coordinate x, resulting in the differentially privacy-processed location x' = x + eta. The noise intensity and privacy protection level are controlled by adjusting the privacy budget epsilon. For categorical data such as user identifiers, an exponential mechanism is used to achieve differential privacy. An exponential weight is calculated based on the truthfulness u(x, r) of each possible output result r. The anonymized user identifier r' is obtained by randomly sampling according to the weights. Privacy protection and data utility are balanced by adjusting the privacy budget epsilon and the truthfulness function u. Location information and authentication logs processed with differential privacy are uploaded to a cloud-based security big data platform. Multi-dimensional data models, such as Hive tables, are used for storage and indexing. Highly available distributed architectures, such as Hadoop and Spark, are used for large-scale data management and computation. A strict role-based data access control mechanism is established to ensure data security and compliance. On the cloud-based security big data platform, association rule mining algorithms such as April and FP-Growth, and sequence pattern mining algorithms such as GSP and SPADE, are used to perform association analysis and threat intelligence mining on the differentially privacy-processed location information and authentication logs. An adaptive threshold adjustment strategy is adopted, dynamically setting the minimum support threshold min_sup=log(N) / N and the minimum confidence threshold min_conf=1-exp(-N / 10) based on the data size N. The thresholds are automatically adjusted as the data size changes to balance the quantity and quality of association rules. Threat intelligence analysis is performed on the mined association rules and sequence patterns, using a combination of rule-based systems and machine learning-based classification models. This approach leverages existing security knowledge bases to classify known threats while also discovering new, unknown threats. For multi-classification and imbalanced data problems, ensemble learning algorithms such as XGBoost and LightGBM are prioritized to construct threat classification models. Hyperparameters are then tuned using methods like grid search or Bayesian optimization to improve the accuracy and robustness of threat detection. Based on the generated threat intelligence, user risk levels are assessed and warnings are issued. A risk assessment index system and fuzzy evaluation set, combining the analytic hierarchy process (AHP) with fuzzy comprehensive evaluation, are established, including behavioral anomaly degree, threat severity, and user importance. Index weights are calculated using a judgment matrix, and index scores are calculated using a membership function, forming a fuzzy comprehensive evaluation matrix. Finally, the user's comprehensive risk score and risk level are obtained.Based on a comparison of the comprehensive risk score with a preset threshold, high-risk users are automatically identified, and authentication strategies are dynamically adjusted according to the risk level. Security defenses such as secondary authentication, access restrictions, and connection blocking are implemented for high-risk behaviors. Incremental learning algorithms are used to continuously optimize the location privacy protection strategy and adaptive authentication model. Online and progressive learning algorithms such as stochastic gradient descent (SGD) and incremental support vector machine (ISVM) are employed to update model parameters in real time based on newly collected location data and authentication logs, and to adapt to changes in data distribution by dynamically adjusting hyperparameters such as learning rate and regularization parameters. Simultaneously, an active learning mechanism is introduced, employing uncertain sampling strategies such as edge sampling and entropy sampling to actively acquire and label the most valuable samples for model judgment, and use them for incremental training to improve the model's generalization performance and concept drift adaptability. A long-term mechanism for communication link risk analysis and privacy protection is established, and corresponding management processes and security guidelines are formulated. The management process includes operational specifications, role responsibilities, and emergency plans for data collection, de-identification processing, threat intelligence generation, and risk warning response, and is subject to rolling reviews every six months or one year based on business and system changes. The security guidelines include institutional requirements for location privacy data anonymization, access authorization, and incident reporting, and are updated in a timely manner according to changes in laws and regulations. Through continuously improving management mechanisms and compliance construction, the security risk prevention and privacy protection of communication links are effectively implemented, thus strengthening the foundation of enterprise network security management.

[0038] For example, when collecting location information of communication links, various methods such as base station positioning, GPS positioning, and WiFi positioning can be used to obtain data such as the geographical coordinates and location type of user devices. For instance, base station positioning can obtain the base station number where the user is located, and then query the corresponding geographical coordinates and location type according to the base station location database, with an accuracy of 100 meters to 1 kilometer. GPS positioning can achieve an accuracy of within 10 meters, but it may not work in indoor environments. Therefore, it is necessary to comprehensively utilize multiple positioning technologies and fuse them through algorithms such as Kalman filtering to improve the accuracy and continuity of location information. Regarding authentication logs, authentication servers and proxy servers deployed in different locations such as the core network and access network can capture the request and response messages of authentication protocols such as RADIUS and Diameter initiated by user devices in real time, and parse key fields such as timestamps, user identifiers, and device identifiers to form structured log data. When performing differential privacy processing on the collected raw location data using the Laplace mechanism, different privacy budgets (epsilon) can be set according to the sensitivity level of the location. For example, for highly sensitive locations such as home addresses, epsilon can be set to 0.1, while for locations in public areas such as offices, epsilon can be set to 1, thus protecting privacy while minimizing the impact of noise. For categorical user identifiers, the truthfulness function u(x,r) can be defined as an indicator function in the exponential mechanism, i.e., u(x,r) = 1 if r is the true identifier of x, u(x,r) = 0 if r is not the true identifier of x, thus maximizing the sampling probability of true identifiers. The parameters lambda of the Laplace distribution and the sensitivity Deltau of the exponential mechanism can be selected based on empirical values, such as lambda ranging from 0.1 to 10 and Deltau ranging from 0.01 to 0.1. When performing correlation analysis on location data and authentication logs in the cloud, the April algorithm can be used for frequent itemset and association rule mining. For example, attributes such as location, time, and device can be divided into categories with a certain granularity. For instance, location can be divided into different city blocks, and time into 24 hours per day. Then, a transaction can be represented using multidimensional attributes to mine frequent itemsets and association rules. For example, {location=A, time=evening}=>{device=M} indicates that at night in location A, a user frequently uses device M to access the network. The support and confidence thresholds of the Aprior algorithm can be dynamically adjusted according to the data size N. When N is large, the support threshold can be appropriately increased to reduce the number of frequent itemsets, while the confidence threshold can be decreased to discover more weak association rules. For example, when N increases from 10,000 to 100,000, the support threshold can be increased from 1% to 2%, and the confidence threshold can be decreased from 50% to 40%.When performing sequence pattern mining, the SPADE algorithm can be used to process time series data, mining user movement trajectories and behavioral events at different times and locations to discover frequent sub-sequence patterns. For threat analysis of association rules and sequence patterns, the XGBoost algorithm can be used to train a multi-classification model. First, historical data is labeled according to known threat types, extracting features such as time, location, duration, frequency, and device type for each event, and selecting the Top-K most discriminative feature subsets based on feature importance analysis. Then, the XGBoost algorithm is used to train the multi-classification model, optimizing hyperparameters such as the number of trees, depth, and learning rate through grid search, and evaluating model performance using 5-fold cross-validation. Iteration stops when the classification accuracy exceeds 90%. Finally, the trained threat classification model is used to predict new unknown events in real time, identifying abnormal behavior and potential threats. For example, if a user frequently moves rapidly between multiple base stations and repeatedly logs into a VPN between 2 AM and 4 AM, but has never exhibited this behavior in the previous 30 days, there is a high probability of an external intrusion threat. When conducting risk assessment, the Analytic Hierarchy Process (AHP) can be used to divide user risks into several dimensions such as threat severity, vulnerability, and importance. A judgment matrix is ​​constructed through pairwise comparisons, and the maximum eigenvalue of the judgment matrix is ​​calculated and normalized to obtain the weights of each dimension. For example, the judgment matrix for threat severity can be defined as [(1,2,5),(1 / 2,1,3),(1 / 5,1 / 3,1)], indicating that threat severity is more important than vulnerability and importance, with ratios of 2 and 5 respectively. The weight vector calculated based on this matrix is ​​[0.58,0.31,0.11], meaning that the impact weights of threat severity, vulnerability, and importance on user risk are 58%, 31%, and 11%, respectively. When calculating the membership degree of each dimension, a piecewise function can be used. For example, if threat severity is divided into 5 levels, the membership vector is [0,0.25,0.5,0.75,1], representing the membership degree corresponding to threat severity from low to high. Finally, the weight vector obtained by the analytic hierarchy process (AHP) is multiplied by the membership vector and summed to obtain a comprehensive risk score for the user. A score exceeding 0.7 indicates a high-risk user. When using incremental learning algorithms to optimize privacy protection strategies and authentication models, stochastic gradient descent (SGD) can be used for online learning. For example, for an SVM classifier, upon receiving a new sample (x, y), the gradient of the loss function with respect to the model parameter theta, nabla_thetaL, is calculated based on the difference between the current model's predicted value and the actual label. The parameters theta_new = theta_old - etacdotnabla_thetaL are then updated in the reverse direction of the gradient, where eta is the learning rate.During the iteration process, the learning rate can employ a decay strategy, such as eta = eta_0 / (1 + alphat), where eta_0 is the initial learning rate, alpha is the decay rate, and t is the number of iterations, continuously improving the convergence speed and stability of online learning. Furthermore, regularization techniques, such as L1 and L2 regularization, can be used to reduce overfitting risk and improve the model's generalization ability. Regarding active learning, taking an SVM classifier as an example, the distance d from a new sample x to the hyperplane can be calculated as d = |theta^Tx| / ||theta||_2. If d is less than a threshold such as 0.1, the sample is considered to be near the classification boundary and is the most representative and discriminative sample, requiring active labeling and addition to the training set for incremental learning. The purpose of active learning is to maximize the model's learning effect by minimizing the number of queries, avoiding the waste of limited manual labeling resources. Finally, when establishing a communication link risk management mechanism, practical and feasible management measures need to be formulated. For example, in the data acquisition phase, it's crucial to ensure the integrity, accuracy, and timeliness of location data and authentication logs. Automated data quality monitoring rules can be set up to promptly alert and handle issues such as missing or outlier values. In the data anonymization phase, the principle of "minimum necessary" must be followed to avoid excessive collection and use of privacy data. Regular data security impact assessments should be conducted to promptly identify and remediate vulnerabilities in data anonymization. In the threat intelligence analysis and risk warning phase, a unified threat intelligence sharing platform needs to be established to integrate internal and external threat intelligence sources, improving the timeliness and accuracy of intelligence analysis and threat discovery. Automated risk warning and response processes should also be established to promptly block and handle high-risk incidents.

[0039] The location privacy authentication method in the communication link provided in this application embodiment can ensure the security, reliability, and consistency of the authentication process. When performing multi-mode authentication with location privacy protection in the communication link, it is necessary to formulate a reasonable privacy protection strategy, specifying the rules for the collection, storage, use, and sharing of location information. Through a flexible policy management mechanism, the granularity of the privacy protection strategy can be dynamically adjusted according to different privacy protection needs, achieving refined management and protection of location information, improving the effectiveness of privacy protection and user experience. It is also necessary to adaptively switch authentication modes according to different network environments and security threats. Through the policy management mechanism, network status and security events can be monitored in real time, dynamically selecting the most suitable authentication mode for the current scenario, such as password authentication, biometric authentication, and location authentication, thereby improving the security and reliability of authentication.

[0040] This invention provides a method for protecting location privacy in communication links. By acquiring multi-dimensional location information, it can generate a more accurate and comprehensive integrated location fingerprint. This not only improves positioning accuracy but also provides a solid foundation for subsequent privacy protection measures. Dynamically selecting the granularity of location information, differential privacy processing, homomorphic encryption, and generating obfuscated data using generative adversarial networks—these measures effectively reduce the risk of location information leakage and ensure user privacy and security. In particular, the application of differential privacy algorithms can ensure the anonymity of personal location data while providing statistical analysis value. By combining factors such as user behavior and network environment, personalized privacy protection strategies are generated, and authentication strategies are dynamically optimized to achieve refined and intelligent location information management, improving the system's response speed and adaptability. By fusing multiple authentication elements through convolutional neural networks to form a comprehensive authentication fingerprint, the security of the authentication process is enhanced, the false acceptance rate and rejection rate are reduced, and the user experience is improved. The introduction of hidden Markov models enables the system to monitor anomalies in communication in real time and take timely actions such as secondary authentication or link disconnection, effectively preventing the spread of security threats. The processed data is uploaded to the cloud for in-depth analysis, and potential threats are discovered using association rule mining and sequence pattern mining algorithms. Combined with incremental learning, protection strategies and authentication models are continuously iterated and optimized to ensure the long-term efficient operation and security of the system.

[0041] Figure 3 The diagram shows the structure of a conversation device provided in an embodiment of this application. The device 100 includes: a determination module 110, a generation module 120, an association module 130, and an adjustment module 140.

[0042] The determination module determines the location fingerprint based on the location information of the communication link; The generation module generates a private protected location tag based on the location fingerprint, wherein the protected location tag includes obfuscated data of the location fingerprint; The association module associates the protected location tag with the attribute characteristics of the communication link; The adjustment module adjusts the management strategy for the location information of the communication link based on the protected location tag.

[0043] In one possible implementation, the determining module 110 obtains the device fingerprint, user identity, and access behavior of the communication link as authentication elements; A comprehensive authentication fingerprint is generated by extracting and fusing features from heterogeneous authentication elements using a convolutional neural network algorithm.

[0044] In one possible implementation, the determination module 110 associates the comprehensive authentication fingerprint with the location tag of the communication link, network type, and security threat; An authentication strategy knowledge base is constructed using inference algorithms, and Markov decision process algorithms are used to dynamically optimize and adaptively infer authentication strategies to obtain the optimal authentication strategies for different scenarios. The authentication mode, authentication protocol, and authentication strength of the communication link are adjusted in real time according to the strategy.

[0045] In one possible implementation, the determination module 110 uses a hidden Markov model algorithm to monitor the location changes and behavioral anomalies of the communication link in real time; If a high-risk situation such as a sudden change in location or abnormal behavior is detected, authentication or disconnection of the link will be triggered.

[0046] In one possible implementation, the determination module 110 performs differential privacy processing on the location information of the communication link and the authentication log data, and then uploads them to the cloud-based security big data platform; Threat intelligence analysis and risk warning are performed using association rule mining algorithms and sequence pattern mining algorithms. Incremental learning algorithms are used to continuously optimize location privacy protection strategies and adaptive authentication models.

[0047] In one possible implementation, the determining module 110 acquires the location information of the communication link; Multi-source heterogeneous location data are fused using the Kalman filter algorithm to generate a comprehensive location fingerprint.

[0048] In one possible implementation, the determining module 110 determines the security level and privacy protection requirements of the communication link; Fuzzy C-means clustering algorithm is used to dynamically select location information of appropriate granularity from location fingerprints; Desensitization is performed using a differential privacy algorithm, while homomorphic encryption is used to encrypt data in sensitive locations. Generative adversarial network algorithms are used to generate location-scrambled data. Privacy-protected location labels are obtained based on the location obfuscation data.

[0049] Figure 4 The diagram illustrates the hardware structure of an electronic device implementing the embodiments of this application. Referring to the diagram, at the hardware level, the electronic device includes a processor and optionally, an internal bus, a network interface, and a memory. The memory may include RAM, such as high-speed random-access memory (RAM), or non-volatile memory, such as at least one disk storage device. Of course, the electronic device may also include other hardware required for other services.

[0050] The processor, network interface, and memory can be interconnected via an internal bus, which can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. This bus can be categorized as an address bus, data bus, control bus, etc. For ease of illustration, only a single bidirectional arrow is used in this diagram, but this does not imply that there is only one bus or one type of bus.

[0051] Memory is used to store programs. Specifically, programs may include program code, which includes computer operation instructions. Memory may include main memory and non-volatile memory, and provides instructions and data to the processor.

[0052] The processor reads the corresponding computer program from non-volatile memory into main memory and then executes it, forming a device at the logical level that locates the target user. The processor executes the program stored in memory and specifically performs the following: Figure 1-2 The methods disclosed in the embodiments shown achieve the functions and beneficial effects of the methods described in the preceding method embodiments, and will not be repeated here.

[0053] The above is as stated in this application. Figure 1-2The methods disclosed in the illustrated embodiments can be applied to or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above methods can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0054] The electronic device can also execute the methods described in the preceding method embodiments and achieve the functions and beneficial effects of the methods described in the preceding method embodiments, which will not be repeated here.

[0055] Of course, in addition to software implementation, the electronic device of this application does not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. In other words, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0056] This application also proposes a computer-readable storage medium that stores one or more programs, which, when executed by an electronic device including multiple applications, cause the electronic device to perform... Figure 1-2 The methods disclosed in the embodiments shown achieve the functions and beneficial effects of the methods described in the preceding method embodiments, and will not be repeated here.

[0057] The computer-readable storage medium mentioned above includes read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk, etc.

[0058] Furthermore, embodiments of this application also provide a computer program product, the computer program product including a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions, which, when executed by a computer, implement the following process: Figure 1-2 The methods disclosed in the embodiments shown achieve the functions and beneficial effects of the methods described in the preceding method embodiments, and will not be repeated here.

[0059] In summary, the above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

[0060] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0061] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0062] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0063] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

Claims

1. A location-privacy authentication method in a communication link, comprising: Determine the location fingerprint based on the location information of the communication link; A private protected location tag is generated based on the location fingerprint, and the protected location tag includes obfuscated data of the location fingerprint; Associate the protected location tag with the attribute characteristics of the communication link; The management strategy for the location information of the communication link is adjusted based on the protected location tag.

2. The method according to claim 1, wherein, After the management strategy for adjusting the location information of the communication link based on the protected location tag, the method further includes: The device fingerprint, user identity, and access behavior of the communication link are used as authentication elements. A comprehensive authentication fingerprint is generated by extracting and fusing features from heterogeneous authentication elements using a convolutional neural network algorithm.

3. The method according to claim 2, wherein, After the management strategy for adjusting the location information of the communication link based on the protected location tag, the method further includes: The authentication fingerprint is associated with the location tag of the communication link, network type, and security threat. An authentication strategy knowledge base is constructed using inference algorithms, and Markov decision process algorithms are used to dynamically optimize and adaptively infer authentication strategies to obtain the optimal authentication strategies for different scenarios. The authentication mode, authentication protocol, and authentication strength of the communication link are adjusted in real time according to the strategy.

4. The method according to claim 3, wherein, After the management strategy for adjusting the location information of the communication link based on the protected location tag, the method further includes: Hidden Markov Model (HMM) algorithm is used to monitor the location changes and behavioral anomalies of the communication link in real time. If a high-risk situation such as a sudden change in location or abnormal behavior is detected, authentication or disconnection of the link will be triggered.

5. The method according to claim 3, wherein, After the management strategy for adjusting the location information of the communication link based on the protected location tag, the method further includes: After differential privacy processing of the location information of the communication link and the authentication log data, they are uploaded to the cloud-based security big data platform; Threat intelligence analysis and risk warning are performed using association rule mining algorithms and sequence pattern mining algorithms. Incremental learning algorithms are used to continuously optimize location privacy protection strategies and adaptive authentication models.

6. The method according to claim 1, wherein, Based on the location information of the communication link, the location fingerprint is determined as follows: Obtain the location information of the communication link; Multi-source heterogeneous location data are fused using the Kalman filter algorithm to generate a comprehensive location fingerprint.

7. The method according to claim 1, wherein, A privately protected location tag is generated based on the location fingerprint. The protected location tag includes obfuscated data from the location fingerprint, including: Based on the security level and privacy protection requirements of the communication link; Fuzzy C-means clustering algorithm is used to dynamically select location information of appropriate granularity from location fingerprints; Desensitization is performed using a differential privacy algorithm, while homomorphic encryption is used to encrypt data in sensitive locations. Generative adversarial network algorithms are used to generate location-scrambled data. Privacy-protected location labels are obtained based on the location obfuscation data.

8. A conversational device, comprising: The determination module determines the location fingerprint based on the location information of the communication link; The generation module generates a private protected location tag based on the location fingerprint, wherein the protected location tag includes obfuscated data of the location fingerprint; The association module associates the protected location tag with the attribute characteristics of the communication link; The adjustment module adjusts the management strategy for the location information of the communication link based on the protected location tag.

9. An electronic device, comprising: processor; as well as A memory configured to store computer-executable instructions, which, when executed, use the processor to perform the steps of the session method according to any one of claims 1-7.

10. A computer-readable medium storing one or more programs, which, when executed by an electronic device including a plurality of applications, cause the electronic device to perform the steps of the session method according to any one of claims 1-7.

Images