A method for secure access authentication in private networks based on dynamic tokens

Abstract

This invention discloses a secure access authentication method for private networks based on dynamic tokens, belonging to the field of network security authentication technology. It includes: mining behavioral patterns from a user's historical access record sequences using an access intent prediction thread to construct an access behavior baseline; intercepting the current access request and extracting the current identity token and current access context information; inputting the current identity token into a dynamic token verifier for dual verification of timeliness and legitimacy; when the token is valid, performing multi-dimensional matching analysis between the current access context information and the access behavior baseline to calculate the behavioral deviation; combining the token information, context information, and behavioral deviation into an authentication feature tensor, inputting it into a pre-trained dynamic access intent classifier, and outputting an intent confidence score; when the score meets a threshold, issuing a temporary permission policy to the private network access control gateway. This method improves the accuracy of secure access authentication for private networks through the collaboration of behavioral baseline deviation analysis and the intent classifier.

Description

Technical Field

[0001] This invention relates to the field of network security authentication technology, specifically to a private network secure access authentication method based on dynamic tokens. Background Technology

[0002] In existing private network security access authentication processes, a single-pass verification mechanism based on dynamic tokens is commonly used. When a user initiates an access request, the system only verifies whether the dynamic password submitted by the user matches the baseline password synchronously generated on the server. Once verification is successful, access is granted. This authentication method only judges the validity and matching of the token itself, ignoring potential abnormal characteristics of the user's access behavior. This allows attackers to steal valid tokens and launch malicious access from uncommon network addresses, uncommon time windows, or unauthorized service ports, while the system lacks the ability to detect such deviations.

[0003] Another existing technical solution introduces rule-based static access control policies, which filter users' access target addresses and service ports through preset access control lists or blacklist mechanisms. The drawback of this approach is that rule configuration relies on the administrator's experience and presets, making it unable to adapt to the natural migration of legitimate user access behavior as business needs change. When a user's legitimate access needs are temporarily adjusted, static rules are prone to false blocking, while when attackers disguise their behavior as normal access patterns, static rules struggle to identify subtle contextual anomalies.

[0004] The existing solutions described above expose two levels of problems. First, dynamic token verification and access behavior context analysis are separated. The coarse-grained logic of granting access once the token is valid cannot address the security threat posed by stolen tokens used for access in abnormal contexts. Second, there is a lack of effective quantitative methods for judging whether access behavior deviates from users' historical habits. It is impossible to establish an adaptive mapping relationship between the degree of behavioral deviation and the granting decision, making it difficult for the system to distinguish between legitimate, occasional behavioral deviations and malicious abnormal behavior. Summary of the Invention

[0005] The purpose of this invention is to disclose a private network security access authentication method that, after valid token verification, does not directly grant access permissions, but instead quantifies the deviation between the access behavior and the user's historical baseline, integrates token information, context information, and deviation into a unified feature input learning model for intent discrimination, and determines whether to issue a temporary permission policy based on the discrimination result, in order to overcome the shortcomings of existing solutions that cannot detect abnormal behavior context of token holders.

[0006] To achieve the above objectives, this invention provides the following technical solution: a private network security access authentication method based on dynamic tokens. This method integrates user behavior baseline analysis and dynamic intent classification, adding access context deviation assessment on top of token verification to achieve multi-dimensional adaptive security authentication. The method includes: By using an access intent prediction thread to mine behavioral patterns from users' historical access records, a baseline of user access behavior is constructed. Specifically, all historical access records within a preset review time window are retrieved from the user behavior log database, sorted by access initiation time to generate a historical access record sequence. From each record, the access target address, service port number, timestamp, and duration are extracted to form a historical access behavior vector. All historical access behavior vectors are input into a behavior pattern miner in chronological order for cluster analysis to identify multiple types of historical access behavior patterns. The frequency and periodicity of each pattern are statistically analyzed, and the dominant behavior pattern is selected. The range of access target addresses, service port numbers, and access time periods corresponding to the dominant behavior pattern are used as the baseline feature set. Preferably, the behavior pattern miner uses a density-based clustering algorithm to determine the behavior patterns corresponding to clusters with a sample size exceeding a preset threshold as the dominant behavior patterns, ensuring that the baseline reflects the user's typical access habits.

[0007] The system intercepts user-initiated access requests in real time, extracting the current identity token and current access context information. It listens on the access port at the private network ingress gateway, intercepts the data packets of current access requests, and performs protocol parsing. The current identity token is extracted from the protocol header fields; this token contains a dynamic password field generated based on a time-synchronized one-time password algorithm, a unique token sequence number assigned to the user, and a token timestamp field. The current access context information, including the source IP address, destination IP address, destination service port number, request timestamp, and request operation type, is parsed from the packet payload fields.

[0008] The current identity token is input into the dynamic token verifier for dual verification of timeliness and legitimacy. The token generation time is extracted from the token, and the time difference between this time difference and the current system time is calculated. If the time difference is less than or equal to the preset maximum allowed time offset threshold, the timeliness verification is considered successful; otherwise, the token verification status is directly determined to be invalid, and a clock synchronization alarm event is triggered. After passing the timeliness verification, the local token status cache table is queried using the token serial number field as an index to obtain the corresponding baseline dynamic password and token status flag. If the dynamic password field matches the baseline dynamic password and the token status flag is in an unused state, the legitimacy verification is considered successful, and the verification status is set to valid; otherwise, it is set to invalid. This dual verification mechanism effectively prevents replay attacks and token tampering.

[0009] When the token verification status is valid, the current access context information is matched and analyzed against the access behavior baseline in multiple dimensions to calculate the behavioral deviation of the current access request. The current target IP address, current target service port number, and current request timestamp are extracted from the current access context information as access dimension parameters. These parameters are then matched with the access target address range in the baseline feature set using address prefix matching, with the access service port number range using port interval matching, and with the access time period range using time period inclusion determination to obtain time matching results. The behavioral deviation is obtained by weighted summation of the matching results for each dimension and their corresponding matching weight coefficients. Preferably, the matching weight coefficients are dynamically adjusted based on the statistical distribution of the user's historical access behavior, with dimensions with higher access frequency assigned higher weight coefficients, making the deviation calculation more closely reflect the user's actual access characteristics.

[0010] The current identity token, current access context information, and behavioral deviation are combined into an authentication feature tensor, which is then input into a pre-trained dynamic access intent classifier for classification decisions, outputting an intent confidence score corresponding to the current access request. During the combination process, the dynamic password, sequence number, and timestamp fields in the token are numerically encoded to generate the first feature sub-vector. The source IP address, destination IP address, destination service port number, and request operation type in the access context information are one-hot encoded to generate the second feature sub-vector. The behavioral deviation is normalized and scaled to serve as the third feature sub-vector. These are then concatenated in order of feature dimensions to generate the authentication feature tensor. The dynamic access intent classifier performs forward propagation computation through a multi-layer fully connected network, with the output layer outputting the probability value that the current access request belongs to the legitimate access category as the intent confidence score. This classifier integrates token identity information, access environment information, and behavioral deviation degree, enabling a more comprehensive identification of abnormal access intents.

[0011] When the intent confidence score is greater than or equal to a preset confidence threshold, a temporary allow policy corresponding to the current access request is issued to the private network access control gateway; when the intent confidence score is less than the confidence threshold, an access denial instruction is issued and the access denial event is recorded. The temporary allow policy is generated based on the source IP address and target service port number in the access context information, and is encapsulated as a policy configuration instruction and sent to the private network access control gateway through the gateway management interface, instructing the gateway to add a temporary forwarding entry to the forwarding rule table. At the same time, the corresponding policy timer is started. When the accumulated time reaches the preset policy validity period, a policy revocation instruction is sent through the gateway management interface, instructing the gateway to delete the temporary forwarding entry, thereby achieving accurate and timely revocation of access permissions.

[0012] As a preferred technical solution of the present invention, during the period when the temporary access policy is in effect, the access connection established by the user through the policy is continuously monitored. When the connection interruption is detected, the duration of the continuous connection and the actual amount of data transmitted are recorded. If the duration of the continuous connection is less than the effective duration of the policy and the actual amount of data transmitted is less than the preset upper limit of the amount of data transmitted, the current access request is marked as an abnormal early termination request, and the corresponding abnormal early termination record is written into the audit log to provide a basis for subsequent security analysis.

[0013] This invention also incrementally trains the dynamic access intent classifier to continuously adapt to changes in access patterns. Newly added labeled access records are periodically extracted from the user behavior log database. Each record contains a historical authentication feature tensor and the corresponding real access result label. The historical authentication feature tensor is input into the dynamic access intent classifier to obtain a predicted classification result. The classification loss value is calculated based on the difference between the predicted classification result and the real label. When the classification loss value exceeds a preset threshold, a gradient descent optimization algorithm is used to iteratively update the network weight parameters of the classifier. This involves multiplying the weight gradient value calculated in this round by a preset learning rate coefficient to obtain an adjustment amount, which is then added element-wise to the current weight parameters to obtain the updated weight parameters. This updated weight parameter replaces the original parameters in the model parameter storage area, completing a single incremental training iteration. Through incremental training, the classifier can learn from new access records, maintain sensitivity to user behavior evolution trends, and improve the accuracy and adaptability of intent classification.

[0014] The technical effects and advantages provided by the present invention in the above technical solution are as follows: This technical solution does not immediately grant access after the dynamic token verification is valid. Instead, it extracts the current target Internet Protocol address, the current target service port number, and the current request timestamp from the current access context information. These are then compared with the baseline feature set of the access behavior baseline using address prefix matching, port range comparison, and time period inclusion relationship judgment. Subsequently, the address matching results, port matching results, and time matching results are weighted and summed according to the matching weight coefficients of each dimension to calculate the behavior deviation degree. This deviation quantifies the degree of difference between the current access behavior and the user's historical dominant behavior pattern. Based on this mechanism, even if the token itself passes the legality and timeliness verification, as long as the access behavior exhibits contextual characteristics that are significantly inconsistent with the baseline, it will be reflected in the deviation degree value. This provides a quantifiable anomaly indicator for subsequent judgment, enabling the system to instantly identify context-level anomalies when attackers initiate logins from different locations, access during non-habitual periods, or unauthorized access after stealing a legitimate token, thus blocking deep security threats beyond token verification.

[0015] After obtaining the behavioral deviation, this scheme generates a first feature sub-vector by numerically encoding the dynamic password field, token serial number field, and token timestamp field of the current identity token. It then generates a second feature sub-vector by one-hot encoding the current source internet protocol address, current target internet protocol address, current target service port number, and current request operation type from the current access context information. Finally, it uses the normalized and scaled behavioral deviation as the third feature sub-vector. These three sub-vectors are concatenated in tensor order according to feature dimensions to form an authentication feature tensor. This authentication feature tensor is input into a pre-trained dynamic access intent classifier. The classifier's multi-layer fully connected network performs forward propagation calculations, outputting the probability value that the current access request belongs to the legitimate access category as the intent confidence score. Compared to single-dimensional rule matching based on hard thresholds, this approach, which integrates token attributes, multimodal context features, and behavioral deviation and then unifies them with a learning model for comprehensive reasoning, can capture the complex nonlinear relationships between different feature dimensions. When occasional behavioral deviations by legitimate users remain consistent across token features and operation types, the classifier assigns a high confidence score to avoid false blocking. Conversely, when the token, context, and deviation exhibit typical patterns of attack behavior in the feature space, the classifier outputs a low confidence score to reject the user. This adaptive evaluation avoids false positives and false negatives caused by improper threshold settings in static rules, significantly improving the accuracy of authentication decisions in complex attack scenarios. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0017] Figure 1 This is a flowchart of a private network security access authentication method based on dynamic tokens; Figure 2 This is a flowchart of the user access behavior baseline construction process; Figure 3 This is a flowchart of the access request interception and identity token and context information extraction process; Figure 4 This is a schematic diagram of the clustering results of users' historical access behavior patterns; Figure 5 This is a frequency distribution and kernel density estimation graph of the user's current request timestamp hour dimension; Figure 6 It is the classification loss curve during the training process of the dynamic access intent classifier. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] See Figure 1 This invention provides a method for secure access authentication in a private network based on dynamic tokens, comprising: mining the behavior patterns of a user's historical access record sequences through an access intent prediction thread to construct a baseline of the user's access behavior; intercepting the current access request initiated by the user in real time, and extracting the current identity token and current access context information from the current access request; inputting the current identity token into a dynamic token verifier for dual verification of timeliness and legality, and outputting the token verification status; when the token verification status is valid, performing multi-dimensional matching analysis between the current access context information and the access behavior baseline to calculate the behavioral deviation between the current access request and the access behavior baseline; combining the current identity token, the current access context information, and the behavioral deviation into an authentication feature tensor, inputting the authentication feature tensor into a pre-trained dynamic access intent classifier for classification decision, and outputting the intent confidence score corresponding to the current access request; when the intent confidence score is greater than or equal to a preset confidence threshold, issuing a temporary access policy corresponding to the current access request to the private network access control gateway.

[0020] Example 1: In specific implementation, please refer to Figure 2 The process of constructing a baseline of user access behavior by mining behavioral patterns from the user's historical access record sequence through the access intent prediction thread is as follows.

[0021] The system retrieves all historical access records of the user within a preset review time window from the user behavior log database. These records are then sorted chronologically according to the time of access initiation, generating a historical access record sequence. The user behavior log database is deployed in the data persistence layer of the private network security management platform. Each historical access record is stored in structured data format, including a timestamp field indicating the time of access initiation. The preset review time window is configured by the security administrator based on the characteristics of the private network's business cycle; for example, setting the preset review time window to 30 calendar days ensures that behavior pattern mining covers a complete business operation cycle. The sorting operation uses an ascending comparison sorting algorithm based on the timestamp field to ensure that the time interval between adjacent records in the generated historical access record sequence is consistent with the user's actual operation sequence.

[0022] The historical access record sequence is traversed, and each record is extracted to contain the historical access target address, historical access service port number, historical access timestamp, and historical access duration, forming a historical access behavior vector for each record. The historical access target address is the Internet Protocol address of the internal server within the private network; the historical access service port number is the Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) port number; the historical access timestamp is the Unix timestamp at the moment the access was initiated; and the historical access duration is the millisecond-level duration from connection establishment to connection release. The historical access behavior vector is represented by a four-dimensional real number vector, where the four components correspond to the decimal integer representation of the historical access target address, the integer value of the historical access service port number, the value of the historical access timestamp, and the value of the historical access duration, respectively.

[0023] All historical access behavior vectors are input into the behavior pattern miner in chronological order. The behavior pattern miner performs cluster analysis on all historical access behavior vectors to identify multiple types of user historical access behavior patterns and counts the frequency and periodicity of each type of historical access behavior pattern within a preset review time window. The behavior pattern miner uses a density-based clustering algorithm, specifically the DBSCAN algorithm. Before clustering, the components of each dimension of the historical access behavior vector are normalized to their minimum and maximum values, mapping the values ​​of each component to the [0,1] interval. The normalization formula is:

[0024] in, This represents the original value of any component in the historical access behavior vector. This represents the minimum value among all historical access behavior vectors for this component. This represents the maximum value among all historical access behavior vectors for this component. This represents the normalized component value. The neighborhood radius parameter of the DBSCAN algorithm is set to 0.15, the minimum number of points parameter is set to 5, and the distance metric is Euclidean distance. After running the DBSCAN algorithm, all normalized historical access behavior vectors are divided into multiple clusters and noise points, with each cluster corresponding to a type of historical access behavior pattern. For each type of historical access behavior pattern, the number of historical access behavior vectors contained in that cluster is counted as the frequency of occurrence, and the historical access timestamp component of the historical access behavior vectors in that cluster is extracted. Periodic patterns are detected using Fast Fourier Transform, and if there is a significant peak in the spectrum, the corresponding period length is recorded.

[0025] Based on the frequency and periodicity of each type of historical access behavior pattern, dominant behavior patterns are selected from multiple types of historical access behavior patterns. The range of access target addresses, access service port numbers, and access time periods contained in the dominant behavior pattern are used as the baseline feature set for the access behavior baseline. When selecting dominant behavior patterns, the behavior patterns corresponding to clusters whose sample count in the clustering results exceeds a preset proportion threshold are identified as dominant behavior patterns. The preset proportion threshold is set to 15%, meaning that when the proportion of historical access behavior vectors in a cluster exceeds 15% of the total number of historical access behavior vectors, the behavior pattern corresponding to that cluster is marked as a dominant behavior pattern. For the clusters corresponding to dominant behavior patterns, the historical access target address field of all historical access behavior vectors in the cluster is extracted, and the longest common prefix of the address prefix matching is calculated to obtain the access target address range; the minimum and maximum values ​​of the historical access service port number field are extracted to form the access service port number range; the hours and minutes corresponding to the historical access timestamp field are extracted, and a time distribution histogram is calculated, with the time interval covering more than 80% of the samples being used as the access time period range. These ranges together form the baseline feature set of the access behavior baseline, and are stored in a memory cache in a structured data format for subsequent matching analysis.

[0026] See Figure 4 The figure shows the clustering results of the normalized historical access behavior vectors obtained from the behavior pattern mining process in Example 1. The horizontal axis represents the normalized access target address component, and the vertical axis represents the normalized access timestamp component, with both coordinates ranging from [0,1]. The figure distinguishes four main historical access behavior pattern clusters and noise points using different symbols: circles represent historical access behavior pattern 1 (cluster 1), squares represent historical access behavior pattern 2 (cluster 2), triangles represent historical access behavior pattern 3 (cluster 3), diamonds represent historical access behavior pattern 4 (cluster 4), and crosses represent noise points.

[0027] The data points in each cluster exhibit a clear clustering trend. In cluster 1, the target address components are concentrated in the range of 0 to 0.3, while the corresponding timestamp components are mainly distributed between 0.1 and 0.6, indicating that this pattern has a narrow target address range and a relatively concentrated access time. In cluster 2, the target address components are mainly concentrated in the range of 0.6 to 0.9, while the timestamps are distributed between 0.4 and 0.8, showing that this behavioral pattern has a significantly different target address range from cluster 1, and less overlap in access time periods. In cluster 3, the target address components are located in the range of 0.2 to 0.7, while the timestamp components are mostly in the range of 0 to 0.4, indicating an earlier access time and partial overlap with clusters 1 and 2. In cluster 4, the target address components are relatively dispersed, but the timestamp components are concentrated in the higher range of 0.6 to 1.0, indicating that this behavioral pattern has a later access time and a relatively wide distribution of target addresses.

[0028] The noise points are relatively dispersed, existing both at the edges of each cluster and in the gaps between clusters, indicating that some historical access behaviors do not belong to any dominant access behavior pattern. Overall, the clusters show good distinguishability in the two key dimensions of access target address and access time, which is consistent with the description in Example 1 of using the density-based DBSCAN clustering algorithm to perform cluster analysis on the normalized historical access behavior vector. The clustering parameters, such as the neighborhood radius of 0.15 and the minimum number of points of 5, effectively distinguish the multiple historical access behavior patterns of users.

[0029] Example 2: In specific implementation, please refer to Figure 3 The process of intercepting the current access request initiated by the user in real time and extracting the current identity token and current access context information from the current access request is as follows.

[0030] The system monitors the access port at the private network gateway. When a user submits an access request via a client, it intercepts the data packet of that request. The private network gateway is deployed at the private network boundary, and all access requests from user clients to servers within the private network pass through it. A packet capture hook function is registered in the operating system kernel network protocol stack of the private network gateway, binding the access port to transport layer ports 80 / 443 and simultaneously monitoring the transport layer ports in promiscuous mode. When a client initiates a Transmission Control Protocol (TCP) connection request to the private network gateway, the kernel network protocol stack triggers the hook function after completing the three-way handshake. The hook function copies the complete data packet from the kernel buffer to the user space memory area, completing the interception operation. The intercepted data packet is temporarily stored in the memory buffer as a byte stream, retaining the original network byte order.

[0031] The data packet undergoes protocol parsing to extract the current identity token from the protocol header fields. Protocol parsing employs a layered approach: starting with the Ethernet frame header, it sequentially strips the Internet Protocol header and Transmission Control Protocol header, locating the application layer payload start offset. The current identity token is embedded in a custom extended field of the application layer protocol header. When the application layer protocol is Hypertext Transfer Protocol (HTTP), the current identity token is stored in the custom field "X-Auth-Token" in the HTTP request header. Protocol parsing locates the "X-Auth-Token:" prefix through string matching, extracts the subsequent Base64-encoded string, and decodes it to obtain the raw binary representation of the current identity token. The current identity token includes a dynamic password field, a token serial number field, and a token timestamp field. The dynamic password field is located in the first 6 bytes of the current identity token. It is a dynamic verification code generated based on a time-synchronized one-time cipher algorithm. This algorithm uses the time-synchronized one-time cipher algorithm of the RFC6238 standard, taking the device key corresponding to the token serial number field and the current time step as input. It performs an HMAC-SHA-256 hash operation and extracts a 6-digit decimal number as the dynamic verification code. The token serial number field follows the dynamic password field and is 16 bytes long. It is a unique device identifier assigned to the user during registration and uses a globally unique identifier format. The token timestamp field is located at the end of the current identity token and is 8 bytes long. It records the token generation time when the dynamic password field was generated in Unix timestamp format.

[0032] The current access context information is parsed from the payload field of the data packet. This information includes the current source internet protocol address, the current destination internet protocol address, the current destination service port number, the current request timestamp, and the current request operation type. When the application layer protocol is Hypertext Transfer Protocol (HTTP), the payload field is the HTTP request body. The parsing process extracts a JSON string of type "application / json" from the HTTP request body. After parsing by a JSON parser, structured key-value pairs are obtained. The current source internet protocol address is extracted from the source internet protocol address field in the Transmission Control Protocol (TCP) header and represented as a dotted decimal string. The current destination internet protocol address is extracted from the destination internet protocol address field in the TCP header. The current destination service port number is extracted from the destination port number field in the TCP header and represented as an integer. The current request timestamp is extracted from the "X-Request-Timestamp" field in the HTTP request header and represented as a Unix timestamp integer. The current request operation type is extracted from the "operation" field in the JSON key-value pair, representing the semantics of the user's request operation, such as enumerated values ​​like "read", "write", and "delete". Once extracted, the current access context information is encapsulated into a memory structure object for subsequent processing steps to call.

[0033] See Figure 5 In the graph, the horizontal axis represents the hour (h) corresponding to the current request timestamp, ranging from 0:00 to 23:00, and the vertical axis represents frequency, reflecting the number of times the request occurs within each hour segment. The gray bar chart shows the frequency distribution of the current request timestamp in different hour segments, and the black curve represents the corresponding kernel density estimate, reflecting the smooth probability density trend of the request time distribution.

[0034] As shown in the gray bar chart, request frequency begins to rise after 6:00 AM, increases rapidly between 7:00 AM and 11:00 AM, peaks at 10:00 AM with a high frequency of nearly 90 requests, indicating that user access requests are concentrated in the morning. The frequency then decreases slightly between 11:00 AM and 1:00 PM, but remains at a moderate level. Another secondary peak occurs between 1:00 PM and 5:00 PM, with the frequency exceeding 70 requests at 3:00 PM, indicating that users still have significant access activity in the afternoon. The frequency gradually decreases after 5:00 PM, dropping to a low level after 8:00 PM, with fewer requests during the night, approaching zero in the early morning.

[0035] The kernel density estimation curve and the histogram show a generally consistent trend, smoothly depicting the bimodal distribution of request times, with two distinct peaks at 10:00 AM and 3:00 PM, reflecting the periodicity of user access behavior. This bimodal distribution corresponds to the periodicity of the access behavior pattern detected by the Fast Fourier Transform in Example 1, indicating that user access requests are concentrated in fixed time periods on weekday mornings and afternoons.

[0036] This time distribution feature is the basis for determining the access time period range in the access behavior baseline in Example 4. When selecting a time interval covering more than 80% of the samples as the access time period range, it will focus on including two main time periods: 7:00 to 11:00 AM and 1:00 to 5:00 PM, thereby realizing the judgment of the time period inclusion relationship of the current access request timestamp and the adjustment of matching weight.

[0037] Example 3: In practice, the current identity token is input into the dynamic token verifier for dual verification of its validity and legality, and the token verification status is output as follows.

[0038] The dynamic token validator first performs a timeliness check. It extracts the token generation time from the token's timestamp field on the current identity token. The extraction process parses the last 8 bytes of the current identity token into a 64-bit unsigned integer in big-endian byte order. This integer value represents the number of seconds since the Unix epoch and is assigned to a variable to record the token generation time. The current system time is obtained by calling the clock_gettime function of the operating system on which the private network security management platform is located. The current system time is a Unix timestamp in seconds, read from the system's real-time clock. The time difference between the token generation time and the current system time is calculated using the formula:

[0039] in, This indicates the token generation time extracted from the token timestamp field of the current identity token. This indicates the current system time obtained during the timeliness verification process. This represents the calculated time difference, in seconds.

[0040] Time difference The value is compared with the preset maximum allowed time offset threshold. The maximum allowed time offset threshold is set to 60 seconds. The reason for setting 60 seconds is that the dynamic password field in the current identity token is generated by a time-synchronized one-time password algorithm. The time-synchronized one-time password algorithm divides the time into 30-second step windows and generates a dynamic verification code bound to the current time step. When there is a slight deviation between the user client clock and the private network security management platform clock, the dynamic password field may be generated near the boundary of adjacent time steps. Setting the maximum allowed time offset threshold of 60 seconds can cover a complete time step plus the fault tolerance range of one step before and after, avoiding the misjudgment of a legitimate token as invalid due to a small clock offset.

[0041] When time difference When the time difference is less than or equal to the preset maximum allowed time offset threshold, the current identity token is deemed to have passed the timeliness verification. If the time offset exceeds the maximum allowed time threshold, the current identity token is deemed to have failed the timeliness verification. If the current identity token fails the timeliness verification, the dynamic token validator skips the validity verification and sets the token verification status to invalid, while simultaneously triggering a clock synchronization alarm event. When the clock synchronization alarm event is triggered, the dynamic token validator constructs an alarm message structure, which includes the token serial number field from the current identity token, the token generation time in the token timestamp field, the current system time, and the reason code for failing the timeliness verification. The alarm message is then sent to the security management center via the Syslog protocol. The security management center records the alarm event and notifies the security administrator to check the user client's clock synchronization status.

[0042] After the current identity token passes the timeliness verification, the dynamic token verifier performs a legitimacy verification. It extracts the token serial number field from the current identity token. The token serial number field is a 16-byte globally unique identifier. Extraction is achieved by copying bytes 7 to 22 of the current identity token to a memory buffer and formatting it as a standard globally unique identifier string. The local token state cache table is queried using the globally unique identifier string of the token serial number field as an index. The local token state cache table is a hash table structure maintained in the memory of the private network security management platform. The key of the hash table is the globally unique identifier string of the token serial number field, and the value is a structure containing a base dynamic password string and token state flags. The base dynamic password string is calculated in real-time by the dynamic token verifier during the query: the dynamic token verifier retrieves the device key bound to the token serial number field from the device registration database based on the token serial number field. The device key is a Base32 encoded string, using the same time-synchronized one-time password algorithm as the user client, based on the current system time. The corresponding time step is used as input to calculate a 6-digit decimal number, which serves as the base dynamic password. The token status flag is a Boolean variable with a value indicating whether it is unused or used; the initial state is unused.

[0043] When searching the local token status cache table, if the entry corresponding to the token serial number field does not exist, the dynamic token verifier assumes that the token serial number field carried in the current identity token has not been registered, determines that the current identity token has failed the validity verification, and sets the token verification status to invalid. If the entry corresponding to the token serial number field exists, the base dynamic password and token status flag are obtained. The dynamic password field in the current identity token is compared character by character with the base dynamic password. The dynamic password field is a string consisting of 6 decimal digits, and the base dynamic password is also a string consisting of 6 decimal digits; the comparison operation uses exact string matching. Simultaneously, the value of the token status flag is checked.

[0044] When the dynamic password field in the current identity token matches the baseline dynamic password and the token status flag is in an unused state, the current identity token is deemed to have passed the validity verification, and the token verification status is set to a valid state. After being set to a valid state, the dynamic token verifier immediately updates the token status flag corresponding to the token serial number field in the local token status cache table to a used state, preventing the same dynamic password field from being reused and causing a replay attack.

[0045] If the dynamic password field in the current identity token is inconsistent with the baseline dynamic password, or if the token status flag is in the "used" state, the current identity token is deemed to have failed the legitimacy verification, and the token verification status is set to invalid. In the case of a discrepancy between the dynamic password field and the baseline dynamic password, the dynamic token verifier records a password mismatch event; in the case of a "used" token status flag, the dynamic token verifier records a suspected replay attack event and writes the event information to the security audit log.

[0046] Example 4: In practice, when the token verification status is valid, the current access context information is matched and analyzed with the access behavior baseline in multiple dimensions. The process of calculating the behavioral deviation between the current access request and the access behavior baseline is as follows.

[0047] The current target Internet Protocol address, current target service port number, and current request timestamp are extracted from the current access context information and used as parameters for the current access dimension. The current access context information is stored as an in-memory structure object. Accessing the "dst_ip" field of the structure object retrieves the current target Internet Protocol address, represented as a dotted decimal string, such as a single Class A, Class B, or Class C Internet Protocol address. Accessing the "dst_port" field retrieves the current target service port number, which is a 16-bit unsigned integer. Accessing the "req_timestamp" field retrieves the current request timestamp, a 64-bit Unix timestamp integer value in seconds. The values ​​of these three fields are assigned to three variables, denoted as . , and .

[0048] The current target Internet Protocol address Address prefix matching is performed between the target address range and the baseline feature set to obtain the address matching result. The target address range in the baseline feature set is stored in the form of classless inter-domain routing prefixes, denoted as . , It consists of two parts: the Internet Protocol address (IPA) containing the network prefix and the subnet mask length. The address prefix matching process will... Convert to a 32-bit unsigned integer. The network prefix Internet Protocol address is also converted to a 32-bit unsigned integer, depending on the subnet mask length. Construct a 32-bit subnet mask, the first part of the subnet mask... One bit is 1, and the rest are 0. Perform a bitwise logical AND operation between the corresponding 32-bit unsigned integer and the subnet mask to obtain the network prefix portion of the current address; The corresponding 32-bit unsigned integer is bitwise ANDed with the subnet mask to obtain the baseline network prefix. The network prefix of the current address is compared to the baseline network prefix for complete consistency. If they are completely identical, the address matching result is obtained. The value is 1; if they do not match, the address matching result is... The value is 0.

[0049] Current target service port number The port range is compared with the access service port number range in the baseline feature set to obtain the port matching result. The access service port number range in the baseline feature set is defined by a minimum port number. and a maximum port number Definition, indicating from arrive The closed interval. Port interval comparison process to determine... Does it meet the requirements? .when When the port number falls within a closed interval of the port number range, the port matching result is... The value is 1; when Less than or greater than At that time, port matching results The value is 0.

[0050] The current access time corresponding to the current request timestamp is compared with the access time range in the baseline feature set to determine the time period inclusion relationship, thus obtaining the time matching result. Current request timestamp For Unix timestamp integer values, convert them to the current day's time using system time processing functions. Convert the time to three integer values ​​(hour, minute, and second) in the local time zone. Multiply the hour value by 3600 and the minute value by 60, then add these values ​​to the second value to obtain the second offset of the current access time within that day. The access time range in the baseline feature set is offset by a starting second. and an end second offset Definition, indicating from arrive The closed interval. The process of determining the inclusion relationship of time periods. Does it meet the requirements? .when When the time falls within the access time period range, the time matching result The value is 1; when Less than or greater than Time matching results The value is 0.

[0051] Based on the matching weight coefficients corresponding to the address matching results, port matching results, and time matching results, a weighted sum is performed on the address matching results, port matching results, and time matching results to calculate the behavior deviation. Behavior Deviation The calculation formula is:

[0052] in, This indicates the possible values ​​for the address matching result, ranging from 0 to 1. This indicates the possible values ​​for the port matching result, which can be either 0 or 1. This indicates the possible values ​​for the time matching result, ranging from 0 to 1. This represents the matching weight coefficient corresponding to the address matching result, and its value ranges from (0,1). This represents the matching weight coefficient corresponding to the port matching result, and its value range is (0,1); This represents the matching weight coefficient corresponding to the time matching result, with a value range of (0,1); and the three weight coefficients satisfy the constraints. . This represents the calculated behavioral deviation, with a value range of [0,1]. The closer the value is to 0, the more consistent the current access request is with the baseline access behavior; the closer the value is to 1, the greater the degree of deviation.

[0053] The matching weight coefficients for address matching, port matching, and time matching results are dynamically adjusted based on the statistical distribution of the user's historical access behavior, with higher-frequency dimensions assigned higher weight coefficients. Specifically, during the adjustment, all historical access records within the most recent preset review time window are extracted from the user behavior log database, and the coefficients of variation for each of the three dimensions are calculated. For the access target address dimension, the Shannon entropy of different historical access target addresses in all historical access records is calculated. For the service port number dimension, calculate the Shannon entropy of different historical service port numbers in all historical access records. For the access time dimension, the 24 hours of a day are divided into 24 time periods with 1-hour granularity. The frequency distribution of access initiation times falling into each time period in all historical access records is statistically analyzed, and the Shannon entropy of this distribution is calculated. A higher Shannon entropy indicates that user access behavior in that dimension is more dispersed and less regular; a lower Shannon entropy indicates that user access behavior in that dimension is more concentrated and more regular. The three Shannon entropy values ​​are normalized so that the sum of the normalized Shannon entropies is 1. The matching weight coefficient corresponding to the address matching result is then determined. according to Calculate the matching weight coefficient corresponding to the port matching result. according to Calculate the matching weight coefficient corresponding to the time matching result. according to Calculation, where , and These represent the normalized Shannon entropy for the address, port, and time dimensions, respectively. This calculation method assigns higher weight coefficients to dimensions with stronger regularity (i.e., lower Shannon entropy), thus playing a greater discriminative role in calculating behavioral deviation. The dynamic adjustment process is executed once every preset review time window to adapt to gradual changes in user access behavior.

[0054] Example 5: In practice, the current identity token, current access context information, and behavior deviation are combined into an authentication feature tensor. The authentication feature tensor is then input into a pre-trained dynamic access intent classifier for classification decision-making, and the intent confidence score corresponding to the current access request is output as follows.

[0055] The dynamic password, token serial number, and token timestamp fields in the current identity token are numerically encoded to generate the first feature sub-vector. The dynamic password field is a 6-digit decimal string, which is directly converted into a 6-dimensional integer vector during numerical encoding. Each dimension represents a decimal digit, with values ​​ranging from 0 to 9. The token serial number field is a 16-byte globally unique identifier, which is also converted into a 16-dimensional integer vector, with each dimension corresponding to a one-byte unsigned integer value ranging from 0 to 255. The token timestamp field is an 8-byte Unix timestamp, which is converted into a 1-dimensional 64-bit integer and then normalized to a floating-point value in the range [0,1]. Normalization uses a predefined reference time interval length of 31,536,000 seconds, corresponding to the number of seconds in a year. The 6-dimensional integer vector of the dynamic password field, the 16-dimensional integer vector of the token serial number field, and the 1-dimensional floating-point value of the token timestamp field are concatenated sequentially to form a 23-dimensional first feature sub-vector, denoted as . .

[0056] One-hot encoding is performed on the current source Internet Protocol address, current target Internet Protocol address, current target service port number, and current request operation type in the current access context information to generate a second feature sub-vector. The current source Internet Protocol address is a dotted decimal string, and the current target Internet Protocol address is also a dotted decimal string. Each Internet Protocol address is split into 4 bytes, with each byte taking a value from 0 to 255. Each byte is one-hot encoded using 8 bits, resulting in a 256-dimensional sparse vector, where the dimension corresponding to the value is 1, and the rest are 0. A single Internet Protocol address is encoded to obtain a 4 × 256 = 1024-dimensional vector. The two Internet Protocol addresses together generate a 2048-dimensional vector. The current target service port number is a 16-bit integer, and 16-bit one-hot encoding is used to generate a 65536-dimensional vector. The current request operation type is an enumerated string. The preset set of operation type enumeration values ​​includes five operations: "read", "write", "delete", "execute", and "list". Five-dimensional one-hot encoding is used, with each operation corresponding to one dimension. The dimension matching the current request operation type is set to 1, and the others are set to 0. The 1024-dimensional vector of the current source Internet Protocol address, the 1024-dimensional vector of the current target Internet Protocol address, the 65536-dimensional vector of the current target service port number, and the 5-dimensional vector of the current request operation type are concatenated in sequence to form the second feature sub-vector, denoted as... .

[0057] The behavior deviation is normalized and scaled before being used as the third feature vector. The value calculated in step 4 is in the range [0,1], which is already within the normalized interval. Therefore, this floating-point value is directly used as a 1-dimensional vector, denoted as... .

[0058] The first, second, and third feature vectors are concatenated into tensors according to their feature dimensions to generate the authentication feature tensor. in front, Centered Finally, a continuous one-dimensional tensor is generated. The total dimensions are 23 + 2048 + 65536 + 5 + 1 = 67613. The authentication feature tensor is input into the input layer of the dynamic access intent classifier. After forward propagation through the multi-layer fully connected network of the dynamic access intent classifier, the output layer outputs the probability value that the current access request belongs to the legitimate access category. This probability value is used as the intent confidence score. The dynamic access intent classifier is a feedforward neural network with the following structure: the input layer contains 67613 neurons, completely corresponding to the dimensions of the authentication feature tensor; after the input layer, a first fully connected hidden layer with 512 neurons using a linear rectified activation function is connected; after the first fully connected hidden layer, a second fully connected hidden layer with 256 neurons using a linear rectified activation function is connected; after the second fully connected hidden layer, a third fully connected hidden layer with 128 neurons using a linear rectified activation function is connected; after the third fully connected hidden layer, an output layer with 1 neuron using a sigmoid activation function is connected. The output value of the sigmoid activation function is... The interval (0,1) represents the probability that the current access request belongs to the legitimate access category. This probability value is used as the intent confidence score. The forward propagation calculation process is as follows: the input vector... The first hidden layer output is obtained by multiplying the first hidden layer weight matrix by the first hidden layer weight matrix, adding the bias vector, and activating it with a linear rectified function. The second hidden layer output is obtained by multiplying the first hidden layer output by the second hidden layer weight matrix, adding the bias vector, and activating it with a linear rectified function. This process continues until the output layer, where the probability value is obtained using the Sigmoid function. The initial values ​​of all network weight parameters are determined during the pre-training phase. The pre-training phase uses a pre-labeled set of historical access records and trains the network using backpropagation and the Adam optimizer. The initial learning rate is set to 0.001, the batch size to 64, and the training epochs to 100. The early termination condition is that the validation set loss does not decrease for five consecutive epochs.

[0059] When the intent confidence score is greater than or equal to a preset confidence threshold, a temporary allow policy corresponding to the current access request is issued to the private network access control gateway. The preset confidence threshold is 0.85, which is determined based on the analysis of the receiver operating characteristic curve after model pre-training, selecting a threshold point that results in a false positive rate below 0.01 and a true positive rate above 0.95. After each intent confidence score is obtained, it is compared with 0.85. When the intent confidence score is less than the confidence threshold, an access denial instruction is issued to the private network access control gateway, and this access denial event is recorded. The access denial instruction is sent via a remote procedure call message through the gateway management interface. The message body contains the request identifier number and denial action code of the current access request. When recording this access denial event, the token sequence number field in the current identity token, the current source Internet Protocol address and the current destination Internet Protocol address in the current access context information, the intent confidence score, and the denial timestamp are written to the security audit log.

[0060] When the intent confidence score is greater than or equal to the confidence threshold, a temporary allow policy is generated based on the current source Internet Protocol address and the current target service port number in the current access context information. The generation process is as follows: using the current source Internet Protocol address as the source address condition and the current target service port number as the destination port condition, a rule allowing forwarding is constructed. The rule's five-tuple is "source address = current source Internet Protocol address, destination address = any, protocol = Transmission Control Protocol, source port = any, destination port = current target service port number", and the action is set to allow forwarding. The temporary allow policy is encapsulated as a policy configuration instruction in JSON format, containing the operation type "add_rule", the rule five-tuple field, and the policy validity period field, which is preset to 300 seconds. The policy configuration instruction is sent to the private network access control gateway through the gateway management interface. The gateway management interface is based on the HTTPS protocol and uses two-way certificate authentication to ensure communication security. After receiving the policy configuration instruction, the private network access control gateway parses the JSON content and adds a temporary forwarding entry to its own forwarding rule table. This temporary forwarding entry contains the above five-tuple conditions and allowed forwarding actions, and carries a live timestamp, which is the current gateway system time plus the policy validity period of 300 seconds.

[0061] After the temporary allowance policy takes effect, the corresponding policy timer is started. This timer is a timer instance running in the memory of the private network security management platform, incrementing in seconds to accumulate the duration. When the accumulated duration of the policy timer reaches the preset policy validity period of 300 seconds, a policy revocation command is sent to the private network access control gateway via the gateway management interface. The policy revocation command also uses JSON format, containing the operation type "delete_rule" and the five-tuple field of the rule to be deleted. Upon receiving the policy revocation command, the private network access control gateway searches for a temporary forwarding entry matching the five-tuple in the forwarding rule table and deletes it. If no matching entry is found, a revocation failure log is recorded.

[0062] The incremental training steps for the dynamic access intent classifier are as follows: Newly added labeled access records are periodically extracted from the user behavior log database, with a period of 24 hours. Each labeled access record contains a historical authentication feature tensor and a corresponding real access result label. The historical authentication feature tensor is constructed in the same way as the authentication feature tensor in the online phase, containing a 67613-dimensional tensor formed by concatenating the first, second, and third feature sub-vectors from the historical time. The real access result label is annotated by security auditors during post-event analysis, with a value of 1 indicating legitimate access and a value of 0 indicating illegitimate access. During extraction, only newly added records whose annotation time is after the previous round of incremental training are extracted.

[0063] Each historical authentication feature tensor is input into the dynamic access intent classifier for forward computation to obtain the predicted classification result, i.e., the Sigmoid output value. Based on the difference between the predicted classification result and the actual access result label, the classification loss value of the dynamic access intent classifier is calculated. The classification loss value is calculated using the binary cross-entropy loss function.

[0064] in, This indicates that the dynamic access intent classifier is for the first... The predicted classification result output by the historical authentication feature tensor has a value range of (0,1); Indicates the first The label of the actual access result corresponding to each historical authentication feature tensor, with a value of 0 or 1; This indicates the total number of labeled access records extracted during this incremental training. This represents the calculated classification loss value. The base of the logarithm in a single summation term is the natural logarithm.

[0065] Based on the classification loss value, the gradient descent optimization algorithm is used to iteratively update the network weight parameters of the dynamic access intent classifier. When the classification loss value is greater than a preset loss threshold, the gradient values ​​of the network weight parameters calculated during this incremental training are retained. The preset loss threshold is 0.01. When the loss value is lower than this threshold, the model is considered to be well-fitted, and this weight update is skipped to avoid overfitting. The gradient values ​​of the network weight parameters are calculated through backpropagation: starting from the output layer, the partial derivatives of the loss value with respect to the weights and biases of each layer are calculated layer by layer, and the gradient is propagated using the chain rule. The retained gradient values ​​include the gradients of the weight matrices and bias vectors of each fully connected layer.

[0066] The gradient value of each layer's network weight parameter is multiplied by a preset learning rate coefficient to obtain the network weight parameter adjustment. The learning rate coefficient is set to 0.0001 during incremental training; this small value is to avoid excessive perturbation to the existing network weight parameters during incremental training. The current network weight parameters of the dynamic access intent classifier are added element-wise with the network weight parameter adjustment to obtain the updated network weight parameters. The element-wise addition operation is performed independently on each element of the weight matrix and bias vector. The updated network weight parameters are written to the model parameter storage area of ​​the dynamic access intent classifier, replacing the current network weight parameters, completing a single incremental training iteration. The model parameter storage area is a contiguous memory region that stores the floating-point values ​​of all weight matrices and bias vectors in layer order.

[0067] After the temporary allowance policy takes effect, the policy timer corresponding to the temporary allowance policy is started. When the cumulative timer duration reaches the preset policy validity period of 300 seconds, a policy revocation command is sent to the private network access control gateway through the gateway management interface, instructing the private network access control gateway to delete the temporary forwarding entry from the forwarding rule table. The process also includes auditing user access connection behavior during the period when the temporary allowance policy is in effect.

[0068] During the period when the temporary access policy is in effect, the private network security management platform continuously monitors access connections established by users through the temporary access policy. The monitoring method involves receiving the status information of the Transmission Control Protocol (TCP) connection matched by the temporary access policy through the packet mirroring interface of the private network ingress gateway. This status information includes the connection establishment timestamp and connection status change events. When an access connection interruption is detected, the connection interruption event includes the completion of the TCP four-way handshake or a connection timeout. The platform records the duration of the access connection and the actual amount of data transmitted. The duration of the connection is defined as the difference in seconds between the connection establishment timestamp and the connection interruption timestamp. The actual amount of data transmitted is the total number of bidirectional bytes transmitted through the private network ingress gateway during the connection's lifetime, provided by the gateway's statistical data.

[0069] The system compares the duration of the persistent connection with the policy's effective duration of 300 seconds, and compares the actual amount of data transmitted with the preset upper limit. The upper limit is preset to 104,857,600 bytes (100 megabytes), a value determined based on the maximum data transfer volume of a typical private network service access in a single session. Transmission exceeding this limit may correspond to data leakage. When the persistent connection duration is less than the policy's effective duration of 300 seconds and the actual amount of data transmitted is less than the upper limit of 104,857,600 bytes, the current access request is marked as an abnormal early termination request, and the corresponding abnormal early termination record is written to the audit log. The abnormal early termination record includes the request identifier, token sequence number, current source Internet Protocol address, current destination Internet Protocol address, persistent connection duration, actual amount of data transmitted, interruption reason code, and a timestamp. The audit log is stored in the security audit partition of the user behavior log library for subsequent security event tracing.

[0070] See Figure 6 In the graph, the horizontal axis represents the number of iteration batches of the dynamic access intent classifier during incremental training, ranging from 0 to 600 batches; the vertical axis represents the classification loss value. The value ranges from approximately 0 to 0.6. The solid curve in the figure shows the trend of the classification loss value with the number of iterations, while the dashed horizontal line represents the preset loss threshold of 0.01.

[0071] Observing the trend of the curve, in the initial stage (from 0 to about 100 batches), the classification loss value rapidly decreased from about 0.6 to 0.2, demonstrating the significant adaptive training effect of the dynamic access intent classifier on newly labeled access records. Subsequently, in the middle stage (from about 100 to 300 batches), the loss value continued to decrease at a relatively gentle rate to close to 0.05, indicating that the model gradually approached a better fit. Finally, in the later stage (from about 300 to 600 batches), the classification loss value tended to stabilize and fluctuate, remaining around 0.01 or even below this threshold, meaning that the network weight parameters had reached the preset fitting requirements.

[0072] As described in Example 5 regarding the incremental training steps, when the classification loss value is below the threshold of 0.01, the current weight update will be skipped to avoid overfitting. The loss line in the figure is below this threshold in most later iterations, indicating that the dynamic access intent classifier has been sufficiently trained, its performance is stable, and it possesses strong generalization ability.

[0073] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A private network secure access authentication method based on dynamic tokens, characterized in that, The method includes: By using the access intent prediction thread to mine behavioral patterns from the user's historical access record sequence, a baseline of the user's access behavior is constructed. The system can intercept the current access request initiated by the user in real time and extract the current identity token and current access context information from the current access request. The current identity token is input into the dynamic token verifier for dual verification of its validity and legality, and the token verification status is output. When the token verification status is valid, the current access context information is matched and analyzed with the access behavior baseline in multiple dimensions to calculate the behavioral deviation between the current access request and the access behavior baseline. The current identity token, the current access context information, and the behavior deviation are combined into an authentication feature tensor. The authentication feature tensor is input into a pre-trained dynamic access intent classifier for classification decision, and the intent confidence score corresponding to the current access request is output. When the intent confidence score is greater than or equal to the preset confidence threshold, a temporary allow policy corresponding to the current access request is sent to the private network access control gateway.

2. The method for secure access authentication of a private network based on dynamic tokens according to claim 1, characterized in that, The step of mining behavioral patterns from the user's historical access record sequences through an access intent prediction thread to construct the user's access behavior baseline includes: Retrieve all historical access records of the user within a preset review time window from the user behavior log library, sort all historical access records according to the time sequence of access initiation, and generate the historical access record sequence. Traverse each historical access record in the historical access record sequence, extract the historical access target address, historical access service port number, historical access timestamp and historical access duration contained in each historical access record, and form a historical access behavior vector corresponding to each historical access record; All historical access behavior vectors are input into the behavior pattern mining tool in chronological order. The behavior pattern mining tool performs cluster analysis on all historical access behavior vectors to identify multiple types of historical access behavior patterns of the user and count the frequency and periodicity of each type of historical access behavior pattern within the preset review time window. Based on the frequency and periodicity of each type of historical access behavior pattern, the dominant behavior pattern is selected from multiple types of historical access behavior patterns, and the range of access target address, access service port number, and access time period included in the dominant behavior pattern is used as the baseline feature set of the access behavior baseline.

3. The method for secure access authentication of a private network based on dynamic tokens according to claim 2, characterized in that, The behavior pattern miner uses a density-based clustering algorithm to perform cluster analysis on all historical access behavior vectors, and determines the behavior pattern corresponding to the cluster whose sample number ratio in the clustering results exceeds a preset threshold as the dominant behavior pattern.

4. The method for secure access authentication of a private network based on dynamic tokens according to claim 2, characterized in that, The system intercepts the user's current access request in real time and extracts the current identity token and current access context information from the current access request, including: Monitor the access port at the private network gateway, and when the current access request submitted by the user through the client is detected, intercept the data packet of the current access request; The data packet is parsed according to the protocol, and the current identity token is extracted from the protocol header field of the data packet. The current identity token includes a dynamic password field, a token serial number field, and a token timestamp field. The current access context information is parsed from the payload field of the data packet. The current access context information includes the current source Internet Protocol address, the current target Internet Protocol address, the current target service port number, the current request timestamp, and the current request operation type.

5. A private network secure access authentication method based on dynamic tokens according to claim 4, characterized in that, The dynamic password field in the current identity token is a dynamic verification code generated based on a time-synchronized one-time password algorithm, and the token serial number field is a unique device identifier assigned to the user during registration.

6. The method for secure access authentication of a private network based on dynamic tokens according to claim 4, characterized in that, The current identity token is input into the dynamic token verifier for dual verification of its validity and legality, and the token verification status is output, including: Extract the token generation time carried in the token timestamp field from the current identity token, and calculate the time difference between the token generation time and the current system time; When the time difference is less than or equal to the preset maximum allowed time offset threshold, the current identity token is determined to have passed the timeliness verification; when the time difference is greater than the maximum allowed time offset threshold, the current identity token is determined to have failed the timeliness verification. After the current identity token passes the timeliness verification, the token serial number field is extracted from the current identity token. The local token status cache table is queried using the token serial number field as an index to obtain the base dynamic password and token status flag corresponding to the token serial number field. When the dynamic password field in the current identity token is consistent with the baseline dynamic password and the token status flag is in an unused state, the current identity token is determined to have passed the legality verification and the token verification status is set to a valid state. When the dynamic password field in the current identity token is inconsistent with the baseline dynamic password or the token status flag is in the used state, it is determined that the current identity token has failed the legality verification and the token verification status is set to invalid.

7. A private network secure access authentication method based on dynamic tokens according to claim 6, characterized in that, When the current identity token fails the timeliness verification, the legality verification is skipped and the token verification status is set to invalid, while a clock synchronization alarm event is triggered.

8. A private network security access authentication method based on dynamic tokens according to claim 6, characterized in that, When the token verification status is valid, the current access context information is matched with the access behavior baseline in a multi-dimensional way to calculate the behavioral deviation between the current access request and the access behavior baseline, including: Extract the current target Internet Protocol address, the current target service port number, and the current request timestamp from the current access context information, and use them as current access dimension parameters respectively; The current target Internet Protocol address is matched with the range of access target addresses in the baseline feature set to obtain the address matching result. The current target service port number is compared with the range of access service port numbers in the baseline feature set to obtain a port matching result. The time period inclusion relationship between the current access time corresponding to the current request timestamp and the access time period range in the baseline feature set is determined to obtain the time matching result. Based on the matching weight coefficients corresponding to the address matching result, the port matching result, and the time matching result, the address matching result, the port matching result, and the time matching result are weighted and summed to calculate the behavior deviation.

9. A private network security access authentication method based on dynamic tokens according to claim 8, characterized in that, The matching weight coefficients corresponding to the address matching result, the port matching result, and the time matching result are dynamically adjusted according to the statistical distribution of the user's historical access behavior, with higher weight coefficients assigned to dimensions with higher access frequency.

10. A private network secure access authentication method based on dynamic tokens according to claim 8, characterized in that, The current identity token, the current access context information, and the behavior deviation are combined into an authentication feature tensor. This authentication feature tensor is then input into a pre-trained dynamic access intent classifier for classification decisions. The output is an intent confidence score corresponding to the current access request, including: The dynamic password field, token serial number field, and token timestamp field in the current identity token are numerically encoded to generate the first feature sub-vector; One-hot encoding is performed on the current source Internet Protocol address, current target Internet Protocol address, current target service port number, and current request operation type in the current access context information to generate a second feature sub-vector; The behavior deviation is normalized and scaled to obtain the third feature vector. The first feature vector, the second feature vector, and the third feature vector are concatenated into tensors according to the feature dimension order to generate the authentication feature tensor. The authentication feature tensor is input into the input layer of the dynamic access intent classifier. After forward propagation calculation through the multi-layer fully connected network of the dynamic access intent classifier, the output layer of the dynamic access intent classifier outputs the probability value that the current access request belongs to the legitimate access category. The probability value is used as the intent confidence score.

Images